[Epic] M2M API — keyed third-party data API + guest throttling

オープン
  • 何か問題がありますか？
#416 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
8/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
静か
技術スタック
django, python
領域
api, authorization, backend

調査の方向性

This is an epic with no code change of its own; the design lives in docs/features/m2m-api/README.md on the branch named in the body. Read that doc first, then the linked child issues, starting with pskillen/meshflow-api#417 (guest endpoint throttling), which the epic says ships independently. Done means the child issues close and the epic's listed deliverables exist, so a newcomer should pick up one child issue rather than this epic.

索引モデルが issue の本文から書いたものです。

説明

enhancement

Summary

A read-only, versioned machine-to-machine API at /api/m2m/v1/ for third-party dashboards and analytics. It is separate from the bot ingest API (NodeAPIKey) and the web UI API (JWT).

  • Approved users (Django group m2m_api) mint their own API keys, several per user, after accepting versioned terms: acceptable use, good faith, non-commercial, attribution. Data is licensed CC BY-NC 4.0.
  • Data is aggregates first (packets today, nodes heard, role mix, feeder counts, time series), plus infrastructure nodes with health metrics. Meshtastic and MeshCore are strictly split. No positions.
  • This epic also adds throttling to the existing guest-readable endpoints, which are currently unthrottled, so the M2M terms can't be bypassed by scraping.

Motivating request: a scotmesh-style dashboard (cf. https://meshcore.scotmesh.net/) for the Meshtastic side, linking back to Meshflow node pages.

Design doc: docs/features/m2m-api/README.md (on branch claude/elegant-ramanujan-llmcka until merged)

Key decisions

Topic Decision
Path /api/m2m/v1/ on the existing domain; key management at /api/m2m/keys/ (JWT)
Mint permission Django group m2m_api (or staff), checked only when minting
Request auth API key only: exists, hash matches, not revoked, owner.is_active. No group check per request.
Disabling a user Kills all their keys immediately and stamps them revoked
Group removal Stops new mints only; existing keys keep working
Withdraw One staff operation: remove from group and revoke all keys
Terms bump 90-day grace period, then 403 until re-accepted
"Today" UTC calendar day, documented in feature docs and OpenAPI
Infra roles (MT) nodes.constants.INFRASTRUCTURE_ROLES (ROUTER, ROUTER_CLIENT, REPEATER, ROUTER_LATE). Not CLIENT_BASE.
Infra types (MC) adv_type repeater, room
Feeders Aggregate counts only
Positions Omitted
Opt-out ObservedNode.m2m_opt_out, settable by claimant, managed-node owner or staff. Excluded from per-node output, still counted in aggregates.
Ingress Prod reaches Django only via Cloudflare Tunnel, so CF-Connecting-IP is trusted in prod (behind a setting)
Initial rates Guest 120/min/IP · guest expensive 10/min/IP · JWT user 600/min · M2M 60/min + 5000/day per key, same ceiling per owner

Breakdown (delivery order)

API (meshflow-api)

  • pskillen/meshflow-api#417 Guest endpoint throttling. Ships independently.
  • pskillen/meshflow-api#418 API keys: model, auth, terms, CRUD, throttles
  • pskillen/meshflow-api#419 Staff "withdraw M2M access" (needs #418)
  • pskillen/meshflow-api#420 Node opt-out flag
  • pskillen/meshflow-api#421 v1 Meshtastic data endpoints (needs #418, #420). Unblocks the requester.
  • pskillen/meshflow-api#422 Usage metering (needs #418)
  • pskillen/meshflow-api#423 v1 MeshCore endpoints (needs #421)
  • pskillen/meshflow-api#424 History: role-mix snapshots, infra health (later)

UI (meshflow-ui)

  • pskillen/meshflow-ui#362 Developer / API access page (with #418)
  • pskillen/meshflow-ui#363 Opt-out toggle (with #420)

Done when

  • Guest endpoints are throttled in prod with CF-aware client IPs, and ingest is untouched.
  • An approved user can mint a key in the UI, and the scotmesh-style dashboard can be built against /api/m2m/v1/meshtastic/*.
  • MeshCore endpoints reach parity.
  • openapi-m2m.yaml is published, and ENV_VARS.md, REDIS.md and permissions/README.md are updated.
主要言語
Python
スター
1
フォーク
0
平均マージ
23時間 9分
マージ済み PR（30日）
15

環境構築

  • Dockerfile または Docker Compose ファイルあり
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

pskillen/meshflow-api のほかの issue

pskillen/meshflow-api の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。