API gateway and rate limiting

if !dec.Allowed {
  secs := (dec.RetryAfter + time.Second - 1) / time.Second
  w.Header().Set("Retry-After", strconv.FormatInt(int64(secs), 10))
  http.Error(w, "too many requests", http.StatusTooManyRequests)
  return
}

-- Fixed window: count requests in the current window; refuse once the count passes the limit.
-- KEYS[1] the counter for this window: rl:{user:42}:fw:<window start, ms>
-- ARGV[1] now, ms    ARGV[2] window, ms    ARGV[3] limit
-- Returns {allowed, retry after ms, remaining, delay ms}.
local now = tonumber(ARGV[1])
local window = tonumber(ARGV[2])
local limit = tonumber(ARGV[3])
local count = redis.call('INCR', KEYS[1])
if count == 1 then
  redis.call('PEXPIRE', KEYS[1], window)
end
if count <= limit then
  return {1, 0, limit - count, 0}
end
local window_end = now - now % window + window
return {0, window_end - now, 0, 0}

-- Sliding window log: keep the time of every admitted request; admit while fewer than the limit
-- fall inside the last window.
-- KEYS[1] sorted set, member = request id, score = time: rl:{user:42}:log
-- ARGV[1] now, ms    ARGV[2] window, ms    ARGV[3] limit    ARGV[4] request id
-- Returns {allowed, retry after ms, remaining, delay ms}.
local now = tonumber(ARGV[1])
local window = tonumber(ARGV[2])
local limit = tonumber(ARGV[3])
redis.call('ZREMRANGEBYSCORE', KEYS[1], '-inf', now - window)
local count = redis.call('ZCARD', KEYS[1])
if count < limit then
  redis.call('ZADD', KEYS[1], now, ARGV[4])
  redis.call('PEXPIRE', KEYS[1], window)
  return {1, 0, limit - count - 1, 0}
end
local oldest = redis.call('ZRANGE', KEYS[1], 0, 0, 'WITHSCORES')
return {0, tonumber(oldest[2]) + window - now, 0, 0}

-- Sliding window counter: two fixed-window counters. The estimate weights the previous window by
-- the part of it that still overlaps the sliding window:
--   estimate = previous × (window − elapsed) / window + current
-- Multiply through by window to stay in whole numbers.
-- KEYS[1] current window counter    KEYS[2] previous window counter
-- ARGV[1] now, ms    ARGV[2] window, ms    ARGV[3] limit
-- Returns {allowed, retry after ms, remaining, delay ms}.
local now = tonumber(ARGV[1])
local window = tonumber(ARGV[2])
local limit = tonumber(ARGV[3])
local elapsed = now % window
local curr = tonumber(redis.call('GET', KEYS[1]) or '0')
local prev = tonumber(redis.call('GET', KEYS[2]) or '0')
local used = prev * (window - elapsed) + curr * window
if used + window <= limit * window then
  redis.call('INCR', KEYS[1])
  redis.call('PEXPIRE', KEYS[1], 2 * window)
  return {1, 0, math.floor((limit * window - used - window) / window), 0}
end
-- Refused. Find the first moment the estimate leaves room, if no other request arrives.
-- In this window: previous × (window − e) + (current + 1) × window ≤ limit × window.
if prev > 0 and curr + 1 <= limit then
  local e = window - math.floor((limit - curr - 1) * window / prev)
  if e < window then
    return {0, e - elapsed, 0, 0}
  end
end
-- In the next window the current count becomes the previous one.
local e2 = 0
if curr > 0 then
  e2 = math.max(0, window - math.floor((limit - 1) * window / curr))
end
return {0, window - elapsed + e2, 0, 0}

-- Token bucket: a bucket holds up to `burst` tokens and refills at `rate` tokens a second. Each
-- request takes one token. Tokens are counted in thousandths, so the script stays in whole numbers.
-- KEYS[1] hash with fields tokens and ts: rl:{user:42}:tb
-- ARGV[1] now, ms    ARGV[2] rate, tokens a second    ARGV[3] burst
-- Returns {allowed, retry after ms, remaining, delay ms}.
local now = tonumber(ARGV[1])
local rate = tonumber(ARGV[2]) -- tokens a second = thousandths of a token per ms
local cap = tonumber(ARGV[3]) * 1000
local state = redis.call('HMGET', KEYS[1], 'tokens', 'ts')
local tokens = tonumber(state[1]) or cap
local ts = tonumber(state[2]) or now
if now > ts then
  tokens = math.min(cap, tokens + (now - ts) * rate)
  ts = now
end
local allowed, retry = 0, 0
if tokens >= 1000 then
  tokens = tokens - 1000
  allowed = 1
else
  retry = math.floor((1000 - tokens + rate - 1) / rate)
end
redis.call('HSET', KEYS[1], 'tokens', tokens, 'ts', ts)
redis.call('PEXPIRE', KEYS[1], math.floor(cap / rate) + 1000)
return {allowed, retry, math.floor(tokens / 1000), 0}

-- Leaky bucket, as a queue: requests leave at a constant rate, one every `interval` ms. A request
-- waits for its slot. When `capacity` requests already wait, the bucket is full and refuses.
-- KEYS[1] the time the bucket is empty again: rl:{user:42}:lb
-- ARGV[1] now, ms    ARGV[2] interval, ms    ARGV[3] capacity
-- Returns {allowed, retry after ms, remaining, delay ms}.
local now = tonumber(ARGV[1])
local interval = tonumber(ARGV[2])
local capacity = tonumber(ARGV[3])
local empty_at = tonumber(redis.call('GET', KEYS[1]) or '0')
local slot = math.max(empty_at, now)
local wait = slot - now
local max_wait = (capacity - 1) * interval
if wait > max_wait then
  return {0, wait - max_wait, 0, 0}
end
redis.call('SET', KEYS[1], slot + interval, 'PX', wait + interval + 1000)
return {1, 0, math.floor((max_wait - wait) / interval), wait}

// Allow implements the two tiers.
func (t *Tiered) Allow(ctx context.Context, client string, now time.Time) (Decision, error) {
  if d := t.Local.Allow(client, now); !d.Allowed {
    return d, nil
  }
  return t.Global.Allow(ctx, client, now)
}

if err != nil {
  if mode == FailOpen {
    log.Warn("rate limiter unavailable; failing open", "client", c, "err", err)
    next.ServeHTTP(w, r)
    return
  }
  log.Error("rate limiter unavailable; failing closed", "client", c, "err", err)
  w.Header().Set("Retry-After", "1")
  http.Error(w, "rate limiter unavailable", http.StatusServiceUnavailable)
  return
}