Abuse and Multi-Tenancy

// A global rate limit does not stop a noisy neighbour; it only tells you
// afterwards that there was one. Meter per tenant.
// Redis 5.0+: scripts may call TIME, because replication is by effect.
// HSET with several field/value pairs needs Redis 4.0+.
const BUCKET = `
local cap    = tonumber(ARGV[1])
local rate   = tonumber(ARGV[2])            -- tokens refilled per second
local cost   = tonumber(ARGV[3])
local now    = tonumber(redis.call('TIME')[1])   -- server clock, one source of truth
local b      = redis.call('HMGET', KEYS[1], 'tokens', 'ts')
local tokens = tonumber(b[1]) or cap        -- an unseen tenant starts full
local ts     = tonumber(b[2]) or now
tokens = math.min(cap, tokens + (now - ts) * rate)
local allowed = 0
if tokens >= cost then tokens = tokens - cost; allowed = 1 end
redis.call('HSET', KEYS[1], 'tokens', tokens, 'ts', now)
redis.call('EXPIRE', KEYS[1], math.ceil(cap / rate) * 2)  -- idle buckets expire full
return { allowed, math.floor(tokens) }`;

const sha = await redis.script('LOAD', BUCKET);  // load once at boot, EVALSHA per call

async function allow(tenantId, plan, cost = 1) {
  const { burst, perSecond } = PLANS[plan];      // the quota is a pricing decision
  const [ok, left] = await redis.evalsha(sha, 1, `q:${tenantId}`, burst, perSecond, cost);
  return { ok: ok === 1, remaining: left };
}

// Rate limits bound arrivals. This bounds how much of the fleet one tenant
// can hold at once, which is the thing that starves everybody else.
const MAX_PER_TENANT = 4;       // cluster-wide ceiling is this times your replica count
const inFlight = new Map();

async function runForTenant(tenantId, job) {
  const n = inFlight.get(tenantId) ?? 0;   // `?? 0` only defaults on null/undefined, unlike `|| 0`
  if (n >= MAX_PER_TENANT) throw new Shed('tenant at concurrency cap'); // 429, with Retry-After
  inFlight.set(tenantId, n + 1);
  try {
    return await job();
  } finally {
    const left = inFlight.get(tenantId) - 1;
    // Delete at zero, or the map grows by one entry per tenant you ever saw.
    if (left === 0) inFlight.delete(tenantId); else inFlight.set(tenantId, left);
  }
}

// Cross-tenant isolation is the one invariant worth asserting in CI, because
// the failure is a breach rather than a bug report.
test.each(TENANT_SCOPED_ROUTES)('%s does not leak across tenants', async (route) => {
  const acme   = await seedTenant('acme');
  const globex = await seedTenant('globex');

  const res = await request(app)
    .get(route.replace(':id', acme.invoiceId))
    .set('Authorization', `Bearer ${tokenFor(globex.user)}`);

  // 404, not 403: a 403 tells the caller the id exists, which is already a leak.
  expect(res.status).toBe(404);
});

test('a query with no tenant set returns nothing, not everything', async () => {
  await withTenant(ACME, c => c.query("INSERT INTO invoices (tenant_id, total) VALUES ($1, 1)", [ACME]));

  // appPool connects as a NON-OWNER role, so the policy applies. No set_config
  // here, so current_setting('app.tenant_id', true) is NULL, the comparison is
  // NULL, and zero rows come back. Run this exact test as the owner and it
  // returns the row — which is how you catch a missing FORCE ROW LEVEL SECURITY.
  const { rows } = await appPool.query('SELECT * FROM invoices');
  expect(rows).toHaveLength(0);
});