ratelimit

type CoreAPIResolver struct {
	// contains filtered or unexported fields
}

type CoreAPIResolverOption func(*CoreAPIResolver)

type Decision int

type KeyFunc func(r *http.Request) string

type KeyKind string

type Limit struct {
	// Rate is the number of requests allowed per Period.
	Rate int

	// Period is the time window for the rate limit (e.g., time.Minute).
	Period time.Duration

	// Burst is the maximum number of requests allowed in a single burst.
	// If zero, defaults to Rate.
	Burst int
}

type LimitResolver interface {
	// Resolve returns the rate limit for the given key and context.
	// The key is typically derived from the principal ID or client ID.
	Resolve(ctx context.Context, key string, r *http.Request) Limit
}

type Limiter struct {
	// contains filtered or unexported fields
}

type MemoryOption func(*MemoryStorage)

type MemoryStorage struct {
	// contains filtered or unexported fields
}

type Option func(*Limiter)

type Peeker interface {
	// Peek returns what Allow would return, without counting.
	Peek(ctx context.Context, key string, limit Limit) (Result, error)
}

type Policy struct {
	// contains filtered or unexported fields
}

type PolicyConfig struct {
	// Storage keeps the counters (required): MemoryStorage for one
	// instance, RedisStorage when several share the limits.
	Storage Storage

	// Address finds the client address (see clientaddr). Nil uses the
	// direct peer.
	Address *clientaddr.Resolver

	// Default is the default layer's limit per address. Zero uses
	// DefaultAddressLimit; DisableDefault turns the layer off.
	Default        Limit
	DisableDefault bool

	// DefaultFailClosed answers 503 when the storage fails on the default
	// layer. By default the default layer lets requests through and logs;
	// the route limits of the credential endpoints still refuse.
	DefaultFailClosed bool

	// Routes is the route table. Nil uses DefaultRoutes; an empty non-nil
	// table has no route policies.
	Routes []Route

	// ExemptNetworks are client networks, in CIDR notation or as single
	// addresses, exempt from every limit: back-channel callers such as
	// relying parties' servers.
	ExemptNetworks []string

	// KnownClient reports whether an OAuth client exists. With it, client
	// limits give only registered clients their own bucket, and requests
	// naming others share one, so made-up client IDs cannot grow the
	// storage. Optional.
	KnownClient func(ctx context.Context, clientID string) bool

	// Logger receives storage failures. Default: slog.Default().
	Logger *slog.Logger

	// Observability records metrics. Optional.
	Observability *observability.Observability
}

type RedisConfig struct {
	// Addr is the Redis server address (e.g., "localhost:6379").
	Addr string

	// Password is the Redis password (optional).
	Password string

	// DB is the Redis database number (default 0).
	DB int

	// PoolSize is the maximum number of connections (default 10).
	PoolSize int

	// Cluster enables Redis Cluster mode.
	Cluster bool

	// ClusterAddrs are the cluster node addresses (used when Cluster is true).
	ClusterAddrs []string
}

type RedisOption func(*RedisStorage)

type RedisStorage struct {
	// contains filtered or unexported fields
}

type Result struct {
	// Allowed is true if the request should be permitted.
	Allowed bool

	// Remaining is the number of requests remaining in the current window.
	Remaining int

	// ResetAt is when the rate limit window resets.
	ResetAt time.Time

	// RetryAfter is the duration to wait before retrying (only set if not allowed).
	RetryAfter time.Duration
}

type Route struct {
	// Name names the policy in keys and in the RateLimit-Policy header.
	Name string

	// Paths are matched against the request path: "/oauth/token" matches
	// that path only, "/login*" every path starting with "/login", and
	// "/bff/auth/*" every path under "/bff/auth/" (and "/bff/auth"). When
	// several routes match, the longest pattern wins.
	Paths []string

	// Methods restricts the route to these methods; empty matches all.
	Methods []string

	// Exempt skips the default layer and every route limit, for health
	// checks, static assets, and callers whose addresses are shared, such
	// as a payment provider's webhooks.
	Exempt bool

	// Limits are checked in order after the default layer.
	Limits []RouteLimit

	// FailOpen lets requests through when the storage fails. Routes fail
	// closed by default: the credential endpoints refuse rather than run
	// without limits.
	FailOpen bool
}

type RouteLimit struct {
	Key   KeyKind
	Limit Limit
}

type StaticResolver struct {
	Limit Limit
}

type Storage interface {
	// Allow checks if a request should be allowed and updates the counter.
	// Returns the result of the check and any error.
	Allow(ctx context.Context, key string, limit Limit) (Result, error)

	// Reset clears the rate limit state for a key.
	Reset(ctx context.Context, key string) error

	// Close releases any resources held by the storage.
	Close() error
}

type TieredResolver struct {
	Tiers    map[string]Limit
	Default  Limit
	TierFunc func(ctx context.Context, key string, r *http.Request) string
	// contains filtered or unexported fields
}