[Traffic Control] Support on bridge node

crates/sui-bridge/Cargo.toml

@@ -25,6 +25,7 @@ mysten-metrics.workspace = true
 sui-sdk.workspace = true
 sui-keys.workspace = true
 sui-config.workspace = true
+sui-core.workspace = true
 clap.workspace = true
 tracing.workspace = true
 bin-version.workspace = true

crates/sui-bridge/src/config.rs

@@ -34,6 +34,7 @@ use sui_types::crypto::SuiKeyPair;
 use sui_types::digests::{get_mainnet_chain_identifier, get_testnet_chain_identifier};
 use sui_types::event::EventID;
 use sui_types::object::Owner;
+use sui_types::traffic_control::PolicyConfig;
 use tracing::info;
 
 #[serde_as]
@@ -114,6 +115,8 @@ pub struct BridgeNodeConfig {
     pub sui: SuiConfig,
     /// Eth configuration
     pub eth: EthConfig,
+    /// Traffic control policy configuration
+    pub policy_config: Option<PolicyConfig>,
 }
 
 impl Config for BridgeNodeConfig {}
@@ -183,6 +186,7 @@ impl BridgeNodeConfig {
             sui_client: sui_client.clone(),
             eth_client: eth_client.clone(),
             approved_governance_actions,
+            policy_config: self.policy_config.clone(),
         };
         if !self.run_client {
             return Ok((bridge_server_config, None));
@@ -371,6 +375,8 @@ pub struct BridgeServerConfig {
     pub eth_client: Arc<EthClient<MeteredEthHttpProvier>>,
     /// A list of approved governance actions. Action in this list will be signed when requested by client.
     pub approved_governance_actions: Vec<BridgeAction>,
+    /// Traffic control policy configuration
+    pub policy_config: Option<PolicyConfig>,
 }
 
 // TODO: add gas balance alert threshold

crates/sui-bridge/src/error.rs

@@ -69,6 +69,8 @@ pub enum BridgeError {
     RestAPIError(String),
     // Uncategorized error
     Generic(String),
+    // Rate limiting
+    TooManyRequests,
 }
 
 pub type BridgeResult<T> = Result<T, BridgeError>;

crates/sui-bridge/src/node.rs

@@ -23,6 +23,7 @@ use std::{
     sync::Arc,
     time::Duration,
 };
+use sui_core::traffic_controller::{metrics::TrafficControllerMetrics, TrafficController};
 use sui_types::{
     bridge::{BRIDGE_COMMITTEE_MODULE_NAME, BRIDGE_MODULE_NAME},
     event::EventID,
@@ -37,12 +38,21 @@ pub async fn run_bridge_node(
     prometheus_registry: prometheus::Registry,
 ) -> anyhow::Result<JoinHandle<()>> {
     init_all_struct_tags();
-    let metrics = Arc::new(BridgeMetrics::new(&prometheus_registry));
-    let (server_config, client_config) = config.validate(metrics.clone()).await?;
+    let bridge_metrics = Arc::new(BridgeMetrics::new(&prometheus_registry));
+    let tc_metrics = TrafficControllerMetrics::new(&prometheus_registry);
+
+    let (server_config, client_config) = config.validate(bridge_metrics.clone()).await?;
+    let traffic_controller = server_config.policy_config.map(|policy_config| {
+        Arc::new(TrafficController::spawn(
+            policy_config.clone(),
+            tc_metrics,
+            None, // remote firewall config
+        ))
+    });
 
     // Start Client
     let _handles = if let Some(client_config) = client_config {
-        start_client_components(client_config, metrics.clone()).await
+        start_client_components(client_config, bridge_metrics.clone()).await
     } else {
         Ok(vec![])
     }?;
@@ -59,9 +69,10 @@ pub async fn run_bridge_node(
             server_config.sui_client,
             server_config.eth_client,
             server_config.approved_governance_actions,
-            metrics.clone(),
+            traffic_controller,
+            bridge_metrics.clone(),
         ),
-        metrics,
+        bridge_metrics,
         Arc::new(metadata),
     ))
 }
@@ -417,6 +428,7 @@ mod tests {
             approved_governance_actions: vec![],
             run_client: false,
             db_path: None,
+            policy_config: None,
         };
         // Spawn bridge node in memory
         let _handle = run_bridge_node(
@@ -480,6 +492,7 @@ mod tests {
             approved_governance_actions: vec![],
             run_client: true,
             db_path: Some(db_path),
+            policy_config: None,
         };
         // Spawn bridge node in memory
         let _handle = run_bridge_node(
@@ -554,6 +567,7 @@ mod tests {
             approved_governance_actions: vec![],
             run_client: true,
             db_path: Some(db_path),
+            policy_config: None,
         };
         // Spawn bridge node in memory
         let _handle = run_bridge_node(

crates/sui-bridge/src/server/handler.rs

@@ -17,6 +17,7 @@ use lru::LruCache;
 use std::num::NonZeroUsize;
 use std::str::FromStr;
 use std::sync::Arc;
+use sui_core::traffic_controller::TrafficController;
 use sui_types::digests::TransactionDigest;
 use tap::TapFallible;
 use tokio::sync::{oneshot, Mutex};
@@ -42,12 +43,13 @@ pub trait BridgeRequestHandlerTrait {
         tx_digest_base58: String,
         event_idx: u16,
     ) -> Result<Json<SignedBridgeAction>, BridgeError>;
-
     /// Handles a request to sign a governance action.
     async fn handle_governance_action(
         &self,
         action: BridgeAction,
     ) -> Result<Json<SignedBridgeAction>, BridgeError>;
+    /// Returns the traffic controller
+    fn traffic_controller(&self) -> Option<Arc<TrafficController>>;
 }
 
 #[async_trait::async_trait]
@@ -225,6 +227,7 @@ pub struct BridgeRequestHandler {
         BridgeAction,
         oneshot::Sender<BridgeResult<SignedBridgeAction>>,
     )>,
+    traffic_controller: Option<Arc<TrafficController>>,
 }
 
 impl BridgeRequestHandler {
@@ -236,6 +239,7 @@ impl BridgeRequestHandler {
         sui_client: Arc<SuiClient<SC>>,
         eth_client: Arc<EthClient<EP>>,
         approved_governance_actions: Vec<BridgeAction>,
+        traffic_controller: Option<Arc<TrafficController>>,
         metrics: Arc<BridgeMetrics>,
     ) -> Self {
         let (sui_signer_tx, sui_rx) = mysten_metrics::metered_channel::channel(
@@ -284,6 +288,7 @@ impl BridgeRequestHandler {
             sui_signer_tx,
             eth_signer_tx,
             governance_signer_tx,
+            traffic_controller,
         }
     }
 }
@@ -343,6 +348,10 @@ impl BridgeRequestHandlerTrait for BridgeRequestHandler {
         })?;
         Ok(Json(signed_action))
     }
+
+    fn traffic_controller(&self) -> Option<Arc<TrafficController>> {
+        self.traffic_controller.clone()
+    }
 }
 
 #[cfg(test)]