系統設計

1import { createHmac, timingSafeEqual } from "node:crypto";
2 
3// Public teaching fixture; real issuers keep the key private.
4const SECRET = "gw-secret";
5const GATEWAY_MS = 2, TIMEOUT_MS = 1000, MAX_ATTEMPTS = 2;
6const CAPACITY = 5, REFILL_PER_SEC = 2;           // token bucket per user
7const SERVICES = ["users", "orders", "products"];
8 
9type Backend = (service: string, attempt: number) => number; // latency, ms
10type Reply = { status: number; ms: number; attempts: number };
11 
12function signToken(user: string): string {
13  return user + "." + createHmac("sha256", SECRET).update(user, "utf8").digest("hex");
14}
15 
16class Gateway {
17  private buckets = new Map<string, { tokens: number; at: number }>();
18  constructor(private backend: Backend) {}
19 
20  handle(token: string, path: string, now: number): Reply {
21    const user = this.verify(token);
22    if (user === null) return { status: 401, ms: GATEWAY_MS, attempts: 0 };
23    if (!this.allow(user, now)) return { status: 429, ms: GATEWAY_MS, attempts: 0 };
24    const service = path.split("/")[1];
25    if (!SERVICES.includes(service)) return { status: 404, ms: GATEWAY_MS, attempts: 0 };
26    return this.forward(service);
27  }
28 
29  // Backend for frontend: one call from the app, three behind it.
30  home(token: string, now: number): Reply {
31    const user = this.verify(token);
32    if (user === null) return { status: 401, ms: GATEWAY_MS, attempts: 0 };
33    if (!this.allow(user, now)) return { status: 429, ms: GATEWAY_MS, attempts: 0 };
34    const replies = SERVICES.map((s) => this.forward(s));
35    // Sent concurrently, so the slowest sets the time.
36    const ms = GATEWAY_MS + Math.max(...replies.map((r) => r.ms - GATEWAY_MS));
37    const failed = replies.some((r) => r.status !== 200);
38    const attempts = replies.reduce((sum, r) => sum + r.attempts, 0);
39    return { status: failed ? 504 : 200, ms, attempts };
40  }
41 
42  private verify(token: string): string | null {
43    const dot = token.lastIndexOf(".");
44    if (dot <= 0) return null;
45    const user = token.slice(0, dot);
46    const supplied = token.slice(dot + 1);
47    if (supplied.length !== 64 || !/^[0-9a-f]{64}$/.test(supplied)) return null;
48    const expected = createHmac("sha256", SECRET).update(user, "utf8").digest();
49    return timingSafeEqual(Buffer.from(supplied, "hex"), expected) ? user : null;
50  }
51 
52  private allow(user: string, now: number): boolean {
53    const b = this.buckets.get(user) ?? { tokens: CAPACITY, at: now };
54    b.tokens = Math.min(CAPACITY, b.tokens + (now - b.at) * REFILL_PER_SEC);
55    b.at = now;
56    this.buckets.set(user, b);
57    if (b.tokens < 1) return false;
58    b.tokens -= 1;
59    return true;
60  }
61 
62  private forward(service: string): Reply {
63    let ms = GATEWAY_MS;
64    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
65      const took = this.backend(service, attempt);
66      if (took <= TIMEOUT_MS) return { status: 200, ms: ms + took, attempts: attempt };
67      ms += TIMEOUT_MS;
68    }
69    return { status: 504, ms, attempts: MAX_ATTEMPTS };
70  }
71}