The rate limiting for the rest gateway should be based on trusted information. The user's identity and rate limiting class should be based on information from the JWT (the sub and rls fields, compare T399198#11006680).
Since we need the ability to fall back to an anonymous identity (using the IP address as the user ID), it is probably necessary to use a Lua filter in the Envoy config to process the data from the JWT. To achieve this, we can use Envoy's "dynamic meta-data" feature to plumb the JWT payload through to the Lua code, where it can then be used to inject artifical request headers for use by the rate limiting configuration.
For the JWT provider config we can use the one already present in the config for use with api.wikimedia.org. The new JWT session cookies (T398815) use the same key pair.
Implementation sketch:
- use payload_in_metadata in the JWT provider config to instruct Envoy to store the JWT payload.
- use request_handle:streamInfo() and streamInfo:dynamicMetadata() to access the JWT payload in Lua
- use the information from the metadata to generate the x-wmf-user-id and x-wmf-user-class in Lua