Rate Limiting & Throttling

import time, threading
from collections import defaultdict
from fastapi import FastAPI, Request, HTTPException

class TokenBucket:
    def __init__(self, rate: float, capacity: int):
        self.rate = rate           # tokens/second
        self.capacity = capacity   # max tokens (burst size)
        self.tokens = capacity     # start full
        self.last_refill = time.monotonic()
        self.lock = threading.Lock()

    def consume(self) -> bool:
        with self.lock:
            now = time.monotonic()
            # Add new tokens based on elapsed time
            elapsed = now - self.last_refill
            self.tokens = min(self.capacity, self.tokens + elapsed * self.rate)
            self.last_refill = now

            if self.tokens >= 1:
                self.tokens -= 1
                return True   # allowed
            return False      # rate limited

app = FastAPI()

# প্রতি user/API-key এর জন্য আলাদা bucket
# Free: 5/sec, Paid: 50/sec
TIERS = {
    "free": {"rate": 5, "capacity": 10},
    "paid": {"rate": 50, "capacity": 100},
}
buckets = {}

@app.middleware("http")
async def rate_limit(request: Request, call_next):
    api_key = request.headers.get("X-API-Key", "anonymous")
    tier = "paid" if api_key.startswith("paid_") else "free"

    if api_key not in buckets:
        cfg = TIERS[tier]
        buckets[api_key] = TokenBucket(cfg["rate"], cfg["capacity"])

    bucket = buckets[api_key]
    if not bucket.consume():
        raise HTTPException(
            status_code=429,
            detail={"error": "Too Many Requests", "tier": tier},
            headers={"Retry-After": "1",
                     "X-RateLimit-Limit": str(TIERS[tier]["rate"]),
                     "X-RateLimit-Remaining": "0"}
        )

    response = await call_next(request)
    response.headers["X-RateLimit-Remaining"] = str(int(bucket.tokens))
    return response

@app.get("/api/data")
async def get_data():
    return {"data": "success"}

const Redis = require('ioredis');
const redis = new Redis();

async function isRateLimited(userId, limit = 100, windowMs = 60000) {
    const now = Date.now();
    const windowStart = now - windowMs;
    const key = `rl:${userId}`;

    // Atomic pipeline — all 4 ops run together
    const [[, count]] = await redis
        .pipeline()
        .zremrangebyscore(key, 0, windowStart)   // remove old
        .zadd(key, now, `${now}`)               // add current
        .zcard(key)                               // get count
        .pexpire(key, windowMs)                   // set TTL
        .exec()
        .then(r => r.slice(2, 3));

    return { limited: count > limit, remaining: Math.max(0, limit - count) };
}

// Express middleware
const rateLimit = (limit, windowMs) => async (req, res, next) => {
    const key = req.headers['x-user-id'] || req.ip;
    const { limited, remaining } = await isRateLimited(key, limit, windowMs);

    res.set('X-RateLimit-Limit', limit);
    res.set('X-RateLimit-Remaining', remaining);

    if (limited) return res.status(429).json({
        error: 'Too Many Requests',
        retry_after: Math.ceil(windowMs / 1000)
    });
    next();
};

// Different limits for different endpoints
app.use('/api/login', rateLimit(5, 300000));   // 5 per 5 min
app.use('/api/search', rateLimit(30, 60000));  // 30 per min
app.use('/api/', rateLimit(100, 60000));       // 100 per min

# Rate limit zones define করুন (http block এ)
http {
    # Zone 1: login endpoint — per IP, 5 req/5min
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/m;

    # Zone 2: API — per user (X-User-Id header), 100/min
    limit_req_zone $http_x_user_id zone=api:20m rate=100r/m;

    # Zone 3: search — 30/min per IP
    limit_req_zone $binary_remote_addr zone=search:10m rate=30r/m;

    server {
        listen 80;

        # Login: strict — 5 per 5min, no burst
        location /api/login {
            limit_req zone=login burst=5 nodelay;
            limit_req_status 429;
            proxy_pass http://backend;
        }

        # Search: moderate burst allowed
        location /api/search {
            limit_req zone=search burst=10;
            limit_req_status 429;
            proxy_pass http://backend;
        }

        # General API: 100/min, burst of 20
        location /api/ {
            limit_req zone=api burst=20 nodelay;
            limit_req_status 429;
            # Custom 429 response
            error_page 429 /rate_limit.json;
            proxy_pass http://backend;
        }

        location = /rate_limit.json {
            internal;
            default_type application/json;
            return 429 '{"error":"Too Many Requests","retry_after":60}';
        }
    }
}