fix: harden frontdoor and usage ingestion

apps/aether-gateway/src/state/app.rs

@@ -23,6 +23,17 @@ use super::{
     LocalProviderDeleteTaskState, ProviderTransportSnapshotCacheKey,
 };
 
+const DEFAULT_REQUEST_BODY_READ_TIMEOUT_MS: u64 = 120_000;
+const MIN_REQUEST_BODY_READ_TIMEOUT_MS: u64 = 1_000;
+const MAX_REQUEST_BODY_READ_TIMEOUT_MS: u64 = 600_000;
+const REQUEST_BODY_READ_TIMEOUT_MS_ENV: &str = "AETHER_GATEWAY_REQUEST_BODY_READ_TIMEOUT_MS";
+
+const DEFAULT_LOCAL_EXECUTION_PLANNING_TIMEOUT_MS: u64 = 30_000;
+const MIN_LOCAL_EXECUTION_PLANNING_TIMEOUT_MS: u64 = 500;
+const MAX_LOCAL_EXECUTION_PLANNING_TIMEOUT_MS: u64 = 120_000;
+const LOCAL_EXECUTION_PLANNING_TIMEOUT_MS_ENV: &str =
+    "AETHER_GATEWAY_LOCAL_EXECUTION_PLANNING_TIMEOUT_MS";
+
 #[cfg(test)]
 type TestExecutionRuntimeSyncOverrideFn = dyn Fn(
         &aether_contracts::ExecutionPlan,
@@ -43,6 +54,52 @@ impl std::fmt::Debug for TestExecutionRuntimeSyncOverride {
     }
 }
 
+#[derive(Debug, Clone)]
+pub(crate) struct FrontdoorRuntimeGuardConfig {
+    pub(crate) request_body_read_timeout: Duration,
+    pub(crate) local_execution_planning_timeout: Duration,
+}
+
+impl FrontdoorRuntimeGuardConfig {
+    pub(crate) fn from_env() -> Self {
+        Self {
+            request_body_read_timeout: env_duration_ms(
+                REQUEST_BODY_READ_TIMEOUT_MS_ENV,
+                DEFAULT_REQUEST_BODY_READ_TIMEOUT_MS,
+                MIN_REQUEST_BODY_READ_TIMEOUT_MS,
+                MAX_REQUEST_BODY_READ_TIMEOUT_MS,
+            ),
+            local_execution_planning_timeout: env_duration_ms(
+                LOCAL_EXECUTION_PLANNING_TIMEOUT_MS_ENV,
+                DEFAULT_LOCAL_EXECUTION_PLANNING_TIMEOUT_MS,
+                MIN_LOCAL_EXECUTION_PLANNING_TIMEOUT_MS,
+                MAX_LOCAL_EXECUTION_PLANNING_TIMEOUT_MS,
+            ),
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn for_tests(
+        request_body_read_timeout: Duration,
+        local_execution_planning_timeout: Duration,
+    ) -> Self {
+        Self {
+            request_body_read_timeout,
+            local_execution_planning_timeout,
+        }
+    }
+}
+
+fn env_duration_ms(key: &str, default_ms: u64, min_ms: u64, max_ms: u64) -> Duration {
+    let ms = std::env::var(key)
+        .ok()
+        .and_then(|value| value.trim().parse::<u64>().ok())
+        .filter(|value| *value > 0)
+        .unwrap_or(default_ms)
+        .clamp(min_ms, max_ms);
+    Duration::from_millis(ms)
+}
+
 #[derive(Debug, Clone)]
 pub struct AppState {
     #[cfg(test)]
@@ -54,6 +111,7 @@ pub struct AppState {
     pub(crate) usage_runtime: Arc<usage::UsageRuntime>,
     pub(crate) video_tasks: Arc<VideoTaskService>,
     pub(crate) video_task_poller: Option<VideoTaskPollerConfig>,
+    pub(crate) frontdoor_runtime_guards: Arc<FrontdoorRuntimeGuardConfig>,
     pub(crate) request_gate: Option<Arc<ConcurrencyGate>>,
     pub(crate) distributed_request_gate: Option<Arc<RuntimeSemaphore>>,
     pub(crate) client: reqwest::Client,

apps/aether-gateway/src/state/core.rs

@@ -21,7 +21,9 @@ use aether_runtime_state::{
 };
 use aether_scheduler_core::PROVIDER_KEY_RPM_WINDOW_SECS;
 
-use super::{AppState, FrontdoorCorsConfig, LocalExecutionRuntimeMissDiagnostic};
+use super::{
+    AppState, FrontdoorCorsConfig, FrontdoorRuntimeGuardConfig, LocalExecutionRuntimeMissDiagnostic,
+};
 
 use super::super::async_task::{
     spawn_video_task_poller, VideoTaskPollerConfig, VideoTaskService, VideoTaskTruthSourceMode,
@@ -227,6 +229,7 @@ impl AppState {
                 VideoTaskTruthSourceMode::PythonSyncReport,
             )),
             video_task_poller: None,
+            frontdoor_runtime_guards: Arc::new(FrontdoorRuntimeGuardConfig::from_env()),
             request_gate: None,
             distributed_request_gate: None,
             client,

apps/aether-gateway/src/state/integrations.rs

@@ -60,12 +60,7 @@ impl provider_transport::VideoTaskTransportSnapshotLookup for AppState {
     ) -> Result<Option<GatewayProviderTransportSnapshot>, String> {
         self.read_provider_transport_snapshot(provider_id, endpoint_id, key_id)
             .await
-            .map_err(|err| match err {
-                GatewayError::UpstreamUnavailable { message, .. }
-                | GatewayError::ControlUnavailable { message, .. }
-                | GatewayError::Client { message, .. }
-                | GatewayError::Internal(message) => message,
-            })
+            .map_err(GatewayError::into_message)
     }
 }
 
@@ -77,12 +72,7 @@ impl ModelFetchTransportRuntime for AppState {
     ) -> Result<Option<LocalResolvedOAuthRequestAuth>, String> {
         AppState::resolve_local_oauth_request_auth(self, transport)
             .await
-            .map_err(|err| match err {
-                GatewayError::UpstreamUnavailable { message, .. }
-                | GatewayError::ControlUnavailable { message, .. }
-                | GatewayError::Client { message, .. }
-                | GatewayError::Internal(message) => message,
-            })
+            .map_err(GatewayError::into_message)
     }
 
     async fn resolve_model_fetch_proxy(
@@ -99,12 +89,7 @@ impl ModelFetchTransportRuntime for AppState {
     ) -> Result<ExecutionResult, String> {
         execution_runtime::execute_execution_runtime_sync_plan(self, None, plan)
             .await
-            .map_err(|err| match err {
-                GatewayError::UpstreamUnavailable { message, .. }
-                | GatewayError::ControlUnavailable { message, .. }
-                | GatewayError::Client { message, .. }
-                | GatewayError::Internal(message) => message,
-            })
+            .map_err(GatewayError::into_message)
     }
 }
 

apps/aether-gateway/src/state/mod.rs

@@ -27,6 +27,7 @@ pub(crate) use self::admin_types::{
     UserDailyQuotaAvailabilityRecord, UserPlanEntitlementRecord,
 };
 pub use self::app::AppState;
+pub(crate) use self::app::FrontdoorRuntimeGuardConfig;
 pub(crate) use self::cache::{
     CachedProviderTransportSnapshot, AUTH_API_KEY_LAST_USED_MAX_ENTRIES,
     AUTH_API_KEY_LAST_USED_TTL, PROVIDER_TRANSPORT_SNAPSHOT_CACHE_MAX_ENTRIES,

apps/aether-gateway/src/state/oauth.rs

@@ -1448,12 +1448,7 @@ impl AppState {
                 .map_err(
                     |err| provider_transport::LocalOAuthRefreshError::InvalidResponse {
                         provider_type,
-                        message: match err {
-                            GatewayError::UpstreamUnavailable { message, .. }
-                            | GatewayError::ControlUnavailable { message, .. }
-                            | GatewayError::Client { message, .. }
-                            | GatewayError::Internal(message) => message,
-                        },
+                        message: err.into_message(),
                     },
                 )?;
         let response_body_text = local_oauth_execution_body_text(&result);

apps/aether-gateway/src/state/testing.rs

@@ -11,7 +11,7 @@ use aether_data_contracts::repository::video_tasks::{
 };
 use serde_json::json;
 
-use super::{AppState, GatewayDataState};
+use super::{AppState, FrontdoorRuntimeGuardConfig, GatewayDataState};
 use crate::{provider_transport, usage};
 
 #[cfg(test)]
@@ -31,6 +31,14 @@ impl AppState {
         self
     }
 
+    pub(crate) fn with_frontdoor_runtime_guard_config_for_tests(
+        mut self,
+        config: FrontdoorRuntimeGuardConfig,
+    ) -> Self {
+        self.frontdoor_runtime_guards = Arc::new(config);
+        self
+    }
+
     pub(crate) fn with_tunnel_identity_for_tests(
         mut self,
         instance_id: &str,