impr(ARSN-621): Support getAccountLimitsByCanonicalIds on Vault wrapper

lib/auth/Vault.ts

@@ -6,6 +6,7 @@ import AuthInfo, {
     AuthorizationResults,
     AuthV4Results,
     AccountCanonicalInfo,
+    AccountLimits,
 } from './AuthInfo';
 import { ArsenalCallback } from '../types';
 import RequestContext from '../policyEvaluator/RequestContext';
@@ -409,6 +410,41 @@ export default class Vault {
         });
     }
 
+    /**
+     * A getter for rate limit config given an account canonical ID
+     * @param canonicalId - account canonicalId
+     * @param log - log object
+     * @param callback - callback function
+     * @returns callback with either error or an object from Vault
+     * containing the rate limit config for the account
+     */
+    getAccountLimitsByCanonicalId(
+        canonicalId: string,
+        log: RequestLogger,
+        callback: ArsenalCallback<AccountLimits | undefined>,
+    ) {
+        if (typeof this.client.getAccountLimitsByCanonicalIds !== 'function') {
+            callback(null, undefined);
+            return;
+        }
+
+        log.trace('getting rate limit config from Vault based on canonicalId');
+        const options = {
+            reqUid: log.getSerializedUids(),
+            logger: log,
+        };
+        this.client.getAccountLimitsByCanonicalIds([canonicalId], options, (err, res) => {
+            if (err) {
+                log.debug('received error message from vault', {
+                    error: err,
+                    canonicalId,
+                });
+                return callback(err);
+            }
+            return callback(null, res.message.body[canonicalId]);
+        });
+    }
+
     /** checkPolicies -- call Vault to evaluate policies
      * @param {object} requestContextParams - parameters needed to construct
      * requestContext in Vault

package.json

@@ -3,7 +3,7 @@
     "engines": {
         "node": ">=20"
     },
-    "version": "8.4.22",
+    "version": "8.4.23",
     "config": {
         "mongodbMemoryServer": {
             "version": "8.0.23"

tests/unit/auth/Vault.spec.js

@@ -77,6 +77,7 @@ describe('Vault class', () => {
             getEmailAddresses: sandbox.stub(),
             getAccountIds: sandbox.stub(),
             getCanonicalIdsByAccountIds: sandbox.stub(),
+            getAccountLimitsByCanonicalIds: sandbox.stub(),
             checkPolicies: sandbox.stub(),
             getOrCreateEncryptionKeyId: sandbox.stub(),
         };
@@ -579,6 +580,73 @@ describe('Vault class', () => {
         });
     });
 
+    describe('getAccountLimitsByCanonicalId', () => {
+        const limitConfig = { RequestsPerSecond: { Limit: 1500 } };
+
+        it('should return the limit config for the canonical ID', done => {
+            const mockResponse = {
+                message: { body: { canonical123: limitConfig } },
+            };
+            mockClient.getAccountLimitsByCanonicalIds.callsFake((_, __, cb) => cb(null, mockResponse));
+
+            vault.getAccountLimitsByCanonicalId('canonical123', log, (err, data) => {
+                assert.strictEqual(err, null);
+                assert.deepStrictEqual(data, limitConfig);
+                done();
+            });
+        });
+
+        it('should pass the canonical ID as a single-item list and the log options', done => {
+            const mockResponse = {
+                message: { body: { canonical123: limitConfig } },
+            };
+            mockClient.getAccountLimitsByCanonicalIds.callsFake((canonicalIds, options, cb) => {
+                assert.deepStrictEqual(canonicalIds, ['canonical123']);
+                assert.strictEqual(options.reqUid, log.getSerializedUids());
+                assert.strictEqual(options.logger, log);
+                cb(null, mockResponse);
+            });
+
+            vault.getAccountLimitsByCanonicalId('canonical123', log, err => {
+                assert.strictEqual(err, null);
+                assert(mockClient.getAccountLimitsByCanonicalIds.calledOnce);
+                done();
+            });
+        });
+
+        it('should return undefined when the canonical ID is absent from the response', done => {
+            const mockResponse = { message: { body: {} } };
+            mockClient.getAccountLimitsByCanonicalIds.callsFake((_, __, cb) => cb(null, mockResponse));
+
+            vault.getAccountLimitsByCanonicalId('canonical123', log, (err, data) => {
+                assert.strictEqual(err, null);
+                assert.strictEqual(data, undefined);
+                done();
+            });
+        });
+
+        it('should return undefined when the client does not implement the method', done => {
+            delete mockClient.getAccountLimitsByCanonicalIds;
+
+            vault.getAccountLimitsByCanonicalId('canonical123', log, (err, data) => {
+                assert.strictEqual(err, null);
+                assert.strictEqual(data, undefined);
+                done();
+            });
+        });
+
+        it('should return error when client fails', done => {
+            const mockError = new Error('Client error');
+            mockClient.getAccountLimitsByCanonicalIds.callsFake((_, __, cb) => cb(mockError));
+
+            vault.getAccountLimitsByCanonicalId('canonical123', log, (err, data) => {
+                assert.strictEqual(err, mockError);
+                assert.strictEqual(data, undefined);
+                done();
+            });
+        });
+    });
+
     describe('checkPolicies', () => {
         it('should return authorization results', done => {
             const mockParams = [{ test: 'param' }];