1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
use dashmap::DashMap;
use std::hash::Hash;
use std::sync::Arc;
use std::time::{Duration, Instant};
// Fixed-window limiter, generic over whatever key makes sense for the
// endpoint (client IP for unauthenticated auth attempts, user id for an
// authenticated endpoint like stats submission). Good enough to blunt
// brute force / scripted abuse against a single-instance deployment without
// pulling in a separate crate; a multi-instance deployment would need this
// backed by a shared store (e.g. the DB or Redis) instead.
#[derive(Clone)]
pub struct RateLimiter<K: Eq + Hash + Clone + Send + Sync + 'static = std::net::IpAddr> {
hits: Arc<DashMap<K, (Instant, u32)>>,
max_attempts: u32,
window: Duration,
}
impl<K: Eq + Hash + Clone + Send + Sync + 'static> RateLimiter<K> {
pub fn new(max_attempts: u32, window: Duration) -> Self {
Self { hits: Arc::new(DashMap::new()), max_attempts, window }
}
/// Returns true if this key is still within its allowance and records the attempt.
pub fn check(&self, key: K) -> bool {
let now = Instant::now();
let mut entry = self.hits.entry(key).or_insert((now, 0));
if now.duration_since(entry.0) > self.window {
*entry = (now, 0);
}
entry.1 += 1;
entry.1 <= self.max_attempts
}
}
|