API Gateway: Patterns, Benefits & Implementation

// Sliding window rate limiter at the gateway
const redis = require('redis').createClient();

async function rateLimiter(limit, windowMs) {
  return async (req, res, next) => {
    const key = 'rl:' + (req.headers['x-client-id'] || req.ip);
    const now  = Date.now();
    const win  = Math.floor(now / windowMs);

    const count = await redis.incr(key + ':' + win);
    if (count === 1) await redis.expire(key + ':' + win, Math.ceil(windowMs / 1000) * 2);

    res.setHeader('X-RateLimit-Limit',     limit);
    res.setHeader('X-RateLimit-Remaining', Math.max(0, limit - count));
    res.setHeader('X-RateLimit-Reset',     (win + 1) * windowMs);

    if (count > limit) {
      res.setHeader('Retry-After', Math.ceil(windowMs / 1000));
      return res.status(429).json({
        error: 'Too Many Requests',
        retry_after: Math.ceil(windowMs / 1000)
      });
    }
    next();
  };
}

// Different limits per plan
gateway.use('/api/', async (req, res, next) => {
  const plan  = req.headers['x-client-plan'] || 'free';
  const limit = { free: 100, pro: 1000, enterprise: 10000 }[plan] || 100;
  return rateLimiter(limit, 60_000)(req, res, next); // per minute
});

// Add tracing headers to every upstream request
gateway.use((req, res, next) => {
  const { randomUUID } = require('crypto');
  req.headers['x-request-id']   = req.headers['x-request-id'] || randomUUID();
  req.headers['x-forwarded-for'] = req.ip;
  req.headers['x-gateway-time'] = Date.now().toString();
  next();
});

// Response transformation — strip internal headers, add versioning
gateway.use((req, res, next) => {
  const originalSend = res.json.bind(res);
  res.json = (body) => {
    // Add API version envelope
    originalSend({
      data:       body,
      api_version: '1.0',
      request_id:  req.headers['x-request-id']
    });
  };
  next();
});

// gateway.js — production-ready API gateway skeleton
const express  = require('express');
const proxy    = require('http-proxy-middleware');
const jwt      = require('jsonwebtoken');
const redis    = require('redis').createClient({ url: process.env.REDIS_URL });
const pino     = require('pino');

const logger  = pino();
const gateway = express();

await redis.connect();

// 1. Request logging
gateway.use((req, res, next) => {
  const start = Date.now();
  res.on('finish', () => logger.info({
    method: req.method, path: req.path,
    status: res.statusCode, ms: Date.now() - start,
    requestId: req.headers['x-request-id']
  }));
  next();
});

// 2. Request ID injection
gateway.use((req, _, next) => {
  req.headers['x-request-id'] ||= require('crypto').randomUUID();
  next();
});

// 3. JWT auth (skip public paths)
const PUBLIC = new Set(['/health', '/auth/token']);
gateway.use(async (req, res, next) => {
  if (PUBLIC.has(req.path)) return next();
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'Unauthorized' });
  try {
    const p = jwt.verify(token, process.env.JWT_SECRET);
    req.headers['x-user-id']   = p.sub;
    req.headers['x-user-roles'] = (p.roles || []).join(',');
    next();
  } catch { res.status(401).json({ error: 'Invalid token' }); }
});

// 4. Rate limiting — 100 req/min per user
gateway.use(async (req, res, next) => {
  if (PUBLIC.has(req.path)) return next();
  const key  = 'rl:' + (req.headers['x-user-id'] || req.ip);
  const win  = Math.floor(Date.now() / 60000);
  const cnt  = await redis.incr(key + ':' + win);
  if (cnt === 1) await redis.expire(key + ':' + win, 120);
  res.setHeader('X-RateLimit-Limit', 100);
  res.setHeader('X-RateLimit-Remaining', Math.max(0, 100 - cnt));
  if (cnt > 100) return res.status(429).json({ error: 'Rate limit exceeded' });
  next();
});

// 5. Route to services
const services = {
  '/users':    'http://user-service:3001',
  '/orders':   'http://order-service:3002',
  '/payments': 'http://payment-service:3003'
};
Object.entries(services).forEach(([path, target]) => {
  gateway.use('/api/v1' + path, proxy.createProxyMiddleware({
    target, changeOrigin: true,
    pathRewrite: { '^/api/v1': '' }
  }));
});

// 6. Health check
gateway.get('/health', (_, res) => res.json({ status: 'ok' }));

gateway.listen(8080, () => logger.info('Gateway running on :8080'));