Struct RateLimiter 

pub struct RateLimiter { /* private fields */ }

In-process two-layer rate limiter.

Layer 1 (primary): (TokenId, TenantId) bucket — keeps a shared token from being drained by a single tenant.

Layer 2 (backstop): TokenId bucket — caps aggregate usage by a single token across all tenants. Inherited from the v0.4 design; kept active so pre-multi-tenant operators see no behavioural regression.

Cheaply cloneable: every clone shares the same underlying DashMaps and Clock via Arc.

Implementations

impl RateLimiter

pub const MAX_TENANTS_PER_TOKEN: usize = 4096

Maximum number of distinct tenants tracked per token in the per-(token, tenant) bucket map before LRU eviction kicks in (L10).

Sized generously relative to any realistic legitimate fan-out: a single token addressing more than a few thousand tenants is either a misconfiguration or an attack, and in both cases bounding the memory is the right call. The eviction only ever discards rate-limiter bookkeeping (a f64 balance + two Instants); a subsequently-evicted tenant simply starts from a full burst on its next request, which is strictly more permissive — never a correctness or security regression.

pub fn new(cfg: RateLimitConfig) -> Self

Construct a limiter with the production RealClock.

pub fn with_clock(cfg: RateLimitConfig, clock: Arc<dyn Clock>) -> Self

Construct a limiter with an injected clock (for tests).

pub fn is_disabled(&self) -> bool

true if every configured layer admits unconditionally.

pub fn config(&self) -> RateLimitConfig

Effective configuration this limiter was built with.

pub fn try_admit(&self, token: TokenId, tenant: TenantId) -> AdmitResult

Attempt to claim one permit for the (token, tenant) pair.

Both the per-tenant (primary) and per-token (backstop) buckets must admit. If either rejects we return AdmitResult::Reject carrying the smaller of the two retry Durations — per the per-tenant-bucket design note, the smaller backoff is the earliest the client could plausibly retry, even though it may still face the other bucket on the next attempt.

To avoid leaking a permit on one layer when the other rejects, we hold both layers’ inner mutexes across the decision and only deduct when both would admit. The lock-order is (token, tenant) then token; since these live in two distinct DashMaps and every caller takes them in the same order, no cycle is possible.

Trait Implementations

impl Clone for RateLimiter

fn clone(&self) -> RateLimiter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RateLimiter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.