Introduce ErrMissingTenant for scoped limiters

[tarcisiozf]

This pull request standardizes how missing tenant errors are reported across all scoped limiters in the pkg/settings/limits package. It introduces a new sentinel error, ErrMissingTenant, and updates all relevant limiters to wrap and return this error when a required tenant is missing from the context. Comprehensive tests are also added to ensure correct error handling and categorization.

Error handling improvements:

• Introduced a new sentinel error ErrMissingTenant in errors.go to represent the case where a scoped limiter is used without the required tenant in the context. This error is not a LimitError and signals a programming error rather than a system issue.
• Updated all scoped limiters (bound.go, range.go, gate.go, queue.go, rate.go, resource.go, time.go) to wrap and return ErrMissingTenant when the tenant is missing, ensuring consistent error reporting.

Testing and validation:

• Added missing_tenant_test.go to assert that all scoped limiters return ErrMissingTenant when the tenant is missing, and to verify that this error is not misclassified as a LimitError.

[github-actions]

👋 tarcisiozf, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[github-actions]

✅ API Diff Results - github.com/smartcontractkit/chainlink-common

✅ Compatible Changes (2)

pkg/settings/limits (2)

• ErrMissingTenant — ➕ Added

• IsErrRecoverable — ➕ Added

---

📄 View full apidiff report

[Copilot]

🟡 Changes recommended

Optional-scope queue behavior and the public limiter contract documentation need to be addressed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Standardizes missing-tenant handling across scoped limiters with a new ErrMissingTenant sentinel and accompanying tests.

Changes:

• Adds and wraps ErrMissingTenant across scoped limiters.
• Adds tests for error identity and classification.
• Flags optional-scope behavior and public contract documentation for updates.

File summaries

File	Reviewed changes
pkg/settings/limits/time.go	Wraps missing-tenant errors.
pkg/settings/limits/resource.go	Wraps missing-tenant errors.
pkg/settings/limits/rate.go	Wraps missing-tenant errors.
pkg/settings/limits/range.go	Wraps missing-tenant errors.
pkg/settings/limits/queue.go	Wraps missing-tenant errors; optional ScopeOrg behavior requires correction. Moderate, 2 votes.
pkg/settings/limits/missing_tenant_test.go	Tests sentinel behavior and error classification.
pkg/settings/limits/gate.go	Wraps missing-tenant errors.
pkg/settings/limits/errors.go	Defines ErrMissingTenant; public contract documentation requires clarification. Nit, 1 vote.
pkg/settings/limits/bound.go	Wraps missing-tenant errors.

Review details

Suppressed comments (1)

pkg/settings/limits/errors.go:18

• ErrMissingTenant is now returned from Limiter.Limit, but the public Limiter contract in limits.go:32 promises that an error is accompanied by a usable fallback value. For required scopes this path intentionally returns zero/empty values (and the new test says they are meaningless), so callers following the documented contract could enforce an invalid limit. Please update the public/package documentation to describe this programming-error exception and that it is not a gRPC limit error.

// ErrMissingTenant is returned when a scoped limiter is used without the tenant that its
// scope requires in ctx. Unlike a settings read failure, where the limiter still resolves a
// usable value alongside the error, no lookup is attempted here, so callers must not treat
// the returned value as a limit. It signals that the CRE context was never populated, which
// is a programming error rather than a degraded system. Deliberately not a [LimitError]:

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.