Rate limit AI Catalog agent, flow and trigger saves per user

Justin Ho Tuan Duongrequested to merge
636312-rate-limit-ai-catalog-config-validation into master

What does this MR do and why?

Adds a rate limit of 30 requests per minute per user to the GraphQL mutations that save AI Catalog agents, flows, and flow triggers:

  • aiCatalogAgentCreate, aiCatalogAgentUpdate
  • aiCatalogFlowCreate, aiCatalogFlowUpdate
  • aiFlowTriggerCreate, aiFlowTriggerUpdate

Each of these mutations sends the configuration to the Duo Workflow Service for validation.

  • The six mutations share one ApplicationRateLimiter key, ai_catalog_config_validation, so the limit is the total for one user.
  • The check runs after authorization and before the service. It reuses Mutations::Ai::Catalog::RateLimitable, so throttled calls are logged to auth.log.
  • The check is in the mutations, not the services, so internal callers such as the foundational flow sync are not limited.
  • A throttled call returns the error You have saved agents, flows, or triggers too many times. Try again in a minute.
  • 30 per minute matches the limits for enabling and disabling catalog items. In production, the busiest user saved a flow 7 times in one minute.
  • The check is behind the ai_catalog_config_validation_rate_limit feature flag (gitlab_com_derisk, disabled by default).

References

Screenshots or screen recordings

Not applicable. No UI changes.

How to set up and validate locally

  1. In the Rails console, enable the feature flag:

    Feature.enable(:ai_catalog_config_validation_rate_limit)

  2. In the Rails console, use up the limit for your user:

    user = User.find_by_username('root')
30.times { Gitlab::ApplicationRateLimiter.throttled?(:ai_catalog_config_validation, scope: { user: user }) }

  3. In the AI Catalog, edit an agent or a flow and save it.

  4. Confirm that the save fails with the error You have saved agents, flows, or triggers too many times. Try again in a minute.

  5. Wait one minute and save again. Confirm that the save succeeds.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports