PAR-43 · Investigate user's API abuse · Paradaux · taskl.ie
PAR-43
Investigate user's API abuse
There is a need to investigate an abuse case related to an API user. This issue was mentioned by Rían and should be addressed.
Activity
R
rian
This was a mistake in the query responsible - user in question genuinely had no usage.
RCA: Both instances of treasury-api both share the same prometheus (metrics) server for storing API usage, along with which it includes key id, account id, etc as part of each request - the dashboard used to see the throttled dashboards was missing the tenant as part of its query so it was attributing a statecraft player's API usage to a player on democracycraft - a fix to the query has been pushed up and will be deployed shortly, have apologised to the player in question for the misunderstanding / lifted throttles on their identity
(Screenshots were taken within 1 hr of eachother - hence the higher throttled rate on the genuine abuse)
Notice how they're both key id 10? rip, if the query included the tenant it would be fine but alas when I wrote the query i forgot i was using the same prometheus namespace/service name
This was a mistake in the query responsible - user in question genuinely had no usage.
RCA: Both instances of treasury-api both share the same prometheus (metrics) server for storing API usage, along with which it includes key id, account id, etc as part of each request - the dashboard used to see the throttled dashboards was missing the tenant as part of its query so it was attributing a statecraft player's API usage to a player on democracycraft - a fix to the query has been pushed up and will be deployed shortly, have apologised to the player in question for the misunderstanding / lifted throttles on their identity
(Screenshots were taken within 1 hr of eachother - hence the higher throttled rate on the genuine abuse)
Notice how they're both key id 10? rip, if the query included the tenant it would be fine but alas when I wrote the query i forgot i was using the same prometheus namespace/service name
https://github.com/MCCitiesNetwork/economy-explorer/pull/7