API Gateway — Senior chuqurlik

OAuth2 — rollar va grant turlari

OAuth2’da 4 rol: resource owner (foydalanuvchi), client (ilova), authorization server (token beruvchi), resource server (API — gateway bu yerda himoyachi). Asosiy grant turlari:

• Authorization Code + PKCE — SPA va mobil uchun (eng xavfsiz foydalanuvchi oqimi).
• Client Credentials — xizmatlararo (foydalanuvchisiz, service-to-service).

OIDC — OAuth2 ustidagi identity qatlami

OAuth2 ruxsat (authorization) uchun; OIDC unga kimligi (authentication)ni qo‘shadi: ID token (foydalanuvchi kimligi) va access token (nima qila oladi). Gateway access token’ni tekshiradi:

// Gateway access token'ni JWKS (auth server public kalitlari) bilan tekshiradi
const jwks = jwksClient({ jwksUri: 'https://auth.sayt.uz/.well-known/jwks.json' });

async function verifyAtGateway(token: string) {
  const { header } = decodeJwt(token);                    // kid (key id) ni ol
  const key = await jwks.getSigningKey(header.kid);       // mos public kalit
  const claims = jwt.verify(token, key.getPublicKey(), {
    issuer:   'https://auth.sayt.uz',                     // iss tekshiruvi
    audience: 'api.sayt.uz',                              // aud tekshiruvi
  });
  assertScopes(claims.scope, 'orders:read');              // ruxsat (scope)
  return claims;   // downstream'ga uzatiladi: X-User-Id, X-Scopes (ishonchli zona)
}

Eng keng tarqalgani — token bucket (burst’ni ham, o‘rtacha tezlikni ham boshqaradi). Lekin gateway ko‘p nusxada ishlaydi — demak hisoblagich umumiy (Redis) va atomik bo‘lishi shart:

-- TOKEN BUCKET (atomik, Redis Lua) — burst'ga ruxsat, sekin to'ldiriladi
local capacity = tonumber(ARGV[1])      -- max token (burst hajmi)
local rate     = tonumber(ARGV[2])      -- sekundiga to'ldirish tezligi
local now      = tonumber(ARGV[3])
local tokens = tonumber(redis.call('HGET', KEYS[1], 'tokens') or capacity)
local last   = tonumber(redis.call('HGET', KEYS[1], 'ts') or now)
tokens = math.min(capacity, tokens + (now - last) * rate)   -- o'tgan vaqtda to'ldir
if tokens < 1 then return 0 end                              -- token yo'q -> 429 RAD
redis.call('HSET', KEYS[1], 'tokens', tokens - 1, 'ts', now)
redis.call('EXPIRE', KEYS[1], 3600)
return 1                                                     -- ruxsat

Holat qayerda

Gateway’ning o‘zi stateless bo‘lsa, gorizontal masshtablanadi (5-mavzu). Lekin ba’zi holatlar tashqarida saqlanadi:

• Rate-limit hisoblagichlari → Redis (umumiy, 2-bo‘lim).
• Konfiguratsiya (route, plugin) → control plane / DCS (har nusxa bir xil ko‘radi).
• Sessiya → yo‘q! Stateless token (JWT) — gateway hech narsa eslab qolmaydi.

Bo‘g‘oz bo‘lib qolmaslik

So‘rov hayot sikli (request lifecycle)

Har so‘rov plugin’lar zanjiridan o‘tadi. Tartib hal qiluvchi: auth rate-limit’dan oldin (avtorizatsiyasiz so‘rovni sanab o‘tirma), transform route’dan oldin, logging oxirida:

// Gateway so'rov hayot sikli — plugin'lar ZANJIRI (tartib MUHIM)
// kelgan so'rov
//   -> [cors]         CORS tekshiruvi
//   -> [auth]         JWT/OAuth2 (1-bo'lim)
//   -> [rate-limit]   token bucket (2-bo'lim)
//   -> [transform]    so'rovni moslash (header, versiya)
//   -> [router]       to'g'ri upstream'ga yo'naltirish
//        => UPSTREAM xizmat
//   <- [resp-transform] javobni moslash
//   <- [logging]      metrika, trace (12-mavzu)
// javob mijozga

gRPC gateway

gRPC — HTTP/2 ustida ishlaydi, demak gateway h2ni qo‘llashi shart. Ikki muhim vazifa:

• gRPC-Web transcoding: brauzer xom gRPC qila olmaydi — gateway brauzerning HTTP/JSON so‘rovini gRPC’ga (va aksincha) tarjima qiladi (Envoy grpc_web / grpc_json_transcoder filteri).
• Load balancing: gRPC uzoq HTTP/2 ulanishidan foydalanadi — L7 (har so‘rov) balansi kerak (5-mavzu Deep), aks holda yuk notekis.

WebSocket gateway

API versiyalash

Strategiyalar: URI (/v1/orders — eng aniq), header (Accept-Version), content negotiation (Accept). Gateway versiyaga qarab to‘g‘ri backend’ga yo‘naltiradi — eski va yangi versiya yonma-yon yashaydi.

Canary release — gateway trafikni bo‘ladi

Yangi versiyaga avval kichik % trafik yo‘naltiriladi, kuzatiladi (xato/kechikish), so‘ng asta oshiriladi. Gateway weighted routing bilan buni qiladi:

# Canary: trafikning 5% YANGI versiyaga (Envoy weighted clusters)
route_config:
  virtual_hosts:
  - name: api
    routes:
    - match: { prefix: "/v1/orders" }
      route:
        weighted_clusters:
          clusters:
          - { name: orders-v1, weight: 95 }
          - { name: orders-v2, weight: 5 }    # canary — kuzatib, asta oshiriladi

Kong — deklarativ, plugin asosida

# Kong — deklarativ konfiguratsiya (GitOps'ga mos, kod emas)
_format_version: "3.0"
services:
  - name: orders
    url: http://orders-svc:3000
    routes:
      - name: orders-route
        paths: ["/v1/orders"]
    plugins:
      - name: jwt                              # auth (1-bo'lim)
      - name: rate-limiting
        config: { minute: 100, policy: redis } # distributed limit (2-bo'lim)
      - name: prometheus                       # metrika (8-bo'lim)

Envoy — filter chain, dinamik (xDS)

# Envoy — gateway sifatida: listener -> filter chain -> route -> cluster
http_filters:
  - name: envoy.filters.http.jwt_authn        # 1) JWT tekshir
  - name: envoy.filters.http.ratelimit        # 2) rate limit
  - name: envoy.filters.http.grpc_web         # 3) gRPC-Web transcoding (5-bo'lim)
  - name: envoy.filters.http.router           # 4) route -> upstream cluster

Kuzatuvchanlik va xavfsizlik

Senior tayyorlik cheklisti