Skip to content

Add debug logging for Auth0 rate limit budgets, pacing and circuit state - #35

Merged
wasabii merged 1 commit into
developfrom
feature/rate-limit-debug-logging
Aug 10, 2026
Merged

wasabii merged 1 commit into
developfrom
feature/rate-limit-debug-logging

Conversation

@wasabii

@wasabii wasabii commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

What

The rate limit machinery was silent — budgets, pacing delays, and circuit transitions were invisible from the operator log, so diagnosing rate limit behavior meant correlating operator symptoms against the Auth0 tenant log (as we did chasing the api_limit events).

  • Budget per response (debug): bucket, remaining, limit, reset time, and which endpoint reported it.
  • Bucket bindings (debug): logged when an endpoint is first bound to a bucket fingerprint or rebinds.
  • Pacing (debug): each reserved send slot with its delay and the bucket state that produced it.
  • Circuit transitions: warning when a circuit newly opens — the message now distinguishes "received 429 on {endpoint}" from "{endpoint} reported its budget exhausted" (preemptive), which the reconcile-level warnings could not tell apart — and debug when an open circuit is extended or closes.

All loggers are optional constructor parameters, so existing tests and callers are untouched; Auth0HttpClientProvider wires them from ILoggerFactory.

Enabling

Per environment: Logging__LogLevel__Alethic.Auth0.Operator.RateLimiting=Debug (the chart's operator.env passthrough works for this). Circuit open/close warnings appear at default levels.

Testing

Full suite: 440 passed.

The rate limit machinery was silent: budgets, pacing delays and circuit
transitions were invisible, so diagnosing rate limit behavior required
correlating operator symptoms against the Auth0 tenant log. Log at debug
level the budget every response reports (bucket, remaining, limit, reset),
endpoint-to-bucket bindings as they are learned, and each pacing delay with
the bucket state that produced it. Circuit transitions now log at warning
when a circuit newly opens - distinguishing a received 429 from a
preemptive open on an exhausted budget, which the reconcile-level warnings
could not tell apart - and at debug when an open circuit is extended or
closes. Enable per environment with
Logging__LogLevel__Alethic.Auth0.Operator.RateLimiting=Debug.
@wasabii
wasabii merged commit 7f089e3 into develop Aug 10, 2026
5 checks passed
@wasabii
wasabii deleted the feature/rate-limit-debug-logging branch August 10, 2026 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant