Merge branches 'w/9.4/improvement/CLDSRV-945/support_cross_account_rate_limiting' and 'q/w/6225/9.3/improvement/CLDSRV-945/support_cross_account_rate_limiting' into tmp/octopus/q/9.4

Author: bert-e

lib/api/api.js

@@ -91,6 +91,7 @@ const {
     buildRateChecksFromConfig,
     checkRateLimitsForRequest,
 } = require('./apiUtils/rateLimit/helpers');
+const rateLimitCache = require('./apiUtils/rateLimit/cache');
 
 const monitoringMap = policies.actionMaps.actionMonitoringMapS3;
 
@@ -284,6 +285,18 @@ function callApiHandler(apiMethod, apiHandler, request, response, log, callback)
     // Attach the names to the current request
     request.apiMethods = apiMethods;
 
+    // If we have a cached bucket owner for the targeted bucket, pass it to
+    // Vault as a hint so the returned rate limit config is the target account.
+    // Only included when the cache has a hit.
+    const authOptions = {};
+    if (request.bucketName) {
+        const cachedOwner = rateLimitCache.getCachedBucketOwner(request.bucketName);
+        if (cachedOwner) {
+            request.rateLimitTargetAccount = cachedOwner;
+            authOptions.targetAccount = cachedOwner;
+        }
+    }
+
     return async.waterfall(
         [
             next =>
@@ -305,6 +318,7 @@ function callApiHandler(apiMethod, apiHandler, request, response, log, callback)
                     },
                     's3',
                     requestContexts,
+                    authOptions,
                 ),
             (userInfo, authorizationResults, streamingV4Params, infos, next) => {
                 const authNames = { accountName: userInfo.getAccountDisplayName() };