Use a sliding window for rate limiting

Author: timokoessler

library/ratelimiting/RateLimiter.test.ts

@@ -86,3 +86,169 @@ t.test("should allow requests for different keys independently", async (t) => {
     `Request ${maxAmount + 1} for key2 should not be allowed`
   );
 });
+
+t.test("should handle TTL expiration", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  for (let i = 0; i < maxAmount; i++) {
+    limiter.isAllowed(key, ttl, maxAmount);
+  }
+
+  clock.tick(ttl + 1);
+
+  t.ok(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request after TTL should be allowed`
+  );
+});
+
+t.test("should allow requests exactly at limit", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  for (let i = 0; i < maxAmount; i++) {
+    t.ok(
+      limiter.isAllowed(key, ttl, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+  }
+  t.notOk(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request ${maxAmount + 1} should not be allowed`
+  );
+});
+
+t.test("should handle multiple rapid requests", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  for (let i = 0; i < maxAmount; i++) {
+    t.ok(
+      limiter.isAllowed(key, ttl, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+  }
+
+  clock.tick(100);
+
+  t.notOk(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request ${maxAmount + 1} should not be allowed`
+  );
+});
+
+t.test("should handle different window sizes", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  const differentWindowSize = 1000; // 1 second window
+  for (let i = 0; i < maxAmount; i++) {
+    t.ok(
+      limiter.isAllowed(key, differentWindowSize, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+  }
+  t.notOk(
+    limiter.isAllowed(key, differentWindowSize, maxAmount),
+    `Request ${maxAmount + 1} should not be allowed`
+  );
+});
+
+t.test("should handle sliding window with intermittent requests", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  for (let i = 0; i < maxAmount; i++) {
+    t.ok(
+      limiter.isAllowed(key, ttl, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+    clock.tick(100);
+  }
+
+  clock.tick(ttl + 1);
+
+  t.ok(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request after sliding window should be allowed`
+  );
+});
+
+t.test("should handle sliding window edge case", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  for (let i = 0; i < maxAmount; i++) {
+    t.ok(
+      limiter.isAllowed(key, ttl, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+  }
+
+  clock.tick(ttl + 1);
+
+  t.ok(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request after sliding window should be allowed`
+  );
+
+  clock.tick(ttl + 1);
+
+  t.ok(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request after sliding window should be allowed`
+  );
+});
+
+t.test("should handle sliding window with delayed requests", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  for (let i = 0; i < maxAmount; i++) {
+    t.ok(
+      limiter.isAllowed(key, ttl, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+    clock.tick(100);
+  }
+
+  clock.tick(ttl + 1);
+
+  t.ok(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request after sliding window should be allowed`
+  );
+});
+
+t.test("should handle sliding window with burst requests", async (t) => {
+  const limiter = new RateLimiter(maxAmount, ttl);
+  for (let i = 0; i < maxAmount; i++) {
+    t.ok(
+      limiter.isAllowed(key, ttl, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+  }
+
+  clock.tick(ttl / 2 + 1);
+
+  t.notOk(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request ${maxAmount + 1} should not be allowed`
+  );
+  t.notOk(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request ${maxAmount + 2} should not be allowed`
+  );
+  t.notOk(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request ${maxAmount + 3} should not be allowed`
+  );
+
+  clock.tick(ttl / 2 + 1);
+
+  for (let i = 0; i < 2; i++) {
+    t.ok(
+      limiter.isAllowed(key, ttl, maxAmount),
+      `Request ${i + 1} should be allowed`
+    );
+  }
+
+  t.notOk(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request ${maxAmount + 1} should not be allowed`
+  );
+
+  clock.tick(ttl + 1);
+
+  t.ok(
+    limiter.isAllowed(key, ttl, maxAmount),
+    `Request after sliding window should be allowed`
+  );
+});

library/ratelimiting/RateLimiter.ts

@@ -1,41 +1,35 @@
 import { LRUMap } from "./LRUMap";
 
+/**
+ * Sliding window rate limiter implementation
+ */
 export class RateLimiter {
-  private rateLimitedItems: LRUMap<
-    string,
-    { count: number; startTime: number }
-  >;
+  private rateLimitedItems: LRUMap<string, number[]>;
 
   constructor(
     readonly maxItems: number,
     readonly timeToLiveInMS: number
   ) {
-    this.rateLimitedItems = new LRUMap<
-      string,
-      { count: number; startTime: number }
-    >(maxItems, timeToLiveInMS);
+    this.rateLimitedItems = new LRUMap(maxItems, timeToLiveInMS);
   }
 
   isAllowed(key: string, windowSizeInMS: number, maxRequests: number): boolean {
     const currentTime = performance.now();
-    const requestInfo = this.rateLimitedItems.get(key);
+    const requestTimestamps = this.rateLimitedItems.get(key) || [];
 
-    if (!requestInfo) {
-      this.rateLimitedItems.set(key, { count: 1, startTime: currentTime });
-      return true;
-    }
+    // Add current request timestamp to the list
+    requestTimestamps.push(currentTime);
 
-    const elapsedTime = currentTime - requestInfo.startTime;
+    // Filter out timestamps that are older than windowSizeInMS and already expired
+    const filteredTimestamps = requestTimestamps.filter(
+      (timestamp) => currentTime - timestamp <= windowSizeInMS
+    );
 
-    if (elapsedTime > windowSizeInMS) {
-      // Reset the counter and timestamp if windowSizeInMS has expired
-      this.rateLimitedItems.set(key, { count: 1, startTime: currentTime });
-      return true;
-    }
+    // Update the list of timestamps for the key
+    this.rateLimitedItems.set(key, filteredTimestamps);
 
-    if (requestInfo.count < maxRequests) {
-      // Increment the counter if it is within the windowSizeInMS and maxRequests
-      requestInfo.count += 1;
+    // Check if the number of requests is less or equal to the maxRequests
+    if (filteredTimestamps.length <= maxRequests) {
       return true;
     }