gitlab-labkit 4.4.1 → 4.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e7ab6ac58c584a113159e7f42678f508078c83cdeb9a21c86a7f60a5c936b21
-  data.tar.gz: b4c3abaa02eafb546284dc68a08ba4443da4c1b13aa824c98f51e0dac3e749da
+  metadata.gz: 22a38c0fe1a2f28aa538b80348911947c6de64c16d7d870d24835332796faa99
+  data.tar.gz: 6259d696d178f3008aefdf91de71731c81d460cef08259555829f15d8abd462c
 SHA512:
-  metadata.gz: 1b032aa2876124669bf1eac1bc09cf67e79b4df4105e95fbc7d416132dd8d5bf1088c49e4c88b304e9a796e119edea60e4c2fae49a70aba050889a928b66b206
-  data.tar.gz: 91066213316a173023257e30507fdb8c7c0e4e0b360b91dd1efcafebbacd291c82f62e9470798aa86488ae991bb8f81b1c395856ee2e03b537e3ae5a244d78c3
+  metadata.gz: dd404f717fe9cee20cb544ad23cd5aa3195683ac0efe8bf8363988fdb8dcacc4fcaa817ac6f4cb3fcdb4f2e3d193c6d93cc13deea0344067e44fac7f3c593fb3
+  data.tar.gz: cc8d6bb5fe6fde8c17f969d4a708bd41901de5f9383f4821e3acf13a2eb35c240a80d18d3853ac5f29b689d7841df254f540233174646204358e698b9e0f643e

data/.gitlab-ci-asdf-versions.yml

@@ -1,5 +1,5 @@
 # DO NOT MANUALLY EDIT; Run ./scripts/update-asdf-version-variables.sh to update this
 variables:
-    GL_ASDF_RUBY_VERSION: "4.0.5"
+    GL_ASDF_RUBY_VERSION: "4.0.6"
     GL_ASDF_SHELLCHECK_VERSION: "0.11"
     GL_ASDF_SHFMT_VERSION: "3.13"

data/.tool-versions

@@ -1,3 +1,3 @@
-ruby 4.0.5
+ruby 4.0.6
 shfmt 3.13
 shellcheck 0.11

data/lib/labkit/rate_limit/README.md

@@ -121,6 +121,29 @@ different question than `check`. A matched `:skip` rule terminates `peek`
 the same way it terminates `check`: matched, `:allow`, no Redis read, no
 `info`.
 
+### Clearing state
+
+`Limiter#clear(identifier)` deletes this limiter's counters for one
+identifier, along with any ban a rule carrying `ban_for` has written, and returns the
+number of keys removed.
+
+```ruby
+RACK_LIMITER.clear({ ip: "1.2.3.4" }) # => 2
+```
+
+Counters otherwise only disappear when their window expires; this is the only
+way to end one early. It exists for call sites where a later success should
+wipe earlier failures, such as an authentication ban cleared by a valid
+login.
+
+Every rule in the limiter is cleared, matched or not, because a caller
+clearing state after a success knows the identifier rather than which rules
+happened to match on the way in. Each rule is deleted in its own call, since
+rules do not share a Redis Cluster slot. Clearing an identifier with no state
+is a no-op returning `0`. A Redis failure fails open like `check`, leaving the
+rest of the state to expire on its own, and the return value counts whatever
+was removed before the failure.
+
 ## Identifier
 
 `Identifier` is a small value object wrapping a hash of caller attributes.
@@ -150,6 +173,8 @@ A `Rule` is a `Data.define` value object with the following fields:
 | `period`          | Window length in seconds. May be a callable resolved on every check.                                                                                                 |
 | `action`          | What the rule does when it matches. One of `:limit`, `:log`, `:skip`. Default `:limit`. See [Actions](#actions).                                                     |
 | `characteristics` | Array of identifier keys whose values are folded into the Redis counter key. Each unique combination gets its own counter.                                           |
+| `count_distinct`  | Optional identifier key. When set, the rule counts distinct values seen for that key within the window, backed by a Redis SET rather than a counter. Must not overlap `characteristics`. |
+| `ban_for`         | Optional ban duration, whole seconds, minimum 1. Changes the accounting; `action` still decides who is blocked. Rejected on `:skip`. May be a callable resolved on every check.     |
 
 Making `limit` or `period` callable is the supported pattern for
 runtime-tunable thresholds (e.g. feature flags or database-backed settings):
@@ -219,7 +244,7 @@ An exceeded rule has `remaining` 0 and therefore outranks any rule still under
 its limit. For a `:log` rule that means shadow traffic surfaces to the caller
 as `exceeded? == true` (with `action` still `:allow`) — visible, but unable to
 block. A `:log`-only path that matches therefore returns `matched? == true`
-and emits no `rule="unmatched"` metric.
+and its check is counted as `checks_total{matched="true"}`.
 
 ```mermaid
 flowchart TD
@@ -227,20 +252,22 @@ flowchart TD
     Iter -->|yes| Match{rule.match<br/>all satisfied?}
     Match -->|no| Iter
     Match -->|yes| Skip{rule.action<br/>== :skip?}
-    Skip -->|"yes (no Redis op)"| SkipEmit[Emit calls_total<br/>action=skip]
+    Skip -->|"yes (no Redis op)"| SkipEmit[Emit rule_evaluations_total<br/>action=skip, result=skip]
     SkipEmit --> SkipReturn([Return matched=true<br/>action=:allow])
-    Skip -->|no| Eval["INCR Redis counter<br/>(see Redis sequence below)"]
+    Skip -->|no| Ban{"ban_for rule with<br/>a ban in force?"}
+    Ban -->|"yes (no increment)"| Build
+    Ban -->|no| Eval["INCR Redis counter<br/>(see Redis sequence below)"]
     Eval --> Build[Build Evaluation<br/>resolve limit/period]
     Build --> Add[Add evaluation to Result]
-    Add --> Emit[Emit calls_total + limit/period gauges]
-    Emit --> Act{"result.block?<br/>(:limit rule over limit)"}
+    Add --> Emit[Emit rule_evaluations_total<br/>+ limit/period gauges]
+    Emit --> Act{"result.block?<br/>(:limit rule over its limit,<br/>or its ban in force)"}
     Act -->|yes| Return([Return Result<br/>action=:block])
-    Act -->|"no (:log, or :limit under limit)"| Iter
-    Iter -->|no more rules| Any{any rule<br/>evaluated?}
-    Any -->|yes| ReturnFold([Return Result reporting<br/>most-constraining evaluation])
-    Any -->|no| Unmatched[Emit calls_total<br/>rule=unmatched, action=allow]
-    Unmatched --> ReturnUnmatched([Return matched=false<br/>action=:allow])
-    Eval -. StandardError .-> Error[Emit errors_total<br/>log warn]
+    Act -->|"no (:log, or under limit)"| Iter
+    Iter -->|no more rules| Return2([Return Result reporting<br/>most-constraining evaluation,<br/>or matched=false if none])
+    Return --> Check[Emit checks_total<br/>action, matched, error]
+    SkipReturn --> Check
+    Return2 --> Check
+    Eval -. StandardError .-> Error[Emit errors_total +<br/>checks_total error=true<br/>log warn]
     Error --> ReturnErr([Return error=true<br/>action=:allow])
 ```
 
@@ -249,23 +276,51 @@ discards the verdicts of the rules already evaluated, even though their counters
 were incremented. Those requests are counted but produce no verdict — the
 fail-open trade-off is that a request is never blocked on a partial evaluation.
 
-Note that `calls_total` is emitted **per matched rule**, so summing it by
-`rate_limiter` counts rule evaluations, not requests.
+`rule_evaluations_total` is emitted **per evaluated rule** (including matched
+`:skip` rules); `checks_total` is emitted **exactly once per check**, whatever
+path the evaluation takes — so summing `checks_total` by `rate_limiter` counts
+requests through the limiter, and "no rule matched" is `matched="false"` on the
+check rather than a placeholder rule.
+
+Only matched rules are evaluated: a rule whose `match:` conditions are not
+satisfied emits nothing to `rule_evaluations_total` (match-testing is not an
+evaluation), so the counter has no "didn't match" population and needs no
+label for it. A matched `count_distinct` rule skipped by the missing-key
+fail-open also emits nothing here — it was never evaluated; that check is
+visible via `checks_total{error="true"}` and the
+`rate_limit_missing_count_distinct` log, which carries the rule name.
+
+During the transition the deprecated `calls_total` counter is additionally
+emitted at every point the diagram emits `rule_evaluations_total` (with its
+historical per-rule semantics, including the `rule="unmatched"` placeholder
+after the loop). It is not shown above to keep the diagram legible; see the
+Metrics table below.
 
 ### Actions
 
 The rule's `action` describes what the rule does; the result's `action`
 describes the outcome — what the caller should do — and is only ever `:allow`
-or `:block`. The counter is always incremented when a rule matches, except for
-`:skip` rules, which never touch Redis:
-
-| rule action | what it does                                  | exceeded? | result action | terminating?  |
-|-------------|-----------------------------------------------|-----------|---------------|---------------|
-| `:limit`    | count against the limit                       | no        | `:allow`      | no — continue |
-| `:limit`    | count against the limit                       | yes       | `:block`      | yes — stop    |
-| `:log`      | count against the limit (observability only)  | no        | `:allow`      | no — continue |
-| `:log`      | count against the limit (observability only)  | yes       | `:allow`      | no — continue |
-| `:skip`     | don't count (bypass)                          | n/a       | `:allow`      | yes — stop    |
+or `:block`. A matching rule increments its counter, with two exceptions:
+`:skip` rules never touch Redis, and a rule carrying `ban_for` whose ban is
+already in force short-circuits before incrementing. The `result` label on
+`rule_evaluations_total` records what each evaluation decided:
+
+| rule action | what it does                                  | exceeded? | result action | `result` label | terminating?  |
+|-------------|-----------------------------------------------|-----------|---------------|----------------|---------------|
+| `:limit`    | count against the limit                       | no        | `:allow`      | `allow`        | no — continue |
+| `:limit`    | count against the limit                       | yes       | `:block`      | `block`        | yes — stop    |
+| `:log`      | count against the limit (observability only)  | no        | `:allow`      | `allow`        | no — continue |
+| `:log`      | count against the limit (observability only)  | yes       | `:allow`      | `log`          | no — continue |
+| `:skip`     | don't count (bypass)                          | n/a       | `:allow`      | `skip`         | yes — stop    |
+
+A rule may also carry `ban_for`, which changes the accounting rather than the
+action. On crossing the limit it writes a ban that outlives the counting
+window, and it stops counting while that ban holds:
+
+| rule action | with `ban_for`                                | exceeded? | result action | `result` label | terminating?  |
+|-------------|-----------------------------------------------|-----------|---------------|----------------|---------------|
+| `:limit`    | count, or skip counting while banned          | yes       | `:block`      | `banned`       | yes — stop    |
+| `:log`      | same accounting, records what it would do     | yes       | `:allow`      | `banned`       | no — continue |
 
 - `:limit` — when exceeded, `Result#action` is `:block` and evaluation
   terminates. Caller should reject the request (e.g. with HTTP 429). When under
@@ -281,17 +336,53 @@ or `:block`. The counter is always incremented when a rule matches, except for
   `Result#action` `:allow` **without any Redis operation**: nothing is
   counted, so `limit`, `period`, `characteristics`, and `count_distinct` are
   inert and the result carries no `info` (`to_response_headers` is `{}`).
-  The match is still observable via `calls_total{action="skip"}`. Use this
-  for bypasses.
+  The match is still observable via `rule_evaluations_total{action="skip"}`.
+  Use this for bypasses.
+- `ban_for` — enforcement that outlives the window, on either counting action.
+  On crossing the limit the rule writes a second key that keeps blocking for
+  `ban_for` seconds, long after the counter window has expired. While that ban
+  is in force the rule reports `exceeded? == true` and does not count, so a
+  caller cannot extend its own ban, and `reset_at` reports when the ban lifts
+  rather than when the window rolls. Use this where repeated failures should
+  cost more than a window, such as authentication attempts. State can be
+  discarded early with [`#clear`](#clearing-state).
+
+  With `action: :limit` the ban blocks. With `action: :log` the rule does all
+  of the same accounting, including writing the ban and suppressing counting
+  while it holds, and only skips the blocking, so a shadow measures what
+  enforcement would have produced rather than approximating it.
+
+  A `ban_for` shorter than `period` is legal but surprising: the ban can lapse
+  while the counter is still over the limit, so `peek` reports not-exceeded
+  while the next `check` re-bans immediately. Bans are normally longer than the
+  window they are counted in.
+
+  The duration is whole seconds and must be at least 1, since the ban is
+  written with `SET EX`. A callable is checked again each time it resolves, and
+  a value under a second raises rather than reaching Redis. Being an error, it
+  fails open like any other, so a rule whose `ban_for` cannot resolve stops
+  blocking entirely: watch `errors_total` after changing one.
+
+  Take care combining `ban_for` with `cost:`. One expensive call can cross the
+  limit on its own, and with a ban attached that costs the caller the whole ban
+  rather than a single rejection. Checking with `peek` first has the same edge,
+  since the call it deliberately lets through is enough to start a ban. Bans
+  suit counting discrete failures, such as bad credentials, better than they
+  suit variable-cost resource limits.
 
 ### Redis keys
 
 Each matched check writes a key shaped:
 
 ```
-labkit:rl:<limiter_name>:<rule_name>:<char>:<value>[:<char>:<value>...]
+labkit:rl:{<limiter_name>:<rule_name>:<char>:<value>[:<char>:<value>...]}
 ```
 
+The braces are a Redis [hash tag](https://redis.io/docs/latest/operate/oss_and_stack/reference/cluster-spec/#hash-tags):
+on a Redis Cluster only the braced part decides the slot, so every key for one
+rule and identifier lands on the same shard. `BAN_SCRIPT` touches two keys in
+one call, and a cluster rejects a script whose keys span slots.
+
 Characteristic values longer than 200 bytes are replaced with a SHA-256
 hexdigest to bound key length. Missing or empty characteristic values are
 encoded as `_unknown_`. The TTL is set on the first write of each window and
@@ -299,9 +390,24 @@ is not extended on subsequent increments, so the window is a true fixed
 window starting at the first request, not a sliding window.
 
 A check is a single `EVALSHA` of `INCR_SCRIPT` (or `SADD_SCRIPT` for
-`count_distinct` rules). Doing the whole read-modify-write inside Lua means
-there is no window between the increment and the `EXPIRE` in which a key
-could be left without a TTL.
+`count_distinct` rules, or `BAN_SCRIPT` for rules carrying `ban_for`). Doing the whole
+read-modify-write inside Lua means there is no window between the increment
+and the `EXPIRE` in which a key could be left without a TTL.
+
+A rule carrying `ban_for` writes a second key alongside its counter, sharing the
+same hash tag and carrying its own `ban_for` TTL:
+
+```
+labkit:rl:{<limiter_name>:<rule_name>:<char>:<value>[:<char>:<value>...]}:ban
+```
+
+The suffix sits outside the tag, so it cannot change the slot and cannot
+collide with a characteristic value, and both keys are found by the same
+`labkit:rl:{<limiter>:<rule>*` glob. The ban key outlives its counter by
+design: that is the whole point of `ban_for`.
+`BAN_SCRIPT` checks the ban before incrementing, so the ban check,
+the increment and the ban write are one atomic operation and a concurrent
+check cannot miss the threshold crossing.
 
 ```mermaid
 sequenceDiagram
@@ -375,26 +481,53 @@ safe to merge unconditionally.
 
 The evaluator wraps `check` and `peek` in a broad rescue. Any `StandardError`
 (Redis connection failure, timeout, OOM in user-supplied callables, …) is
-logged at WARN with `message: "rate_limit_error"` and returned as an error
-`Result` (`matched?` false, `error?` true, `action` `:allow`). The
-`gitlab_labkit_rate_limiter_errors_total` counter is incremented. The caller
+logged at WARN with `error_type: "rate_limit_error"` and returned as an error
+`Result` (`matched?` false, `error?` true, `action` `:allow`). The caller
 should treat the request as allowed.
 
+A failed-open `check` is still counted: it emits
+`checks_total{action="allow", matched="false", error="true"}`, so the fraction
+of checks that encountered an error is `checks_total{error="true"}` over
+`checks_total`. `error="true"` also covers a check where a matched
+`count_distinct` rule was skipped because the identifier was missing its
+`count_distinct` key — that check completes (`action` and `matched` describe
+its outcome as usual), so `error="true"` is not exclusively fail-open traffic.
+
+The deprecated `gitlab_labkit_rate_limiter_errors_total` counter is still
+incremented on every fail-open (whole-check and per-rule `count_distinct`),
+and remains the only error metric for `peek`, which emits no `checks_total`
+(peek must not inflate the per-check counter). The follow-up MR that removes
+`errors_total` must first decide where `peek` errors go — a dedicated peek
+metric, or logs only.
+
+Metric emission itself is best-effort: a failure in the metrics stack never
+alters the verdict or breaks fail-open, and is logged at WARN with
+`error_type: "rate_limit_metrics_error"` (once per process, to avoid
+flooding).
+
 ## Metrics
 
 `Labkit::RateLimit::Metrics` emits the following Prometheus metrics through
 `Labkit::Metrics::Client`:
 
-| metric                                          | type    | labels                              | meaning                                                              |
-|-------------------------------------------------|---------|-------------------------------------|----------------------------------------------------------------------|
-| `gitlab_labkit_rate_limiter_calls_total`        | counter | `rate_limiter`, `rule`, `action`    | One increment per counted rule (plus one per matched `:skip` rule). `action` is the rule-level outcome: `"allow"` (under limit), `"limit"` (blocking `:limit` rule), `"log"` (exceeded `:log` rule), `"skip"`. `rule="unmatched", action="allow"` when no rule matched. |
-| `gitlab_labkit_rate_limiter_errors_total`       | counter | `rate_limiter`                      | Fail-open events (any `StandardError` in the labkit path).            |
-| `gitlab_labkit_rate_limiter_limit`              | gauge   | `rate_limiter`, `rule`              | Resolved limit at the last check (useful when `limit:` is callable). |
-| `gitlab_labkit_rate_limiter_period_seconds`     | gauge   | `rate_limiter`, `rule`              | Resolved period at the last check.                                   |
-
-Because every matching rule is counted, a single `check` call can emit
-**multiple** `calls_total` increments: one per counted rule (or a single
-`rule="unmatched"` increment if nothing matched).
+| metric                                              | type    | labels                                       | meaning                                                              |
+|-----------------------------------------------------|---------|----------------------------------------------|----------------------------------------------------------------------|
+| `gitlab_labkit_rate_limiter_checks_total`           | counter | `rate_limiter`, `action`, `matched`, `error` | Exactly one increment per `check` call, including fail-open. `action` is what the caller should do (`"allow"` or `"block"`); `matched` and `error` are `"true"`/`"false"`. |
+| `gitlab_labkit_rate_limiter_rule_evaluations_total` | counter | `rate_limiter`, `rule`, `action`, `result`   | One increment per evaluated rule (plus one per matched `:skip` rule). `action` is the configured rule action (`"limit"`, `"log"`, `"skip"`); `result` is what the evaluation decided (`"allow"`, `"block"`, `"log"`, `"skip"`, `"banned"` — see the Actions table). |
+| `gitlab_labkit_rate_limiter_calls_total`            | counter | `rate_limiter`, `rule`, `action`             | **Deprecated** — superseded by `checks_total` + `rule_evaluations_total`. Historical per-rule counter: one increment per counted rule (plus one per matched `:skip` rule), `rule="unmatched", action="allow"` when no rule matched. Emitted unchanged during the transition. |
+| `gitlab_labkit_rate_limiter_errors_total`           | counter | `rate_limiter`                               | **Deprecated** — use `checks_total{error="true"}`. Fail-open events (any `StandardError` in the labkit path); still the only error metric for `peek`. |
+| `gitlab_labkit_rate_limiter_limit`                  | gauge   | `rate_limiter`, `rule`                       | Resolved limit at the last check (useful when `limit:` is callable). |
+| `gitlab_labkit_rate_limiter_period_seconds`         | gauge   | `rate_limiter`, `rule`                       | Resolved period at the last check.                                   |
+
+`sum by (rate_limiter) (rate(gitlab_labkit_rate_limiter_checks_total[5m]))` is
+the request rate through a limiter — no exclusions or dedup needed. A single
+`check` call emits **one** `checks_total` increment and as many
+`rule_evaluations_total` increments as rules it evaluated (possibly zero).
+
+**Transition:** the deprecated `calls_total` and `errors_total` counters keep
+emitting exactly as before this split, so existing dashboards and alerts stay
+correct while consumers migrate to the new counters. Both are removed in a
+follow-up major release once nothing consumes them.
 
 ## Dev/test vs production guards
 

data/lib/labkit/rate_limit/evaluator.rb

@@ -9,6 +9,7 @@ module Labkit
     # @api private
     class Evaluator
       REDIS_KEY_PREFIX = "labkit:rl"
+      BAN_KEY_SUFFIX = ":ban"
       CHAR_VALUE_MAX_LENGTH = 200
       MISSING_VALUE_SENTINEL = "_unknown_"
 
@@ -66,6 +67,50 @@ module Labkit
         return {count, ttl_after}
       LUA
 
+      # Atomic ban check + INCR + conditional ban write, for rules carrying
+      # ban_for.
+      #
+      # An active ban short-circuits before the increment, so a banned caller
+      # cannot extend its own window, matching Rack::Attack::Allow2Ban. This
+      # applies to :log rules too: a shadow that kept counting through its own
+      # ban would report more than enforcement would produce. The
+      # counter and the ban must be read and written together or a concurrent
+      # check can miss the threshold crossing.
+      #
+      # Returns {count, counter TTL, ban TTL}, where a ban TTL below zero means
+      # not banned.
+      BAN_SCRIPT = Labkit::Redis::Script.new(<<~LUA)
+        local rule_counter_key = KEYS[1]
+        local ban_key = KEYS[2]
+
+        local ttl = ARGV[1]
+        local cost = tonumber(ARGV[2])
+        local limit = tonumber(ARGV[3])
+        local ban_for = tonumber(ARGV[4])
+
+        -- TTL answers both questions at once: >= 0 means the ban key exists
+        -- and tells us how long is left, so no separate EXISTS is needed.
+        local ban_ttl = redis.call('TTL', ban_key)
+        if ban_ttl >= 0 then
+          local existing = redis.call('GET', rule_counter_key)
+          return {existing or '0', redis.call('TTL', rule_counter_key), ban_ttl}
+        end
+
+        local count = redis.call('INCRBYFLOAT', rule_counter_key, cost)
+        local ttl_after = redis.call('TTL', rule_counter_key)
+        if ttl_after < 0 then
+          redis.call('EXPIRE', rule_counter_key, ttl)
+          ttl_after = tonumber(ttl)
+        end
+
+        if tonumber(count) > limit then
+          redis.call('SET', ban_key, '1', 'EX', ban_for)
+          return {count, ttl_after, ban_for}
+        end
+
+        return {count, ttl_after, -1}
+      LUA
+
       def initialize(name:, rules:, redis:, logger:)
         @name   = name
         @rules  = rules
@@ -75,13 +120,17 @@ module Labkit
 
       def check(identifier, cost: 1, rule_context: nil)
         cursor = RuleCursor.new
-        check_rules(identifier, cost, rule_context, cursor)
+        result = check_rules(identifier, cost, rule_context, cursor)
       rescue StandardError => e
         # Intentionally broad: fail-open applies to any unexpected error (network,
         # timeout, OOM) not only Redis protocol errors.
         report_error_metrics
         log_error(e, identifier, cursor.rule)
-        Result.error
+        result = Result.error
+      ensure
+        # StandardError-safe emission, so it cannot mask a propagating error.
+        # result is nil when a non-StandardError unwinds: emit nothing then.
+        report_check_metrics(result) if result
       end
 
       # Read-without-increment counterpart to {#check}. Same matching and Result
@@ -96,6 +145,41 @@ module Labkit
         Result.error
       end
 
+      # Deletes this limiter's counters, and any bans, for one identifier.
+      #
+      # Every rule is cleared, matched or not: a caller clearing state after a
+      # success knows the identifier, not which rules happened to match on the
+      # way in. Rules whose keys do not exist are a no-op.
+      #
+      # Fails open like {#check}: an unreachable Redis leaves the state to
+      # expire on its own rather than raising into the caller.
+      def clear(identifier)
+        # Counted as we go, so a connection lost mid-loop still reports the keys
+        # that did go rather than claiming nothing was cleared.
+        removed = 0
+
+        key_groups = @rules.filter_map do |rule|
+          next if rule.action == :skip
+
+          [build_redis_key(rule, identifier), build_redis_key(rule, identifier, BAN_KEY_SUFFIX)]
+        end
+
+        return 0 if key_groups.empty?
+
+        # One DEL per rule. The hash tag holds the rule name, so a rule's own
+        # keys share a slot but two rules do not, and Redis Cluster rejects a
+        # DEL spanning slots.
+        @redis.with do |conn|
+          key_groups.each { |group| removed += conn.del(*group) }
+        end
+
+        removed
+      rescue StandardError => e
+        report_error_metrics
+        log_error(e, identifier, nil)
+        removed
+      end
+
       private
 
       # Every rule that matches is evaluated and counted; matching does not
@@ -104,21 +188,29 @@ module Labkit
       # - :skip terminates on match without touching Redis. No counter is
       #   incremented, so the branch sits before the count_distinct check
       #   (identifier completeness is irrelevant to a rule that builds no key).
-      #   calls_total still increments so the bypass stays observable.
+      #   rule_evaluations_total still increments so the bypass stays observable.
       # - a :limit rule over its limit terminates, because the request is
       #   rejected and later rules cannot change that. Rules declared after it
       #   are neither counted nor evaluated, so a blocked request debits every
       #   rule up to and including the one that blocked, and none after it.
+      #   A :limit rule carrying ban_for counts as over its limit for as long
+      #   as its ban holds, so it terminates for the whole ban. The same rule
+      #   with action :log does identical accounting and terminates nothing,
+      #   which is what makes it a faithful shadow.
       #
       # Every other matched rule - :log, and :limit while under its limit - is
       # counted and collected into the returned Result, which reports the
       # most-constraining evaluation (ranking lives in Result::Evaluation#<=>).
       # cost is therefore debited from every matching rule, not just the first.
       #
+      # Metrics: each evaluated rule emits rule_evaluations_total (plus the
+      # deprecated per-rule calls_total); the per-check checks_total is
+      # emitted once in #check. Full contract in the README's Metrics section.
+      #
       # SET-mode rules (rule.count_distinct set) that match but whose identifier
-      # is missing the count_distinct key fail open + log + bump errors_total, and
-      # the loop continues to the next rule (the rule is treated as not applicable
-      # rather than aborting the whole evaluation).
+      # is missing the count_distinct key fail open + log + bump errors_total +
+      # flag the Result, and the loop continues to the next rule (the rule is
+      # treated as not applicable rather than aborting the whole evaluation).
       #
       # Error handling stays whole-check (see #check): a raise part-way through
       # discards the results of the rules already evaluated, even though their
@@ -143,12 +235,13 @@ module Labkit
           if rule.count_distinct && missing_count_distinct_value?(rule, identifier)
             log_missing_count_distinct(rule, identifier)
             report_error_metrics
+            result.degraded!
             next
           end
 
           evaluation = evaluate_rule(rule, identifier, cost, rule_context)
           result.add_evaluation(evaluation)
-          report_matched_metrics(evaluation)
+          report_evaluation_metrics(evaluation)
           return result if result.block?
         end
 
@@ -157,6 +250,12 @@ module Labkit
 
         report_unmatched_metrics unless result.matched?
         result
+      rescue StandardError => e # binds e for the ensure
+        raise
+      ensure
+        # Keep the rule attributed while an exception unwinds; clear it on
+        # every normal exit (early returns included).
+        cursor.rule = nil unless e
       end
 
       # Mirror of check_rules without metrics or writes. :log rules are read
@@ -180,9 +279,11 @@ module Labkit
           return result if result.block?
         end
 
-        cursor.rule = nil
-
         result
+      rescue StandardError => e # binds e for the ensure
+        raise
+      ensure
+        cursor.rule = nil unless e
       end
 
       def rule_matches?(rule, identifier)
@@ -195,6 +296,8 @@ module Labkit
       end
 
       def evaluate_rule(rule, identifier, cost, rule_context)
+        return evaluate_ban_rule(rule, identifier, cost, rule_context) if rule.ban_for
+
         redis_key = build_redis_key(rule, identifier)
         resolved_limit = Integer(resolve_value(rule.limit, rule_context))
         resolved_period = Integer(resolve_value(rule.period, rule_context))
@@ -212,6 +315,8 @@ module Labkit
       end
 
       def peek_rule(rule, identifier, rule_context)
+        return peek_ban_rule(rule, identifier, rule_context) if rule.ban_for
+
         redis_key = build_redis_key(rule, identifier)
         resolved_limit = Integer(resolve_value(rule.limit, rule_context))
         resolved_period = Integer(resolve_value(rule.period, rule_context))
@@ -220,6 +325,63 @@ module Labkit
         build_evaluation(rule, resolved_limit, resolved_period, count, ttl)
       end
 
+      def evaluate_ban_rule(rule, identifier, cost, rule_context)
+        resolved_limit = Integer(resolve_value(rule.limit, rule_context))
+        resolved_period = Integer(resolve_value(rule.period, rule_context))
+        resolved_ban_for = resolve_ban_for(rule, rule_context)
+
+        count, ttl, ban_ttl = ban_incr_with_ttl(
+          build_redis_key(rule, identifier),
+          build_redis_key(rule, identifier, BAN_KEY_SUFFIX),
+          resolved_period, cost, resolved_limit, resolved_ban_for
+        )
+
+        build_ban_evaluation(rule, resolved_limit, resolved_period, count, ttl, ban_ttl)
+      end
+
+      # A callable ban_for is only checked at construction, so it can still hand
+      # back something Redis would reject on the SET that writes the ban. Failing
+      # here names ban_for rather than surfacing a line number from the script.
+      def resolve_ban_for(rule, rule_context)
+        raw = resolve_value(rule.ban_for, rule_context)
+        seconds = Integer(raw, exception: false)
+        raise ArgumentError, "ban_for resolved to #{raw.inspect}, need at least 1 second" if seconds.nil? || seconds < 1
+
+        seconds
+      end
+
+      def peek_ban_rule(rule, identifier, rule_context)
+        resolved_limit = Integer(resolve_value(rule.limit, rule_context))
+        resolved_period = Integer(resolve_value(rule.period, rule_context))
+
+        count, ttl, ban_ttl = read_ban_with_ttl(
+          build_redis_key(rule, identifier),
+          build_redis_key(rule, identifier, BAN_KEY_SUFFIX)
+        )
+
+        build_ban_evaluation(rule, resolved_limit, resolved_period, count, ttl, ban_ttl)
+      end
+
+      # A ban blocks whether it was written by this call or an earlier one, so
+      # +exceeded+ tracks the ban rather than the count: once the counter window
+      # has expired the count can sit below the limit while the ban still holds.
+      # reset_at reports when the caller may retry, which is the ban expiry.
+      def build_ban_evaluation(rule, resolved_limit, resolved_period, count, ttl, ban_ttl)
+        banned = ban_ttl >= 0
+        window_remaining = ttl >= 0 ? ttl : resolved_period
+
+        info = Result::Info.new(
+          resolved_limit: resolved_limit, resolved_period: resolved_period,
+          count: count,
+          # A ban outlives its counter, so count reads 0 once the window has
+          # gone. Nothing is remaining while the ban still blocks.
+          remaining: banned ? 0 : [resolved_limit - count, 0].max,
+          reset_at: Time.now.utc + (banned ? ban_ttl : window_remaining)
+        )
+
+        Result::Evaluation.new(rule: rule, exceeded: banned, info: info)
+      end
+
       def build_evaluation(rule, resolved_limit, resolved_period, count, ttl)
         info = Result::Info.new(
           resolved_limit: resolved_limit, resolved_period: resolved_period,
@@ -231,12 +393,19 @@ module Labkit
         Result::Evaluation.new(rule: rule, exceeded: count > resolved_limit, info: info)
       end
 
-      def build_redis_key(rule, identifier)
-        key = "#{REDIS_KEY_PREFIX}:#{@name}:#{rule.name}"
+      # The limiter, rule and characteristics sit inside a Redis hash tag, so a
+      # counter and its ban always hash to the same cluster slot. BAN_SCRIPT
+      # touches both in one call, and Redis Cluster rejects a script whose keys
+      # span slots. +suffix+ is appended outside the tag, so it cannot change
+      # the slot and cannot collide with a characteristic value.
+      def build_redis_key(rule, identifier, suffix = nil)
+        key = "#{REDIS_KEY_PREFIX}:{#{@name}:#{rule.name}"
         rule.characteristics.each do |char|
           value = resolve_char_value(char, identifier)
-          key += ":#{char}:#{encode_char_value(value)}"
+          key << ":#{char}:#{encode_char_value(value)}"
         end
+        key << "}"
+        key << suffix if suffix
         key
       end
 
@@ -294,6 +463,30 @@ module Labkit
         end
       end
 
+      # Atomic ban check + increment + conditional ban write. See BAN_SCRIPT.
+      # The returned ban TTL is negative when no ban is in force.
+      def ban_incr_with_ttl(counter_key, ban_key, period, cost, limit, ban_for)
+        @redis.with do |conn|
+          raw_count, ttl, ban_ttl = BAN_SCRIPT.eval(
+            conn, keys: [counter_key, ban_key], argv: [period, cost, limit, ban_for]
+          )
+          [Float(raw_count), Integer(ttl), Integer(ban_ttl)]
+        end
+      end
+
+      # Pipelined read of both keys for #peek. No EXPIRE and no SET: peeking a
+      # banned identifier must not extend either the window or the ban.
+      def read_ban_with_ttl(counter_key, ban_key)
+        @redis.with do |conn|
+          raw_count, ttl, ban_ttl = conn.pipelined do |pipe|
+            pipe.get(counter_key)
+            pipe.ttl(counter_key)
+            pipe.ttl(ban_key)
+          end
+          [raw_count.nil? ? 0.0 : Float(raw_count), Integer(ttl), Integer(ban_ttl)]
+        end
+      end
+
       # Pipelined GET + TTL. No EXPIRE: peek must not extend the window.
       # A missing key (GET => nil, TTL => -2) is reported as count=0; the
       # build_evaluation fallback then derives reset_at from the rule period
@@ -341,6 +534,7 @@ module Labkit
       # loop reached one, or after it finished - so the field is logged as null
       # rather than omitted, the same way identifier is. A named rule is the rule
       # whose match or evaluation raised.
+      # Never raises: a logging failure must not break fail-open.
       def log_error(error, identifier, rule = nil)
         @logger.warn(
           name: @name,
@@ -350,6 +544,8 @@ module Labkit
           Labkit::Fields::ERROR_MESSAGE => error.message,
           identifier: identifier&.to_h
         )
+      rescue StandardError
+        nil
       end
 
       def log_missing_count_distinct(rule, identifier)
@@ -362,43 +558,67 @@ module Labkit
         )
       end
 
-      def report_matched_metrics(evaluation)
-        Metrics.calls_total.increment(
-          rate_limiter: @name,
-          rule: evaluation.rule.name,
-          action: (evaluation.exceeded? ? evaluation.rule.action : :allow).to_s
-        )
-        Metrics.limit_gauge.set(
-          { rate_limiter: @name, rule: evaluation.rule.name },
-          evaluation.info.resolved_limit
+      def report_evaluation_metrics(evaluation)
+        rule_labels = { rate_limiter: @name, rule: evaluation.rule.name }
+
+        Metrics.safe_increment(
+          :rule_evaluations_total,
+          rule_labels.merge(action: evaluation.rule.action.to_s, result: evaluation_result(evaluation)),
+          logger: @logger
         )
-        Metrics.period_gauge.set(
-          { rate_limiter: @name, rule: evaluation.rule.name },
-          evaluation.info.resolved_period
+        # Deprecated dual emission - remove together with Metrics.calls_total.
+        Metrics.safe_increment(
+          :calls_total,
+          rule_labels.merge(action: (evaluation.exceeded? ? evaluation.rule.action : :allow).to_s),
+          logger: @logger
         )
+        Metrics.safe_set(:limit_gauge, rule_labels, evaluation.info.resolved_limit, logger: @logger)
+        Metrics.safe_set(:period_gauge, rule_labels, evaluation.info.resolved_period, logger: @logger)
+      end
+
+      # An exceeded :log rule reports "log" rather than the "allow" the caller
+      # sees, so shadow rules over their limit stay visible.
+      # A ban is not a distinct action, so without this a blocking ban would be
+      # indistinguishable from an ordinary block. On a ban_for rule exceeded?
+      # means the ban is in force, whether this call wrote it or an earlier one
+      # did, which is exactly what is worth counting separately.
+      def evaluation_result(evaluation)
+        return "allow" unless evaluation.exceeded?
+        return "banned" if evaluation.rule.ban_for
+
+        evaluation.rule.action == :limit ? "block" : "log"
       end
 
-      # calls_total carries action="skip" (the rule action, not the :allow the
-      # caller sees) so bypass traffic stays distinguishable from counted
-      # allows. No limit/period gauges: a skip rule has no limit to report.
       def report_skipped_metrics(rule)
-        Metrics.calls_total.increment(
-          rate_limiter: @name,
-          rule: rule.name,
-          action: "skip"
+        Metrics.safe_increment(
+          :rule_evaluations_total,
+          { rate_limiter: @name, rule: rule.name, action: "skip", result: "skip" },
+          logger: @logger
         )
+        # Deprecated dual emission - remove together with Metrics.calls_total.
+        Metrics.safe_increment(:calls_total, { rate_limiter: @name, rule: rule.name, action: "skip" }, logger: @logger)
       end
 
+      # Deprecated dual emission - remove together with Metrics.calls_total.
       def report_unmatched_metrics
-        Metrics.calls_total.increment(
-          rate_limiter: @name,
-          rule: "unmatched",
-          action: "allow"
+        Metrics.safe_increment(:calls_total, { rate_limiter: @name, rule: "unmatched", action: "allow" }, logger: @logger)
+      end
+
+      def report_check_metrics(result)
+        Metrics.safe_increment(
+          :checks_total,
+          {
+            rate_limiter: @name,
+            action: result.action.to_s,
+            matched: result.matched?.to_s,
+            error: (result.error? || result.degraded?).to_s
+          },
+          logger: @logger
         )
       end
 
       def report_error_metrics
-        Metrics.errors_total.increment(rate_limiter: @name)
+        Metrics.safe_increment(:errors_total, { rate_limiter: @name }, logger: @logger)
       end
     end
   end

data/lib/labkit/rate_limit/limiter.rb

@@ -45,7 +45,7 @@ module Labkit
       #   the rule definition and the call site colocated.
       # @return [Result]
       def check(identifier, cost: 1, rule_context: nil)
-        id = identifier.is_a?(Identifier) ? identifier : Identifier.new(identifier)
+        id = to_identifier(identifier)
         @evaluator.check(id, cost: cost, rule_context: rule_context)
       end
 
@@ -65,12 +65,33 @@ module Labkit
       # @param rule_context [Hash, nil] see {#check}
       # @return [Result]
       def peek(identifier, rule_context: nil)
-        id = identifier.is_a?(Identifier) ? identifier : Identifier.new(identifier)
+        id = to_identifier(identifier)
         @evaluator.peek(id, rule_context: rule_context)
       end
 
+      # Discards this limiter's state for one identifier: every rule's counter,
+      # and any ban written by a rule carrying ban_for.
+      #
+      # For call sites where a later success should wipe earlier failures, such
+      # as an authentication ban cleared by a valid login. Counters otherwise
+      # only expire with their window; this is the only way to end one early.
+      #
+      # Scoped to this limiter and identifier, not to a single rule: a caller
+      # clearing after a success knows who succeeded, not which rules matched.
+      #
+      # @param identifier [Identifier, Hash] caller attributes
+      # @return [Integer] number of Redis keys removed; on a Redis error, those
+      #   removed before it failed
+      def clear(identifier)
+        @evaluator.clear(to_identifier(identifier))
+      end
+
       private
 
+      def to_identifier(identifier)
+        identifier.is_a?(Identifier) ? identifier : Identifier.new(identifier)
+      end
+
       def validate_name!(name)
         raise ArgumentError, "name must be a non-empty String" unless name.is_a?(String) && !name.empty?
         return name if NAME_PATTERN.match?(name)

data/lib/labkit/rate_limit/metrics.rb

@@ -1,14 +1,60 @@
 # frozen_string_literal: true
 
+require "concurrent-ruby"
+
 module Labkit
   module RateLimit
     module Metrics
+      # Process-wide once-latch for log_failure; specs reset via make_false.
+      FAILURE_LOGGED = Concurrent::AtomicBoolean.new(false)
+
       module_function
 
-      # Emitted once per *matched rule*, not once per check: every rule that
-      # matches is evaluated, so summing this by rate_limiter counts rule
-      # evaluations rather than requests. rule="unmatched", action="allow" is
-      # emitted only when no rule matched at all.
+      # Metric emission must never affect the caller's outcome. Resolving the
+      # metric by name keeps a raising getter inside the rescue.
+      def safe_increment(counter, labels, logger: nil)
+        public_send(counter).increment(**labels) # rubocop:disable GitlabSecurity/PublicSend
+      rescue StandardError => e
+        log_failure(e, counter, labels, logger)
+      end
+
+      # Gauge counterpart of safe_increment.
+      def safe_set(gauge, labels, value, logger: nil)
+        public_send(gauge).set(labels, value) # rubocop:disable GitlabSecurity/PublicSend
+      rescue StandardError => e
+        log_failure(e, gauge, labels, logger)
+      end
+
+      # make_true returns true only for the flipping caller, so exactly one
+      # warn per process. Never raises - a raise here would defeat the
+      # callers' rescues.
+      def log_failure(error, metric, labels, logger)
+        return unless logger && FAILURE_LOGGED.make_true
+
+        logger.warn(
+          name: labels[:rate_limiter],
+          metric: metric.to_s,
+          Labkit::Fields::ERROR_TYPE => "rate_limit_metrics_error",
+          Labkit::Fields::CLASS_NAME => error.class.to_s,
+          Labkit::Fields::ERROR_MESSAGE => error.message
+        )
+      rescue StandardError
+        nil
+      end
+
+      # Emitted exactly once per #check call, including calls that fail open;
+      # summing by rate_limiter gives the request rate through the limiter.
+      def checks_total
+        Labkit::Metrics::Client.counter(
+          :gitlab_labkit_rate_limiter_checks_total,
+          'Total number of rate limit checks',
+          { rate_limiter: nil, action: nil, matched: nil, error: nil }
+        )
+      end
+
+      # Deprecated: superseded by checks_total and rule_evaluations_total.
+      # Emitted unchanged (once per matched rule, rule="unmatched" when none
+      # matched) until consumers migrate; will get removed in a follow-up release.
       def calls_total
         Labkit::Metrics::Client.counter(
           :gitlab_labkit_rate_limiter_calls_total,
@@ -17,6 +63,18 @@ module Labkit
         )
       end
 
+      # Emitted once per *evaluated* rule. Only matched rules are evaluated:
+      # Unmatched traffic is checks_total{matched="false"}
+      def rule_evaluations_total
+        Labkit::Metrics::Client.counter(
+          :gitlab_labkit_rate_limiter_rule_evaluations_total,
+          'Total number of rate limit rule evaluations',
+          { rate_limiter: nil, rule: nil, action: nil, result: nil }
+        )
+      end
+
+      # Deprecated: superseded by checks_total{error="true"}. Still emitted
+      # because it remains the only error metric for #peek.
       def errors_total
         Labkit::Metrics::Client.counter(
           :gitlab_labkit_rate_limiter_errors_total,

data/lib/labkit/rate_limit/result.rb

@@ -25,6 +25,8 @@ module Labkit
     #               false). Other rules may also have matched and been counted;
     #               see #evaluations.
     # error?      - true if Redis was unavailable; result fails open (exceeded? is false)
+    # degraded?   - true if a matched count_distinct rule was skipped by the
+    #               missing-key fail-open path; the check still completed
     # info        - Result::Info with per-window counters for the reported rule;
     #               nil when matched? is false, error?, or the matched rule is
     #               :skip (no counter exists)
@@ -40,6 +42,7 @@ module Labkit
         @evaluations = []
         @skip_rule = nil
         @error = error
+        @degraded = false
         @most_constraining = nil
       end
 
@@ -78,6 +81,17 @@ module Labkit
         @error
       end
 
+      # Unlike error?, the check keeps going: the flag marks the outcome as
+      # degraded without changing it.
+      def degraded!
+        @degraded = true
+        self
+      end
+
+      def degraded?
+        @degraded
+      end
+
       def action
         block? ? :block : :allow
       end
@@ -119,9 +133,10 @@ module Labkit
     # exceeded - whether the post-increment count exceeded the resolved limit
     # info     - Result::Info with the per-window counters
     #
-    # Evaluations order by constraint: a blocking evaluation (:limit rule over
-    # its limit) ranks strictly first - it decides the request no matter what
-    # any other rule reports - then exceeded ones, then fewest remaining.
+    # Evaluations order by constraint: a blocking evaluation (a :limit rule over
+    # its limit, or one whose ban is still in force) ranks strictly first - it
+    # decides the request no matter what any other rule reports - then exceeded
+    # ones, then fewest remaining.
     # remaining floors at 0, so an exceeded :log rule ties with one sitting
     # exactly on its limit; ranking exceeded ahead keeps a breach from being
     # hidden by a rule that merely reached its limit.

data/lib/labkit/rate_limit/rule.rb

@@ -14,10 +14,17 @@ module Labkit
     # period          - window in seconds; may be a callable (resolved per check)
     # action          - :limit (enforce; the result blocks when the rule is over
     #                   its limit, which also terminates evaluation), :log (count
-    #                   and log only, never blocks and never terminates), or
-    #                   :skip (bypass: permit and terminate evaluation on match
-    #                   without counting; performs no Redis operation, so limit,
-    #                   period, characteristics, and count_distinct are inert)
+    #                   and log only, never blocks and never terminates),
+    #                   or :skip (bypass: permit and terminate evaluation on
+    #                   match without counting; performs no Redis operation, so
+    #                   limit, period, characteristics, and count_distinct are
+    #                   inert)
+    # ban_for         - optional ban duration in seconds. On crossing the limit
+    #                   the rule writes a separate ban key that outlives the
+    #                   counter window, and stops counting while it holds.
+    #                   +action+ still decides who is blocked: :limit enforces
+    #                   the ban, :log records what it would have done. Rejected
+    #                   on :skip. May be a callable, resolved per check.
     # characteristics - identifier keys used to build the compound Redis counter key
     # count_distinct  - optional Symbol naming an identifier key. When set, the rule
     #                   counts the number of distinct values seen for that key within
@@ -28,7 +35,27 @@ module Labkit
     # +name+ must be a lowercase alphanumeric-and-underscore string of at most 64
     # characters. It is used as the middle segment of every Redis counter key for
     # this rule, so changing a rule's name mid-window abandons its in-flight counters.
-    Rule = Data.define(:name, :match, :limit, :period, :action, :characteristics, :count_distinct) do
+    Rule = Data.define(:name, :match, :limit, :period, :action, :characteristics, :count_distinct, :ban_for) do
+      # ban_for changes the accounting; action still decides who gets blocked.
+      # A :skip rule counts nothing, so it has no limit to cross and no ban to
+      # write.
+      def self.normalize_ban_for(value, action_sym, count_distinct_sym)
+        return nil if value.nil?
+
+        raise ArgumentError, "ban_for is not valid on a :skip rule" if action_sym == :skip
+
+        # The ban path counts with INCRBYFLOAT, so a SET-backed rule would
+        # silently count calls instead of distinct values.
+        raise ArgumentError, "ban_for cannot be combined with count_distinct #{count_distinct_sym.inspect}" if count_distinct_sym
+
+        return value if value.respond_to?(:call)
+        # Whole seconds: the ban is written with SET EX, and anything under a
+        # second truncates to 0, which Redis rejects.
+        return value if value.is_a?(Numeric) && value >= 1
+
+        raise ArgumentError, "ban_for must be a Numeric of at least 1 second or a callable, got #{value.inspect}"
+      end
+
       def self.normalize_count_distinct(value, characteristics_arr)
         sym =
           case value
@@ -44,7 +71,10 @@ module Labkit
         sym
       end
 
-      def initialize(name:, limit:, period:, characteristics:, match: {}, action: :limit, count_distinct: nil)
+      def initialize(
+        name:, limit:, period:, characteristics:,
+        match: {}, action: :limit, count_distinct: nil, ban_for: nil
+      )
         raise ArgumentError, "name must be a String or Symbol, got #{name.class}" unless name.is_a?(String) || name.is_a?(Symbol)
 
         name_str = name.to_s
@@ -59,6 +89,7 @@ module Labkit
         end
 
         characteristics_arr = Array(characteristics).map(&:to_sym).freeze
+        count_distinct_sym = self.class.normalize_count_distinct(count_distinct, characteristics_arr)
 
         super(
           name: name_str.freeze,
@@ -67,7 +98,8 @@ module Labkit
           period: period,
           action: action_sym,
           characteristics: characteristics_arr,
-          count_distinct: self.class.normalize_count_distinct(count_distinct, characteristics_arr)
+          count_distinct: count_distinct_sym,
+          ban_for: self.class.normalize_ban_for(ban_for, action_sym, count_distinct_sym)
         )
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 4.4.1
+  version: 4.6.0
 platform: ruby
 authors:
 - Andrew Newdigate
@@ -716,7 +716,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Instrumentation for GitLab
 test_files: []