We are developing an API Portal/Gateway. The work is described by the API Gateway initiative.
As part of this project, we plan to use the OAuthRateLimiter extension to add rate limiter information to the OAuth token.
The extension holds a single database table with a mapping from OAuth client ID to the rate limit tier. The rate limits for different tiers are statically configured in mediawiki-config. The tiers are assigned to the clients via a maintenance script. Dynamic tiers and UI for tier management might be implemented later if needed.
The ratelimit claims for the client is supplied to the OAuth extension via a new hook. The OAuth extension adds the claims to the access token JWT as private claims, which is then used by the envoy API Gateway to supply to the ratelimit service.
Currently, the code depends on the fork of the oauth2-server library, which includes a single pull request which adds support for private claims. We're working with upstream to get the pull request accepted in the upstream library, and the need for the fork will eventually disappear.
(Insert one or more links to where the feature can be tested, e.g. on Beta Cluster.)
Which code to review
This task is a placeholder. I will update the description when the extension is ready for review.