fix(ratelimit): count Req per Interval, not per second

The sustained gate compared requests per second with Req, which is a count per Interval. An interval of one minute with req 10 allowed 600 requests. The gate now compares the count in the interval with Req. One-second intervals behave as before. A burst at or above req has no effect, because the sustained gate always binds first.
This commit is contained in:
2026-11-03 00:07:57 +00:00
parent e2af5b079f
commit c128a0f4d9
4 changed files with 62 additions and 67 deletions
+1 -1
View File
@@ -821,7 +821,7 @@ Enable rate limiting based on user roles using the `ROLE_RATE_LIMIT` environment
- `ROLE_RATE_LIMIT`: Enable role-based rate limiting (default: `false`)
**Features:**
- **Burst control**: Optional burst limits for handling traffic spikes
- **Burst control**: Optional `burst` caps requests in a short window (one tenth of the interval). `req` counts requests per `interval`. A `burst` at or above `req` has no effect.
`ratelimit.json` is loaded once at startup; changing the file requires a restart.