الـ Rate Limiting في Redis: fixed window و sliding window و token bucket

import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL);
await redis.flushall();
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

// fixed window: عدّاد لكل تانية (اسم الـ key فيه رقم التانية)
async function fixedWindow(user, limit) {
  const window = Math.floor(Date.now() / 1000);
  const key = `rl:fixed:${user}:${window}`;
  const n = await redis.incr(key);
  if (n === 1) await redis.expire(key, 2);
  return n <= limit;
}

// نستنى لحد قبل آخر التانية بـ 50ms، ونبعت 5، وبعد ما تبدأ التانية الجاية 5 كمان
await sleep(1000 - (Date.now() % 1000) - 50);
const first = await Promise.all(Array.from({ length: 5 }, () => fixedWindow("mona", 5)));
await sleep(100);
const second = await Promise.all(Array.from({ length: 5 }, () => fixedWindow("mona", 5)));
const allowed = [...first, ...second].filter(Boolean).length;
console.log(`الحد 5 في التانية، واتقبل ${allowed} في حوالي 100ms`);
redis.disconnect();

$ node main.js
الحد 5 في التانية، واتقبل 10 في حوالي 100ms

import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL);
await redis.flushall();
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

// sliding window log: كل request بالوقت بتاعه في sorted set، وبنعدّ آخر ثانية بالزبط
redis.defineCommand("slidingLog", {
  numberOfKeys: 1,
  lua: `
    local now = tonumber(ARGV[1])
    local window = tonumber(ARGV[2])
    local limit = tonumber(ARGV[3])
    redis.call('ZREMRANGEBYSCORE', KEYS[1], 0, now - window)
    if redis.call('ZCARD', KEYS[1]) >= limit then return 0 end
    redis.call('ZADD', KEYS[1], now, ARGV[4])
    redis.call('PEXPIRE', KEYS[1], window)
    return 1
  `,
});

let id = 0;
const hit = (user) => redis.slidingLog(`rl:log:${user}`, Date.now(), 1000, 5, `${Date.now()}-${id++}`);

await sleep(1000 - (Date.now() % 1000) - 50);
const first = await Promise.all(Array.from({ length: 5 }, () => hit("mona")));
await sleep(100);
const second = await Promise.all(Array.from({ length: 5 }, () => hit("mona")));
console.log("اتقبل:", [...first, ...second].filter((x) => x === 1).length);
await sleep(1000);
console.log("بعد تانية:", await hit("mona"));
redis.disconnect();

$ node main.js
اتقبل: 5
بعد تانية: 1

import express from "express";
import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL);
await redis.flushall();
const app = express();


redis.defineCommand("tokenBucket", {
  numberOfKeys: 1,
  lua: `
    local now = tonumber(ARGV[1])
    local capacity = tonumber(ARGV[2])
    local refill = tonumber(ARGV[3])
    local state = redis.call('HMGET', KEYS[1], 'tokens', 'ts')
    local tokens = tonumber(state[1]) or capacity
    local ts = tonumber(state[2]) or now
    tokens = math.min(capacity, tokens + (now - ts) / 1000 * refill)
    local allowed = 0
    local wait = 0
    if tokens >= 1 then
      tokens = tokens - 1
      allowed = 1
    else
      wait = math.ceil((1 - tokens) / refill * 1000)
    end
    redis.call('HSET', KEYS[1], 'tokens', tokens, 'ts', now)
    redis.call('PEXPIRE', KEYS[1], 10000)
    return {allowed, math.floor(tokens), wait}
  `,
});

function rateLimit(capacity, refill) {
  return async (req, res, next) => {
    const who = req.get("X-User") ?? req.ip;
    const [allowed, remaining, wait] = await redis.tokenBucket(`rl:tb:${who}`, Date.now(), capacity, refill);
    res.set("RateLimit-Limit", String(capacity));
    if (allowed === 1) {
      res.set("RateLimit-Remaining", String(remaining));
      return next();
    }
    res.set("Retry-After", String(Math.ceil(wait / 1000)));
    res.status(429).json({ error: "كتير، استنى شوية" });
  };
}

app.get("/api/data", rateLimit(5, 2), (req, res) => res.json({ ok: true }));

const server = app.listen(3000, async () => {
  const call = (user) => fetch("http://localhost:3000/api/data", { headers: { "X-User": user } });
  const first = [];
  for (let i = 0; i < 7; i++) first.push(await call("mona"));
  console.log("mona:", first.map((r) => r.status).join(" "), "| retry-after:", first[6].headers.get("retry-after"));
  console.log("omar:", (await call("omar")).status);
  await new Promise((r) => setTimeout(r, 1100));
  const later = [];
  for (let i = 0; i < 3; i++) later.push((await call("mona")).status);
  console.log("mona بعد 1100ms:", later.join(" "));
  server.close();
  redis.disconnect();
});

$ node main.js
mona: 200 200 200 200 200 429 429 | retry-after: 1
omar: 200
mona بعد 1100ms: 200 200 429