fix: harden gateway against Riot API deprecations and operational failures

  - Replace deprecated summoner-v4/by-name with composite by-riot-id
    (Account-V1 → PUUID → Summoner-V4); old route returns 410 Gone
  - Retry 5xx with exponential backoff (0/100ms/500ms) before tripping
    circuit breaker, absorbing transient Riot instability
  - Isolate circuit breaker per (region, endpoint) so match failures
    don't block summoner lookups in the same region
  - Fix app rate limiter to be a single global instance — per-region
    limiters allowed N×limit burst with a single API key
  - Cap L1 cache with LRU eviction (hashicorp/golang-lru, default 10k)
    to prevent OOM under bulk scraping workloads
  - Cache 404s in L1 with short TTL to stop repeated misses from
    hammering the Riot API on invalid/deleted resources
  - Enforce aud claim in JWT validation to prevent user-facing tokens
    from authenticating as internal services
  - Inject version/commit/builtAt into /health via ldflags
  - Add X-Request-ID middleware for cross-service log correlation

Author: Bulletdev

LICENSE

@@ -16,16 +16,28 @@ import (
 	"prostaff-riot-gateway/internal/circuit"
 	"prostaff-riot-gateway/internal/config"
 	"prostaff-riot-gateway/internal/handlers"
+	"prostaff-riot-gateway/internal/middleware"
 	"prostaff-riot-gateway/internal/ratelimit"
 	"prostaff-riot-gateway/internal/riot"
 )
 
+// Injected at build time via ldflags:
+//
+//	-ldflags "-X main.version=$(git describe --tags --always) \
+//	          -X main.commit=$(git rev-parse --short HEAD) \
+//	          -X main.builtAt=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+var (
+	version = "dev"
+	commit  = "none"
+	builtAt = "unknown"
+)
+
 func main() {
 	cfg := config.Load()
 
 	logger := buildLogger(cfg.LogLevel)
 
-	l1 := cache.NewMemory(60 * time.Second)
+	l1 := cache.NewMemory(60*time.Second, cfg.CacheL1MaxSize)
 	l2 := cache.NewRedis(cfg.RedisURL, cfg.CacheEnabled, logger)
 
 	limiter := ratelimit.NewAppLimiter(cfg.RiotRateLimitPerSecond, cfg.RiotRateLimitBurst, cfg.RiotRateLimitPer2Min)
@@ -37,7 +49,7 @@ func main() {
 	leagueH := handlers.NewLeagueHandler(riotClient, l1, l2, logger)
 	matchesH := handlers.NewMatchesHandler(riotClient, l1, l2, logger)
 	masteryH := handlers.NewMasteryHandler(riotClient, l1, l2, logger)
-	healthH := handlers.NewHealthHandler(breakers, l2)
+	healthH := handlers.NewHealthHandler(breakers, l2, version, commit, builtAt)
 
 	r := buildRouter(summonerH, leagueH, matchesH, masteryH, healthH, cfg.InternalJWTSecret)
 
@@ -53,7 +65,7 @@ func main() {
 	signal.Notify(done, os.Interrupt, syscall.SIGINT, syscall.SIGTERM)
 
 	go func() {
-		logger.Info("prostaff-riot-gateway started", "port", cfg.Port)
+		logger.Info("prostaff-riot-gateway started", "port", cfg.Port, "version", version, "commit", commit)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 			logger.Error("server error", "error", err)
 			os.Exit(1)
@@ -82,13 +94,16 @@ func buildRouter(
 	jwtSecret string,
 ) *mux.Router {
 	r := mux.NewRouter()
+	r.Use(middleware.RequestID)
 
 	r.HandleFunc("/health", healthH.Handle).Methods(http.MethodGet)
 
 	riot := r.PathPrefix("/riot").Subrouter()
 	riot.Use(auth.InternalAuth(jwtSecret))
 
 	riot.HandleFunc("/summoner/{region}/by-puuid/{puuid}", summonerH.ByPUUID).Methods(http.MethodGet)
+	riot.HandleFunc("/summoner/{region}/by-riot-id/{gameName}/{tagLine}", summonerH.ByRiotID).Methods(http.MethodGet)
+	// by-name was removed — Riot deprecated summoner-v4/by-name in 2024.
 	riot.HandleFunc("/summoner/{region}/by-name/{name}", summonerH.ByName).Methods(http.MethodGet)
 	riot.HandleFunc("/account/{region}/{riotId}/{tagline}", summonerH.AccountByRiotID).Methods(http.MethodGet)
 	riot.HandleFunc("/account/{region}/by-puuid/{puuid}", summonerH.AccountByPUUID).Methods(http.MethodGet)

cmd/server/main.go

@@ -2,7 +2,7 @@ services:
   gateway:
     build:
       context: .
-      dockerfile: dockerfile
+      dockerfile: Dockerfile
     expose:
       - "4444"
     restart: unless-stopped

docker-compose.production.yaml

@@ -2,7 +2,7 @@ services:
   gateway:
     build:
       context: .
-      dockerfile: dockerfile
+      dockerfile: Dockerfile
     ports:
       - "4444:4444"
     env_file: .env

docker-compose.yml

@@ -15,4 +15,5 @@ require (
 require (
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 )

dockerfile

@@ -10,6 +10,8 @@ github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeD
 github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=

go.mod

@@ -6,24 +6,32 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 )
 
+const GatewayAudience = "prostaff-riot-gateway"
+
 var ErrInvalidToken = errors.New("invalid or expired token")
 
-// ServiceClaims are the JWT claims used by internal ProStaff services.
 type ServiceClaims struct {
 	Service string `json:"service"`
 	jwt.RegisteredClaims
 }
 
-// ValidateServiceToken parses and validates a JWT issued by an internal service.
+// ValidateServiceToken rejects tokens whose aud != GatewayAudience, preventing
+// user-facing JWTs from being reused as service tokens even if the secret is shared.
 func ValidateServiceToken(tokenString, secret string) (*ServiceClaims, error) {
 	claims := &ServiceClaims{}
 
-	token, err := jwt.ParseWithClaims(tokenString, claims, func(t *jwt.Token) (interface{}, error) {
-		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
-			return nil, errors.New("unexpected signing method")
-		}
-		return []byte(secret), nil
-	})
+	token, err := jwt.ParseWithClaims(
+		tokenString,
+		claims,
+		func(t *jwt.Token) (interface{}, error) {
+			if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+				return nil, errors.New("unexpected signing method")
+			}
+			return []byte(secret), nil
+		},
+		jwt.WithAudience(GatewayAudience),
+		jwt.WithExpirationRequired(),
+	)
 	if err != nil {
 		return nil, ErrInvalidToken
 	}

go.sum

@@ -1,56 +1,74 @@
 package cache
 
 import (
-	"sync"
 	"time"
+
+	lru "github.com/hashicorp/golang-lru/v2"
 )
 
 type entry struct {
 	data      []byte
 	expiresAt time.Time
 }
 
-// Memory is a thread-safe in-process cache with TTL (L1).
 type Memory struct {
-	store sync.Map
+	cache *lru.Cache[string, entry]
 }
 
-func NewMemory(gcInterval time.Duration) *Memory {
-	m := &Memory{}
+func NewMemory(gcInterval time.Duration, maxSize int) *Memory {
+	c, _ := lru.New[string, entry](maxSize)
+	m := &Memory{cache: c}
 	go m.gc(gcInterval)
 	return m
 }
 
 func (m *Memory) Get(key string) ([]byte, bool) {
-	v, ok := m.store.Load(key)
+	v, ok := m.cache.Get(key)
 	if !ok {
 		return nil, false
 	}
-	e := v.(entry)
-	if time.Now().After(e.expiresAt) {
-		m.store.Delete(key)
+	if time.Now().After(v.expiresAt) {
+		m.cache.Remove(key)
 		return nil, false
 	}
-	return e.data, true
+	return v.data, true
 }
 
 func (m *Memory) Set(key string, data []byte, ttl time.Duration) {
-	m.store.Store(key, entry{
+	m.cache.Add(key, entry{
 		data:      data,
 		expiresAt: time.Now().Add(ttl),
 	})
 }
 
+func (m *Memory) SetNegative(key string, ttl time.Duration) {
+	m.cache.Add("404:"+key, entry{
+		data:      nil,
+		expiresAt: time.Now().Add(ttl),
+	})
+}
+
+func (m *Memory) IsNegative(key string) bool {
+	v, ok := m.cache.Get("404:" + key)
+	if !ok {
+		return false
+	}
+	if time.Now().After(v.expiresAt) {
+		m.cache.Remove("404:" + key)
+		return false
+	}
+	return true
+}
+
 func (m *Memory) gc(interval time.Duration) {
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
 	for range ticker.C {
 		now := time.Now()
-		m.store.Range(func(k, v interface{}) bool {
-			if now.After(v.(entry).expiresAt) {
-				m.store.Delete(k)
+		for _, key := range m.cache.Keys() {
+			if v, ok := m.cache.Peek(key); ok && now.After(v.expiresAt) {
+				m.cache.Remove(key)
 			}
-			return true
-		})
+		}
 	}
 }

internal/auth/jwt.go

@@ -9,12 +9,27 @@ type TTL struct {
 
 // TTLs defines cache durations for each Riot resource type.
 var TTLs = map[string]TTL{
-	"summoner-by-puuid": {L1: 10 * time.Minute, L2: 10 * time.Minute},
-	"summoner-by-name":  {L1: 5 * time.Minute, L2: 5 * time.Minute},
-	"account":           {L1: time.Hour, L2: time.Hour},
-	"league-summoner":   {L1: 5 * time.Minute, L2: 5 * time.Minute},
-	"league-puuid":      {L1: 5 * time.Minute, L2: 5 * time.Minute},
-	"match-ids":         {L1: 5 * time.Minute, L2: 5 * time.Minute},
-	"match-detail":      {L1: time.Hour, L2: 24 * time.Hour},
-	"mastery-top":       {L1: 30 * time.Minute, L2: time.Hour},
+	"summoner-by-riot-id": {L1: 10 * time.Minute, L2: 10 * time.Minute},
+	"summoner-by-puuid":   {L1: 10 * time.Minute, L2: 10 * time.Minute},
+	"summoner-by-name":    {L1: 5 * time.Minute, L2: 5 * time.Minute},
+	"account":             {L1: time.Hour, L2: time.Hour},
+	"league-summoner":     {L1: 5 * time.Minute, L2: 5 * time.Minute},
+	"league-puuid":        {L1: 5 * time.Minute, L2: 5 * time.Minute},
+	"match-ids":           {L1: 5 * time.Minute, L2: 5 * time.Minute},
+	"match-detail":        {L1: time.Hour, L2: 24 * time.Hour},
+	"mastery-top":         {L1: 30 * time.Minute, L2: time.Hour},
+}
+
+// NegativeTTLs defines how long a confirmed 404 is cached in L1 per resource type.
+// Only cached in L1 (not L2) since these are short-lived and service-specific.
+var NegativeTTLs = map[string]time.Duration{
+	"summoner-by-riot-id": 30 * time.Second,
+	"summoner-by-puuid":   2 * time.Minute,
+	"summoner-by-name":    30 * time.Second,
+	"account":             2 * time.Minute,
+	"league-summoner":     30 * time.Second,
+	"league-puuid":        30 * time.Second,
+	"match-ids":           30 * time.Second,
+	"match-detail":        5 * time.Minute,
+	"mastery-top":         30 * time.Second,
 }