MR 324 — Use JWT for frontend client and limit requests per second

Summary

Removes the frontend API key system and allows JWT-authenticated users to access data endpoints directly, with a per-user per-minute rate limit backed by Redis.

Changes

Remove front API key system (Database, Api)

• Dropped is_front column from the apikeys table (migration 20260316000000_remove_is_front).
• Removed POST /apikeys/front endpoint from the database, config, schema, models, DAO, handlers, and OpenAPI spec (migration 20260316000001_remove_front_apikey_endpoint).
• Removed CreateFrontApikey variant from ApikeyManagementEndpoint and is_front field from the Apikey type.
• Simplified DELETE /apikeys/all to unconditionally delete all keys and remove the user limit cache entry.

JWT Bearer auth for data endpoints (Api)

• Data endpoints (/blockchain/ethereum/*, /blockchain/bitcoin/*, /blockchain/multichain/*) now accept a JWT Bearer token in addition to an API key.
• The middleware probes for a JWT-shaped token (three dot-separated segments) before falling back to API key auth; a failed JWT verification silently falls through to API key auth.
• Authorized accounts (status = authorized) are admitted; accounts pending verification receive 403 Forbidden.

Per-user per-minute rate limiting (Api)

• Added JwtRateLimiter backed by a Redis atomic Lua script (SCRIPT_JWT_RATE_LIMIT).
• Uses a fixed-window counter keyed on {prefix}jwt_rl:{user_id}:{minute_bucket} where minute_bucket = unix_seconds / 60.
• Each user has an independent counter; the window resets at every UTC minute boundary.
• Returns 429 Too Many Requests when the budget is exhausted.
• Limit configurable via JWT_RATE_LIMIT_PER_MINUTE (default: 100 req/min).

Configuration (Config)

• Added JWT_RATE_LIMIT_PER_MINUTE=100 to argos.env.
• Removed POST /apikeys/front from api_setup_config/endpoints.json.

Integration test (Workspace, Makefile)

• Added test/jwt_rate_limit crate with a 5-phase end-to-end test:
  • Authenticates two distinct users via the auth server.
  • Verifies that limit requests all succeed for user1.
  • Verifies that requests beyond the limit return 429 for user1.
  • Verifies that user2's counter is independent (user2 can still make requests while user1 is blocked).
  • Verifies that both counters reset after the UTC minute rolls over.
• Added make test-jwt-rate-limit target with JWT_TEST_LIMIT=5 override for fast test runs.

Documentation (Doc)

• Added doc/api.md documenting all authentication strategies, error codes, and environment variables.

Closes #324

adam.khayam (3b164c89) at 19 Mar 16:11

Thomas Santoni (81e51e45) at 19 Mar 16:04

... and 13 more commits

Thomas Santoni (6dd38ed0) at 19 Mar 16:01

... and 13 more commits

Thomas Santoni (108d547a) at 19 Mar 15:04

... and 13 more commits

Closes #337

Hamid (95944e0c) at 19 Mar 15:01

... and 94 more commits

Hamid (95944e0c) at 19 Mar 14:42

... and 5 more commits

adam.khayam (c22187d2) at 19 Mar 13:33

Thomas Santoni (08d26515) at 19 Mar 13:16

... and 13 more commits

Thomas Santoni (69f18234) at 19 Mar 13:13

... and 13 more commits

Thomas Santoni (ef381a69) at 19 Mar 12:58

... and 13 more commits

Hamid (48af0999) at 19 Mar 12:55

... and 38 more commits

Rodi-Can Bozman (02d89c9e) at 19 Mar 12:54

Context

Allows me to fetch the right version of rust at compilation without switching manually (I have different toolchain for other projects).

Rodi-Can Bozman (7161477a) at 19 Mar 12:54

... and 1 more commit

Context

Allows me to fetch the right version of rust at compilation without switching manually (I have different toolchain for other projects).

Context

Allows me to fetch the right version of rust at compilation without switching manually (I have different toolchain for other projects).