Struct ThreeLayerRateLimiter 

pub struct ThreeLayerRateLimiter { /* private fields */ }

Three-layer rate limiter for inbound authenticated per-request traffic.

Methods are &self — concurrent admission decisions don’t take a write lock. Each layer uses its own governor limiter and the Result<(), RejectLayer> short-circuits at the first rejection.

Keyspace bound (#645). The two keyed layers carry per-layer cap_per_{ip,peer} and pruning_per_{ip,peer} fields. The flags are deliberately split (not one shared) so a slow per-IP retain_recent sweep does not block a concurrent per-peer sweep — and vice versa.

Implementations

impl ThreeLayerRateLimiter

pub fn new( cfg: &RateLimitConfig, metrics: Arc<dyn RateLimitMetricsSink>, ) -> Self

Build a limiter from the resolved config snapshot and a metrics sink.

pub fn check( &self, peer_node_id: &NodeId, peer_ip: Option<IpAddr>, ) -> Result<(), RejectLayer>

Try to admit one inbound request. peer_ip == None for relay-only connections — the per-IP layer is skipped (no key to charge), matching the ConnectionLimiter precedent at crate::dispatch::ConnectionLimiter::acquire.

On rejection, calls RateLimitMetricsSink::rejected with the layer that fired and returns it. No sink call on the success path.

Cheapest-first ordering (global → per-IP → per-peer): the first layer to reject short-circuits, so a per-peer-flooded request that would also have failed the global cap counts as global (the layer that actually drained the budget).

pub fn admit_batch_extra( &self, peer_node_id: &NodeId, peer_ip: Option<IpAddr>, extra: usize, ) -> usize

Stage 2 of the two-stage batch admission (ADR 022 §Batch token accounting). After Self::check has charged the stage-1 frame token, this consumes up to extra (= n - 1 for a batch of n hashes) more units cheapest-first, each unit identical to what one separate StoreRequest admission would charge — so the per-second work ceiling is the same whether the publisher sends n separate Stores or one BatchStore of size n (ADR 022 AC 17).

Returns the number of extra units granted; the first 1 + returned hashes of the batch pass through per-hash processing, the remainder are acked false. Returns 0 when extra == 0 or the budget is already exhausted.

No rejection counter is bumped: the inbound frame was already admitted at stage 1, and the over-budget tail is deferred work the publisher retries, not a rejected request. Because the per-unit charge short-circuits cheapest-first, the terminating unit may consume a global (and per-IP) token without a per-peer token — byte-for-byte what the (k+1)-th separate Store would have done.

pub fn gc_per_ip(&self) -> Option<(usize, usize)>

Periodic GC sweep for the per-IP keyed map (#645). Returns Some((before, after)) on a sweep that actually ran, or None when the per-IP layer is disabled or the single-flight CAS was lost to a concurrent prune (lazy or another GC tick). Mirrors crate::dispatch::ConnectionLimiter::gc_per_source.

pub fn gc_per_peer(&self) -> Option<(usize, usize)>

Periodic GC sweep for the per-peer keyed map (#645). Sibling of Self::gc_per_ip.

pub fn per_ip_tracked(&self) -> usize

Current tracked-key count for the per-IP keyed map (#645). 0 when the layer is disabled.

pub fn per_peer_tracked(&self) -> usize

Current tracked-key count for the per-peer keyed map (#645).