API ゲートウェイ — サービスの入り口

# openapi/task-service.yaml（抜粋）
openapi: "3.0.3"
info:
  title: EchoTask Task Service API
  version: "1.0"
components:
  securitySchemes:
    BearerAuth: { type: http, scheme: bearer, bearerFormat: JWT }
  schemas:
    Task:
      type: object
      required: [id, title, status]
      properties:
        id:         { type: integer }
        title:      { type: string }
        status:     { type: string, enum: [todo, in_progress, done] }
        due_date:   { type: string, format: date, nullable: true }
        created_at: { type: string, format: date-time }
security: [{ BearerAuth: [] }]
paths:
  /tasks:
    get:
      summary: タスク一覧取得
      parameters:
        - { name: status, in: query, schema: { type: string } }
        - { name: page,   in: query, schema: { type: integer, default: 1 } }
      responses:
        "200": { description: タスク一覧 }
        "401": { description: 認証エラー }
    post:
      summary: タスク作成
      requestBody:
        required: true
        content:
          application/json:
            schema: { type: object, required: [title], properties: { title: { type: string } } }
      responses:
        "201": { description: 作成成功 }

# spec/requests/api/v1/tasks_spec.rb
require 'swagger_helper'
 
RSpec.describe 'Task API', type: :request do
  path '/api/v1/tasks' do
    get 'タスク一覧取得' do
      tags 'Tasks'; security [BearerAuth: []]; produces 'application/json'
      parameter name: :status, in: :query, type: :string, required: false
 
      response '200', 'タスク一覧' do
        schema type: :object,
               properties: { tasks: { type: :array, items: { '$ref' => '#/components/schemas/Task' } } }
        let(:Authorization) { "Bearer #{token_for(create(:user))}" }
        run_test!
      end
 
      response '401', '認証エラー' do
        let(:Authorization) { 'Bearer invalid' }
        run_test!
      end
    end
  end
end
# bundle exec rake rswag:specs:swaggerize → swagger/v1/swagger.yaml を自動生成

# config/routes.rb
Rails.application.routes.draw do
  namespace :api do
    namespace :v1 do
      resources :tasks, only: [:index, :show, :create, :update, :destroy]
    end
    namespace :v2 do
      resources :tasks, only: [:index, :show, :create, :update, :destroy]
    end
  end
end
 
# v2: カーソルページネーションとフィルタリングを追加
module Api::V2
  class TasksController < ApplicationController
    def index
      tasks = current_user.tasks
                          .filter_by(params[:filters])
                          .cursor_paginate(after: params[:cursor])
      render json: TaskV2Serializer.new(tasks).serializable_hash
    end
  end
end

# cloudformation/api-gateway.yaml（抜粋）
Resources:
  HttpApi:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: echo-task-api
      ProtocolType: HTTP
      CorsConfiguration:
        AllowHeaders: ["Content-Type", "Authorization"]
        AllowMethods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
        AllowOrigins: ["https://app.echotask.com"]
        MaxAge: 86400
 
  JwtAuthorizer:
    Type: AWS::ApiGatewayV2::Authorizer
    Properties:
      ApiId: !Ref HttpApi
      AuthorizerType: JWT
      Name: echo-task-jwt
      IdentitySource: "$request.header.Authorization"
      JwtConfiguration:
        Audience: ["echo-task-api"]
        Issuer: !Sub "https://cognito-idp.ap-northeast-1.amazonaws.com/${UserPool}"
 
  # 認証必須ルート
  TasksRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref HttpApi
      RouteKey: "ANY /api/v1/tasks/{proxy+}"
      AuthorizationType: JWT
      AuthorizerId: !Ref JwtAuthorizer
      Target: !Sub "integrations/${TaskServiceIntegration}"
 
  # 認証不要ルート（ログイン・サインアップ）
  AuthRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref HttpApi
      RouteKey: "POST /api/v1/auth/{proxy+}"
      AuthorizationType: NONE
      Target: !Sub "integrations/${AuthServiceIntegration}"
 
  TaskServiceIntegration:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref HttpApi
      IntegrationType: HTTP_PROXY
      IntegrationUri: !Sub "http://${TaskServiceALB.DNSName}/api/v1/tasks/{proxy}"
      IntegrationMethod: ANY
      PayloadFormatVersion: "1.0"
      RequestParameters:
        # 検証済みのユーザーIDをダウンストリームに転送
        "append:header.X-User-ID":    "$context.authorizer.claims.sub"
        "append:header.X-User-Email": "$context.authorizer.claims.email"
 
  ApiStage:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      ApiId: !Ref HttpApi
      StageName: "$default"
      AutoDeploy: true
      DefaultRouteSettings:
        ThrottlingBurstLimit: 500
        ThrottlingRateLimit: 100
      AccessLogSettings:
        DestinationArn: !GetAtt ApiAccessLogGroup.Arn
        Format: '{"id":"$context.requestId","ip":"$context.identity.sourceIp","uid":"$context.authorizer.claims.sub","method":"$context.httpMethod","path":"$context.path","status":"$context.status","ms":"$context.responseLatency"}'
 
  ApiAccessLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/apigateway/echo-task
      RetentionInDays: 30

# DynamoDBレスポンス → JSON 変換の例（VTL）
ResponseTemplates:
  application/json: |
    #set($item = $input.path('$.Item'))
    {
      "id":         "$item.id.S",
      "title":      "$item.title.S",
      "status":     "$item.status.S",
      "created_at": "$item.created_at.S"
    }

# cloudformation/cognito.yaml（抜粋）
Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: echo-task-users
      UsernameAttributes: [email]
      AutoVerifiedAttributes: [email]
      Policies:
        PasswordPolicy: { MinimumLength: 8, RequireUppercase: true, RequireNumbers: true }
      MfaConfiguration: OPTIONAL
      EnabledMfas: [SOFTWARE_TOKEN_MFA]
 
  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
      ClientName: echo-task-app
      GenerateSecret: false
      ExplicitAuthFlows: [ALLOW_USER_PASSWORD_AUTH, ALLOW_REFRESH_TOKEN_AUTH, ALLOW_USER_SRP_AUTH]
      AccessTokenValidity: 1    # 1時間
      RefreshTokenValidity: 30  # 30日
      TokenValidityUnits: { AccessToken: hours, RefreshToken: days }

# app/services/cognito_token_verifier.rb
class CognitoTokenVerifier
  ISSUER   = "https://cognito-idp.ap-northeast-1.amazonaws.com/#{ENV['COGNITO_USER_POOL_ID']}"
  JWKS_URI = "#{ISSUER}/.well-known/jwks.json"
 
  def self.verify(token)
    # JWKSをRailsキャッシュに1時間保持（起動のたびにHTTPしない）
    jwks = Rails.cache.fetch('cognito_jwks', expires_in: 1.hour) do
      JSON.parse(Faraday.get(JWKS_URI).body)
    end
    header   = JWT.decode(token, nil, false).last
    key_data = jwks['keys'].find { |k| k['kid'] == header['kid'] }
    raise AuthError, '公開鍵が見つかりません' unless key_data
 
    rsa_key = JWT::JWK.import(key_data).keypair
    payload, = JWT.decode(token, rsa_key, true,
                          algorithms: ['RS256'], iss: ISSUER, verify_iss: true)
    payload.with_indifferent_access
  rescue JWT::ExpiredSignature  then raise AuthError, 'トークンの有効期限が切れています'
  rescue JWT::DecodeError => e  then raise AuthError, "無効なトークン: #{e.message}"
  end
end
 
# app/controllers/concerns/cognito_authenticatable.rb
module CognitoAuthenticatable
  extend ActiveSupport::Concern
  included { before_action :authenticate_request! }
 
  private
 
  def authenticate_request!
    token = request.headers['Authorization']&.delete_prefix('Bearer ')
    raise AuthError, 'トークンが指定されていません' unless token
    @current_claims = CognitoTokenVerifier.verify(token)
  rescue AuthError => e
    render json: { error: e.message }, status: :unauthorized
  end
 
  def current_user_id    = @current_claims[:sub]
  def current_user_email = @current_claims[:email]
end

# config/initializers/rack_attack.rb
class Rack::Attack
  # Redisをストアとして使用
  Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(
    url: ENV['REDIS_URL']
  )
 
  # IPアドレスによる制限（未認証含む全アクセス）
  throttle('api/ip', limit: 300, period: 5.minutes) do |req|
    req.ip if req.path.start_with?('/api/')
  end
 
  # 認証済みユーザーによる制限（ユーザーIDで識別）
  throttle('api/user', limit: 1000, period: 1.hour) do |req|
    # API Gatewayがヘッダーに付けたユーザーID
    req.env['HTTP_X_USER_ID']
  end
 
  # ログイン試行の制限（ブルートフォース対策）
  throttle('login/ip', limit: 5, period: 20.seconds) do |req|
    req.ip if req.path == '/api/v1/auth/login' && req.post?
  end
 
  # レートリミット超過時のレスポンス
  self.throttled_responder = lambda do |env|
    match_data = env['rack.attack.match_data']
    now        = match_data[:epoch_time]
    period     = match_data[:period]
    retry_after = period - (now % period)
 
    [
      429,
      {
        'Content-Type'      => 'application/json',
        'Retry-After'       => retry_after.to_s,
        'X-RateLimit-Reset' => (now + retry_after).to_i.to_s
      },
      [{ error: 'リクエスト数の上限に達しました。しばらく待ってから再試行してください。',
         retry_after: retry_after }.to_json]
    ]
  end
end

# app/graphql/types/query_type.rb
module Types
  class QueryType < Types::BaseObject
    # ダッシュボード: 複数サービスを1リクエストで集約
    field :dashboard, Types::DashboardType, null: false
 
    def dashboard
      uid = context[:current_user_id]
      {
        tasks:         TaskServiceClient.new.recent_tasks(user_id: uid, limit: 10),
        notifications: NotificationServiceClient.new.unread(user_id: uid),
        analytics:     AnalyticsServiceClient.new.weekly_summary(user_id: uid)
      }
    end
 
    field :tasks, [Types::TaskType], null: false do
      argument :status, String, required: false
      argument :page,   Integer, required: false, default_value: 1
    end
 
    def tasks(status: nil, page: 1)
      TaskServiceClient.new.list(
        user_id: context[:current_user_id], status: status, page: page
      )
    end
  end
end
 
# スキーマ定義（graphql-batchでN+1を防ぐ）
class EchoTaskSchema < GraphQL::Schema
  query    Types::QueryType
  mutation Types::MutationType
  use      GraphQL::Batch
end

// middleware/auth.go — JWKSキャッシュ + JWT検証
func JWTAuth(jwksURL string) func(http.Handler) http.Handler {
    cache := jwk.NewCache(context.Background())
    cache.Register(jwksURL)
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            h := r.Header.Get("Authorization")
            if !strings.HasPrefix(h, "Bearer ") {
                http.Error(w, `{"error":"認証が必要です"}`, http.StatusUnauthorized)
                return
            }
            keys, _ := cache.Get(r.Context(), jwksURL)
            tok, err := jwt.Parse([]byte(strings.TrimPrefix(h, "Bearer ")),
                jwt.WithKeySet(keys), jwt.WithValidate(true))
            if err != nil {
                http.Error(w, `{"error":"無効なトークンです"}`, http.StatusUnauthorized)
                return
            }
            next.ServeHTTP(w, r.WithContext(
                context.WithValue(r.Context(), ctxUserID, tok.Subject())))
        })
    }
}
 
// middleware/rate_limit.go — インメモリ（本番はRedisに差し替え）
func RateLimit(limit int, window time.Duration) func(http.Handler) http.Handler {
    var mu sync.Mutex
    type entry struct{ n int; reset time.Time }
    m := map[string]*entry{}
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            k, _ := r.Context().Value(ctxUserID).(string)
            if k == "" { k = r.RemoteAddr }
            mu.Lock()
            e, ok := m[k]
            if !ok || time.Now().After(e.reset) { e = &entry{reset: time.Now().Add(window)}; m[k] = e }
            e.n++; n := e.n
            mu.Unlock()
            if n > limit { http.Error(w, `{"error":"レートリミット超過"}`, http.StatusTooManyRequests); return }
            next.ServeHTTP(w, r)
        })
    }
}
 
// middleware/logging.go — slogで構造化ログ
func Logging(log *slog.Logger) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            start := time.Now()
            rw := &statusWriter{ResponseWriter: w, code: 200}
            next.ServeHTTP(rw, r)
            uid, _ := r.Context().Value(ctxUserID).(string)
            log.Info("req", "method", r.Method, "path", r.URL.Path,
                "status", rw.code, "ms", time.Since(start).Milliseconds(), "uid", uid)
        })
    }
}
 
// チェーンの組み立て
// handler := Logging(log)(RateLimit(1000, time.Hour)(JWTAuth(jwksURL)(mux)))

# cloudformation/websocket-api.yaml
Resources:
  WebSocketApi:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: echo-task-realtime
      ProtocolType: WEBSOCKET
      RouteSelectionExpression: "$request.body.action"
 
  ConnectRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref WebSocketApi
      RouteKey: "$connect"
      AuthorizationType: NONE
      Target: !Sub "integrations/${ConnectIntegration}"
 
  DisconnectRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref WebSocketApi
      RouteKey: "$disconnect"
      Target: !Sub "integrations/${DisconnectIntegration}"
 
  ConnectIntegration:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref WebSocketApi
      IntegrationType: AWS_PROXY
      IntegrationUri: !Sub "arn:aws:apigateway:ap-northeast-1:lambda:path/2015-03-31/functions/${WebSocketConnectFunction.Arn}/invocations"
 
  WebSocketStage:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      ApiId: !Ref WebSocketApi
      StageName: production
      AutoDeploy: true

# app/services/websocket_notifier.rb
class WebSocketNotifier
  def self.notify_task_update(user_id:, task:)
    db    = Aws::DynamoDB::Client.new
    apigw = Aws::ApiGatewayManagementApi::Client.new(endpoint: ENV['WEBSOCKET_ENDPOINT'])
    msg   = { action: 'task_updated', task: TaskSerializer.new(task).as_json }.to_json
 
    db.query(table_name: ENV['CONNECTIONS_TABLE'], index_name: 'UserIdIndex',
             key_condition_expression: 'user_id = :uid',
             expression_attribute_values: { ':uid' => user_id }).items.each do |conn|
      apigw.post_to_connection(connection_id: conn['connection_id'], data: msg)
    rescue Aws::ApiGatewayManagementApi::Errors::GoneException
      db.delete_item(table_name: ENV['CONNECTIONS_TABLE'],
                     key: { connection_id: conn['connection_id'] })
    end
  end
end