Make request limit provider async and scoped

Author: pwelter34

samples/Sample.Bruno/Authenticated Endpoints/Get Addresses.bru

@@ -6,18 +6,20 @@ meta {
 
 get {
   url: {{baseUrl}}/addresses
+  body: none
+  auth: none
 }
 
 tests {
   test("Status code is 200", function() {
     expect(res.getStatus()).to.equal(200);
   });
-
+  
   test("Response is array", function() {
     const body = res.getBody();
     expect(Array.isArray(body)).to.be.true;
   });
-
+  
   test("Address objects have required properties", function() {
     const body = res.getBody();
     if (body.length > 0) {

samples/Sample.MinimalApi/Program.cs

@@ -23,11 +23,22 @@ public static void Main(string[] args)
         builder.Services.AddOpenApi();
         builder.Services.AddEndpointsApiExplorer();
 
-        builder.Services.AddHmacRateLimiter(configure: options =>
-        {
-            options.RequestsPerPeriod = 10;
-            options.BurstFactor = 1;
-        });
+        builder.Services
+            .AddHmacRateLimiter(
+                policyName: "UserPolicy",
+                configure: options =>
+                {
+                    options.RequestsPerPeriod = 2;
+                    options.BurstFactor = 1;
+                }
+            )
+            .AddHmacRateLimiter(
+                configure: options =>
+                {
+                    options.RequestsPerPeriod = 10;
+                    options.BurstFactor = 1;
+                }
+            );
 
         var application = builder.Build();
 
@@ -48,19 +59,20 @@ public static void Main(string[] args)
 
         application
             .MapPost("/weather", (Weather weather) => Results.Ok(weather))
-            .WithName("PostWeather");
+            .WithName("PostWeather")
+            .RequireHmacRateLimiting();
 
         application
             .MapGet("/users", () => UserFaker.Instance.Generate(10))
             .WithName("GetUsers")
             .RequireAuthorization()
-            .RequireHmacRateLimiting();
+            .RequireHmacRateLimiting("UserPolicy");
 
         application
             .MapPost("/users", (User user) => Results.Ok(user))
             .WithName("PostUser")
             .RequireAuthorization()
-            .RequireHmacRateLimiting();
+            .RequireHmacRateLimiting("UserPolicy");
 
         application
             .MapGet("/addresses", () => AddressFaker.Instance.Generate(10))

src/HashGate.AspNetCore/HmacAuthenticationHandler.cs

@@ -35,7 +35,6 @@ public partial class HmacAuthenticationHandler : AuthenticationHandler<HmacAuthe
     /// <param name="options">The options monitor for <see cref="HmacAuthenticationSchemeOptions"/>.</param>
     /// <param name="logger">The logger factory.</param>
     /// <param name="encoder">The URL encoder.</param>
-    /// <param name="keyProvider">The HMAC key provider used to retrieve client secrets.</param>
     public HmacAuthenticationHandler(
         IOptionsMonitor<HmacAuthenticationSchemeOptions> options,
         ILoggerFactory logger,

src/HashGate.AspNetCore/HmacAuthenticationSchemeOptions.cs

@@ -30,5 +30,13 @@ public class HmacAuthenticationSchemeOptions : AuthenticationSchemeOptions
     /// When set, the keyed service registered under this key is used instead of the default provider.
     /// </summary>
     public string? ProviderServiceKey { get; set; }
+
+    /// <summary>
+    /// Gets or sets the duration for which claims are cached.
+    /// </summary>
+    /// <value>
+    /// The time span for caching claims. If <c>null</c>, claims are not cached.
+    /// </value>
+    public TimeSpan? CacheTime { get; set; }
 }
 

src/HashGate.AspNetCore/IRequestLimitProvider.cs

@@ -5,7 +5,7 @@ namespace HashGate.AspNetCore;
 /// </summary>
 /// <remarks>
 /// When registered via <see cref="RequestLimitExtensions.AddHmacRateLimiter{TProvider}"/>,
-/// the middleware calls <see cref="Get"/> on every request to determine the effective limit
+/// the middleware calls <see cref="GetAsync"/> on every request to determine the effective limit
 /// for the requesting client. Return <see langword="null"/> to fall back to the defaults
 /// configured on <see cref="RequestLimitOptions"/>.
 /// </remarks>
@@ -16,5 +16,6 @@ public interface IRequestLimitProvider
     /// client should use the defaults from <see cref="RequestLimitOptions"/>.
     /// </summary>
     /// <param name="client">The client identifier extracted from the HMAC Authorization header.</param>
-    RequestLimit? Get(string client);
+    /// <param name="cancellationToken">A token to cancel the asynchronous operation.</param>
+    Task<RequestLimit?> GetAsync(string client, CancellationToken cancellationToken = default);
 }

src/HashGate.AspNetCore/RequestLimitExtensions.cs

@@ -19,6 +19,10 @@ public static class RequestLimitExtensions
     /// </summary>
     public const string Policy = "hmac-client";
 
+    // Key used to stash the resolved policy name in HttpContext.Items so OnRejectedAsync
+    // can look up the correct named RequestLimitOptions without knowing the policy name.
+    private static readonly object _policyItemKey = new();
+
     /// <summary>Returns the resolved rate limiting policy name, lowercased.</summary>
     /// <param name="policyName">
     /// Optional suffix that scopes the policy name, enabling multiple independent limiters in
@@ -60,7 +64,7 @@ public static IServiceCollection AddHmacRateLimiter(
     /// </summary>
     /// <remarks>
     /// <typeparamref name="TProvider"/> is registered as a <see cref="IRequestLimitProvider"/> service.
-    /// On each request the provider's <see cref="IRequestLimitProvider.Get"/> is called; returning
+    /// On each request the provider's <see cref="IRequestLimitProvider.GetAsync"/> is called; returning
     /// <see langword="null"/> falls back to <see cref="RequestLimitOptions.RequestsPerPeriod"/> and
     /// <see cref="RequestLimitOptions.BurstFactor"/>. Use <see cref="RequestLimitProvider"/> for
     /// configuration-backed per-client limits.
@@ -81,7 +85,9 @@ public static IServiceCollection AddHmacRateLimiter<TProvider>(
         Action<RequestLimitOptions>? configure = null)
         where TProvider : class, IRequestLimitProvider
     {
-        services.TryAdd(ServiceDescriptor.Describe(typeof(IRequestLimitProvider), typeof(TProvider), lifetime));
+        var policy = PolicyName(policyName);
+        services.TryAdd(new ServiceDescriptor(typeof(IRequestLimitProvider), policy, typeof(TProvider), lifetime));
+
         return AddHmacRateLimiterCore(services, policyName, configure);
     }
 
@@ -108,16 +114,16 @@ private static IServiceCollection AddHmacRateLimiterCore(
     {
         var policy = PolicyName(policyName);
 
-        services.AddOptions<RequestLimitOptions>();
+        services.AddOptions<RequestLimitOptions>(policy);
         if (configure != null)
-            services.Configure(configure);
+            services.Configure(policy, configure);
 
         services.AddRateLimiter(options =>
         {
             options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
             options.OnRejected = OnRejectedAsync;
 
-            options.AddPolicy(policy, Partition);
+            options.AddPolicy(policy, httpContext => Partition(httpContext, policy));
         });
 
         return services;
@@ -127,7 +133,9 @@ private static async ValueTask OnRejectedAsync(OnRejectedContext context, Cancel
     {
         var httpContext = context.HttpContext;
 
-        var opts = httpContext.RequestServices.GetRequiredService<IOptions<RequestLimitOptions>>().Value;
+        // Look up the policy name and options to determine the appropriate Retry-After value for this request.
+        var policyName = httpContext.Items[_policyItemKey] as string ?? Options.DefaultName;
+        var opts = httpContext.RequestServices.GetRequiredService<IOptionsMonitor<RequestLimitOptions>>().Get(policyName);
 
         // Prefer the lease's own retry hint; token buckets replenish continuously so the lease
         // knows exactly when tokens will be available. Fall back to a short window within the period.
@@ -142,10 +150,14 @@ private static async ValueTask OnRejectedAsync(OnRejectedContext context, Cancel
         await httpContext.Response.WriteAsync($"Rate limit exceeded. Retry after {retrySeconds}s.", token);
     }
 
-    private static RateLimitPartition<string> Partition(HttpContext httpContext)
+    private static RateLimitPartition<string> Partition(HttpContext httpContext, string policy)
     {
         var opts = httpContext.RequestServices
-            .GetRequiredService<IOptions<RequestLimitOptions>>().Value;
+            .GetRequiredService<IOptionsMonitor<RequestLimitOptions>>()
+            .Get(policy);
+
+        // Stash the policy name so OnRejectedAsync can look up the same named options.
+        httpContext.Items[_policyItemKey] = policy;
 
         var authorizationHeader = httpContext.Request.Headers.Authorization.ToString();
 
@@ -161,9 +173,16 @@ private static RateLimitPartition<string> Partition(HttpContext httpContext)
         var endpoint = opts.EndpointSelector(httpContext).ToLowerInvariant();
 
         // Per-client override: provider returns null → use options defaults.
-        // GetService returns null when no IRequestLimitProvider is registered (non-generic overload).
-        var provider = httpContext.RequestServices.GetService<IRequestLimitProvider>();
-        var limit = provider?.Get(client) ?? new RequestLimit(opts.RequestsPerPeriod, opts.BurstFactor);
+        // Keyed lookup targets the provider registered for this specific policy;
+        // non-keyed fallback preserves backward compat if no keyed registration exists.
+        var provider = httpContext.RequestServices.GetKeyedService<IRequestLimitProvider>(policy)
+            ?? httpContext.RequestServices.GetService<IRequestLimitProvider>();
+
+        // default to options if provider doesn't exist
+        // ASP.NET Core's partition callback is synchronous; GetAwaiter().GetResult() is safe here
+        // because ASP.NET Core has no SynchronizationContext.
+        var limit = provider?.GetAsync(client, httpContext.RequestAborted).GetAwaiter().GetResult()
+            ?? new RequestLimit(opts.RequestsPerPeriod, opts.BurstFactor);
 
         // Include a content-derived version so that limit changes in configuration
         // cause new partition keys — and thus fresh token buckets — rather than

src/HashGate.AspNetCore/RequestLimitProvider.cs

@@ -52,7 +52,8 @@ public RequestLimitProvider(
     /// <see cref="RequestLimitOptions"/> rather than being treated as zero.
     /// </summary>
     /// <param name="client">The client identifier extracted from the HMAC Authorization header.</param>
-    public RequestLimit? Get(string client)
+    /// <param name="cancellationToken">A token to cancel the asynchronous operation.</param>
+    public Task<RequestLimit?> GetAsync(string client, CancellationToken cancellationToken = default)
     {
         var opts = _options.CurrentValue;
 
@@ -66,14 +67,14 @@ public RequestLimitProvider(
                 "Client '{Client}' not found in rate limit configuration section '{SectionName}'.",
                 client, opts.SectionName);
 
-            return null;
+            return Task.FromResult<RequestLimit?>(null);
         }
 
         // Read each field independently so partial configuration is valid.
         // A missing field (null) falls back to the option default rather than 0.
         var rpp = clientSection.GetValue<int?>("RequestsPerPeriod") ?? opts.RequestsPerPeriod;
         var bf = clientSection.GetValue<int?>("BurstFactor") ?? opts.BurstFactor;
 
-        return new RequestLimit(RequestsPerPeriod: rpp, BurstFactor: bf);
+        return Task.FromResult<RequestLimit?>(new RequestLimit(RequestsPerPeriod: rpp, BurstFactor: bf));
     }
 }

test/HashGate.AspNetCore.Tests/RequestLimitProviderTests.cs

@@ -29,11 +29,11 @@ private static RequestLimitProvider CreateProvider(
     // -----------------------------------------------------------------------
 
     [Fact]
-    public void Get_WhenClientNotInConfiguration_ReturnsNull()
+    public async Task GetAsync_WhenClientNotInConfiguration_ReturnsNull()
     {
         var provider = CreateProvider();
 
-        var result = provider.Get("unknown-client");
+        var result = await provider.GetAsync("unknown-client", TestContext.Current.CancellationToken);
 
         Assert.Null(result);
     }
@@ -43,22 +43,22 @@ public void Get_WhenClientNotInConfiguration_ReturnsNull()
     // -----------------------------------------------------------------------
 
     [Fact]
-    public void Get_WhenClientFullyConfigured_ReturnsConfiguredRequestsPerPeriod()
+    public async Task GetAsync_WhenClientFullyConfigured_ReturnsConfiguredRequestsPerPeriod()
     {
         var provider = CreateProvider();
 
-        var result = provider.Get("full-client");
+        var result = await provider.GetAsync("full-client", TestContext.Current.CancellationToken);
 
         Assert.NotNull(result);
         Assert.Equal(100, result.Value.RequestsPerPeriod);
     }
 
     [Fact]
-    public void Get_WhenClientFullyConfigured_ReturnsConfiguredBurstFactor()
+    public async Task GetAsync_WhenClientFullyConfigured_ReturnsConfiguredBurstFactor()
     {
         var provider = CreateProvider();
 
-        var result = provider.Get("full-client");
+        var result = await provider.GetAsync("full-client", TestContext.Current.CancellationToken);
 
         Assert.NotNull(result);
         Assert.Equal(3, result.Value.BurstFactor);
@@ -69,27 +69,27 @@ public void Get_WhenClientFullyConfigured_ReturnsConfiguredBurstFactor()
     // -----------------------------------------------------------------------
 
     [Fact]
-    public void Get_WhenBurstFactorNotConfigured_FallsBackToOptionsDefault()
+    public async Task GetAsync_WhenBurstFactorNotConfigured_FallsBackToOptionsDefault()
     {
         const int defaultBurstFactor = 7;
         var provider = CreateProvider(configure: o => o.BurstFactor = defaultBurstFactor);
 
         // rpp-only-client has RequestsPerPeriod=50 in config but no BurstFactor
-        var result = provider.Get("rpp-only-client");
+        var result = await provider.GetAsync("rpp-only-client", TestContext.Current.CancellationToken);
 
         Assert.NotNull(result);
         Assert.Equal(50, result.Value.RequestsPerPeriod);
         Assert.Equal(defaultBurstFactor, result.Value.BurstFactor);  // fell back
     }
 
     [Fact]
-    public void Get_WhenRequestsPerPeriodNotConfigured_FallsBackToOptionsDefault()
+    public async Task GetAsync_WhenRequestsPerPeriodNotConfigured_FallsBackToOptionsDefault()
     {
         const int defaultRpp = 99;
         var provider = CreateProvider(configure: o => o.RequestsPerPeriod = defaultRpp);
 
         // bf-only-client has BurstFactor=5 in config but no RequestsPerPeriod
-        var result = provider.Get("bf-only-client");
+        var result = await provider.GetAsync("bf-only-client", TestContext.Current.CancellationToken);
 
         Assert.NotNull(result);
         Assert.Equal(defaultRpp, result.Value.RequestsPerPeriod);    // fell back
@@ -101,23 +101,23 @@ public void Get_WhenRequestsPerPeriodNotConfigured_FallsBackToOptionsDefault()
     // -----------------------------------------------------------------------
 
     [Fact]
-    public void Get_WithCustomSectionName_ReadsFromCorrectSection()
+    public async Task GetAsync_WithCustomSectionName_ReadsFromCorrectSection()
     {
         var provider = CreateProvider(configure: o => o.SectionName = "CustomRateLimits");
 
-        var result = provider.Get("custom-client");
+        var result = await provider.GetAsync("custom-client", TestContext.Current.CancellationToken);
 
         Assert.NotNull(result);
         Assert.Equal(new RequestLimit(RequestsPerPeriod: 200, BurstFactor: 4), result.Value);
     }
 
     [Fact]
-    public void Get_WithCustomSectionName_WhenClientNotInSection_ReturnsNull()
+    public async Task GetAsync_WithCustomSectionName_WhenClientNotInSection_ReturnsNull()
     {
         var provider = CreateProvider(configure: o => o.SectionName = "CustomRateLimits");
 
         // full-client exists under HmacRateLimits but not CustomRateLimits
-        var result = provider.Get("full-client");
+        var result = await provider.GetAsync("full-client", TestContext.Current.CancellationToken);
 
         Assert.Null(result);
     }

test/HashGate.Integration.Tests/Fixtures/TestApplicationFactory.cs

@@ -75,9 +75,9 @@ private static void ConfigureApp(IApplicationBuilder app)
         });
     }
 
-    private static async Task<IResult> EchoPostAsync(HttpContext ctx)
+    private static async Task<IResult> EchoPostAsync(HttpRequest request)
     {
-        using var reader = new StreamReader(ctx.Request.Body, Encoding.UTF8);
+        using var reader = new StreamReader(request.Body, Encoding.UTF8);
         var body = await reader.ReadToEndAsync();
         return Results.Ok(new { body });
     }