Struct RateLimitConfig 

pub struct RateLimitConfig {
    pub enabled: bool,
    pub rps_per_ip: u32,
    pub rps_per_user: u32,
    pub burst_size: u32,
    pub cleanup_interval_secs: u64,
    pub trust_proxy_headers: bool,
    pub trusted_proxy_cidrs: Vec<IpNet>,
}

Rate limiting configuration (token-bucket algorithm).

Enforces request-per-second limits per IP/user across all GraphQL operations. This is the canonical rate limiter for request throttling.

Distinct from fraiseql_auth::AuthRateLimitConfig, which uses a sliding-window algorithm for auth endpoint brute-force protection.

Fields

enabled: bool

Enable rate limiting

rps_per_ip: u32

Requests per second per IP

rps_per_user: u32

Requests per second per user (if authenticated)

burst_size: u32

Burst capacity (maximum tokens to accumulate)

cleanup_interval_secs: u64

Cleanup interval in seconds (remove stale entries)

trust_proxy_headers: bool

Trust X-Real-IP / X-Forwarded-For headers for client IP extraction.

Must only be enabled when behind a trusted reverse proxy.

trusted_proxy_cidrs: Vec<IpNet>

Parsed CIDR ranges trusted as proxy IPs.

When non-empty, X-Forwarded-For is only trusted if the direct connection IP falls within one of these ranges. An empty Vec with trust_proxy_headers = true means all direct IPs are treated as trusted proxies (less secure).

Implementations

impl RateLimitConfig

pub fn from_security_config(sec: &RateLimitingSecurityConfig) -> Self

Build from the [security.rate_limiting] config embedded in the compiled schema.

Maps requests_per_second → rps_per_ip and burst_size directly. rps_per_user uses the explicit requests_per_second_per_user value when set, or defaults to 10× requests_per_second.

The default 10× multiplier reflects that authenticated users are identifiable (abuse is traceable) and include service accounts with higher call rates. Operators can override with requests_per_second_per_user in fraiseql.toml.

Trait Implementations

impl Clone for RateLimitConfig

fn clone(&self) -> RateLimitConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RateLimitConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RateLimitConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RateLimitConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for RateLimitConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.