added optional even listener to client API

build.gradle

@@ -46,6 +46,12 @@ allprojects { subproject ->
             }
         }
 
+        dependencies {
+            testImplementation catalog.junit.jupiter.api
+            testImplementation catalog.junit.jupiter.params
+            testRuntimeOnly catalog.junit.jupiter.engine
+        }
+
         test {
             useJUnitPlatform()
         }

gbcs-api/src/main/java/net/woggioni/gbcs/api/Cache.java

@@ -4,6 +4,7 @@ import net.woggioni.gbcs.api.exception.ContentTooLargeException;
 
 import java.nio.channels.ReadableByteChannel;
 
+
 public interface Cache extends AutoCloseable {
     ReadableByteChannel get(String key);
 

gbcs-api/src/main/java/net/woggioni/gbcs/api/Configuration.java

@@ -43,11 +43,20 @@ public class Configuration {
         int maxRequestSize;
     }
 
+    @Value
+    public static class Quota {
+        long calls;
+        Duration period;
+        long initialAvailableCalls;
+        long maxAvailableCalls;
+    }
+
     @Value
     public static class Group {
         @EqualsAndHashCode.Include
         String name;
         Set<Role> roles;
+        Quota quota;
     }
 
     @Value
@@ -56,7 +65,7 @@ public class Configuration {
         String name;
         String password;
         Set<Group> groups;
-
+        Quota quota;
 
         public Set<Role> getRoles() {
             return groups.stream()
@@ -76,12 +85,22 @@ public class Configuration {
     }
 
     @Value
-    public static class Tls {
+    public static class Throttling {
         KeyStore keyStore;
         TrustStore trustStore;
         boolean verifyClients;
     }
 
+    public enum ClientCertificate {
+        REQUIRED, OPTIONAL
+    }
+
+    @Value
+    public static class Tls {
+        KeyStore keyStore;
+        TrustStore trustStore;
+    }
+
     @Value
     public static class KeyStore {
         Path file;
@@ -95,6 +114,7 @@ public class Configuration {
         Path file;
         String password;
         boolean checkCertificateStatus;
+        boolean requireClientCertificate;
     }
 
     @Value

gbcs-api/src/main/java/net/woggioni/gbcs/api/exception/CacheException.java

@@ -0,0 +1,11 @@
+package net.woggioni.gbcs.api.exception;
+
+public class CacheException extends GbcsException {
+    public CacheException(String message, Throwable cause) {
+        super(message, cause);
+    }
+
+    public CacheException(String message) {
+        this(message, null);
+    }
+}

gbcs-cli/build.gradle

@@ -16,6 +16,8 @@ import net.woggioni.gradle.graalvm.NativeImageTask
 import net.woggioni.gradle.graalvm.JlinkPlugin
 import net.woggioni.gradle.graalvm.JlinkTask
 
+Property<String> mainModuleName = objects.property(String.class)
+mainModuleName.set('net.woggioni.gbcs.cli')
 Property<String> mainClassName = objects.property(String.class)
 mainClassName.set('net.woggioni.gbcs.cli.GradleBuildCacheServerCli')
 
@@ -33,7 +35,7 @@ configurations {
 }
 
 envelopeJar {
-    mainModule = 'net.woggioni.gbcs.cli'
+    mainModule = mainModuleName
     mainClass = mainClassName
 
     extraClasspath = ["plugins"]
@@ -50,20 +52,31 @@ dependencies {
 
 //    runtimeOnly catalog.slf4j.jdk14
     runtimeOnly catalog.logback.classic
+//    runtimeOnly catalog.slf4j.simple
 }
 
 Provider<EnvelopeJarTask> envelopeJarTaskProvider = tasks.named('envelopeJar', EnvelopeJarTask.class) {
 //    systemProperties['java.util.logging.config.class'] = 'net.woggioni.gbcs.LoggingConfig'
-//    systemProperties['log.config.source'] = 'logging.properties'
+//    systemProperties['log.config.source'] = 'net/woggioni/gbcs/cli/logging.properties'
+//    systemProperties['java.util.logging.config.file'] = 'classpath:net/woggioni/gbcs/cli/logging.properties'
     systemProperties['logback.configurationFile'] = 'classpath:net/woggioni/gbcs/cli/logback.xml'
+    systemProperties['io.netty.leakDetectionLevel'] = 'DISABLED'
+
+//    systemProperties['org.slf4j.simpleLogger.showDateTime'] = 'true'
+//    systemProperties['org.slf4j.simpleLogger.defaultLogLevel'] = 'debug'
+//    systemProperties['org.slf4j.simpleLogger.log.com.google.code.yanf4j'] = 'warn'
+//    systemProperties['org.slf4j.simpleLogger.log.net.rubyeye.xmemcached'] = 'warn'
+//    systemProperties['org.slf4j.simpleLogger.dateTimeFormat'] = 'yyyy-MM-dd\'T\'HH:mm:ss.SSSZ'
 }
 
 tasks.named(NativeImagePlugin.CONFIGURE_NATIVE_IMAGE_TASK_NAME, NativeImageConfigurationTask) {
     mainClass = mainClassName
+    mainModule = mainModuleName
 }
 
 tasks.named(NativeImagePlugin.NATIVE_IMAGE_TASK_NAME, NativeImageTask) {
     mainClass = mainClassName
+    mainModule = mainModuleName
     useMusl = true
     buildStaticImage = true
 }

gbcs-cli/native-image/native-image.properties

@@ -1,2 +1,2 @@
-Args=-H:Optimize=3 --gc=serial
+Args=-H:Optimize=3 --gc=serial --initialize-at-run-time=io.netty
 #-H:TraceClassInitialization=io.netty.handler.ssl.BouncyCastleAlpnSslUtils

gbcs-cli/src/main/java/module-info.java

@@ -7,6 +7,7 @@ module net.woggioni.gbcs.cli {
     requires kotlin.stdlib;
     requires net.woggioni.jwo;
     requires net.woggioni.gbcs.api;
+    requires io.netty.codec.http;
 
     exports net.woggioni.gbcs.cli.impl.converters to info.picocli;
     opens net.woggioni.gbcs.cli.impl.commands to info.picocli;

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/GradleBuildCacheServerCli.kt

@@ -13,6 +13,7 @@ import net.woggioni.gbcs.cli.impl.commands.ServerCommand
 import net.woggioni.jwo.Application
 import picocli.CommandLine
 import picocli.CommandLine.Model.CommandSpec
+import java.net.URI
 
 
 @CommandLine.Command(

gbcs-cli/src/main/kotlin/net/woggioni/gbcs/cli/impl/commands/BenchmarkCommand.kt

@@ -1,10 +1,14 @@
 package net.woggioni.gbcs.cli.impl.commands
 
+import io.netty.handler.codec.http.FullHttpRequest
+import io.netty.handler.codec.http.FullHttpResponse
 import net.woggioni.gbcs.common.contextLogger
 import net.woggioni.gbcs.common.error
 import net.woggioni.gbcs.common.info
 import net.woggioni.gbcs.cli.impl.GbcsCommand
 import net.woggioni.gbcs.client.GradleBuildCacheClient
+import net.woggioni.gbcs.client.RequestEventListener
+import net.woggioni.jwo.JWO
 import picocli.CommandLine
 import java.security.SecureRandom
 import java.time.Duration
@@ -13,6 +17,7 @@ import java.util.Base64
 import java.util.concurrent.ExecutionException
 import java.util.concurrent.Future
 import java.util.concurrent.LinkedBlockingQueue
+import java.util.concurrent.Semaphore
 import java.util.concurrent.atomic.AtomicLong
 import kotlin.random.Random
 
@@ -45,60 +50,94 @@ class BenchmarkCommand : GbcsCommand() {
         val entryGenerator = sequence {
             val random = Random(SecureRandom.getInstance("NativePRNGNonBlocking").nextLong())
             while (true) {
-                val key = Base64.getUrlEncoder().encode(random.nextBytes(16)).toString(Charsets.UTF_8)
+                val key = JWO.bytesToHex(random.nextBytes(16))
                 val content = random.nextInt().toByte()
                 val value = ByteArray(0x1000, { _ -> content })
                 yield(key to value)
             }
         }
 
+        log.info {
+            "Starting insertion"
+        }
         val entries = let {
-            val completionQueue = LinkedBlockingQueue<Future<Pair<String, ByteArray>>>(numberOfEntries)
+            val completionCounter = AtomicLong(0)
+            val completionQueue = LinkedBlockingQueue<Pair<String, ByteArray>>(numberOfEntries)
             val start = Instant.now()
+            val semaphore = Semaphore(profile.maxConnections * 3)
             val totalElapsedTime = AtomicLong(0)
-            entryGenerator.take(numberOfEntries).forEach { entry ->
+            val iterator = entryGenerator.take(numberOfEntries).iterator()
-                val requestStart = System.nanoTime()
+            while(completionCounter.get() < numberOfEntries) {
-                val future = client.put(entry.first, entry.second).thenApply { entry }
+                if(iterator.hasNext()) {
-                future.whenComplete { _, _ ->
+                    val entry = iterator.next()
+                    semaphore.acquire()
+                    val eventListener = object : RequestEventListener {
+                        var start: Long? = null
+                        override fun requestSent(req: FullHttpRequest) {
+                            this.start = System.nanoTime()
+                        }
+
+                        override fun responseReceived(res: FullHttpResponse) {
+                            this.start?.let { requestStart ->
                                 totalElapsedTime.addAndGet((System.nanoTime() - requestStart))
-                    completionQueue.put(future)
+                            }
+                            this.start = null
+                        }
+                    }
+                    val future = client.put(entry.first, entry.second, eventListener).thenApply { entry }
+                    future.whenComplete { result, ex ->
+                        if (ex != null) {
+                            log.error(ex.message, ex)
+                        } else {
+                            completionQueue.put(result)
+                        }
+                        semaphore.release()
+                        completionCounter.incrementAndGet()
+                    }
                 }
             }
 
-            val inserted = sequence<Pair<String, ByteArray>> {
+            val inserted = completionQueue.toList()
-                var completionCounter = 0
-                while (completionCounter < numberOfEntries) {
-                    val future = completionQueue.take()
-                    try {
-                        yield(future.get())
-                    } catch (ee: ExecutionException) {
-                        val cause = ee.cause ?: ee
-                        log.error(cause.message, cause)
-                    }
-                    completionCounter += 1
-                }
-            }.toList()
             val end = Instant.now()
             log.info {
                 val elapsed = Duration.between(start, end).toMillis()
-                "Insertion rate: ${numberOfEntries.toDouble() / elapsed * 1000} ops/s"
+                val opsPerSecond = String.format("%.2f", numberOfEntries.toDouble() / elapsed * 1000)
+                "Insertion rate: $opsPerSecond ops/s"
             }
             log.info {
-                "Average time per insertion: ${totalElapsedTime.get() / numberOfEntries.toDouble() * 1000} ms"
+                val avgTxTime = String.format("%.0f", totalElapsedTime.get() / numberOfEntries.toDouble() / 1e6)
+                "Average time per insertion: $avgTxTime ms"
             }
             inserted
         }
         log.info {
             "Inserted ${entries.size} entries"
         }
+        log.info {
+            "Starting retrieval"
+        }
         if (entries.isNotEmpty()) {
-            val completionQueue = LinkedBlockingQueue<Future<Unit>>(entries.size)
+            val completionCounter = AtomicLong(0)
+            val semaphore = Semaphore(profile.maxConnections * 3)
             val start = Instant.now()
             val totalElapsedTime = AtomicLong(0)
             entries.forEach { entry ->
-                val requestStart = System.nanoTime()
+                semaphore.acquire()
-                val future = client.get(entry.first).thenApply {
+                val eventListener = object : RequestEventListener {
+                    var start : Long? = null
+                    override fun requestSent(req: FullHttpRequest) {
+                        this.start = System.nanoTime()
+                    }
+
+                    override fun responseReceived(res: FullHttpResponse) {
+                        this.start?.let { requestStart ->
                             totalElapsedTime.addAndGet((System.nanoTime() - requestStart))
+                        }
+                        this.start = null
+                    }
+                }
+
+                val future = client.get(entry.first, eventListener).thenApply {
                     if (it == null) {
                         log.error {
                             "Missing entry for key '${entry.first}'"
@@ -110,21 +149,19 @@ class BenchmarkCommand : GbcsCommand() {
                     }
                 }
                 future.whenComplete { _, _ ->
-                    completionQueue.put(future)
+                    completionCounter.incrementAndGet()
+                    semaphore.release()
                 }
             }
-            var completionCounter = 0
-            while (completionCounter < entries.size) {
-                completionQueue.take()
-                completionCounter += 1
-            }
             val end = Instant.now()
             log.info {
                 val elapsed = Duration.between(start, end).toMillis()
-                "Retrieval rate: ${entries.size.toDouble() / elapsed * 1000} ops/s"
+                val opsPerSecond = String.format("%.2f", entries.size.toDouble() / elapsed * 1000)
+                "Retrieval rate: $opsPerSecond ops/s"
             }
             log.info {
-                "Average time per retrieval: ${totalElapsedTime.get() / numberOfEntries.toDouble() * 1e6} ms"
+                val avgTxTime = String.format("%.0f", totalElapsedTime.get() / completionCounter.toDouble() / 1e6)
+                "Average time per retrieval: $avgTxTime ms"
             }
         } else {
             log.error("Skipping retrieval benchmark as it was not possible to insert any entry in the cache")

gbcs-client/build.gradle

@@ -10,6 +10,8 @@ dependencies {
     implementation catalog.slf4j.api
     implementation catalog.netty.buffer
     implementation catalog.netty.codec.http
+
+    testRuntimeOnly catalog.logback.classic
 }
 
 

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/Client.kt

@@ -66,11 +66,18 @@ class GradleBuildCacheClient(private val profile: Configuration.Profile) : AutoC
             data class BasicAuthenticationCredentials(val username: String, val password: String) : Authentication()
         }
 
+        class RetryPolicy(
+            val maxAttempts: Int,
+            val initialDelayMillis: Long,
+            val exp: Double
+        )
+
         data class Profile(
             val serverURI: URI,
             val authentication: Authentication?,
             val connectionTimeout: Duration?,
-            val maxConnections : Int
+            val maxConnections: Int,
+            val retryPolicy: RetryPolicy?,
         )
 
         companion object {
@@ -154,16 +161,62 @@ class GradleBuildCacheClient(private val profile: Configuration.Profile) : AutoC
                 // HTTP handlers
                 pipeline.addLast("codec", HttpClientCodec())
                 pipeline.addLast("decompressor", HttpContentDecompressor())
-                pipeline.addLast("aggregator", HttpObjectAggregator(1048576))
+                pipeline.addLast("aggregator", HttpObjectAggregator(134217728))
                 pipeline.addLast("chunked", ChunkedWriteHandler())
             }
         }
         pool = FixedChannelPool(bootstrap, channelPoolHandler, profile.maxConnections)
     }
 
-    fun get(key: String): CompletableFuture<ByteArray?> {
+    private fun executeWithRetry(operation: () -> CompletableFuture<FullHttpResponse>): CompletableFuture<FullHttpResponse> {
-        return sendRequest(profile.serverURI.resolve(key), HttpMethod.GET, null)
+        val retryPolicy = profile.retryPolicy
-            .thenApply {
+        return if (retryPolicy != null) {
+            val outcomeHandler = OutcomeHandler<FullHttpResponse> { outcome ->
+                when (outcome) {
+                    is OperationOutcome.Success -> {
+                        val response = outcome.result
+                        val status = response.status()
+                        when (status) {
+                            HttpResponseStatus.TOO_MANY_REQUESTS -> {
+                                val retryAfter = response.headers()[HttpHeaderNames.RETRY_AFTER]?.let { headerValue ->
+                                    try {
+                                        headerValue.toLong() * 1000
+                                    } catch (nfe: NumberFormatException) {
+                                        null
+                                    }
+                                }
+                                OutcomeHandlerResult.Retry(retryAfter)
+                            }
+
+                            HttpResponseStatus.INTERNAL_SERVER_ERROR, HttpResponseStatus.SERVICE_UNAVAILABLE ->
+                                OutcomeHandlerResult.Retry()
+
+                            else -> OutcomeHandlerResult.DoNotRetry()
+                        }
+                    }
+
+                    is OperationOutcome.Failure -> {
+                        OutcomeHandlerResult.Retry()
+                    }
+                }
+            }
+            executeWithRetry(
+                group,
+                retryPolicy.maxAttempts,
+                retryPolicy.initialDelayMillis.toDouble(),
+                retryPolicy.exp,
+                outcomeHandler,
+                operation
+            )
+        } else {
+            operation()
+        }
+    }
+
+    fun get(key: String, eventListener : RequestEventListener? = null): CompletableFuture<ByteArray?> {
+        return executeWithRetry {
+            sendRequest(profile.serverURI.resolve(key), HttpMethod.GET, null, eventListener)
+        }.thenApply {
             val status = it.status()
             if (it.status() == HttpResponseStatus.NOT_FOUND) {
                 null
@@ -181,16 +234,18 @@ class GradleBuildCacheClient(private val profile: Configuration.Profile) : AutoC
         }
     }
 
-    fun put(key: String, content: ByteArray): CompletableFuture<Unit> {
+    fun put(key: String, content: ByteArray, eventListener : RequestEventListener? = null): CompletableFuture<Unit> {
-        return sendRequest(profile.serverURI.resolve(key), HttpMethod.PUT, content).thenApply {
+        return executeWithRetry {
+            sendRequest(profile.serverURI.resolve(key), HttpMethod.PUT, content, eventListener)
+        }.thenApply {
             val status = it.status()
-            if (it.status() != HttpResponseStatus.CREATED) {
+            if (it.status() != HttpResponseStatus.CREATED && it.status() != HttpResponseStatus.OK) {
                 throw HttpException(status)
             }
         }
     }
 
-    private fun sendRequest(uri: URI, method: HttpMethod, body: ByteArray?): CompletableFuture<FullHttpResponse> {
+    private fun sendRequest(uri: URI, method: HttpMethod, body: ByteArray?, eventListener : RequestEventListener?): CompletableFuture<FullHttpResponse> {
         val responseFuture = CompletableFuture<FullHttpResponse>()
         // Custom handler for processing responses
         pool.acquire().addListener(object : GenericFutureListener<NettyFuture<Channel>> {
@@ -203,9 +258,10 @@ class GradleBuildCacheClient(private val profile: Configuration.Profile) : AutoC
                             ctx: ChannelHandlerContext,
                             response: FullHttpResponse
                         ) {
-                            responseFuture.complete(response)
                             pipeline.removeLast()
                             pool.release(channel)
+                            responseFuture.complete(response)
+                            eventListener?.responseReceived(response)
                         }
 
                         override fun exceptionCaught(ctx: ChannelHandlerContext, cause: Throwable) {
@@ -217,7 +273,6 @@ class GradleBuildCacheClient(private val profile: Configuration.Profile) : AutoC
                             ctx.close()
                             pipeline.removeLast()
                             pool.release(channel)
-                            super.exceptionCaught(ctx, cause)
                         }
                     })
                     // Prepare the HTTP request
@@ -252,7 +307,11 @@ class GradleBuildCacheClient(private val profile: Configuration.Profile) : AutoC
 
                     // Set headers
                     // Send the request
-                    channel.writeAndFlush(request)
+                    channel.writeAndFlush(request).addListener {
+                        if(it.isSuccess) {
+                            eventListener?.requestSent(request)
+                        }
+                    }
                 } else {
                     responseFuture.completeExceptionally(channelFuture.cause())
                 }

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/RequestEventListener.kt

@@ -0,0 +1,10 @@
+package net.woggioni.gbcs.client
+
+import io.netty.handler.codec.http.FullHttpRequest
+import io.netty.handler.codec.http.FullHttpResponse
+
+interface RequestEventListener {
+    fun requestSent(req : FullHttpRequest) {}
+    fun responseReceived(res : FullHttpResponse) {}
+    fun exceptionCaught(ex : Throwable) {}
+}

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/impl/Parser.kt

@@ -17,16 +17,18 @@ object Parser {
 
     fun parse(document: Document): GradleBuildCacheClient.Configuration {
         val root = document.documentElement
-
         val profiles = mutableMapOf<String, GradleBuildCacheClient.Configuration.Profile>()
 
         for (child in root.asIterable()) {
             val tagName = child.localName
             when (tagName) {
                 "profile" -> {
-                    val name = child.renderAttribute("name") ?: throw ConfigurationException("name attribute is required")
+                    val name =
-                    val uri = child.renderAttribute("base-url")?.let(::URI) ?: throw ConfigurationException("base-url attribute is required")
+                        child.renderAttribute("name") ?: throw ConfigurationException("name attribute is required")
+                    val uri = child.renderAttribute("base-url")?.let(::URI)
+                        ?: throw ConfigurationException("base-url attribute is required")
                     var authentication: GradleBuildCacheClient.Configuration.Authentication? = null
+                    var retryPolicy: GradleBuildCacheClient.Configuration.RetryPolicy? = null
                     for (gchild in child.asIterable()) {
                         when (gchild.localName) {
                             "tls-client-auth" -> {
@@ -47,14 +49,42 @@ object Parser {
                                     .toList()
                                     .toTypedArray()
                                 authentication =
-                                    GradleBuildCacheClient.Configuration.Authentication.TlsClientAuthenticationCredentials(key, certChain)
+                                    GradleBuildCacheClient.Configuration.Authentication.TlsClientAuthenticationCredentials(
+                                        key,
+                                        certChain
+                                    )
                             }
 
                             "basic-auth" -> {
-                                val username = gchild.renderAttribute("user") ?: throw ConfigurationException("username attribute is required")
+                                val username = gchild.renderAttribute("user")
-                                val password = gchild.renderAttribute("password") ?: throw ConfigurationException("password attribute is required")
+                                    ?: throw ConfigurationException("username attribute is required")
+                                val password = gchild.renderAttribute("password")
+                                    ?: throw ConfigurationException("password attribute is required")
                                 authentication =
-                                    GradleBuildCacheClient.Configuration.Authentication.BasicAuthenticationCredentials(username, password)
+                                    GradleBuildCacheClient.Configuration.Authentication.BasicAuthenticationCredentials(
+                                        username,
+                                        password
+                                    )
+                            }
+
+                            "retry-policy" -> {
+                                val maxAttempts =
+                                    gchild.renderAttribute("max-attempts")
+                                        ?.let(String::toInt)
+                                        ?: throw ConfigurationException("max-attempts attribute is required")
+                                val initialDelay =
+                                    gchild.renderAttribute("initial-delay")
+                                        ?.let(Duration::parse)
+                                        ?: Duration.ofSeconds(1)
+                                val exp =
+                                    gchild.renderAttribute("exp")
+                                        ?.let(String::toDouble)
+                                        ?: 2.0f
+                                retryPolicy = GradleBuildCacheClient.Configuration.RetryPolicy(
+                                    maxAttempts,
+                                    initialDelay.toMillis(),
+                                    exp.toDouble()
+                                )
                             }
                         }
                     }
@@ -63,7 +93,13 @@ object Parser {
                         ?: 50
                     val connectionTimeout = child.renderAttribute("connection-timeout")
                         ?.let(Duration::parse)
-                    profiles[name] = GradleBuildCacheClient.Configuration.Profile(uri, authentication, connectionTimeout, maxConnections)
+                    profiles[name] = GradleBuildCacheClient.Configuration.Profile(
+                        uri,
+                        authentication,
+                        connectionTimeout,
+                        maxConnections,
+                        retryPolicy
+                    )
                 }
             }
         }

gbcs-client/src/main/kotlin/net/woggioni/gbcs/client/retry.kt

@@ -0,0 +1,75 @@
+package net.woggioni.gbcs.client
+
+import io.netty.util.concurrent.EventExecutorGroup
+import java.util.concurrent.CompletableFuture
+import java.util.concurrent.TimeUnit
+
+sealed class OperationOutcome<T> {
+    class Success<T>(val result: T) : OperationOutcome<T>()
+    class Failure<T>(val ex: Throwable) : OperationOutcome<T>()
+}
+
+sealed class OutcomeHandlerResult {
+    class Retry(val suggestedDelayMillis: Long? = null) : OutcomeHandlerResult()
+    class DoNotRetry : OutcomeHandlerResult()
+}
+
+fun interface OutcomeHandler<T> {
+    fun shouldRetry(result: OperationOutcome<T>): OutcomeHandlerResult
+}
+
+fun <T> executeWithRetry(
+    eventExecutorGroup: EventExecutorGroup,
+    maxAttempts: Int,
+    initialDelay: Double,
+    exp: Double,
+    outcomeHandler: OutcomeHandler<T>,
+    cb: () -> CompletableFuture<T>
+): CompletableFuture<T> {
+    val finalResult = cb()
+    var future = finalResult
+    var shortCircuit = false
+    for (i in 1 until maxAttempts) {
+        future = future.handle { result, ex ->
+            val operationOutcome = if (ex == null) {
+                OperationOutcome.Success(result)
+            } else {
+                OperationOutcome.Failure(ex.cause ?: ex)
+            }
+            if (shortCircuit) {
+                when(operationOutcome) {
+                    is OperationOutcome.Failure -> throw operationOutcome.ex
+                    is OperationOutcome.Success -> CompletableFuture.completedFuture(operationOutcome.result)
+                }
+            } else {
+                when(val outcomeHandlerResult = outcomeHandler.shouldRetry(operationOutcome)) {
+                    is OutcomeHandlerResult.Retry -> {
+                        val res = CompletableFuture<T>()
+                        val delay = run {
+                            val scheduledDelay = (initialDelay * Math.pow(exp, i.toDouble())).toLong()
+                            outcomeHandlerResult.suggestedDelayMillis?.coerceAtMost(scheduledDelay) ?: scheduledDelay
+                        }
+                        eventExecutorGroup.schedule({
+                            cb().handle { result, ex ->
+                                if (ex == null) {
+                                    res.complete(result)
+                                } else {
+                                    res.completeExceptionally(ex)
+                                }
+                            }
+                        }, delay, TimeUnit.MILLISECONDS)
+                        res
+                    }
+                    is OutcomeHandlerResult.DoNotRetry -> {
+                        shortCircuit = true
+                        when(operationOutcome) {
+                            is OperationOutcome.Failure -> throw operationOutcome.ex
+                            is OperationOutcome.Success -> CompletableFuture.completedFuture(operationOutcome.result)
+                        }
+                    }
+                }
+            }
+        }.thenCompose { it }
+    }
+    return future
+}

gbcs-client/src/main/resources/net/woggioni/gbcs/client/schema/gbcs-client.xsd

@@ -13,11 +13,14 @@
     </xs:complexType>
 
     <xs:complexType name="profileType">
+        <xs:sequence>
             <xs:choice>
                 <xs:element name="no-auth" type="gbcs-client:noAuthType"/>
                 <xs:element name="basic-auth" type="gbcs-client:basicAuthType"/>
                 <xs:element name="tls-client-auth" type="gbcs-client:tlsClientAuthType"/>
             </xs:choice>
+            <xs:element name="retry-policy" type="gbcs-client:retryType" minOccurs="0"/>
+        </xs:sequence>
         <xs:attribute name="name" type="xs:token" use="required"/>
         <xs:attribute name="base-url" type="xs:anyURI" use="required"/>
         <xs:attribute name="max-connections" type="xs:positiveInteger" default="50"/>
@@ -38,4 +41,10 @@
         <xs:attribute name="key-password" type="xs:string" use="optional"/>
     </xs:complexType>
 
+    <xs:complexType name="retryType">
+        <xs:attribute name="max-attempts" type="xs:positiveInteger" use="required"/>
+        <xs:attribute name="initial-delay" type="xs:duration" default="PT1S"/>
+        <xs:attribute name="exp" type="xs:double" default="2.0"/>
+    </xs:complexType>
+
 </xs:schema>

gbcs-client/src/test/kotlin/net/woggioni/gbcs/client/RetryTest.kt

@@ -0,0 +1,149 @@
+package net.woggioni.gbcs.client
+
+import io.netty.util.concurrent.DefaultEventExecutorGroup
+import io.netty.util.concurrent.EventExecutorGroup
+import net.woggioni.gbcs.common.contextLogger
+import org.junit.jupiter.api.Assertions
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.extension.ExtensionContext
+import org.junit.jupiter.params.ParameterizedTest
+import org.junit.jupiter.params.provider.Arguments
+import org.junit.jupiter.params.provider.ArgumentsProvider
+import org.junit.jupiter.params.provider.ArgumentsSource
+import java.util.concurrent.CompletableFuture
+import java.util.stream.Stream
+import kotlin.random.Random
+
+class RetryTest {
+
+    data class TestArgs(
+        val seed: Int,
+        val maxAttempt: Int,
+        val initialDelay: Double,
+        val exp: Double,
+    )
+
+    class TestArguments : ArgumentsProvider {
+        override fun provideArguments(context: ExtensionContext): Stream<out Arguments> {
+            return Stream.of(
+                TestArgs(
+                    seed = 101325,
+                    maxAttempt = 5,
+                    initialDelay = 50.0,
+                    exp = 2.0,
+                ),
+                TestArgs(
+                    seed = 101325,
+                    maxAttempt = 20,
+                    initialDelay = 100.0,
+                    exp = 1.1,
+                ),
+                TestArgs(
+                    seed = 123487,
+                    maxAttempt = 20,
+                    initialDelay = 100.0,
+                    exp = 2.0,
+                ),
+                TestArgs(
+                    seed = 20082024,
+                    maxAttempt = 10,
+                    initialDelay = 100.0,
+                    exp = 2.0,
+                )
+            ).map {
+                object: Arguments {
+                    override fun get() = arrayOf(it)
+                }
+            }
+        }
+    }
+
+    @ArgumentsSource(TestArguments::class)
+    @ParameterizedTest
+    fun test(testArgs: TestArgs) {
+        val log = contextLogger()
+        log.debug("Start")
+        val executor: EventExecutorGroup = DefaultEventExecutorGroup(1)
+        val attempts = mutableListOf<Pair<Long, OperationOutcome<Int>>>()
+        val outcomeHandler = OutcomeHandler<Int> { outcome ->
+            when(outcome) {
+                is OperationOutcome.Success -> {
+                    if(outcome.result % 10 == 0) {
+                        OutcomeHandlerResult.DoNotRetry()
+                    } else {
+                        OutcomeHandlerResult.Retry(null)
+                    }
+                }
+                is OperationOutcome.Failure -> {
+                    when(outcome.ex) {
+                        is IllegalStateException -> {
+                            log.debug(outcome.ex.message, outcome.ex)
+                            OutcomeHandlerResult.Retry(null)
+                        }
+                        else -> {
+                            OutcomeHandlerResult.DoNotRetry()
+                        }
+                    }
+                }
+            }
+        }
+        val random = Random(testArgs.seed)
+
+        val future =
+            executeWithRetry(executor, testArgs.maxAttempt, testArgs.initialDelay, testArgs.exp, outcomeHandler) {
+                val now = System.nanoTime()
+                val result = CompletableFuture<Int>()
+                executor.submit {
+                    val n = random.nextInt(0, Integer.MAX_VALUE)
+                    log.debug("Got new number: {}", n)
+                    if(n % 3 == 0) {
+                        val ex = IllegalStateException("Value $n can be divided by 3")
+                        result.completeExceptionally(ex)
+                        attempts += now to OperationOutcome.Failure(ex)
+                    } else if(n % 7 == 0) {
+                        val ex = RuntimeException("Value $n can be divided by 7")
+                        result.completeExceptionally(ex)
+                        attempts += now to OperationOutcome.Failure(ex)
+                    } else {
+                        result.complete(n)
+                        attempts += now to OperationOutcome.Success(n)
+                    }
+                }
+                result
+            }
+        Assertions.assertTrue(attempts.size <= testArgs.maxAttempt)
+        val result = future.handle { res, ex ->
+            if(ex != null) {
+                val err = ex.cause ?: ex
+                log.debug(err.message, err)
+                OperationOutcome.Failure(err)
+            } else {
+                OperationOutcome.Success(res)
+            }
+        }.get()
+        for ((index, attempt) in attempts.withIndex()) {
+            val (timestamp, value) = attempt
+            if (index > 0) {
+                /* Check the delay for subsequent attempts is correct */
+                val previousAttempt = attempts[index - 1]
+                val expectedTimestamp =
+                    previousAttempt.first + testArgs.initialDelay * Math.pow(testArgs.exp, index.toDouble()) * 1e6
+                val actualTimestamp = timestamp
+                val err = Math.abs(expectedTimestamp - actualTimestamp) / expectedTimestamp
+                Assertions.assertTrue(err < 1e-3)
+            }
+            if (index == attempts.size - 1 && index < testArgs.maxAttempt - 1) {
+                /*
+                 * If the last attempt index is lower than the maximum number of attempts, then
+                 * check the outcome handler returns DoNotRetry
+                 */
+                Assertions.assertTrue(outcomeHandler.shouldRetry(value) is OutcomeHandlerResult.DoNotRetry)
+            } else if (index < attempts.size - 1) {
+                /*
+                 * If the attempt is not the last attempt check the outcome handler returns Retry
+                 */
+                Assertions.assertTrue(outcomeHandler.shouldRetry(value) is OutcomeHandlerResult.Retry)
+            }
+        }
+    }
+}

gbcs-client/src/test/resources/logback.xml

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE configuration>
+
+<configuration>
+    <import class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"/>
+    <import class="ch.qos.logback.core.ConsoleAppender"/>
+
+    <appender name="console" class="ConsoleAppender">
+        <target>System.err</target>
+        <encoder class="PatternLayoutEncoder">
+            <pattern>%d [%highlight(%-5level)] \(%thread\) %logger{36} -%kvp- %msg %n</pattern>
+        </encoder>
+    </appender>
+
+    <root level="info">
+        <appender-ref ref="console"/>
+    </root>
+    <logger name="io.netty" level="info"/>
+    <logger name="com.google.code.yanf4j" level="warn"/>
+    <logger name="net.rubyeye.xmemcached" level="warn"/>
+</configuration>

gbcs-common/src/main/java/module-info.java

@@ -5,5 +5,6 @@ module net.woggioni.gbcs.common {
     requires kotlin.stdlib;
     requires net.woggioni.jwo;
 
+    provides java.net.spi.URLStreamHandlerProvider with net.woggioni.gbcs.common.GbcsUrlStreamHandlerFactory;
     exports net.woggioni.gbcs.common;
 }

gbcs-common/src/main/kotlin/net/woggioni/gbcs/common/GbcsUrlStreamHandlerFactory.kt

@@ -6,12 +6,13 @@ import java.net.URL
 import java.net.URLConnection
 import java.net.URLStreamHandler
 import java.net.URLStreamHandlerFactory
+import java.net.spi.URLStreamHandlerProvider
 import java.util.Optional
 import java.util.concurrent.atomic.AtomicBoolean
 import java.util.stream.Collectors
 
 
-class GbcsUrlStreamHandlerFactory : URLStreamHandlerFactory {
+class GbcsUrlStreamHandlerFactory : URLStreamHandlerProvider() {
 
     private class ClasspathHandler(private val classLoader: ClassLoader = GbcsUrlStreamHandlerFactory::class.java.classLoader) :
         URLStreamHandler() {

gbcs-common/src/main/resources/META-INF/services/java.net.spi.URLStreamHandlerProvider

@@ -0,0 +1 @@
+net.woggioni.gbcs.common.GbcsUrlStreamHandlerFactory

gbcs-server/build.gradle

@@ -18,13 +18,15 @@ dependencies {
 
     testImplementation catalog.bcprov.jdk18on
     testImplementation catalog.bcpkix.jdk18on
-    testImplementation catalog.junit.jupiter.api
-    testImplementation catalog.junit.jupiter.params
-    testRuntimeOnly catalog.junit.jupiter.engine
 
     testRuntimeOnly project(":gbcs-server-memcached")
 }
 
+test {
+    systemProperty("io.netty.leakDetectionLevel", "PARANOID")
+    systemProperty("jdk.httpclient.redirects.retrylimit", "1")
+}
+
 publishing {
     publications {
         maven(MavenPublication) {

gbcs-server/src/main/java/module-info.java

@@ -1,5 +1,6 @@
 import net.woggioni.gbcs.api.CacheProvider;
 import net.woggioni.gbcs.server.cache.FileSystemCacheProvider;
+import net.woggioni.gbcs.server.cache.InMemoryCacheProvider;
 
 module net.woggioni.gbcs.server {
     requires java.sql;
@@ -24,5 +25,5 @@ module net.woggioni.gbcs.server {
     opens net.woggioni.gbcs.server.schema;
 
     uses CacheProvider;
-    provides CacheProvider with FileSystemCacheProvider;
+    provides CacheProvider with FileSystemCacheProvider, InMemoryCacheProvider;
 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/GradleBuildCacheServer.kt

@@ -2,11 +2,8 @@ package net.woggioni.gbcs.server
 
 import io.netty.bootstrap.ServerBootstrap
 import io.netty.buffer.ByteBuf
-import io.netty.buffer.Unpooled
 import io.netty.channel.Channel
-import io.netty.channel.ChannelDuplexHandler
 import io.netty.channel.ChannelFuture
-import io.netty.channel.ChannelFutureListener
 import io.netty.channel.ChannelHandler.Sharable
 import io.netty.channel.ChannelHandlerContext
 import io.netty.channel.ChannelInboundHandlerAdapter
@@ -15,35 +12,26 @@ import io.netty.channel.ChannelOption
 import io.netty.channel.ChannelPromise
 import io.netty.channel.nio.NioEventLoopGroup
 import io.netty.channel.socket.nio.NioServerSocketChannel
-import io.netty.handler.codec.DecoderException
 import io.netty.handler.codec.compression.CompressionOptions
-import io.netty.handler.codec.http.DefaultFullHttpResponse
 import io.netty.handler.codec.http.DefaultHttpContent
-import io.netty.handler.codec.http.FullHttpResponse
 import io.netty.handler.codec.http.HttpContentCompressor
 import io.netty.handler.codec.http.HttpHeaderNames
 import io.netty.handler.codec.http.HttpObjectAggregator
 import io.netty.handler.codec.http.HttpRequest
-import io.netty.handler.codec.http.HttpResponseStatus
 import io.netty.handler.codec.http.HttpServerCodec
-import io.netty.handler.codec.http.HttpVersion
 import io.netty.handler.ssl.ClientAuth
 import io.netty.handler.ssl.SslContext
 import io.netty.handler.ssl.SslContextBuilder
 import io.netty.handler.ssl.SslHandler
 import io.netty.handler.stream.ChunkedWriteHandler
+import io.netty.handler.timeout.IdleState
 import io.netty.handler.timeout.IdleStateEvent
 import io.netty.handler.timeout.IdleStateHandler
-import io.netty.handler.timeout.ReadTimeoutException
+import io.netty.util.AttributeKey
-import io.netty.handler.timeout.ReadTimeoutHandler
-import io.netty.handler.timeout.WriteTimeoutException
-import io.netty.handler.timeout.WriteTimeoutHandler
 import io.netty.util.concurrent.DefaultEventExecutorGroup
 import io.netty.util.concurrent.EventExecutorGroup
 import net.woggioni.gbcs.api.Configuration
-import net.woggioni.gbcs.api.Role
 import net.woggioni.gbcs.api.exception.ConfigurationException
-import net.woggioni.gbcs.api.exception.ContentTooLargeException
 import net.woggioni.gbcs.common.GBCS.toUrl
 import net.woggioni.gbcs.common.PasswordSecurity.decodePasswordHash
 import net.woggioni.gbcs.common.PasswordSecurity.hashPassword
@@ -57,7 +45,9 @@ import net.woggioni.gbcs.server.auth.ClientCertificateValidator
 import net.woggioni.gbcs.server.auth.RoleAuthorizer
 import net.woggioni.gbcs.server.configuration.Parser
 import net.woggioni.gbcs.server.configuration.Serializer
+import net.woggioni.gbcs.server.exception.ExceptionHandler
 import net.woggioni.gbcs.server.handler.ServerHandler
+import net.woggioni.gbcs.server.throttling.ThrottlingHandler
 import net.woggioni.jwo.JWO
 import net.woggioni.jwo.Tuple2
 import java.io.OutputStream
@@ -75,12 +65,14 @@ import java.util.regex.Pattern
 import javax.naming.ldap.LdapName
 import javax.net.ssl.SSLPeerUnverifiedException
 
-
 class GradleBuildCacheServer(private val cfg: Configuration) {
     private val log = contextLogger()
 
     companion object {
 
+        val userAttribute: AttributeKey<Configuration.User> = AttributeKey.valueOf("user")
+        val groupAttribute: AttributeKey<Set<Configuration.Group>> = AttributeKey.valueOf("group")
+
         val DEFAULT_CONFIGURATION_URL by lazy { "classpath:net/woggioni/gbcs/gbcs-default.xml".toUrl() }
         private const val SSL_HANDLER_NAME = "sslHandler"
 
@@ -120,12 +112,12 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
     @Sharable
     private class ClientCertificateAuthenticator(
         authorizer: Authorizer,
-        private val anonymousUserRoles: Set<Role>?,
+        private val anonymousUserGroups: Set<Configuration.Group>?,
         private val userExtractor: Configuration.UserExtractor?,
         private val groupExtractor: Configuration.GroupExtractor?,
     ) : AbstractNettyHttpAuthenticator(authorizer) {
 
-        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): Set<Role>? {
+        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): AuthenticationResult? {
             return try {
                 val sslHandler = (ctx.pipeline().get(SSL_HANDLER_NAME) as? SslHandler)
                     ?: throw ConfigurationException("Client certificate authentication cannot be used when TLS is disabled")
@@ -136,10 +128,11 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
                     val clientCertificate = peerCertificates.first() as X509Certificate
                     val user = userExtractor?.extract(clientCertificate)
                     val group = groupExtractor?.extract(clientCertificate)
-                    (group?.roles ?: emptySet()) + (user?.roles ?: emptySet())
+                    val allGroups = ((user?.groups ?: emptySet()).asSequence() + sequenceOf(group).filterNotNull()).toSet()
-                } ?: anonymousUserRoles
+                    AuthenticationResult(user, allGroups)
+                } ?: anonymousUserGroups?.let{ AuthenticationResult(null, it) }
             } catch (es: SSLPeerUnverifiedException) {
-                anonymousUserRoles
+                anonymousUserGroups?.let{ AuthenticationResult(null, it) }
             }
         }
     }
@@ -150,26 +143,26 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
     ) : AbstractNettyHttpAuthenticator(authorizer) {
         private val log = contextLogger()
 
-        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): Set<Role>? {
+        override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): AuthenticationResult? {
             val authorizationHeader = req.headers()[HttpHeaderNames.AUTHORIZATION] ?: let {
                 log.debug(ctx) {
                     "Missing Authorization header"
                 }
-                return users[""]?.roles
+                return users[""]?.let { AuthenticationResult(it, it.groups) }
             }
             val cursor = authorizationHeader.indexOf(' ')
             if (cursor < 0) {
                 log.debug(ctx) {
                     "Invalid Authorization header: '$authorizationHeader'"
                 }
-                return users[""]?.roles
+                return users[""]?.let { AuthenticationResult(it, it.groups) }
             }
             val authenticationType = authorizationHeader.substring(0, cursor)
             if ("Basic" != authenticationType) {
                 log.debug(ctx) {
                     "Invalid authentication type header: '$authenticationType'"
                 }
-                return users[""]?.roles
+                return users[""]?.let { AuthenticationResult(it, it.groups) }
             }
             val (username, password) = Base64.getDecoder().decode(authorizationHeader.substring(cursor + 1))
                 .let(::String)
@@ -189,7 +182,9 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
                     val (_, salt) = decodePasswordHash(passwordAndSalt)
                     hashPassword(password, Base64.getEncoder().encodeToString(salt)) == passwordAndSalt
                 } ?: false
-            }?.roles
+            }?.let { user ->
+                AuthenticationResult(user, user.groups)
+            }
         }
     }
 
@@ -213,15 +208,15 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
                             .map { it as X509Certificate }
                             .toArray { size -> Array<X509Certificate?>(size) { null } }
                     SslContextBuilder.forServer(serverKey, *serverCert).apply {
-                        if (tls.isVerifyClients) {
+                        val clientAuth = tls.trustStore?.let { trustStore ->
-                            clientAuth(ClientAuth.OPTIONAL)
-                            tls.trustStore?.let { trustStore ->
                             val ts = loadKeystore(trustStore.file, trustStore.password)
                             trustManager(
                                 ClientCertificateValidator.getTrustManager(ts, trustStore.isCheckCertificateStatus)
                             )
-                            }
+                            if(trustStore.isRequireClientCertificate) ClientAuth.REQUIRE
-                        }
+                            else ClientAuth.OPTIONAL
+                        } ?: ClientAuth.NONE
+                        clientAuth(clientAuth)
                     }.build()
                 }
             }
@@ -257,13 +252,14 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         }
 
         private val exceptionHandler = ExceptionHandler()
+        private val throttlingHandler = ThrottlingHandler(cfg)
 
         private val authenticator = when (val auth = cfg.authentication) {
             is Configuration.BasicAuthentication -> NettyHttpBasicAuthenticator(cfg.users, RoleAuthorizer())
             is Configuration.ClientCertificateAuthentication -> {
                 ClientCertificateAuthenticator(
                     RoleAuthorizer(),
-                    cfg.users[""]?.roles,
+                    cfg.users[""]?.groups,
                     userExtractor(auth),
                     groupExtractor(auth)
                 )
@@ -312,17 +308,50 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
                 }
             }
             val pipeline = ch.pipeline()
-            cfg.connection.apply {
+            cfg.connection.also { conn ->
-                pipeline.addLast(ReadTimeoutHandler(readTimeout.toMillis(), TimeUnit.MILLISECONDS))
+                val readTimeout = conn.readTimeout.toMillis()
-                pipeline.addLast(WriteTimeoutHandler(writeTimeout.toMillis(), TimeUnit.MILLISECONDS))
+                val writeTimeout = conn.writeTimeout.toMillis()
-                pipeline.addLast(IdleStateHandler(false, 0, 0, idleTimeout.toMillis(), TimeUnit.MILLISECONDS))
+                if(readTimeout > 0 || writeTimeout > 0) {
+                    pipeline.addLast(
+                        IdleStateHandler(
+                            false,
+                            readTimeout,
+                            writeTimeout,
+                            0,
+                            TimeUnit.MILLISECONDS
+                        )
+                    )
+                }
+                val readIdleTimeout = conn.readIdleTimeout.toMillis()
+                val writeIdleTimeout = conn.writeIdleTimeout.toMillis()
+                val idleTimeout = conn.idleTimeout.toMillis()
+                if(readIdleTimeout > 0 || writeIdleTimeout > 0 || idleTimeout > 0) {
+                    pipeline.addLast(
+                        IdleStateHandler(
+                            true,
+                            readIdleTimeout,
+                            writeIdleTimeout,
+                            idleTimeout,
+                            TimeUnit.MILLISECONDS
+                        )
+                    )
+                }
             }
             pipeline.addLast(object : ChannelInboundHandlerAdapter() {
                 override fun userEventTriggered(ctx: ChannelHandlerContext, evt: Any) {
                     if (evt is IdleStateEvent) {
-                        log.debug {
+                        when(evt.state()) {
+                            IdleState.READER_IDLE -> log.debug {
+                                "Read timeout reached on channel ${ch.id().asShortText()}, closing the connection"
+                            }
+                            IdleState.WRITER_IDLE -> log.debug {
+                                "Write timeout reached on channel ${ch.id().asShortText()}, closing the connection"
+                            }
+                            IdleState.ALL_IDLE -> log.debug {
                                 "Idle timeout reached on channel ${ch.id().asShortText()}, closing the connection"
                             }
+                            null -> throw IllegalStateException("This should never happen")
+                        }
                         ctx.close()
                     }
                 }
@@ -337,65 +366,12 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
             authenticator?.let {
                 pipeline.addLast(it)
             }
+            pipeline.addLast(throttlingHandler)
             pipeline.addLast(eventExecutorGroup, serverHandler)
             pipeline.addLast(exceptionHandler)
         }
     }
 
-    @Sharable
-    private class ExceptionHandler : ChannelDuplexHandler() {
-        private val log = contextLogger()
-
-        private val NOT_AUTHORIZED: FullHttpResponse = DefaultFullHttpResponse(
-            HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER
-        ).apply {
-            headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
-        }
-
-        private val TOO_BIG: FullHttpResponse = DefaultFullHttpResponse(
-            HttpVersion.HTTP_1_1, HttpResponseStatus.REQUEST_ENTITY_TOO_LARGE, Unpooled.EMPTY_BUFFER
-        ).apply {
-            headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
-        }
-
-        override fun exceptionCaught(ctx: ChannelHandlerContext, cause: Throwable) {
-            when (cause) {
-                is DecoderException -> {
-                    log.error(cause.message, cause)
-                    ctx.close()
-                }
-
-                is SSLPeerUnverifiedException -> {
-                    ctx.writeAndFlush(NOT_AUTHORIZED.retainedDuplicate())
-                        .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
-                }
-
-                is ContentTooLargeException -> {
-                    ctx.writeAndFlush(TOO_BIG.retainedDuplicate())
-                        .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
-                }
-                is ReadTimeoutException -> {
-                    log.debug {
-                        val channelId = ctx.channel().id().asShortText()
-                        "Read timeout on channel $channelId, closing the connection"
-                    }
-                    ctx.close()
-                }
-                is WriteTimeoutException -> {
-                    log.debug {
-                        val channelId = ctx.channel().id().asShortText()
-                        "Write timeout on channel $channelId, closing the connection"
-                    }
-                    ctx.close()
-                }
-                else -> {
-                    log.error(cause.message, cause)
-                    ctx.close()
-                }
-            }
-        }
-    }
-
     class ServerHandle(
         httpChannelFuture: ChannelFuture,
         private val executorGroups: Iterable<EventExecutorGroup>
@@ -435,7 +411,6 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
             }
             DefaultEventExecutorGroup(Runtime.getRuntime().availableProcessors(), threadFactory)
         }
-        // A helper class that simplifies server configuration
         val bootstrap = ServerBootstrap().apply {
             // Configure the server
             group(bossGroup, workerGroup)

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/auth/Authenticator.kt

@@ -11,30 +11,46 @@ import io.netty.handler.codec.http.HttpRequest
 import io.netty.handler.codec.http.HttpResponseStatus
 import io.netty.handler.codec.http.HttpVersion
 import io.netty.util.ReferenceCountUtil
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.api.Configuration.Group
 import net.woggioni.gbcs.api.Role
+import net.woggioni.gbcs.server.GradleBuildCacheServer
 
 
-abstract class AbstractNettyHttpAuthenticator(private val authorizer : Authorizer)
+abstract class AbstractNettyHttpAuthenticator(private val authorizer: Authorizer) : ChannelInboundHandlerAdapter() {
-        : ChannelInboundHandlerAdapter() {
 
     companion object {
         private val AUTHENTICATION_FAILED: FullHttpResponse = DefaultFullHttpResponse(
-                HttpVersion.HTTP_1_1, HttpResponseStatus.UNAUTHORIZED, Unpooled.EMPTY_BUFFER).apply {
+            HttpVersion.HTTP_1_1, HttpResponseStatus.UNAUTHORIZED, Unpooled.EMPTY_BUFFER
+        ).apply {
             headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
         }
 
         private val NOT_AUTHORIZED: FullHttpResponse = DefaultFullHttpResponse(
-                HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER).apply {
+            HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER
+        ).apply {
             headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
         }
     }
 
+    class AuthenticationResult(val user: Configuration.User?, val groups: Set<Group>)
 
-    abstract fun authenticate(ctx : ChannelHandlerContext, req : HttpRequest) : Set<Role>?
+    abstract fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): AuthenticationResult?
 
     override fun channelRead(ctx: ChannelHandlerContext, msg: Any) {
         if (msg is HttpRequest) {
-            val roles = authenticate(ctx, msg) ?: return authenticationFailure(ctx, msg)
+            val result = authenticate(ctx, msg) ?: return authenticationFailure(ctx, msg)
+            ctx.channel().attr(GradleBuildCacheServer.userAttribute).set(result.user)
+            ctx.channel().attr(GradleBuildCacheServer.groupAttribute).set(result.groups)
+
+            val roles = (
+                (result.user?.let { user ->
+                    user.groups.asSequence().flatMap { group ->
+                        group.roles.asSequence()
+                    }
+                } ?: emptySequence<Role>()) +
+                        result.groups.asSequence().flatMap { it.roles.asSequence() }
+            ).toSet()
             val authorized = authorizer.authorize(roles, msg)
             if (authorized) {
                 super.channelRead(ctx, msg)

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/auth/UserAuthorizer.kt

@@ -8,7 +8,7 @@ class RoleAuthorizer : Authorizer {
 
     companion object {
         private val METHOD_MAP = mapOf(
-            Role.Reader to setOf(HttpMethod.GET, HttpMethod.HEAD),
+            Role.Reader to setOf(HttpMethod.GET, HttpMethod.HEAD, HttpMethod.TRACE),
             Role.Writer to setOf(HttpMethod.PUT, HttpMethod.POST)
         )
     }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/CacheUtils.kt

@@ -0,0 +1,21 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.jwo.JWO
+import java.security.MessageDigest
+
+object CacheUtils {
+    fun digest(
+        data: ByteArray,
+        md: MessageDigest = MessageDigest.getInstance("MD5")
+    ): ByteArray {
+        md.update(data)
+        return md.digest()
+    }
+
+    fun digestString(
+        data: ByteArray,
+        md: MessageDigest = MessageDigest.getInstance("MD5")
+    ): String {
+        return JWO.bytesToHex(digest(data, md))
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/FileSystemCache.kt

@@ -1,7 +1,8 @@
 package net.woggioni.gbcs.server.cache
 
 import net.woggioni.gbcs.api.Cache
-import net.woggioni.jwo.JWO
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.server.cache.CacheUtils.digestString
 import net.woggioni.jwo.LockFile
 import java.nio.channels.Channels
 import java.nio.channels.FileChannel
@@ -19,7 +20,6 @@ import java.util.zip.DeflaterOutputStream
 import java.util.zip.Inflater
 import java.util.zip.InflaterInputStream
 
-
 class FileSystemCache(
     val root: Path,
     val maxAge: Duration,
@@ -28,7 +28,7 @@ class FileSystemCache(
     val compressionLevel: Int
 ) : Cache {
 
-    private fun lockFilePath(key: String): Path = root.resolve("$key.lock")
+    private val log = contextLogger()
 
     init {
         Files.createDirectories(root)
@@ -41,11 +41,21 @@ class FileSystemCache(
         ?.let { md ->
             digestString(key.toByteArray(), md)
         } ?: key).let { digest ->
-        LockFile.acquire(lockFilePath(digest), true).use {
+        root.resolve(digest).takeIf(Files::exists)
-            root.resolve(digest).takeIf(Files::exists)?.let { file ->
+            ?.let { file ->
+                file.takeIf(Files::exists)?.let { file ->
                     if (compressionEnabled) {
                         val inflater = Inflater()
-                    Channels.newChannel(InflaterInputStream(Files.newInputStream(file), inflater))
+                        Channels.newChannel(
+                            InflaterInputStream(
+                                Channels.newInputStream(
+                                    FileChannel.open(
+                                        file,
+                                        StandardOpenOption.READ
+                                    )
+                                ), inflater
+                            )
+                        )
                     } else {
                         FileChannel.open(file, StandardOpenOption.READ)
                     }
@@ -61,7 +71,6 @@ class FileSystemCache(
             ?.let { md ->
                 digestString(key.toByteArray(), md)
             } ?: key).let { digest ->
-            LockFile.acquire(lockFilePath(digest), false).use {
             val file = root.resolve(digest)
             val tmpFile = Files.createTempFile(root, null, ".tmp")
             try {
@@ -80,7 +89,6 @@ class FileSystemCache(
                 Files.delete(tmpFile)
                 throw t
             }
-            }
         }.also {
             gc()
         }
@@ -97,37 +105,16 @@ class FileSystemCache(
     @Synchronized
     private fun actualGc(now: Instant) {
         Files.list(root).filter {
-            !it.fileName.toString().endsWith(".lock")
-        }.filter {
             val creationTimeStamp = Files.readAttributes(it, BasicFileAttributes::class.java)
                 .creationTime()
                 .toInstant()
             now > creationTimeStamp.plus(maxAge)
         }.forEach { file ->
-            val lockFile = lockFilePath(file.fileName.toString())
+            LockFile.acquire(file, false).use {
-            LockFile.acquire(lockFile, false).use {
                 Files.delete(file)
             }
-            Files.delete(lockFile)
         }
     }
 
     override fun close() {}
-
-    companion object {
-        fun digest(
-            data: ByteArray,
-            md: MessageDigest = MessageDigest.getInstance("MD5")
-        ): ByteArray {
-            md.update(data)
-            return md.digest()
-        }
-
-        fun digestString(
-            data: ByteArray,
-            md: MessageDigest = MessageDigest.getInstance("MD5")
-        ): String {
-            return JWO.bytesToHex(digest(data, md))
-        }
-    }
 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/InMemoryCache.kt

@@ -0,0 +1,106 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.gbcs.api.Cache
+import net.woggioni.gbcs.server.cache.CacheUtils.digestString
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import java.nio.ByteBuffer
+import java.nio.channels.Channels
+import java.security.MessageDigest
+import java.time.Duration
+import java.time.Instant
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.PriorityBlockingQueue
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicReference
+import java.util.zip.Deflater
+import java.util.zip.DeflaterOutputStream
+import java.util.zip.Inflater
+import java.util.zip.InflaterInputStream
+
+class InMemoryCache(
+    val maxAge: Duration,
+    val digestAlgorithm: String?,
+    val compressionEnabled: Boolean,
+    val compressionLevel: Int
+) : Cache {
+
+    private val map = ConcurrentHashMap<String, MapValue>()
+
+    private class MapValue(val rc: AtomicInteger, val payload : AtomicReference<ByteArray>)
+
+    private class RemovalQueueElement(val key: String, val expiry : Instant) : Comparable<RemovalQueueElement> {
+        override fun compareTo(other: RemovalQueueElement)= expiry.compareTo(other.expiry)
+    }
+
+    private val removalQueue = PriorityBlockingQueue<RemovalQueueElement>()
+
+    private var running = true
+    private val garbageCollector = Thread({
+        while(true) {
+            val el = removalQueue.take()
+            val now = Instant.now()
+            if(now > el.expiry) {
+                val value = map[el.key] ?: continue
+                val rc = value.rc.decrementAndGet()
+                if(rc == 0) {
+                    map.remove(el.key)
+                }
+            } else {
+                removalQueue.put(el)
+                Thread.sleep(minOf(Duration.between(now, el.expiry), Duration.ofSeconds(1)))
+            }
+        }
+    }).apply {
+        start()
+    }
+
+    override fun close() {
+        running = false
+        garbageCollector.join()
+    }
+
+    override fun get(key: String) =
+        (digestAlgorithm
+            ?.let(MessageDigest::getInstance)
+            ?.let { md ->
+                digestString(key.toByteArray(), md)
+            } ?: key
+                ).let { digest ->
+                map[digest]
+                    ?.let(MapValue::payload)
+                    ?.let(AtomicReference<ByteArray>::get)
+                    ?.let { value ->
+                    if (compressionEnabled) {
+                        val inflater = Inflater()
+                        Channels.newChannel(InflaterInputStream(ByteArrayInputStream(value), inflater))
+                    } else {
+                        Channels.newChannel(ByteArrayInputStream(value))
+                    }
+                }
+            }
+
+    override fun put(key: String, content: ByteArray) {
+        (digestAlgorithm
+            ?.let(MessageDigest::getInstance)
+            ?.let { md ->
+                digestString(key.toByteArray(), md)
+            } ?: key).let { digest ->
+            val value = if (compressionEnabled) {
+                val deflater = Deflater(compressionLevel)
+                val baos = ByteArrayOutputStream()
+                DeflaterOutputStream(baos, deflater).use { stream ->
+                    stream.write(content)
+                }
+                baos.toByteArray()
+            } else {
+                content
+            }
+            val mapValue = map.computeIfAbsent(digest) {
+                MapValue(AtomicInteger(0), AtomicReference())
+            }
+            mapValue.payload.set(value)
+            removalQueue.put(RemovalQueueElement(digest, Instant.now().plus(maxAge)))
+        }
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/InMemoryCacheConfiguration.kt

@@ -0,0 +1,23 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.common.GBCS
+import java.time.Duration
+
+data class InMemoryCacheConfiguration(
+    val maxAge: Duration,
+    val digestAlgorithm : String?,
+    val compressionEnabled: Boolean,
+    val compressionLevel: Int,
+) : Configuration.Cache {
+    override fun materialize() = InMemoryCache(
+        maxAge,
+        digestAlgorithm,
+        compressionEnabled,
+        compressionLevel
+    )
+
+    override fun getNamespaceURI() = GBCS.GBCS_NAMESPACE_URI
+
+    override fun getTypeName() = "inMemoryCacheType"
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/cache/InMemoryCacheProvider.kt

@@ -0,0 +1,59 @@
+package net.woggioni.gbcs.server.cache
+
+import net.woggioni.gbcs.api.CacheProvider
+import net.woggioni.gbcs.common.GBCS
+import net.woggioni.gbcs.common.Xml
+import net.woggioni.gbcs.common.Xml.Companion.renderAttribute
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import java.nio.file.Path
+import java.time.Duration
+import java.util.zip.Deflater
+
+class InMemoryCacheProvider : CacheProvider<InMemoryCacheConfiguration> {
+
+    override fun getXmlSchemaLocation() = "classpath:net/woggioni/gbcs/server/schema/gbcs.xsd"
+
+    override fun getXmlType() = "inMemoryCacheType"
+
+    override fun getXmlNamespace() = "urn:net.woggioni.gbcs.server"
+
+    override fun deserialize(el: Element): InMemoryCacheConfiguration {
+        val maxAge = el.renderAttribute("max-age")
+            ?.let(Duration::parse)
+            ?: Duration.ofDays(1)
+        val enableCompression = el.renderAttribute("enable-compression")
+            ?.let(String::toBoolean)
+            ?: true
+        val compressionLevel = el.renderAttribute("compression-level")
+            ?.let(String::toInt)
+            ?: Deflater.DEFAULT_COMPRESSION
+        val digestAlgorithm = el.renderAttribute("digest") ?: "MD5"
+
+        return InMemoryCacheConfiguration(
+            maxAge,
+            digestAlgorithm,
+            enableCompression,
+            compressionLevel
+        )
+    }
+
+    override fun serialize(doc: Document, cache : InMemoryCacheConfiguration) = cache.run {
+        val result = doc.createElement("cache")
+        Xml.of(doc, result) {
+            val prefix = doc.lookupPrefix(GBCS.GBCS_NAMESPACE_URI)
+            attr("xs:type", "${prefix}:inMemoryCacheType", GBCS.XML_SCHEMA_NAMESPACE_URI)
+            attr("max-age", maxAge.toString())
+            digestAlgorithm?.let { digestAlgorithm ->
+                attr("digest", digestAlgorithm)
+            }
+            attr("enable-compression", compressionEnabled.toString())
+            compressionLevel.takeIf {
+                it != Deflater.DEFAULT_COMPRESSION
+            }?.let {
+                attr("compression-level", it.toString())
+            }
+        }
+        result
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/configuration/Parser.kt

@@ -25,7 +25,7 @@ import java.time.temporal.ChronoUnit
 object Parser {
     fun parse(document: Document): Configuration {
         val root = document.documentElement
-        val anonymousUser = User("", null, emptySet())
+        val anonymousUser = User("", null, emptySet(), null)
         var connection: Configuration.Connection = Configuration.Connection(
             Duration.of(10, ChronoUnit.SECONDS),
             Duration.of(10, ChronoUnit.SECONDS),
@@ -85,6 +85,7 @@ object Parser {
                             "users" -> {
                                 knownUsers += parseUsers(gchild)
                             }
+
                             "groups" -> {
                                 val pair = parseGroups(gchild, knownUsers)
                                 users = pair.first
@@ -107,15 +108,15 @@ object Parser {
                         val typeNamespace = tf.typeNamespace
                         val typeName = tf.typeName
                         CacheSerializers.index[typeNamespace to typeName]
-                            ?: throw IllegalArgumentException("Cache provider for namespace '$typeNamespace' not found")
+                            ?: throw IllegalArgumentException("Cache provider for namespace '$typeNamespace' with name '$typeName' not found")
                     }.deserialize(child)
                 }
 
                 "connection" -> {
                     val writeTimeout = child.renderAttribute("write-timeout")
-                        ?.let(Duration::parse) ?: Duration.of(10, ChronoUnit.SECONDS)
+                        ?.let(Duration::parse) ?: Duration.of(0, ChronoUnit.SECONDS)
                     val readTimeout = child.renderAttribute("read-timeout")
-                        ?.let(Duration::parse) ?: Duration.of(10, ChronoUnit.SECONDS)
+                        ?.let(Duration::parse) ?: Duration.of(0, ChronoUnit.SECONDS)
                     val idleTimeout = child.renderAttribute("idle-timeout")
                         ?.let(Duration::parse) ?: Duration.of(30, ChronoUnit.SECONDS)
                     val readIdleTimeout = child.renderAttribute("read-idle-timeout")
@@ -133,16 +134,17 @@ object Parser {
                         maxRequestSize
                     )
                 }
+
                 "event-executor" -> {
                     val useVirtualThread = root.renderAttribute("use-virtual-threads")
                         ?.let(String::toBoolean) ?: true
                     eventExecutor = Configuration.EventExecutor(useVirtualThread)
                 }
+
                 "tls" -> {
-                    val verifyClients = child.renderAttribute("verify-clients")
-                        ?.let(String::toBoolean) ?: false
                     var keyStore: KeyStore? = null
                     var trustStore: TrustStore? = null
+
                     for (granChild in child.asIterable()) {
                         when (granChild.localName) {
                             "keystore" -> {
@@ -164,15 +166,19 @@ object Parser {
                                 val checkCertificateStatus = granChild.renderAttribute("check-certificate-status")
                                     ?.let(String::toBoolean)
                                     ?: false
+                                val requireClientCertificate = child.renderAttribute("require-client-certificate")
+                                    ?.let(String::toBoolean) ?: false
+
                                 trustStore = TrustStore(
                                     trustStoreFile,
                                     trustStorePassword,
-                                    checkCertificateStatus
+                                    checkCertificateStatus,
+                                    requireClientCertificate
                                 )
                             }
                         }
                     }
-                    tls = Tls(keyStore, trustStore, verifyClients)
+                    tls = Tls(keyStore, trustStore)
                 }
             }
         }
@@ -207,13 +213,47 @@ object Parser {
         }
     }
 
+    private fun parseQuota(el: Element): Configuration.Quota {
+        val calls = el.renderAttribute("calls")
+            ?.let(String::toLong)
+            ?: throw ConfigurationException("Missing attribute 'calls'")
+        val maxAvailableCalls = el.renderAttribute("max-available-calls")
+            ?.let(String::toLong)
+            ?: calls
+        val initialAvailableCalls = el.renderAttribute("initial-available-calls")
+            ?.let(String::toLong)
+            ?: maxAvailableCalls
+        val period = el.renderAttribute("period")
+            ?.let(Duration::parse)
+            ?: throw ConfigurationException("Missing attribute 'period'")
+        return Configuration.Quota(calls, period, initialAvailableCalls, maxAvailableCalls)
+    }
+
     private fun parseUsers(root: Element): Sequence<User> {
-        return root.asIterable().asSequence().filter {
+        return root.asIterable().asSequence().mapNotNull { child ->
-            it.localName == "user"
+            when (child.localName) {
-        }.map { el ->
+                "user" -> {
-            val username = el.renderAttribute("name")
+                    val username = child.renderAttribute("name")
-            val password = el.renderAttribute("password")
+                    val password = child.renderAttribute("password")
-            User(username, password, emptySet())
+                    var quota: Configuration.Quota? = null
+                    for (gchild in child.asIterable()) {
+                        if (gchild.localName == "quota") {
+                            quota = parseQuota(gchild)
+                        }
+                    }
+                    User(username, password, emptySet(), quota)
+                }
+                "anonymous" -> {
+                    var quota: Configuration.Quota? = null
+                    for (gchild in child.asIterable()) {
+                        if (gchild.localName == "quota") {
+                            quota= parseQuota(gchild)
+                        }
+                    }
+                    User("", null, emptySet(), quota)
+                }
+                else -> null
+            }
         }
     }
 
@@ -225,6 +265,7 @@ object Parser {
         }.map { el ->
             val groupName = el.renderAttribute("name") ?: throw ConfigurationException("Group name is required")
             var roles = emptySet<Role>()
+            var quota: Configuration.Quota? = null
             for (child in el.asIterable()) {
                 when (child.localName) {
                     "users" -> {
@@ -238,12 +279,15 @@ object Parser {
                     "roles" -> {
                         roles = parseRoles(child)
                     }
+                    "quota" -> {
+                        quota = parseQuota(child)
                     }
                 }
-            groupName to Group(groupName, roles)
+            }
+            groupName to Group(groupName, roles, quota)
         }.toMap()
         val users = knownUsersMap.map { (name, user) ->
-            name to User(name, user.password, userGroups[name]?.mapNotNull { groups[it] }?.toSet() ?: emptySet())
+            name to User(name, user.password, userGroups[name]?.mapNotNull { groups[it] }?.toSet() ?: emptySet(), user.quota)
         }.toMap()
         return users to groups
     }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/configuration/Serializer.kt

@@ -54,6 +54,27 @@ object Serializer {
                                 user.password?.let { password ->
                                     attr("password", password)
                                 }
+                                user.quota?.let { quota ->
+                                    node("quota") {
+                                        attr("calls", quota.calls.toString())
+                                        attr("period", quota.period.toString())
+                                        attr("max-available-calls", quota.maxAvailableCalls.toString())
+                                        attr("initial-available-calls", quota.initialAvailableCalls.toString())
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    conf.users[""]
+                        ?.let { anonymousUser ->
+                            anonymousUser.quota?.let { quota ->
+                                node("anonymous") {
+                                    node("quota") {
+                                        attr("calls", quota.calls.toString())
+                                        attr("period", quota.period.toString())
+                                        attr("max-available-calls", quota.maxAvailableCalls.toString())
+                                        attr("initial-available-calls", quota.initialAvailableCalls.toString())
+                                    }
                                 }
                             }
                         }
@@ -92,6 +113,14 @@ object Serializer {
                                     }
                                 }
                             }
+                            group.quota?.let { quota ->
+                                node("quota") {
+                                    attr("calls", quota.calls.toString())
+                                    attr("period", quota.period.toString())
+                                    attr("max-available-calls", quota.maxAvailableCalls.toString())
+                                    attr("initial-available-calls", quota.initialAvailableCalls.toString())
+                                }
+                            }
                         }
                     }
                 }
@@ -145,6 +174,7 @@ object Serializer {
                                 attr("password", password)
                             }
                             attr("check-certificate-status", trustStore.isCheckCertificateStatus.toString())
+                            attr("require-client-certificate", trustStore.isRequireClientCertificate.toString())
                         }
                     }
                 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/exception/ExceptionHandler.kt

@@ -0,0 +1,92 @@
+package net.woggioni.gbcs.server.exception
+
+import io.netty.buffer.Unpooled
+import io.netty.channel.ChannelDuplexHandler
+import io.netty.channel.ChannelFutureListener
+import io.netty.channel.ChannelHandler
+import io.netty.channel.ChannelHandlerContext
+import io.netty.handler.codec.DecoderException
+import io.netty.handler.codec.http.DefaultFullHttpResponse
+import io.netty.handler.codec.http.FullHttpResponse
+import io.netty.handler.codec.http.HttpHeaderNames
+import io.netty.handler.codec.http.HttpResponseStatus
+import io.netty.handler.codec.http.HttpVersion
+import io.netty.handler.timeout.ReadTimeoutException
+import io.netty.handler.timeout.WriteTimeoutException
+import net.woggioni.gbcs.api.exception.CacheException
+import net.woggioni.gbcs.api.exception.ContentTooLargeException
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.common.debug
+import javax.net.ssl.SSLPeerUnverifiedException
+
+@ChannelHandler.Sharable
+class ExceptionHandler : ChannelDuplexHandler() {
+    private val log = contextLogger()
+
+    private val NOT_AUTHORIZED: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.FORBIDDEN, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    private val TOO_BIG: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.REQUEST_ENTITY_TOO_LARGE, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    private val NOT_AVAILABLE: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.SERVICE_UNAVAILABLE, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    private val SERVER_ERROR: FullHttpResponse = DefaultFullHttpResponse(
+        HttpVersion.HTTP_1_1, HttpResponseStatus.INTERNAL_SERVER_ERROR, Unpooled.EMPTY_BUFFER
+    ).apply {
+        headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
+    }
+
+    override fun exceptionCaught(ctx: ChannelHandlerContext, cause: Throwable) {
+        when (cause) {
+            is DecoderException -> {
+                log.error(cause.message, cause)
+                ctx.close()
+            }
+
+            is SSLPeerUnverifiedException -> {
+                ctx.writeAndFlush(NOT_AUTHORIZED.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+
+            is ContentTooLargeException -> {
+                ctx.writeAndFlush(TOO_BIG.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+            is ReadTimeoutException -> {
+                log.debug {
+                    val channelId = ctx.channel().id().asShortText()
+                    "Read timeout on channel $channelId, closing the connection"
+                }
+                ctx.close()
+            }
+            is WriteTimeoutException -> {
+                log.debug {
+                    val channelId = ctx.channel().id().asShortText()
+                    "Write timeout on channel $channelId, closing the connection"
+                }
+                ctx.close()
+            }
+            is CacheException -> {
+                log.error(cause.message, cause)
+                ctx.writeAndFlush(NOT_AVAILABLE.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+            else -> {
+                log.error(cause.message, cause)
+                ctx.writeAndFlush(SERVER_ERROR.retainedDuplicate())
+                    .addListener(ChannelFutureListener.CLOSE_ON_FAILURE)
+            }
+        }
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/handler/ServerHandler.kt

@@ -15,9 +15,9 @@ import io.netty.handler.codec.http.HttpMethod
 import io.netty.handler.codec.http.HttpResponseStatus
 import io.netty.handler.codec.http.HttpUtil
 import io.netty.handler.codec.http.LastHttpContent
-import io.netty.handler.stream.ChunkedNioFile
 import io.netty.handler.stream.ChunkedNioStream
 import net.woggioni.gbcs.api.Cache
+import net.woggioni.gbcs.api.exception.CacheException
 import net.woggioni.gbcs.common.contextLogger
 import net.woggioni.gbcs.server.debug
 import net.woggioni.gbcs.server.warn
@@ -36,9 +36,18 @@ class ServerHandler(private val cache: Cache, private val serverPrefix: Path) :
         if (method === HttpMethod.GET) {
             val path = Path.of(msg.uri())
             val prefix = path.parent
-            val key = path.fileName.toString()
+            val key = path.fileName?.toString() ?: let {
+                val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.NOT_FOUND)
+                response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
+                ctx.writeAndFlush(response)
+                return
+            }
             if (serverPrefix == prefix) {
-                cache.get(key)?.let { channel ->
+                try {
+                    cache.get(key)
+                } catch(ex : Throwable) {
+                    throw CacheException("Error accessing the cache backend", ex)
+                }?.let { channel ->
                     log.debug(ctx) {
                         "Cache hit for key '$key'"
                     }
@@ -55,17 +64,18 @@ class ServerHandler(private val cache: Cache, private val serverPrefix: Path) :
                     when (channel) {
                         is FileChannel -> {
                             if (keepAlive) {
-                                ctx.write(ChunkedNioFile(channel))
+                                ctx.write(DefaultFileRegion(channel, 0, channel.size()))
-                                ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT)
+                                ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT.retainedDuplicate())
                             } else {
                                 ctx.writeAndFlush(DefaultFileRegion(channel, 0, channel.size()))
                                     .addListener(ChannelFutureListener.CLOSE)
                             }
                         }
-
                         else -> {
-                            ctx.write(ChunkedNioStream(channel))
+                            ctx.write(ChunkedNioStream(channel)).addListener { evt ->
-                            ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT)
+                                channel.close()
+                            }
+                            ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT.retainedDuplicate())
                         }
                     }
                 } ?: let {
@@ -102,7 +112,11 @@ class ServerHandler(private val cache: Cache, private val serverPrefix: Path) :
                         array()
                     }
                 }
+                try {
                     cache.put(key, bodyBytes)
+                } catch(ex : Throwable) {
+                    throw CacheException("Error accessing the cache backend", ex)
+                }
                 val response = DefaultFullHttpResponse(
                     msg.protocolVersion(), HttpResponseStatus.CREATED,
                     Unpooled.copiedBuffer(key.toByteArray())
@@ -117,11 +131,35 @@ class ServerHandler(private val cache: Cache, private val serverPrefix: Path) :
                 response.headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
                 ctx.writeAndFlush(response)
             }
+        } else if(method == HttpMethod.TRACE) {
+            val replayedRequestHead = ctx.alloc().buffer()
+            replayedRequestHead.writeCharSequence("TRACE ${Path.of(msg.uri())} ${msg.protocolVersion().text()}\r\n", Charsets.US_ASCII)
+            msg.headers().forEach { (key, value) ->
+                replayedRequestHead.apply {
+                    writeCharSequence(key, Charsets.US_ASCII)
+                    writeCharSequence(": ", Charsets.US_ASCII)
+                    writeCharSequence(value, Charsets.UTF_8)
+                    writeCharSequence("\r\n", Charsets.US_ASCII)
+                }
+            }
+            replayedRequestHead.writeCharSequence("\r\n", Charsets.US_ASCII)
+            val requestBody = msg.content()
+            requestBody.retain()
+            val responseBody = ctx.alloc().compositeBuffer(2).apply {
+                addComponents(true, replayedRequestHead)
+                addComponents(true, requestBody)
+            }
+            val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.OK, responseBody)
+            response.headers().apply {
+                set(HttpHeaderNames.CONTENT_TYPE, "message/http")
+                set(HttpHeaderNames.CONTENT_LENGTH, responseBody.readableBytes())
+            }
+            ctx.writeAndFlush(response)
         } else {
             log.warn(ctx) {
                 "Got request with unhandled method '${msg.method().name()}'"
             }
-            val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.BAD_REQUEST)
+            val response = DefaultFullHttpResponse(msg.protocolVersion(), HttpResponseStatus.METHOD_NOT_ALLOWED)
             response.headers()[HttpHeaderNames.CONTENT_LENGTH] = "0"
             ctx.writeAndFlush(response)
         }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/throttling/BucketManager.kt

@@ -0,0 +1,86 @@
+package net.woggioni.gbcs.server.throttling
+
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.jwo.Bucket
+import java.net.InetSocketAddress
+import java.util.Arrays
+import java.util.concurrent.ConcurrentHashMap
+import java.util.function.Function
+
+class BucketManager private constructor(
+    private val bucketsByUser: Map<Configuration.User, Bucket> = HashMap(),
+    private val bucketsByGroup: Map<Configuration.Group, Bucket> = HashMap(),
+    loader: Function<InetSocketAddress, Bucket>?
+) {
+
+    private class BucketsByAddress(
+        private val map: MutableMap<ByteArrayKey, Bucket>,
+        private val loader: Function<InetSocketAddress, Bucket>
+    ) {
+        fun getBucket(socketAddress : InetSocketAddress) = map.computeIfAbsent(ByteArrayKey(socketAddress.address.address))  {
+            loader.apply(socketAddress)
+        }
+    }
+
+    private val bucketsByAddress: BucketsByAddress? = loader?.let {
+        BucketsByAddress(ConcurrentHashMap(), it)
+    }
+
+    private class ByteArrayKey(val array: ByteArray) {
+        override fun equals(other: Any?) = (other as? ByteArrayKey)?.let { bak ->
+            array contentEquals bak.array
+        } ?: false
+
+        override fun hashCode() = Arrays.hashCode(array)
+    }
+
+    fun getBucketByAddress(address : InetSocketAddress) : Bucket? {
+        return bucketsByAddress?.getBucket(address)
+    }
+
+    fun getBucketByUser(user : Configuration.User) = bucketsByUser[user]
+    fun getBucketByGroup(group : Configuration.Group) = bucketsByGroup[group]
+
+    companion object {
+        fun from(cfg : Configuration) : BucketManager {
+            val bucketsByUser = cfg.users.values.asSequence().filter {
+                it.quota != null
+            }.map { user ->
+                val quota = user.quota
+                val bucket = Bucket.local(
+                    quota.maxAvailableCalls,
+                    quota.calls,
+                    quota.period,
+                    quota.initialAvailableCalls
+                )
+                user to bucket
+            }.toMap()
+            val bucketsByGroup = cfg.groups.values.asSequence().filter {
+                it.quota != null
+            }.map { group ->
+                val quota = group.quota
+                val bucket = Bucket.local(
+                    quota.maxAvailableCalls,
+                    quota.calls,
+                    quota.period,
+                    quota.initialAvailableCalls
+                )
+                group to bucket
+            }.toMap()
+            return BucketManager(
+                bucketsByUser,
+                bucketsByGroup,
+                cfg.users[""]?.quota?.let { anonymousUserQuota ->
+                    Function {
+                        Bucket.local(
+                            anonymousUserQuota.maxAvailableCalls,
+                            anonymousUserQuota.calls,
+                            anonymousUserQuota.period,
+                            anonymousUserQuota.initialAvailableCalls
+                        )
+                    }
+                }
+            )
+        }
+    }
+}

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/throttling/ThrottlingHandler.kt

@@ -0,0 +1,99 @@
+package net.woggioni.gbcs.server.throttling
+
+import io.netty.channel.ChannelHandler.Sharable
+import io.netty.channel.ChannelHandlerContext
+import io.netty.channel.ChannelInboundHandlerAdapter
+import io.netty.handler.codec.http.DefaultFullHttpResponse
+import io.netty.handler.codec.http.HttpHeaderNames
+import io.netty.handler.codec.http.HttpResponseStatus
+import io.netty.handler.codec.http.HttpVersion
+import net.woggioni.gbcs.api.Configuration
+import net.woggioni.gbcs.common.contextLogger
+import net.woggioni.gbcs.server.GradleBuildCacheServer
+import net.woggioni.jwo.Bucket
+import net.woggioni.jwo.LongMath
+import java.net.InetSocketAddress
+import java.time.Duration
+import java.time.temporal.ChronoUnit
+import java.util.concurrent.TimeUnit
+
+
+@Sharable
+class ThrottlingHandler(cfg: Configuration) :
+    ChannelInboundHandlerAdapter() {
+
+    private val log = contextLogger()
+    private val bucketManager = BucketManager.from(cfg)
+
+    private val connectionConfiguration = cfg.connection
+
+    /**
+     * If the suggested waiting time from the bucket is lower than this
+     * amount, then the server will simply wait by itself before sending a response
+     * instead of replying with 429
+     */
+    private val waitThreshold = minOf(
+        connectionConfiguration.idleTimeout,
+        connectionConfiguration.readIdleTimeout,
+        connectionConfiguration.writeIdleTimeout
+    ).dividedBy(2)
+
+    override fun channelRead(ctx: ChannelHandlerContext, msg: Any) {
+        val buckets = mutableListOf<Bucket>()
+        val user = ctx.channel().attr(GradleBuildCacheServer.userAttribute).get()
+        if (user != null) {
+            bucketManager.getBucketByUser(user)?.let(buckets::add)
+        }
+        val groups = ctx.channel().attr(GradleBuildCacheServer.groupAttribute).get() ?: emptySet()
+        if (groups.isNotEmpty()) {
+            groups.forEach { group ->
+                bucketManager.getBucketByGroup(group)?.let(buckets::add)
+            }
+        }
+        if (user == null && groups.isEmpty()) {
+            bucketManager.getBucketByAddress(ctx.channel().remoteAddress() as InetSocketAddress)?.let(buckets::add)
+        }
+        if (buckets.isEmpty()) {
+            return super.channelRead(ctx, msg)
+        } else {
+            handleBuckets(buckets, ctx, msg, true)
+        }
+    }
+
+    private fun handleBuckets(buckets : List<Bucket>, ctx : ChannelHandlerContext, msg : Any, delayResponse : Boolean) {
+        var nextAttempt = -1L
+        for (bucket in buckets) {
+            val bucketNextAttempt = bucket.removeTokensWithEstimate(1)
+            if (bucketNextAttempt > nextAttempt) {
+                nextAttempt = bucketNextAttempt
+            }
+        }
+        if(nextAttempt < 0) {
+            super.channelRead(ctx, msg)
+            return
+        }
+        val waitDuration = Duration.of(LongMath.ceilDiv(nextAttempt, 100_000_000L) * 100L, ChronoUnit.MILLIS)
+        if (delayResponse && waitDuration < waitThreshold) {
+            ctx.executor().schedule({
+                handleBuckets(buckets, ctx, msg, false)
+            }, waitDuration.toMillis(), TimeUnit.MILLISECONDS)
+        } else {
+            sendThrottledResponse(ctx, waitDuration)
+        }
+    }
+
+    private fun sendThrottledResponse(ctx: ChannelHandlerContext, retryAfter: Duration) {
+        val response = DefaultFullHttpResponse(
+            HttpVersion.HTTP_1_1,
+            HttpResponseStatus.TOO_MANY_REQUESTS
+        )
+        response.headers()[HttpHeaderNames.CONTENT_LENGTH] = 0
+        retryAfter.seconds.takeIf {
+            it > 0
+        }?.let {
+            response.headers()[HttpHeaderNames.RETRY_AFTER] = retryAfter.seconds
+        }
+
+        ctx.writeAndFlush(response)
+    }
+}

gbcs-server/src/main/resources/META-INF/services/net.woggioni.gbcs.api.CacheProvider

@@ -1 +1,2 @@
 net.woggioni.gbcs.server.cache.FileSystemCacheProvider
+net.woggioni.gbcs.server.cache.InMemoryCacheProvider

gbcs-server/src/main/resources/net/woggioni/gbcs/server/schema/gbcs.xsd

@@ -34,8 +34,8 @@
     </xs:complexType>
 
     <xs:complexType name="connectionType">
-        <xs:attribute name="read-timeout" type="xs:duration" use="optional" default="PT10S"/>
+        <xs:attribute name="read-timeout" type="xs:duration" use="optional" default="PT0S"/>
-        <xs:attribute name="write-timeout" type="xs:duration" use="optional" default="PT10S"/>
+        <xs:attribute name="write-timeout" type="xs:duration" use="optional" default="PT0S"/>
         <xs:attribute name="idle-timeout" type="xs:duration" use="optional" default="PT30S"/>
         <xs:attribute name="read-idle-timeout" type="xs:duration" use="optional" default="PT60S"/>
         <xs:attribute name="write-idle-timeout" type="xs:duration" use="optional" default="PT60S"/>
@@ -48,6 +48,17 @@
 
     <xs:complexType name="cacheType" abstract="true"/>
 
+    <xs:complexType name="inMemoryCacheType">
+        <xs:complexContent>
+            <xs:extension base="gbcs:cacheType">
+                <xs:attribute name="max-age" type="xs:duration" default="P1D"/>
+                <xs:attribute name="digest" type="xs:token" default="MD5"/>
+                <xs:attribute name="enable-compression" type="xs:boolean" default="true"/>
+                <xs:attribute name="compression-level" type="xs:byte" default="-1"/>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+
     <xs:complexType name="fileSystemCacheType">
         <xs:complexContent>
             <xs:extension base="gbcs:cacheType">
@@ -92,17 +103,34 @@
         </xs:choice>
     </xs:complexType>
 
-    <xs:complexType name="usersType">
+    <xs:complexType name="quotaType">
+        <xs:attribute name="calls" type="xs:positiveInteger" use="required"/>
+        <xs:attribute name="period" type="xs:duration" use="required"/>
+        <xs:attribute name="max-available-calls" type="xs:positiveInteger" use="optional"/>
+        <xs:attribute name="initial-available-calls" type="xs:unsignedInt" use="optional"/>
+    </xs:complexType>
+
+    <xs:complexType name="anonymousUserType">
         <xs:sequence>
-            <xs:element name="user" type="gbcs:userType" minOccurs="0" maxOccurs="unbounded"/>
+            <xs:element name="quota" type="gbcs:quotaType" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
     </xs:complexType>
 
     <xs:complexType name="userType">
+        <xs:sequence>
+            <xs:element name="quota" type="gbcs:quotaType" minOccurs="0" maxOccurs="1"/>
+        </xs:sequence>
         <xs:attribute name="name" type="xs:token" use="required"/>
         <xs:attribute name="password" type="xs:string" use="optional"/>
     </xs:complexType>
 
+    <xs:complexType name="usersType">
+        <xs:sequence>
+            <xs:element name="user" type="gbcs:userType" minOccurs="0" maxOccurs="unbounded"/>
+            <xs:element name="anonymous" type="gbcs:anonymousUserType" minOccurs="0" maxOccurs="1"/>
+        </xs:sequence>
+    </xs:complexType>
+
     <xs:complexType name="groupsType">
         <xs:sequence>
             <xs:element name="group" type="gbcs:groupType" maxOccurs="unbounded" minOccurs="0"/>
@@ -118,6 +146,7 @@
                 </xs:unique>
             </xs:element>
             <xs:element name="roles" type="gbcs:rolesType" maxOccurs="1" minOccurs="0"/>
+            <xs:element name="quota" type="gbcs:quotaType" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
         <xs:attribute name="name" type="xs:token"/>
     </xs:complexType>
@@ -154,7 +183,6 @@
             <xs:element name="keystore" type="gbcs:keyStoreType" />
             <xs:element name="truststore" type="gbcs:trustStoreType" minOccurs="0"/>
         </xs:all>
-        <xs:attribute name="verify-clients" type="xs:boolean" use="optional"/>
     </xs:complexType>
 
     <xs:complexType name="keyStoreType">
@@ -168,6 +196,7 @@
         <xs:attribute name="file" type="xs:string" use="required"/>
         <xs:attribute name="password" type="xs:string"/>
         <xs:attribute name="check-certificate-status" type="xs:boolean"/>
+        <xs:attribute name="require-client-certificate" type="xs:boolean" use="optional" default="false"/>
     </xs:complexType>
 
     <xs:complexType name="propertiesType">

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/AbstractBasicAuthServerTest.kt

@@ -24,8 +24,8 @@ abstract class AbstractBasicAuthServerTest : AbstractServerTest() {
     protected val random = Random(101325)
     protected val keyValuePair = newEntry(random)
     protected val serverPath = "gbcs"
-    protected val readersGroup = Configuration.Group("readers", setOf(Role.Reader))
+    protected val readersGroup = Configuration.Group("readers", setOf(Role.Reader), null)
-    protected val writersGroup = Configuration.Group("writers", setOf(Role.Writer))
+    protected val writersGroup = Configuration.Group("writers", setOf(Role.Writer), null)
 
     abstract protected val users : List<Configuration.User>
 

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/AbstractTlsServerTest.kt

@@ -4,6 +4,7 @@ import net.woggioni.gbcs.api.Configuration
 import net.woggioni.gbcs.api.Role
 import net.woggioni.gbcs.common.Xml
 import net.woggioni.gbcs.server.cache.FileSystemCacheConfiguration
+import net.woggioni.gbcs.server.cache.InMemoryCacheConfiguration
 import net.woggioni.gbcs.server.configuration.Serializer
 import net.woggioni.gbcs.server.test.utils.CertificateUtils
 import net.woggioni.gbcs.server.test.utils.CertificateUtils.X509Credentials
@@ -45,8 +46,8 @@ abstract class AbstractTlsServerTest : AbstractServerTest() {
     private lateinit var trustStore: KeyStore
     protected lateinit var ca: X509Credentials
 
-    protected val readersGroup = Configuration.Group("readers", setOf(Role.Reader))
+    protected val readersGroup = Configuration.Group("readers", setOf(Role.Reader), null)
-    protected val writersGroup = Configuration.Group("writers", setOf(Role.Writer))
+    protected val writersGroup = Configuration.Group("writers", setOf(Role.Writer), null)
     protected val random = Random(101325)
     protected val keyValuePair = newEntry(random)
     private val serverPath : String? = null
@@ -158,15 +159,20 @@ abstract class AbstractTlsServerTest : AbstractServerTest() {
                 compressionLevel = Deflater.DEFAULT_COMPRESSION,
                 digestAlgorithm = "MD5"
             ),
+//            InMemoryCacheConfiguration(
+//                maxAge = Duration.ofSeconds(3600 * 24),
+//                compressionEnabled = true,
+//                compressionLevel = Deflater.DEFAULT_COMPRESSION,
+//                digestAlgorithm = "MD5"
+//            ),
             Configuration.ClientCertificateAuthentication(
                 Configuration.TlsCertificateExtractor("CN", "(.*)"),
                 null
             ),
             Configuration.Tls(
                 Configuration.KeyStore(this.serverKeyStoreFile, null, SERVER_CERTIFICATE_ENTRY, PASSWORD),
-                Configuration.TrustStore(this.trustStoreFile, null, false),
+                Configuration.TrustStore(this.trustStoreFile, null, false, false),
-                true
+            )
-            ),
         )
         Xml.write(Serializer.serialize(cfg), System.out)
     }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/BasicAuthServerTest.kt

@@ -10,6 +10,8 @@ import org.junit.jupiter.api.Test
 import java.net.http.HttpClient
 import java.net.http.HttpRequest
 import java.net.http.HttpResponse
+import java.time.Duration
+import java.time.temporal.ChronoUnit
 
 
 class BasicAuthServerTest : AbstractBasicAuthServerTest() {
@@ -19,10 +21,16 @@ class BasicAuthServerTest : AbstractBasicAuthServerTest() {
     }
 
     override val users = listOf(
-        Configuration.User("user1", hashPassword(PASSWORD), setOf(readersGroup)),
+        Configuration.User("user1", hashPassword(PASSWORD), setOf(readersGroup), null),
-        Configuration.User("user2", hashPassword(PASSWORD), setOf(writersGroup)),
+        Configuration.User("user2", hashPassword(PASSWORD), setOf(writersGroup), null),
-        Configuration.User("user3", hashPassword(PASSWORD), setOf(readersGroup, writersGroup)),
+        Configuration.User("user3", hashPassword(PASSWORD), setOf(readersGroup, writersGroup), null),
-        Configuration.User("", null, setOf(readersGroup))
+        Configuration.User("", null, setOf(readersGroup), null),
+        Configuration.User("user4", hashPassword(PASSWORD), setOf(readersGroup),
+            Configuration.Quota(1, Duration.of(1, ChronoUnit.DAYS), 0, 1)
+        ),
+        Configuration.User("user5", hashPassword(PASSWORD), setOf(readersGroup),
+            Configuration.Quota(1, Duration.of(5, ChronoUnit.SECONDS), 0, 1)
+        )
     )
 
     @Test
@@ -144,4 +152,41 @@ class BasicAuthServerTest : AbstractBasicAuthServerTest() {
         val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
         Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
     }
+
+    @Test
+    @Order(6)
+    fun getAsAThrottledUser() {
+        val client: HttpClient = HttpClient.newHttpClient()
+
+        val (key, value) = keyValuePair
+        val user = cfg.users.values.find {
+            it.name == "user4"
+        } ?: throw RuntimeException("user4 not found")
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.TOO_MANY_REQUESTS.code(), response.statusCode())
+    }
+
+    @Test
+    @Order(7)
+    fun getAsAThrottledUser2() {
+        val client: HttpClient = HttpClient.newHttpClient()
+
+        val (key, value) = keyValuePair
+        val user = cfg.users.values.find {
+            it.name == "user5"
+        } ?: throw RuntimeException("user5 not found")
+
+        val requestBuilder = newRequestBuilder(key)
+            .header("Authorization", buildAuthorizationHeader(user, PASSWORD))
+            .GET()
+
+        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        Assertions.assertArrayEquals(value, response.body())
+    }
 }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/ConfigurationTest.kt

@@ -9,6 +9,7 @@ import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.io.TempDir
 import org.junit.jupiter.params.ParameterizedTest
 import org.junit.jupiter.params.provider.ValueSource
+import org.xml.sax.SAXParseException
 import java.nio.file.Files
 import java.nio.file.Path
 
@@ -16,9 +17,10 @@ class ConfigurationTest {
 
     @ValueSource(
         strings = [
-            "classpath:net/woggioni/gbcs/server/test/gbcs-default.xml",
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-default.xml",
-            "classpath:net/woggioni/gbcs/server/test/gbcs-memcached.xml",
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-memcached.xml",
-            "classpath:net/woggioni/gbcs/server/test/gbcs-tls.xml",
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-tls.xml",
+            "classpath:net/woggioni/gbcs/server/test/valid/gbcs-memcached-tls.xml",
         ]
     )
     @ParameterizedTest
@@ -35,4 +37,20 @@ class ConfigurationTest {
         val parsed = Parser.parse(Xml.parseXml(configFile.toUri().toURL()))
         Assertions.assertEquals(cfg, parsed)
     }
+
+    @ValueSource(
+        strings = [
+            "classpath:net/woggioni/gbcs/server/test/invalid/invalid-user-ref.xml",
+            "classpath:net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user.xml",
+            "classpath:net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user2.xml",
+            "classpath:net/woggioni/gbcs/server/test/invalid/multiple-user-quota.xml",
+        ]
+    )
+    @ParameterizedTest
+    fun invalidConfigurationTest(configurationUrl: String) {
+        GbcsUrlStreamHandlerFactory.install()
+        Assertions.assertThrows(SAXParseException::class.java) {
+            Xml.parseXml(configurationUrl.toUrl())
+        }
+    }
 }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/NoAnonymousUserBasicAuthServerTest.kt

@@ -18,9 +18,9 @@ class NoAnonymousUserBasicAuthServerTest : AbstractBasicAuthServerTest() {
     }
 
     override val users = listOf(
-        Configuration.User("user1", hashPassword(PASSWORD), setOf(readersGroup)),
+        Configuration.User("user1", hashPassword(PASSWORD), setOf(readersGroup), null),
-        Configuration.User("user2", hashPassword(PASSWORD), setOf(writersGroup)),
+        Configuration.User("user2", hashPassword(PASSWORD), setOf(writersGroup), null),
-        Configuration.User("user3", hashPassword(PASSWORD), setOf(readersGroup, writersGroup)),
+        Configuration.User("user3", hashPassword(PASSWORD), setOf(readersGroup, writersGroup), null),
     )
 
     @Test

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/NoAnonymousUserTlsServerTest.kt

@@ -12,9 +12,9 @@ import java.net.http.HttpResponse
 class NoAnonymousUserTlsServerTest : AbstractTlsServerTest() {
 
     override val users = listOf(
-        Configuration.User("user1", null, setOf(readersGroup)),
+        Configuration.User("user1", null, setOf(readersGroup), null),
-        Configuration.User("user2", null, setOf(writersGroup)),
+        Configuration.User("user2", null, setOf(writersGroup), null),
-        Configuration.User("user3", null, setOf(readersGroup, writersGroup)),
+        Configuration.User("user3", null, setOf(readersGroup, writersGroup), null),
     )
 
     @Test

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/NoAuthServerTest.kt

@@ -4,6 +4,7 @@ import io.netty.handler.codec.http.HttpResponseStatus
 import net.woggioni.gbcs.api.Configuration
 import net.woggioni.gbcs.common.Xml
 import net.woggioni.gbcs.server.cache.FileSystemCacheConfiguration
+import net.woggioni.gbcs.server.cache.InMemoryCacheConfiguration
 import net.woggioni.gbcs.server.configuration.Serializer
 import net.woggioni.gbcs.server.test.utils.NetworkUtils
 import org.junit.jupiter.api.Assertions
@@ -47,8 +48,7 @@ class NoAuthServerTest : AbstractServerTest() {
             ),
             emptyMap(),
             emptyMap(),
-            FileSystemCacheConfiguration(
+            InMemoryCacheConfiguration(
-                this.cacheDir,
                 maxAge = Duration.ofSeconds(3600 * 24),
                 compressionEnabled = true,
                 digestAlgorithm = "MD5",
@@ -98,7 +98,8 @@ class NoAuthServerTest : AbstractServerTest() {
         val (key, value) = keyValuePair
         val requestBuilder = newRequestBuilder(key)
             .GET()
-        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
         Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
         Assertions.assertArrayEquals(value, response.body())
     }
@@ -111,31 +112,23 @@ class NoAuthServerTest : AbstractServerTest() {
         val (key, _) = newEntry(random)
         val requestBuilder = newRequestBuilder(key).GET()
 
-        val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
         Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
     }
 
-//    @Test
+    @Test
-//    @Order(4)
+    @Order(4)
-//    fun manyRequestsTest() {
+    fun traceTest() {
-//        val client: HttpClient = HttpClient.newHttpClient()
+        val client: HttpClient = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).build()
-//
+        val requestBuilder = newRequestBuilder("").method(
-//        for(i in 0 until 100000) {
+            "TRACE",
-//
+            HttpRequest.BodyPublishers.ofByteArray("sfgsdgfaiousfiuhsd".toByteArray())
-//            val newEntry = random.nextBoolean()
+        )
-//            val (key, _) = if(newEntry) {
+
-//                newEntry(random)
+        val response: HttpResponse<ByteArray> =
-//            } else {
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
-//                keyValuePair
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
-//            }
+        println(String(response.body()))
-//            val requestBuilder = newRequestBuilder(key).GET()
+    }
-//
-//            val response: HttpResponse<ByteArray> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
-//            if(newEntry) {
-//                Assertions.assertEquals(HttpResponseStatus.NOT_FOUND.code(), response.statusCode())
-//            } else {
-//                Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
-//            }
-//        }
-//    }
 }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/TlsServerTest.kt

@@ -7,6 +7,7 @@ import org.bouncycastle.asn1.x500.X500Name
 import org.junit.jupiter.api.Assertions
 import org.junit.jupiter.api.Order
 import org.junit.jupiter.api.Test
+import org.junit.jupiter.params.provider.ArgumentsSource
 import java.net.http.HttpClient
 import java.net.http.HttpRequest
 import java.net.http.HttpResponse
@@ -15,10 +16,10 @@ import java.net.http.HttpResponse
 class TlsServerTest : AbstractTlsServerTest() {
 
     override val users = listOf(
-        Configuration.User("user1", null, setOf(readersGroup)),
+        Configuration.User("user1", null, setOf(readersGroup), null),
-        Configuration.User("user2", null, setOf(writersGroup)),
+        Configuration.User("user2", null, setOf(writersGroup), null),
-        Configuration.User("user3", null, setOf(readersGroup, writersGroup)),
+        Configuration.User("user3", null, setOf(readersGroup, writersGroup), null),
-        Configuration.User("", null, setOf(readersGroup))
+        Configuration.User("", null, setOf(readersGroup), null)
     )
 
     @Test
@@ -133,4 +134,19 @@ class TlsServerTest : AbstractTlsServerTest() {
         val response: HttpResponse<String> = client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofString())
         Assertions.assertEquals(HttpResponseStatus.FORBIDDEN.code(), response.statusCode())
     }
+
+    @Test
+    @Order(8)
+    fun traceAsAnonymousUser() {
+        val client: HttpClient = getHttpClient(null)
+        val requestBuilder = newRequestBuilder("").method(
+            "TRACE",
+            HttpRequest.BodyPublishers.ofByteArray("sfgsdgfaiousfiuhsd".toByteArray())
+        )
+
+        val response: HttpResponse<ByteArray> =
+            client.send(requestBuilder.build(), HttpResponse.BodyHandlers.ofByteArray())
+        Assertions.assertEquals(HttpResponseStatus.OK.code(), response.statusCode())
+        println(String(response.body()))
+    }
 }

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
+    <bind host="127.0.0.1" port="11443"/>
+    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <authorization>
+        <users>
+            <user name="user1" password="password1"/>
+            <user name="user2" password="password2"/>
+            <anonymous>
+                <quota calls="10" period="P3D"/>
+            </anonymous>
+            <anonymous>
+                <quota calls="15" period="P3D"/>
+            </anonymous>
+        </users>
+    </authorization>
+</gbcs:server>

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/invalid/duplicate-anonymous-user2.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
+    <bind host="127.0.0.1" port="11443"/>
+    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <authorization>
+        <users>
+            <user name="user1" password="password1"/>
+            <user name="user2" password="password2"/>
+        </users>
+        <groups>
+            <group name="group1">
+                <users>
+                    <anonymous/>
+                    <user ref="user1"/>
+                    <anonymous/>
+                </users>
+                <roles>
+                    <reader/>
+                </roles>
+            </group>
+        </groups>
+    </authorization>
+</gbcs:server>

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/invalid/invalid-user-ref.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
+    <bind host="127.0.0.1" port="11443"/>
+    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <authorization>
+        <users>
+            <user name="user1" password="password1"/>
+            <user name="user2" password="password2"/>
+        </users>
+        <groups>
+            <group name="readers">
+                <users>
+                    <user ref="user1"/>
+                    <user ref="user5"/>
+                </users>
+                <roles>
+                    <reader/>
+                </roles>
+            </group>
+        </groups>
+    </authorization>
+</gbcs:server>

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/invalid/multiple-user-quota.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
+    <bind host="127.0.0.1" port="11443"/>
+    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <authorization>
+        <users>
+            <user name="user1" password="password1">
+                <quota calls="10" period="PT20S"/>
+                <quota calls="20" period="PT20S"/>
+            </user>
+        </users>
+    </authorization>
+</gbcs:server>

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/valid/gbcs-memcached-tls.xml

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<gbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+             xmlns:gbcs="urn:net.woggioni.gbcs.server"
+             xmlns:gbcs-memcached="urn:net.woggioni.gbcs.server.memcached"
+             xs:schemaLocation="urn:net.woggioni.gbcs.server.memcached jpms://net.woggioni.gbcs.server.memcached/net/woggioni/gbcs/server/memcached/schema/gbcs-memcached.xsd urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd"
+>
+    <bind host="0.0.0.0" port="8443" incoming-connections-backlog-size="4096"/>
+    <connection
+            max-request-size="67108864"
+            idle-timeout="PT30S"
+            read-idle-timeout="PT60S"
+            write-idle-timeout="PT60S"
+            read-timeout="PT5M"
+            write-timeout="PT5M"/>
+    <event-executor use-virtual-threads="true"/>
+    <cache xs:type="gbcs-memcached:memcachedCacheType" max-age="P7D" max-size="16777216" compression-mode="zip">
+        <server host="memcached" port="11211"/>
+    </cache>
+    <authorization>
+        <users>
+            <user name="woggioni">
+                <quota calls="1000" period="PT1S"/>
+            </user>
+            <user name="gitea">
+                <quota calls="10" period="PT1S" initial-available-calls="100" max-available-calls="100"/>
+            </user>
+            <anonymous>
+                <quota calls="2" period="PT5S"/>
+            </anonymous>
+        </users>
+        <groups>
+            <group name="writers">
+                <users>
+                    <user ref="woggioni"/>
+                    <user ref="gitea"/>
+                </users>
+                <roles>
+                    <reader/>
+                    <writer/>
+                </roles>
+            </group>
+        </groups>
+    </authorization>
+    <authentication>
+        <client-certificate>
+            <user-extractor attribute-name="CN" pattern="(.*)"/>
+        </client-certificate>
+    </authentication>
+    <tls>
+        <keystore file="/home/luser/ssl/gbcs.woggioni.net.pfx" key-alias="gbcs.woggioni.net" password="KEYSTORE_PASSWOR" key-password="KEY_PASSWORD"/>
+        <truststore file="/home/luser/ssl/woggioni.net.pfx" check-certificate-status="false" password="TRUSTSTORE_PASSWORD"/>
+    </tls>
+</gbcs:server>

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/valid/gbcs-tls.xml

@@ -11,23 +11,28 @@
             idle-timeout="PT30M"
             max-request-size="4096"/>
     <event-executor use-virtual-threads="false"/>
-    <cache xs:type="gbcs:fileSystemCacheType" path="/tmp/gbcs" max-age="P7D"/>
+    <cache xs:type="gbcs:inMemoryCacheType" max-age="P7D"/>
     <authorization>
         <users>
-            <user name="user1" password="password1"/>
+            <user name="user1" password="password1">
+                <quota calls="3600" period="PT1H"/>
+            </user>
             <user name="user2" password="password2"/>
             <user name="user3" password="password3"/>
+            <anonymous>
+                <quota calls="10" period="PT1M"/>
+            </anonymous>
         </users>
         <groups>
             <group name="readers">
                 <users>
                     <user ref="user1"/>
-<!--                    <user ref="user5"/>-->
                     <anonymous/>
                 </users>
                 <roles>
                     <reader/>
                 </roles>
+                <quota calls="10" period="PT1S"/>
             </group>
             <group name="writers">
                 <users>
@@ -45,6 +50,7 @@
                     <reader/>
                     <writer/>
                 </roles>
+                <quota calls="1000" period="P1D"/>
             </group>
         </groups>
     </authorization>
@@ -56,6 +62,6 @@
     </authentication>
     <tls>
         <keystore file="keystore.pfx" key-alias="key1" password="password" key-password="key-password"/>
-        <truststore file="truststore.pfx" password="password" check-certificate-status="true" />
+        <truststore file="truststore.pfx" password="password" check-certificate-status="true" require-client-certificate="true"/>
     </tls>
 </gbcs:server>

gradle.properties

@@ -2,9 +2,9 @@ org.gradle.configuration-cache=false
 org.gradle.parallel=true
 org.gradle.caching=true
 
-gbcs.version = 0.0.8
+gbcs.version = 0.0.11
 
-lys.version = 2025.01.17
+lys.version = 2025.01.25
 
 gitea.maven.url = https://gitea.woggioni.net/api/packages/woggioni/maven
 docker.registry.url=gitea.woggioni.net

settings.gradle

@@ -1,6 +1,5 @@
 pluginManagement {
     repositories {
-        mavenLocal()
         maven {
             url = getProperty('gitea.maven.url')
         }