APILimit stores quota and rate limit on ACL level (per API)

type APILimit struct {
	RateLimit
	ThrottleInterval	float64	`json:"throttle_interval" msg:"throttle_interval"`
	ThrottleRetryLimit	int	`json:"throttle_retry_limit" msg:"throttle_retry_limit"`
	MaxQueryDepth		int	`json:"max_query_depth" msg:"max_query_depth"`
	QuotaMax		int64	`json:"quota_max" msg:"quota_max"`
	QuotaRenews		int64	`json:"quota_renews" msg:"quota_renews"`
	QuotaRemaining		int64	`json:"quota_remaining" msg:"quota_remaining"`
	QuotaRenewalRate	int64	`json:"quota_renewal_rate" msg:"quota_renewal_rate"`
	SetBy			string	`json:"-" msg:"-"`
}

AccessDefinition defines which versions of an API a key has access to NOTE: when adding new fields it is required to map them from DBAccessDefinition in the gateway/policy.go:19 TODO: is it possible to share fields?

type AccessDefinition struct {
	APIName			string			`json:"api_name" msg:"api_name"`
	APIID			string			`json:"api_id" msg:"api_id"`
	Versions		[]string		`json:"versions" msg:"versions"`
	AllowedURLs		[]AccessSpec		`bson:"allowed_urls" json:"allowed_urls" msg:"allowed_urls"`	// mapped string MUST be a valid regex
	RestrictedTypes		[]graphql.Type		`json:"restricted_types" msg:"restricted_types"`
	AllowedTypes		[]graphql.Type		`json:"allowed_types" msg:"allowed_types"`
	Limit			APILimit		`json:"limit" msg:"limit"`
	FieldAccessRights	[]FieldAccessDefinition	`json:"field_access_rights" msg:"field_access_rights"`
	DisableIntrospection	bool			`json:"disable_introspection" msg:"disable_introspection"`

	AllowanceScope	string	`json:"allowance_scope" msg:"allowance_scope"`

	Endpoints	Endpoints	`json:"endpoints,omitempty" msg:"endpoints,omitempty"`
}

AccessSpecs define what URLS a user has access to an what methods are enabled

type AccessSpec struct {
	URL	string		`json:"url" msg:"url"`
	Methods	[]string	`json:"methods" msg:"methods"`
}

This type doesn't have documentation.

type BasicAuthData struct {
	Password	string		`json:"password" msg:"password"`
	Hash		HashType	`json:"hash_type" msg:"hash_type"`
}

Endpoint holds the configuration for endpoint rate limiting.

type Endpoint struct {
	Path	string		`json:"path,omitempty" msg:"path"`
	Methods	EndpointMethods	`json:"methods,omitempty" msg:"methods"`
}

EndpointMethod holds the configuration on endpoint method level.

type EndpointMethod struct {
	Name	string		`json:"name,omitempty" msg:"name,omitempty"`
	Limit	RateLimit	`json:"limit,omitempty" msg:"limit,omitempty"`
}

EndpointMethods is a collection of EndpointMethod.

type EndpointMethods []EndpointMethod

EndpointRateLimitInfo holds the information to process endpoint rate limits.

type EndpointRateLimitInfo struct {
	// KeySuffix is the suffix to use for the storage key.
	KeySuffix	string
	// Rate is the allowance.
	Rate	float64
	// Per is the rate limiting interval.
	Per	float64
}

Endpoints is a collection of Endpoint.

type Endpoints []Endpoint

EndpointsMap is the type to hold endpoint rate limit information as a map.

type EndpointsMap map[string]RateLimit

This type doesn't have documentation.

type FieldAccessDefinition struct {
	TypeName	string		`json:"type_name" msg:"type_name"`
	FieldName	string		`json:"field_name" msg:"field_name"`
	Limits		FieldLimits	`json:"limits" msg:"limits"`
}

This type doesn't have documentation.

type FieldLimits struct {
	MaxQueryDepth int `json:"max_query_depth" msg:"max_query_depth"`
}

This type doesn't have documentation.

type GraphAccessDefinition struct {
}

This type doesn't have documentation.

type HashType string

This type doesn't have documentation.

type JWTData struct {
	Secret string `json:"secret" msg:"secret"`
}

This type doesn't have documentation.

type Monitor struct {
	TriggerLimits []float64 `json:"trigger_limits" msg:"trigger_limits"`
}

Policy represents a user policy swagger:model

type Policy struct {
	MID				model.ObjectID				`bson:"_id,omitempty" json:"_id" gorm:"primaryKey;column:_id"`
	ID				string					`bson:"id,omitempty" json:"id"`
	Name				string					`bson:"name" json:"name"`
	OrgID				string					`bson:"org_id" json:"org_id"`
	Rate				float64					`bson:"rate" json:"rate"`
	Per				float64					`bson:"per" json:"per"`
	QuotaMax			int64					`bson:"quota_max" json:"quota_max"`
	QuotaRenewalRate		int64					`bson:"quota_renewal_rate" json:"quota_renewal_rate"`
	ThrottleInterval		float64					`bson:"throttle_interval" json:"throttle_interval"`
	ThrottleRetryLimit		int					`bson:"throttle_retry_limit" json:"throttle_retry_limit"`
	MaxQueryDepth			int					`bson:"max_query_depth" json:"max_query_depth"`
	AccessRights			map[string]AccessDefinition		`bson:"access_rights" json:"access_rights"`
	HMACEnabled			bool					`bson:"hmac_enabled" json:"hmac_enabled"`
	EnableHTTPSignatureValidation	bool					`json:"enable_http_signature_validation" msg:"enable_http_signature_validation"`
	Active				bool					`bson:"active" json:"active"`
	IsInactive			bool					`bson:"is_inactive" json:"is_inactive"`
	Tags				[]string				`bson:"tags" json:"tags"`
	KeyExpiresIn			int64					`bson:"key_expires_in" json:"key_expires_in"`
	Partitions			PolicyPartitions			`bson:"partitions" json:"partitions"`
	LastUpdated			string					`bson:"last_updated" json:"last_updated"`
	MetaData			map[string]interface{}			`bson:"meta_data" json:"meta_data"`
	GraphQL				map[string]GraphAccessDefinition	`bson:"graphql_access_rights" json:"graphql_access_rights"`

	// Smoothing contains rate limit smoothing settings.
	Smoothing	*apidef.RateLimitSmoothing	`json:"smoothing" bson:"smoothing"`
}

This type doesn't have documentation.

type PolicyPartitions struct {
	Quota		bool	`bson:"quota" json:"quota"`
	RateLimit	bool	`bson:"rate_limit" json:"rate_limit"`
	Complexity	bool	`bson:"complexity" json:"complexity"`
	Acl		bool	`bson:"acl" json:"acl"`
	PerAPI		bool	`bson:"per_api" json:"per_api"`
}

RateLimit holds rate limit configuration.

type RateLimit struct {
	// Rate is the allowed number of requests per interval.
	Rate	float64	`json:"rate" msg:"rate"`
	// Per is the interval at which rate limit is enforced.
	Per	float64	`json:"per" msg:"per"`

	// Smoothing contains rate limit smoothing settings.
	Smoothing	*apidef.RateLimitSmoothing	`json:"smoothing,omitempty" bson:"smoothing,omitempty"`
}

SessionState objects represent a current API session, mainly used for rate limiting. There's a data structure that's based on this and it's used for Protocol Buffer support, make sure to update "coprocess/proto/coprocess_session_state.proto" and generate the bindings using: cd coprocess/proto && ./update_bindings.sh

swagger:model

type SessionState struct {
	LastCheck			int64				`json:"last_check" msg:"last_check"`
	Allowance			float64				`json:"allowance" msg:"allowance"`
	Rate				float64				`json:"rate" msg:"rate"`
	Per				float64				`json:"per" msg:"per"`
	ThrottleInterval		float64				`json:"throttle_interval" msg:"throttle_interval"`
	ThrottleRetryLimit		int				`json:"throttle_retry_limit" msg:"throttle_retry_limit"`
	MaxQueryDepth			int				`json:"max_query_depth" msg:"max_query_depth"`
	DateCreated			time.Time			`json:"date_created" msg:"date_created"`
	Expires				int64				`json:"expires" msg:"expires"`
	QuotaMax			int64				`json:"quota_max" msg:"quota_max"`
	QuotaRenews			int64				`json:"quota_renews" msg:"quota_renews"`
	QuotaRemaining			int64				`json:"quota_remaining" msg:"quota_remaining"`
	QuotaRenewalRate		int64				`json:"quota_renewal_rate" msg:"quota_renewal_rate"`
	AccessRights			map[string]AccessDefinition	`json:"access_rights" msg:"access_rights"`
	OrgID				string				`json:"org_id" msg:"org_id"`
	OauthClientID			string				`json:"oauth_client_id" msg:"oauth_client_id"`
	OauthKeys			map[string]string		`json:"oauth_keys" msg:"oauth_keys"`
	Certificate			string				`json:"certificate" msg:"certificate"`
	BasicAuthData			BasicAuthData			`json:"basic_auth_data" msg:"basic_auth_data"`
	JWTData				JWTData				`json:"jwt_data" msg:"jwt_data"`
	HMACEnabled			bool				`json:"hmac_enabled" msg:"hmac_enabled"`
	EnableHTTPSignatureValidation	bool				`json:"enable_http_signature_validation" msg:"enable_http_signature_validation"`
	HmacSecret			string				`json:"hmac_string" msg:"hmac_string"`
	RSACertificateId		string				`json:"rsa_certificate_id" msg:"rsa_certificate_id"`
	IsInactive			bool				`json:"is_inactive" msg:"is_inactive"`
	ApplyPolicyID			string				`json:"apply_policy_id" msg:"apply_policy_id"`
	ApplyPolicies			[]string			`json:"apply_policies" msg:"apply_policies"`
	DataExpires			int64				`json:"data_expires" msg:"data_expires"`
	Monitor				Monitor				`json:"monitor" msg:"monitor"`
	// Deprecated: EnableDetailRecording is deprecated. Use EnableDetailedRecording
	// going forward instead
	EnableDetailRecording	bool			`json:"enable_detail_recording" msg:"enable_detail_recording"`
	EnableDetailedRecording	bool			`json:"enable_detailed_recording" msg:"enable_detailed_recording"`
	MetaData		map[string]interface{}	`json:"meta_data" msg:"meta_data"`
	Tags			[]string		`json:"tags" msg:"tags"`
	Alias			string			`json:"alias" msg:"alias"`
	LastUpdated		string			`json:"last_updated" msg:"last_updated"`
	IdExtractorDeadline	int64			`json:"id_extractor_deadline" msg:"id_extractor_deadline"`
	SessionLifetime		int64			`bson:"session_lifetime" json:"session_lifetime"`

	// Used to store token hash
	keyHash	string
	KeyID	string	`json:"-"`

	// Smoothing contains rate limit smoothing settings.
	Smoothing	*apidef.RateLimitSmoothing	`json:"smoothing" bson:"smoothing"`

	// modified holds the hint if a session has been modified for update.
	// use Touch() to set it, and IsModified() to get it.
	modified	bool
}

func IsHashType(t string) bool {
	switch HashType(t) {
	case HashBCrypt, HashSha256, HashMurmur32, HashMurmur64, HashMurmur128:
		return true
	}
	return false
}

Cognitive complexity: 3, Cyclomatic complexity: 3

func NewSessionState() *SessionState {
	return &SessionState{}
}

Cognitive complexity: 1, Cyclomatic complexity: 1

func (p *Policy) APILimit() APILimit {
	return APILimit{
		QuotaMax:		p.QuotaMax,
		QuotaRenewalRate:	p.QuotaRenewalRate,
		ThrottleInterval:	p.ThrottleInterval,
		ThrottleRetryLimit:	p.ThrottleRetryLimit,
		MaxQueryDepth:		p.MaxQueryDepth,
		RateLimit: RateLimit{
			Rate:		p.Rate,
			Per:		p.Per,
			Smoothing:	p.Smoothing,
		},
	}
}

Cognitive complexity: 2, Cyclomatic complexity: 1

APILimit returns an user.APILimit from the session data.

func (s *SessionState) APILimit() APILimit {
	return APILimit{
		RateLimit: RateLimit{
			Rate:		s.Rate,
			Per:		s.Per,
			Smoothing:	s.Smoothing,
		},
		QuotaMax:		s.QuotaMax,
		QuotaRenewalRate:	s.QuotaRenewalRate,
		QuotaRenews:		s.QuotaRenews,
		ThrottleInterval:	s.ThrottleInterval,
		ThrottleRetryLimit:	s.ThrottleRetryLimit,
		MaxQueryDepth:		s.MaxQueryDepth,
	}
}

Cognitive complexity: 2, Cyclomatic complexity: 1

CustomPolicies returns a map of custom policies on the session. To preserve policy order, use GetCustomPolicies instead.

func (s *SessionState) CustomPolicies() (map[string]Policy, error) {
	customPolicies, err := s.GetCustomPolicies()
	if err != nil {
		return nil, err
	}

	result := make(map[string]Policy, len(customPolicies))
	for i := 0; i < len(customPolicies); i++ {
		result[customPolicies[i].ID] = customPolicies[i]
	}

	return result, nil
}

Cognitive complexity: 4, Cyclomatic complexity: 3

GetCustomPolicies is like CustomPolicies but returns the list, preserving order.

func (s *SessionState) GetCustomPolicies() ([]Policy, error) {
	var (
		customPolicies []Policy
	)

	metadataPolicies, found := s.MetaData["policies"].([]interface{})
	if !found {
		return nil, errors.New("policies not found in metadata")
	}

	polJSON, err := json.Marshal(metadataPolicies)
	if err != nil {
		return nil, fmt.Errorf("failed to marshal metadata policies: %w", err)
	}

	if err := json.Unmarshal(polJSON, &customPolicies); err != nil {
		return nil, fmt.Errorf("failed to unmarshal metadata policies: %w", err)
	}

	return customPolicies, err
}

Cognitive complexity: 7, Cyclomatic complexity: 4

GetQuotaLimitByAPIID return quota max, quota remaining, quota renewal rate and quota renews for the given session

func (s *SessionState) GetQuotaLimitByAPIID(apiID string) (int64, int64, int64, int64) {
	if access, ok := s.AccessRights[apiID]; ok && !access.Limit.IsEmpty() {
		return access.Limit.QuotaMax,
			access.Limit.QuotaRemaining,
			access.Limit.QuotaRenewalRate,
			access.Limit.QuotaRenews
	}

	return s.QuotaMax, s.QuotaRemaining, s.QuotaRenewalRate, s.QuotaRenews
}

Cognitive complexity: 2, Cyclomatic complexity: 3

IsBasicAuth returns whether the key is basic auth or not.

func (s *SessionState) IsBasicAuth() bool {
	return s.BasicAuthData.Password != ""
}

Cognitive complexity: 0, Cyclomatic complexity: 1

IsModified will return true if session has been modified to trigger an update.

func (s *SessionState) IsModified() bool {
	return s.modified
}

Cognitive complexity: 0, Cyclomatic complexity: 1

func (s *SessionState) KeyHash() string {
	if s.keyHash == "" {
		panic("KeyHash cache not found. You should call `SetKeyHash` before.")
	}

	return s.keyHash
}

Cognitive complexity: 2, Cyclomatic complexity: 2

func (s *SessionState) KeyHashEmpty() bool {
	return s.keyHash == ""
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Lifetime returns the lifetime of a session. Global session lifetime has always precedence. Then, the session lifetime value in the key level takes precedence. However, if key respectKeyExpiration is true, when the key expiration has longer than the session lifetime, the key expiration is returned. It means even if the session lifetime finishes, it waits for the key expiration for physical removal.

func (s *SessionState) Lifetime(respectKeyExpiration bool, fallback int64, forceGlobalSessionLifetime bool, globalSessionLifetime int64) int64 {
	if forceGlobalSessionLifetime {
		return globalSessionLifetime
	}

	if s.SessionLifetime > 0 {
		return calculateLifetime(respectKeyExpiration, s.Expires, s.SessionLifetime)
	}

	if fallback > 0 {
		return calculateLifetime(respectKeyExpiration, s.Expires, fallback)
	}

	return 0
}

Cognitive complexity: 6, Cyclomatic complexity: 4

func (s *SessionState) MD5Hash() string {
	return fmt.Sprintf("%x", md5.Sum([]byte(fmt.Sprintf("%+v", s))))
}

Cognitive complexity: 0, Cyclomatic complexity: 1

PoliciesEqualTo compares and returns true if passed slice if IDs contains only current ApplyPolicies

func (s *SessionState) PoliciesEqualTo(ids []string) bool {
	if len(s.ApplyPolicies) != len(ids) {
		return false
	}

	polIDMap := make(map[string]bool, len(ids))
	for _, id := range ids {
		polIDMap[id] = true
	}

	for _, curID := range s.ApplyPolicies {
		if !polIDMap[curID] {
			return false
		}
	}

	return true
}

Cognitive complexity: 10, Cyclomatic complexity: 5

PolicyIDs returns the IDs of all the policies applied to this session. For backwards compatibility reasons, this falls back to ApplyPolicyID if ApplyPolicies is empty.

func (s *SessionState) PolicyIDs() []string {
	if len(s.ApplyPolicies) > 0 {
		return s.ApplyPolicies
	}
	if s.ApplyPolicyID != "" {
		return []string{s.ApplyPolicyID}
	}
	return nil
}

Cognitive complexity: 5, Cyclomatic complexity: 3

Reset marks the session as not modified, skipping related updates.

func (s *SessionState) Reset() {
	s.modified = false
}

Cognitive complexity: 0, Cyclomatic complexity: 1

SetCustomPolicies sets custom policies into session metadata.

func (s *SessionState) SetCustomPolicies(list []Policy) {
	if s.MetaData == nil {
		s.MetaData = make(map[string]interface{})
	}

	policies := []interface{}{}
	for pol := range list {
		policies = append(policies, list[pol])
	}
	s.MetaData["policies"] = policies
}

Cognitive complexity: 8, Cyclomatic complexity: 3

func (s *SessionState) SetKeyHash(hash string) {
	s.keyHash = hash
}

Cognitive complexity: 0, Cyclomatic complexity: 1

func (s *SessionState) SetPolicies(ids ...string) {
	s.ApplyPolicyID = ""
	s.ApplyPolicies = ids
}

Cognitive complexity: 0, Cyclomatic complexity: 1

TagsFromMetadata updates the session state with the tags from the metadata.

func (s *SessionState) TagsFromMetadata(data map[string]interface{}) (updateSession bool) {
	developerID, keyFound := data["tyk_developer_id"].(string)
	if keyFound {
		s.MetaData["tyk_developer_id"] = developerID
		updateSession = true
	}

	limitPattern, keyFound := data["rate_limit_pattern"].(string)
	if keyFound {
		s.MetaData["rate_limit_pattern"] = limitPattern
		updateSession = true
	}

	// pteam-<id>, porg-<id>
	clientTags, ok := data["tags"].([]interface{})
	if ok {
		for _, tag := range clientTags {
			strTag, ok := tag.(string)
			if !ok {
				continue
			}
			s.Tags = append(s.Tags, strTag)
		}
		updateSession = true
	}

	policies, ok := data["policies"].([]interface{})
	if ok {
		s.MetaData["policies"] = policies
		updateSession = true
	}

	return
}

Cognitive complexity: 16, Cyclomatic complexity: 7

Touch marks the session as modified, indicating that it should be updated.

func (s *SessionState) Touch() {
	s.modified = true
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Clone does a deepcopy of APILimit.

func (a APILimit) Clone() *APILimit {
	var smoothingRef *apidef.RateLimitSmoothing
	if a.Smoothing != nil {
		smoothing := *a.Smoothing
		smoothingRef = &smoothing
	}

	return &APILimit{
		RateLimit: RateLimit{
			Rate:		a.Rate,
			Per:		a.Per,
			Smoothing:	smoothingRef,
		},
		ThrottleInterval:	a.ThrottleInterval,
		ThrottleRetryLimit:	a.ThrottleRetryLimit,
		MaxQueryDepth:		a.MaxQueryDepth,
		QuotaMax:		a.QuotaMax,
		QuotaRenews:		a.QuotaRenews,
		QuotaRemaining:		a.QuotaRemaining,
		QuotaRenewalRate:	a.QuotaRenewalRate,
		SetBy:			a.SetBy,
	}
}

Cognitive complexity: 4, Cyclomatic complexity: 2

IsEmpty checks if APILimit is empty.

func (a APILimit) IsEmpty() bool {
	if a.Rate != 0 {
		return false
	}

	if a.Per != 0 {
		return false
	}

	if a.ThrottleInterval != 0 {
		return false
	}

	if a.ThrottleRetryLimit != 0 {
		return false
	}

	if a.MaxQueryDepth != 0 {
		return false
	}

	if a.QuotaMax != 0 {
		return false
	}

	if a.QuotaRenews != 0 {
		return false
	}

	if a.QuotaRemaining != 0 {
		return false
	}

	if a.QuotaRenewalRate != 0 {
		return false
	}

	if a.SetBy != "" {
		return false
	}

	return true
}

Cognitive complexity: 20, Cyclomatic complexity: 11

Contains is used to assert if a method exists in EndpointMethods.

func (em EndpointMethods) Contains(method string) bool {
	for _, v := range em {
		if strings.EqualFold(v.Name, method) {
			return true
		}
	}
	return false
}

Cognitive complexity: 5, Cyclomatic complexity: 3

Len is used to implement sort interface.

func (em EndpointMethods) Len() int {
	return len(em)
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Less is used to implement sort interface.

func (em EndpointMethods) Less(i, j int) bool {
	return strings.ToUpper(em[i].Name) < strings.ToUpper(em[j].Name)
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Swap is used to implement sort interface.

func (em EndpointMethods) Swap(i, j int) {
	em[i], em[j] = em[j], em[i]
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Len is used to implement sort interface.

func (es Endpoints) Len() int {
	return len(es)
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Less is used to implement sort interface.

func (es Endpoints) Less(i, j int) bool {
	return es[i].Path < es[j].Path
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Map returns EndpointsMap of Endpoints using the key format [method:path]. If duplicate entries are found, it would get overwritten with latest entries Endpoints.

func (es Endpoints) Map() EndpointsMap {
	if len(es) == 0 {
		return nil
	}

	out := make(EndpointsMap)
	for _, e := range es {
		for _, method := range e.Methods {
			key := fmt.Sprintf("%s:%s", method.Name, e.Path)
			out[key] = method.Limit
		}
	}

	return out
}

Cognitive complexity: 8, Cyclomatic complexity: 4

Swap is used to implement sort interface.

func (es Endpoints) Swap(i, j int) {
	es[i], es[j] = es[j], es[i]
}

Cognitive complexity: 0, Cyclomatic complexity: 1

Endpoints coverts EndpointsMap to Endpoints.

func (em EndpointsMap) Endpoints() Endpoints {
	if len(em) == 0 {
		return nil
	}

	var perPathMethods = make(map[string]EndpointMethods)
	for key, rateLimit := range em {
		keyParts := strings.Split(key, ":")
		if len(keyParts) != 2 {
			continue
		}

		method, path := keyParts[0], keyParts[1]
		epMethod := EndpointMethod{
			Name:	method,
			Limit:	rateLimit,
		}
		if methods, ok := perPathMethods[path]; ok {
			perPathMethods[path] = append(methods, epMethod)
			continue
		}

		perPathMethods[path] = EndpointMethods{
			epMethod,
		}
	}

	var endpoints Endpoints
	for path, methods := range perPathMethods {
		sort.Sort(methods)
		endpoints = append(endpoints, Endpoint{
			Path:		path,
			Methods:	methods,
		})
	}

	sort.Sort(endpoints)

	return endpoints
}

Cognitive complexity: 15, Cyclomatic complexity: 6

Enabled reports if partitioning is enabled.

func (p PolicyPartitions) Enabled() bool {
	return p.Quota || p.RateLimit || p.Acl || p.Complexity
}

Cognitive complexity: 0, Cyclomatic complexity: 4

Duration returns the time between two allowed requests at the defined rate. It's used to decide which rate limit has a bigger allowance.

func (r RateLimit) Duration() time.Duration {
	if r.Per <= 0 || r.Rate <= 0 {
		return 0
	}
	return time.Duration(float64(time.Second) * r.Per / r.Rate)
}

Cognitive complexity: 2, Cyclomatic complexity: 3

Clone returns a fresh copy of s

func (s SessionState) Clone() SessionState {
	// Simple vales are cloned by value
	newSession := s
	newSession.AccessRights = cloneAccess(s.AccessRights)
	newSession.OauthKeys = cloneKeys(s.OauthKeys)
	newSession.ApplyPolicies = cloneSlice(s.ApplyPolicies)
	newSession.MetaData = cloneMetadata(s.MetaData)
	newSession.Tags = cloneSlice(s.Tags)

	return newSession
}

Cognitive complexity: 0, Cyclomatic complexity: 1