← All Go packages

github.com/anulum/director-ai/gateway/internal/ratelimit

package ratelimit // import "github.com/anulum/director-ai/gateway/internal/ratelimit"

Package ratelimit implements a token-bucket rate limiter keyed by API-key
fingerprint. An unauthenticated request is bucketed by remote address so that a
misconfigured client with no key still cannot DoS the gateway.

Storage is in-memory and per-process — fine for a single gateway replica.
A shared Redis-backed implementation is a v2 concern.

TYPES

type Limiter struct {
	// Has unexported fields.
}
    Limiter enforces a per-key rate budget using the token-bucket algorithm.
    Zero-value Limiter is unusable; construct with New.

func New(rpm, burst int) *Limiter
    New returns a Limiter that allows “rpm“ requests per minute with up to
    “burst“ tokens on the gauge at any time. “rpm <= 0“ disables rate limiting
    entirely — the Handler becomes a passthrough.

func NewWithClock(rpm, burst int, clock func() time.Time) *Limiter
    NewWithClock is for tests: it lets callers inject a deterministic clock so
    the bucket fills at a known rate.

func (l *Limiter) Allow(id string) (bool, time.Duration)
    Allow decrements one token from the bucket keyed by “id“. Returns (allowed,
    retryAfter). “retryAfter“ is only meaningful when “allowed“ is false.

func (l *Limiter) Handler(next http.Handler, fingerprintFn func(*http.Request) string) http.Handler
    Handler wraps next with rate limiting. The bucket key is the audit
    fingerprint when present, otherwise the remote address.

func (l *Limiter) Reset()
    Reset removes every bucket. Useful for tests and for a future admin-only
    "flush" endpoint.