Repository navigation
Conversation
Tokenless requests to scoped connect and metadata routes consult a short-lived in-isolate route cache with a bounded entry count; repeat lookups for the same route reuse the stored result. Anonymous traffic on those surfaces passes a per-client-IP rate-limit binding; health and generic metadata stay unlimited. Authenticated proxied requests pass per-user and per-config rate-limit bindings after token verification, resolve the active route once per request, and record one usage data point per proxied request in the bound analytics dataset. Upstream hostname validation results are cached per hostname for a short bounded window across both address families.
iscekic
added
drain
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryThe incremental change removes the duplicated status blob from the proxy usage data point, leaving the numeric status only in Files Reviewed (1 file)
Previous Review Summaries (4 snapshots, latest commit 4f7f51e)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 4f7f51e)Status: No Issues Found | Recommendation: Merge Executive SummaryThe incremental change charges the client-IP window when a bearer credential fails verification, closing the previously reported rate-limit bypass; the new branch is covered by a focused regression test. Overview
Files Reviewed (2 files)
Previous review (commit ca7f2c7)Status: 1 Issue Found | Recommendation: Address before merge Executive SummaryThe earlier Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit d97c480)Status: 1 Issue Found | Recommendation: Address before merge Executive SummaryThe new bearer-header bypass in Overview
Issue Details (click to expand)WARNING
Files Reviewed (5 files)
Fix these issues in Kilo Cloud Previous review (commit 29c7bca)Status: 3 Issues Found | Recommendation: Address before merge Executive SummaryThe new anonymous per-IP limiter also throttles authenticated runtime traffic to 60 req/min, and runtime limits are consumed before token/route matching, allowing another config's window to be exhausted. Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (11 files)
Reviewed by deepseek-v4.1-flash-1017 · Input: 40.9K · Output: 2K · Cached: 265.5K Review guidance: REVIEW.md from base branch |
…ror reasons stable
… for parsed-token decisions
|
bot: Closing this pull request as obsolete.
Changed paths, all absent on
There is no code on |
Pull request was closed
Tokenless requests to the scoped connect and metadata routes resolve the route through a short-lived in-isolate cache with a bounded entry count; repeat requests for the same route reuse the stored result. The scoped surfaces pass a per-client-IP rate-limit binding, and authenticated proxied requests pass per-user and per-config windows after token verification, resolve the route once per request, and record one usage data point in the bound analytics dataset. Upstream hostname validation outcomes are cached per hostname for a short bounded window. Health and generic metadata stay unlimited.
Verification
Unit:
pnpm --filter cloudflare-mcp-gateway test— 31 tests pass (was 18; new tests cover cache reuse for known and unknown routes, metadata-route cache reuse, 429 responses on the limited surfaces, both limiter keys consumed before runtime-state loading, usage data point content, hostname validation cache reuse/expiry/negative-caching).typecheckandlintclean; repo-widepnpm typecheckclean.E2E on this VM (
wrangler dev --env dev+ local Postgres + query counting viapg_stat_statements):404, and the route query runs exactly once for the whole repetition (again after the cache window expires).401challenge with an intactWWW-Authenticateheader on every request, one query for the repeated requests inside the window.404, the remainder receive429, and the database query count matches the allowed count only.200and unlimited.404(staleness bounded by TTL).403(no seeded instance) with both limiter keys consumed before database work; a sustained sequence over the window produced the expected429share and exactly one route query per allowed request, none per limited one.200throughout.Proxy answers
Question: Where do the route and hostname caches live?
Answer: In-isolate bounded maps with named TTL constants (in-isolate Map).
Question: What transport enforces the request windows?
Answer: Cloudflare rate-limit bindings, one for the anonymous surfaces and one for the runtime surface (CF rate-limit binding).
Question: What does a request beyond the anonymous window receive?
Answer: HTTP 429 with a
rate_limitedJSON error body (429 rate_limited).Question: What cache freshness applies to the unauthenticated route decision?
Answer: A 5-second window for that decision; authenticated requests keep the per-request fresh route recheck and the full eligibility recheck (5s TTL).