feat(rook): harden gateway transport and chat delivery#632
Merged
Conversation
Add inbound auth, transport middleware, global surface rate limits, chat idempotency, and streaming support so Rook can protect and serve OpenAI-compatible chat traffic more reliably.
Contributor
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughSummary by CodeRabbitRelease Notes
WalkthroughThis PR implements comprehensive transport-layer hardening for the Rook gateway across five coordinated slices: inbound bearer-token authentication, transport middleware baseline (request-ID and forwarded-header sanitization), per-surface rate limiting, chat-completions idempotency with replay protection, and SSE streaming support. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant InboundAuth as Inbound Auth<br/>Middleware
participant Transport as Transport<br/>Middleware
participant RateLimit as Rate Limit<br/>Middleware
participant Idempotency as Idempotency<br/>Middleware
participant Handler as Chat Handler
participant Upstream as Upstream<br/>Provider
participant DB as SQLite DB
Client->>InboundAuth: POST /v1/chat/completions<br/>Authorization: Bearer token
InboundAuth->>InboundAuth: Extract & validate bearer
alt Auth fails
InboundAuth-->>Client: 401 Unauthorized
end
InboundAuth->>Transport: Inject AuthenticatedPrincipal
Transport->>Transport: Resolve request ID<br/>Sanitize forwarded headers
Transport->>RateLimit: Inject SanitizedTransportContext
RateLimit->>RateLimit: Check surface budget
alt Rate limit exceeded
RateLimit-->>Client: 429 Too Many Requests<br/>Retry-After
end
RateLimit->>Idempotency: Route to handler
Idempotency->>Idempotency: Extract Idempotency-Key
Idempotency->>Idempotency: Canonicalize JSON body<br/>Compute SHA-256 hash
Idempotency->>DB: Reserve (check scope,<br/>key, hash match)
alt Key reused with<br/>different body
DB-->>Idempotency: KeyReusedMismatch
Idempotency-->>Client: 409 Conflict
end
alt Request in progress
DB-->>Idempotency: ReplayInProgress
Idempotency-->>Client: 409 Conflict
end
alt Completed replay found
DB-->>Idempotency: ReplayCompleted{response}
Idempotency-->>Client: Stored response<br/>+ Idempotency-Replayed
end
Idempotency->>Handler: New reservation created
Handler->>Handler: Check stream flag
alt stream: true
Handler->>Upstream: open_chat_completion_stream()
Upstream-->>Handler: UpstreamStreamingResponse
Handler->>Handler: Parse upstream SSE<br/>Emit data: chunks
Handler-->>Client: 200 text/event-stream<br/>Streamed [DONE]
else stream: false/absent
Handler->>Upstream: proxy_chat_completion()
Upstream-->>Handler: Full buffered response
Handler-->>Client: 200 application/json
end
Handler->>DB: Complete idempotency<br/>(status, body, timestamp)
Transport->>Transport: Emit completion log<br/>request_id, status, duration
sequenceDiagram
participant Req as Request<br/>with Idempotency-Key
participant Middleware as Idempotency<br/>Middleware
participant Service as Idempotency<br/>Service
participant DB as SQLite DB
participant Handler as Handler
Req->>Middleware: Read & validate key
alt Invalid key
Middleware-->>Req: 400 Bad Request
end
Middleware->>Middleware: Read body bytes<br/>Canonicalize JSON
Middleware->>Service: reserve_chat_completion()
Service->>DB: SELECT BY scope+key+method+path
alt Row exists
DB->>Service: Existing record
alt Hash matches & completed
Service-->>Middleware: ReplayCompleted
Middleware->>DB: Select response<br/>status/body/content-type
Middleware-->>Req: Stored response<br/>+ Idempotency-Replayed: true
else Hash differs
Service-->>Middleware: KeyReusedMismatch
Middleware-->>Req: 409 Conflict
else Status in-progress
Service-->>Middleware: ReplayInProgress
Middleware-->>Req: 409 Conflict
end
else No row exists
Service->>DB: INSERT in-progress<br/>started_at, expires_at
Service-->>Middleware: ReservedNew
Middleware->>Handler: Proceed with execution
Handler->>Handler: Execute upstream call
Handler->>Service: complete_chat_completion()<br/>response status/body
Service->>DB: UPDATE to completed<br/>response data, completed_at
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Rationale: Five coordinated subsystems (auth, transport, rate limiting, idempotency, streaming) introduce substantial new logic with security-critical paths (bearer validation, CIDR matching, canonical JSON hashing, replay state machine). Heterogeneous changes span config validation, database schema, middleware composition ordering, error handling per surface, and SSE framing. Extensive test coverage and documentation mitigate scope, but interactions between auth→transport→rate-limit→idempotency→handler stacking and idempotency bypass for streaming require careful control-flow verification. Possibly related PRs
Suggested labels
Suggested reviewers
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
|
Contributor
✅ Contributor ReportUser: @yacosta738
Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-04-22 to 2026-04-22 |
coderabbitai
Bot
added
area:rust
area:docs
risk:high
risk:security
area:ci
area:web
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
/v1/chat/completionsand/v1/modelsfor OpenAI-style compatibility #589Summary
This PR hardens the Rook gateway transport and chat delivery path as a cohesive Rook-only change set.
/api/*and/v1/*/api/*,/v1/models, and/v1/chat/completionsPOST /v1/chat/completionswhenstream: trueTested Information
Targeted Rust tests were run across the implemented slices, including:
/api/*and/v1/*routes429,Retry-After, and startup/config validation[DONE]termination, setup failure behavior, and mid-stream abort behaviorI also ran
cargo test --manifest-path "clients/rook/Cargo.toml"during validation passes to confirm the Rook slice behavior in the broader crate context, while noting unrelated existing failures outside these slices where applicable.Documentation Impact
openspec/specs/gateway/spec.mdopenspec/changes/archive/2026-04-21-rook-589-gateway-api/state.yamlopenspec/changes/archive/2026-04-22-rook-591-inbound-auth-boundary/openspec/changes/archive/2026-04-22-rook-591-transport-middleware-baseline/openspec/changes/archive/2026-04-22-rook-591-global-surface-rate-limits/openspec/changes/archive/2026-04-22-rook-591-chat-completions-idempotency/openspec/changes/archive/2026-04-22-rook-591-chat-completions-streaming-transport/Breaking Changes
None intended. This PR expands Rook transport capabilities and constraints without intentionally changing unrelated public contracts outside the Rook gateway path.
Checklist