Struct RateLimit 

pub struct RateLimit {
    pub rate: u32,
    pub window: Duration,
}

Fields

rate: u32

Requests per window.

window: Duration

Window duration.

Implementations

impl RateLimit

pub const fn rate(&self) -> u32

Substrate-canonical per-:politicas :rate-limit :rate Envoy-local-rate-limit-mesh token-bucket capacity scalar accessor every consumer of the Aplicacao’s per-:contratos-edge rate-limit-bucket capacity keys off — returns the author-declared :politicas :rate-limit typed u32 verbatim, copied out of the typed slot’s own u32 storage (u32 is Copy, so the accessor returns by value; no borrow of &self past the call). Non-optional (the surrounding Option<RateLimit> is the “slot present?” projection at the parent MeshPolicy::rate_limit axis; a RateLimit past pattern-match is definitionally present, and its :rate field carries the token-bucket capacity as a required-axis scalar).

The :politicas :rate-limit :rate axis carries the “token-bucket capacity” contract (MESH-COMPOSITION §III.2 #3) — the typed slot’s u32 accept-set (zero-floor rejected through AplicacaoError::PolicyRateLimitZero, upper-bounded by POLICY_RATE_LIMIT_MAX) maps onto the Envoy local_rate_limit.token_bucket.max_tokens per-cluster token-bucket-capacity scalar (equivalently the future CiliumClusterwideEnvoyConfig per-:politicas overlay MESH-COMPOSITION §III.2 #3 acknowledges). Every downstream consumer that reads the token-bucket capacity keys off this scalar (the AplicacaoSpec::validate_politicas zero-floor + cap bracket that gates on the canonical crate::render::require_positive_bounded_u32 helper, the [rate_limit_codec::render] Duration → unit projection that emits the <n>/<s|m|h> author surface, the future M4 per-Aplicacao Envoy config reconciler materialization pass, the future per-:contratos-edge rate-limit-override overlay the MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .rate field was accessed inline at three production sites — AplicacaoSpec::validate_politicas’s require_positive_bounded_u32(rl.rate, …) call, and the two [rate_limit_codec::render] format-arm arms (canonical-window format!("{}/{unit}", rl.rate) and non-canonical-window format!("{}/{}s", rl.rate, …) fallback). Three open-coded field-accesses that expressed no compile-time link back to the typed sub-struct axis. A future extension of the :rate axis to a richer author surface — a per-:contratos-edge rate override the operator pins through a future :contratos :rate slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster rate-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain u32 token capacity to a richer {max_tokens, tokens_per_fill} tuple once Envoy’s local_rate_limit.token_bucket block’s peer tokens_per_fill axis comes into scope, a per-Envoy-cluster descriptor-key gate before the token arms — would have had to be threaded through every open-coded copy in lockstep or the validate gate, the codec’s render path, and the future M4 emit path would silently disagree on which token capacity a given RateLimit resolves to (an author’s :rate-limit "100/s" would satisfy validate while the render / emit paths silently read a drifted other value, or vice versa: a validated typed slot would land at the emit boundary as a no-op limiter whose token capacity is structurally so high that no realistic per-edge traffic shape can drain it). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas :rate-limit token-capacity surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

First sub-struct scalar accessor on the RateLimit axis — sibling in shape to the peer per-CircuitBreaker CircuitBreaker::max_failures (3a74062) required-u32 accessor on the peer per-sub-struct required-axis, extended onto the per-RateLimit required-u32 axis; opens the “per-RateLimit required-axis scalar” projection pattern the sibling RateLimit::window future lift folds on. Same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline the peer WitContract::source / WitContract::destination (7f0fd43), WitContract::world_ref (0804823), Membro::nome (4a32abf), Membro::versao_requirement (a40b0e3), Entrada::destination (6db982c), CircuitBreaker::max_failures (3a74062), CircuitBreaker::window (373957f) accessors carry on their respective per-mesh-slot-atom scalar-value axes. Named rate() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

pub const fn window(&self) -> Duration

Substrate-canonical per-:politicas :rate-limit :window Envoy-local-rate-limit-mesh token-bucket refill-period scalar accessor every consumer of the Aplicacao’s per-:contratos-edge rate-limit-bucket refill period keys off — returns the author-declared :politicas :rate-limit typed Duration verbatim, copied out of the typed slot’s own Duration storage (Duration is Copy, so the accessor returns by value; no borrow of &self past the call). Non-optional (the surrounding Option<RateLimit> is the “slot present?” projection at the parent MeshPolicy::rate_limit axis; a RateLimit past pattern-match is definitionally present, and its :window field carries the token-bucket refill period as a required-axis scalar).

The :politicas :rate-limit :window axis carries the “token-bucket refill period” contract (MESH-COMPOSITION §III.2 #3) — the typed slot’s Duration accept-set (constrained to the three canonical windows {1s, 60s, 3600s} the [RATE_LIMIT_UNIT_TABLE] lifts, rejected off-set through AplicacaoError::PolicyRateLimitWindowNotCanonical) maps onto the Envoy local_rate_limit.token_bucket.fill_interval per-cluster token-bucket-refill-period scalar (equivalently the future CiliumClusterwideEnvoyConfig per-:politicas overlay MESH-COMPOSITION §III.2 #3 acknowledges). Every downstream consumer that reads the token-bucket refill period keys off this scalar (the AplicacaoSpec::validate_politicas canonical-window gate that keys off [is_canonical_rate_limit_window], the [rate_limit_codec::render] Duration → unit projection that emits the <n>/<s|m|h> author surface — canonical arm via [rate_limit_window_unit] and non-canonical fallback via .as_secs(), the future M4 per-Aplicacao Envoy config reconciler materialization pass, the future per-:contratos- edge rate-limit-override overlay the MESH-COMPOSITION §III.2 #3 roadmap acknowledges).

Prior to this lift the .window field was accessed inline at three production sites — AplicacaoSpec::validate_politicas’s is_canonical_rate_limit_window(rl.window) shape-gate call plus the sibling AplicacaoError::PolicyRateLimitWindowNotCanonical error-payload construction on refusal, and the two [rate_limit_codec::render] arms (canonical-window rate_limit_window_unit(rl.window) dispatch and non-canonical-window rl.window.as_secs() fallback). Three open-coded field-accesses that expressed no compile-time link back to the typed sub-struct axis. A future extension of the :window axis to a richer author surface — a per-:contratos- edge window override the operator pins through a future :contratos :window slot the MESH-COMPOSITION §III.2 #3 roadmap acknowledges, a per-cluster window-default overlay the M4 CR materializer resolves per-CR, a promotion of the plain Duration refill period to a richer {fill_interval, tokens_per_fill} tuple once Envoy’s local_rate_limit.token_bucket block’s peer tokens_per_fill axis comes into scope, an addition of a "d" day suffix once Envoy’s rate_limit_action grows daily-bucket support — would have had to be threaded through every open-coded copy in lockstep or the validate gate, the codec’s render path, and the future M4 emit path would silently disagree on which refill period a given RateLimit resolves to (an author’s :rate-limit "100/s" would satisfy validate while the render / emit paths silently read a drifted other value, or vice versa: a validated typed slot would land at the emit boundary as a limiter whose refill period is structurally so long that no realistic per-edge traffic shape stays inside the token budget). Lifting the resolution to a typed method on the substrate primitive means every downstream consumer of the Aplicacao’s per-:politicas :rate-limit refill-period surface reaches for exactly one typed dispatch — the resolver’s accept-set migrates as a unit on any future axis addition.

Second sub-struct scalar accessor on the RateLimit axis — sibling in shape to the just-landed RateLimit::rate (7f81a60) required-u32 accessor on the peer per-RateLimit required-axis, extended onto the per-sub-struct required-Duration axis; closes the last unlifted per-RateLimit scalar-value axis (the M3 mesh-slot family’s per-sub-struct accessor coverage is now complete across both CircuitBreaker and RateLimit). Same “one typed dispatch on the substrate primitive, thin projections at each consumer” discipline the peer CircuitBreaker::max_failures (3a74062), CircuitBreaker::window (373957f), RateLimit::rate (7f81a60), WitContract::source / WitContract::destination (7f0fd43), WitContract::world_ref (0804823), Membro::nome (4a32abf), Membro::versao_requirement (a40b0e3), Entrada::destination (6db982c) accessors carry on their respective per-mesh-slot-atom scalar-value axes. Named window() to match the storage field’s name; the accessor’s identity maps onto the canonical MESH-COMPOSITION §III.2 vocabulary the slot’s docstring already carries.

pub fn canonical_unit(&self) -> Option<RateLimitUnit>

Recognize this rate-limit’s :window as a canonical RateLimitUnit arm — Some(RateLimitUnit) when the window exactly matches one of the three closed-set arm-Durations (1s / 60s / 3600s), None when the window carries a non-canonical magnitude the codec’s round-trip would break on (sub-second residue, or a second-magnitude outside the set RateLimitUnit::ALL enumerates).

Every validated RateLimit past AplicacaoSpec::validate_politicas returns Some here — the validate gate’s AplicacaoError::PolicyRateLimitWindowNotCanonical arm rejects every window this accessor returns None on. Downstream consumers past validate (the codec’s [rate_limit_codec::render] path, the future M4 per-Aplicacao Envoy config reconciler’s materialization pass, the future per-:contratos-edge rate-limit- override overlay the MESH-COMPOSITION §III.2 #3 roadmap acknowledges) that read the typed unit off a validated slot can pattern-match on the returned Some without re-checking canonicality at the consumer layer — the typed enum surface is the load-bearing carrier of the canonicality invariant.

Preferred over the free [is_canonical_rate_limit_window] module-private helper at any call site that has the typed RateLimit in hand (the codec’s render arm at [rate_limit_codec::render], the validate gate’s canonical-form arm in AplicacaoSpec::validate_politicas, any future per-:contratos edge-override overlay resolver): those consumers reach for the typed enum without going through the .window() scalar-projection layer, and get the enum value directly (which the codec’s render arm can then format via RateLimitUnit::as_suffix / std::fmt::Display). Same “typed sub-struct scalar accessor, one dispatch on the substrate primitive” discipline the sibling RateLimit::rate and RateLimit::window accessors carry on the peer per-sub-struct scalar-value axes, extended onto the per-RateLimit typed-unit projection axis (the third scalar accessor on the RateLimit axis, first typed-enum-return projection).

Trait Implementations

impl Clone for RateLimit

fn clone(&self) -> RateLimit

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RateLimit

impl Debug for RateLimit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for RateLimit

impl PartialEq for RateLimit

fn eq(&self, other: &RateLimit) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RateLimit