What is an API gateway?

// An API gateway as a pipeline: route -> authenticate -> authorise -> rate limit
// -> forward. Backends are in-process functions and the clock is simulated.
// The token is a simplified signed token (payload + HMAC), standing in for a JWT.
const crypto = require("crypto");

const SECRET = "gateway-demo-secret";
function sign(payload) {
  return crypto.createHmac("sha256", SECRET).update(payload).digest("hex").slice(0, 16);
}
function makeToken(sub, role, exp) {
  const payload = `sub=${sub};role=${role};exp=${exp}`;
  return `${payload}.${sign(payload)}`;
}

const ROUTES = [ // longest matching prefix wins
  { prefix: "/api/orders/admin", service: "orders-svc", role: "admin" },
  { prefix: "/api/orders", service: "orders-svc", role: "user" },
  { prefix: "/api/users", service: "users-svc", role: "user" },
  { prefix: "/public", service: "content-svc", role: null },
];

const buckets = new Map(); // token bucket per caller: 3 requests burst, 1 per second refill
function allow(key, nowMs) {
  const cap = 3, perMs = 1 / 1000;
  const b = buckets.get(key) ?? { tokens: cap, at: nowMs };
  b.tokens = Math.min(cap, b.tokens + (nowMs - b.at) * perMs);
  b.at = nowMs;
  buckets.set(key, b);
  if (b.tokens >= 1) { b.tokens -= 1; return { ok: true }; }
  return { ok: false, retryAfterMs: Math.ceil((1 - b.tokens) / perMs) };
}

function handle(nowMs, path, token) {
  const route = ROUTES.filter((r) => path.startsWith(r.prefix)).sort((a, b) => b.prefix.length - a.prefix.length)[0];
  if (!route) return "404 no route";
  let caller = "anonymous";
  if (route.role) {
    if (!token) return "401 missing token";
    const dot = token.lastIndexOf(".");
    const payload = token.slice(0, dot), sig = token.slice(dot + 1);
    const good = sign(payload);
    if (sig.length !== good.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(good))) return "401 bad signature";
    const claims = Object.fromEntries(payload.split(";").map((kv) => kv.split("=")));
    if (Number(claims.exp) * 1000 <= nowMs) return "401 token expired";
    if (route.role === "admin" && claims.role !== "admin") return "403 role user may not call admin route";
    caller = claims.sub;
  }
  const limit = allow(caller, nowMs);
  if (!limit.ok) return `429 rate limited, Retry-After ${Math.ceil(limit.retryAfterMs / 1000)}s`;
  return caller === "anonymous" ? `200 -> ${route.service} (public route, no identity)` : `200 -> ${route.service} (X-User-Id: ${caller} added)`;
}

const alice = makeToken("alice", "user", 1800);
const root = makeToken("root", "admin", 1800);
const forged = alice.replace("role=user", "role=admin");
const oldTok = makeToken("bob", "user", 60);

console.log("Part 1: one gateway, many checks");
const calls = [
  [0, "/api/orders/42", alice], [100, "/api/orders/43", alice], [200, "/api/users/me", alice],
  [300, "/api/orders/44", alice], [1400, "/api/orders/45", alice],
  [1500, "/api/orders/admin/refund", alice], [1600, "/api/orders/admin/refund", forged],
  [1700, "/api/orders/admin/refund", root], [1800, "/api/users/me", oldTok.slice(0, -1) + "0"],
  [61000, "/api/users/me", oldTok], [61100, "/api/users/me", null], [61200, "/public/home", null],
  [61300, "/internal/metrics", null],
];
for (const [t, path, tok] of calls) {
  console.log(`  t=${String(t).padStart(5)}ms  ${path.padEnd(26)} ${handle(t, path, tok)}`);
}

console.log("\nPart 2: one screen needs 3 backend calls (40, 70, 55 ms); mobile RTT 150 ms");
const backend = [40, 70, 55], rtt = 150, hop = 2; // hop = gateway to service RTT in the data centre
const direct = backend.reduce((s, b) => s + rtt + b, 0);
const viaGatewaySeq = rtt + backend.reduce((s, b) => s + hop + b, 0);
const viaGatewayPar = rtt + hop + Math.max(...backend);
console.log(`  client calls each service in turn:   ${direct} ms`);
console.log(`  gateway calls them in turn:          ${viaGatewaySeq} ms`);
console.log(`  gateway calls them in parallel:      ${viaGatewayPar} ms`);