Repository navigation
Classify endpoints by the Auth0 route table instead of guessing at ids - #36
Merged
Merged
Conversation
Resource server ids are lowercase hex, so the character-based id test (anything outside lowercase letters, digits and hyphens) never marks them and every resource server got its own endpoint key instead of sharing /api/v2/resource-servers/*. Harmless for budget tracking, since the bucket fingerprint still merges them, but it bloats the endpoint map and the debug log with per-id keys. A segment of 16+ characters consisting solely of lowercase hex is now an id too; route vocabulary is short and always contains letters outside a-f.
The segment heuristic guessed which path segments were identifiers, and it
guessed wrong in both directions: lowercase-hex resource server ids read as
vocabulary (so every resource server got its own endpoint key), and
email-templates/verify read as a literal route when "verify" is really a
{templateName} value. The Management API is a public, fixed surface with a
published specification, so match the real routes instead.
Auth0ManagementApiRoutes.cs holds all 252 Management API route templates,
generated from https://auth0.com/docs/api/management/openapi.json by the
Update-Auth0ManagementApiRoutes.ps1 script beside it. Paths match the route
with the most literal segments, so /clients/search wins over /clients/{id};
a path matching no known route still falls back to the heuristic, so an
unlisted route degrades rather than breaks.
This is not only tidier logs. Reserve cannot pace an endpoint key it has
never recorded, so a key that varies per identifier spent one unpaced
request per resource - exactly the holes that per-id resource server keys
were opening in pacing coverage.
wasabii
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Endpoint classification used a heuristic — replace any path segment that "looks like an id" with
*— to group requests by route. The debug logging added in #35 showed it guessing wrong in both directions:6a6138f9c72d57d0faf77934), so nothing in them trips the character test and every resource server got its own endpoint key.email-templates/verifywas asserted to be a literal route, but the real route is/email-templates/{templateName}—verifyis a value. A test encoded that mistake.The Management API is a public, fixed surface with a published specification, so this matches the real route table instead of guessing.
Changes
RateLimiting/Generated/Auth0ManagementApiRoutes.cs— all 252 Management API route templates, generated fromhttps://auth0.com/docs/api/management/openapi.json(spec info.version 2.0).RateLimiting/Generated/Update-Auth0ManagementApiRoutes.ps1— regenerates the above; run it when Auth0 publishes new endpoints, review the diff, rebuild./clients/searchwins over/clients/{id}, and/branding/themes/defaultover/branding/themes/{themeId}.Why it matters beyond tidy logs
Reservereturns no delay for an endpoint key it has never recorded — pacing only applies once a key has a learned bucket binding. A key that varies per identifier therefore spends one unpaced request per resource, which is precisely the hole per-id resource server keys were opening in pacing coverage.Testing
Full suite: 445 passed, including new coverage for hex id replacement, custom-text prompt/language collapsing, literal-route preference, unknown-route fallback, and the corrected
{templateName}behavior.