Enum RateLimiter 

#[non_exhaustive]
pub enum RateLimiter {
    InMemory(InMemoryRateLimiter),
}

Rate limiter that dispatches to either an in-memory or Redis backend.

Construct via RateLimiter::new (in-memory, default) or RateLimiter::new_redis (distributed Redis, requires the redis-rate-limiting Cargo feature).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

InMemory(InMemoryRateLimiter)

Single-node token-bucket limiter backed by HashMap with RwLock.

Implementations

impl RateLimiter

pub fn new(config: RateLimitConfig) -> Self

Create an in-memory rate limiter.

pub fn with_path_rules_from_security( self, sec: &RateLimitingSecurityConfig, ) -> Self

Attach per-path rules from [security.rate_limiting] auth endpoint fields.

pub const fn config(&self) -> &RateLimitConfig

Return the active rate limit configuration.

pub const fn path_rule_count(&self) -> usize

Number of per-path rate limit rules registered.

pub fn retry_after_for_path(&self, path: &str) -> u32

Seconds a client should wait before retrying after a per-path rate limit rejection.

Returns the window duration for the matching path rule (e.g. 60s for an auth/start rule with 5 req/60s), not the IP token-bucket interval.

pub async fn check_ip_limit(&self, ip: &str) -> CheckResult

Check whether a request from ip is within the global IP rate limit.

pub async fn check_user_limit(&self, user_id: &str) -> CheckResult

Check whether a request from user_id is within the per-user limit.

pub async fn check_path_limit(&self, path: &str, ip: &str) -> CheckResult

Check the per-path rate limit for a request from ip to path.

Returns an allowed CheckResult when no rule governs the path. CheckResult::retry_after_secs reflects the actual per-path window, not the global IP rate.

pub async fn cleanup(&self)

Evict stale in-memory buckets.

No-op for the Redis backend — Redis handles expiry via PEXPIRE.

pub fn retry_after_secs(&self) -> u32

Conservative static estimate of how long (in seconds) a client must wait before the IP-level bucket refills one token: ceil(1 / rps_per_ip).

Used when no backend-computed retry_after_ms is available (e.g., the in-memory backend before the precise value is plumbed end-to-end, or as a fallback on Redis errors). Minimum 1 second.