nb_api_client 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2082f32bdb205caf63485893abe3199b480329fde2079592e38ba4b53b37660d
-  data.tar.gz: 793459a2c5f1271be72812d91cbf8d251795c8dffa5d73edb4d0d68047ca62e8
+  metadata.gz: ef855607df4fa9e26f513dd0ead54a8110b30baf30af94d21f10a8b11de06b45
+  data.tar.gz: 9ddcd3bc22a1b7947fc74e0d789a498a5b252b980e0cefb92cf916afcdedb8af
 SHA512:
-  metadata.gz: efd0d26a0b2ac02fa0cd418b0ff27281fea5afa8122790d0ef36b83dc81216604d0395576b01207d4321de2cc39a446d03ee1b988ed1f5d18b85f79bbc5b26c2
-  data.tar.gz: d19ea9e67bb1689876e9d33d81c561ae452b59f41a5c736df151c4c7d90ef34a185a6b6c0602e1fcbfe496faf0fc90f15941fa99f4207c44112cf5c36c8cc3a8
+  metadata.gz: 027ae83f574dcfdccdfd1c0b138bc37f731ac24b5d7c0321874d7846115e99ff5d506ff896abb566770889024520a59825578b5933c5a6489994a5229f9f6735
+  data.tar.gz: afe137de2bc248504c9a83f6b4e84e266de8f077556db836f8a6c3601636aa2aed094a912994479ebcf08ada7e694165c107ed886559df6c0b7916b61653857a

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.2.0] - 2026-07-16
+
+- **Breaking:** Removed the `redis` and `connection_pool` gem dependencies, along with
+  `config.redis_url` and `config.rate_limit_pool_size`. `NbApiClient::RateLimiter` now
+  implements its sliding window (a bucketed sliding-window-counter algorithm) on top of
+  the existing `configuration.cache_store` (defaults to `Rails.cache`) instead of a
+  dedicated Redis connection pool and Lua script. Rate limiting is disabled entirely if
+  no `cache_store` is configured.
+
 ## [0.1.1] - 2026-07-16
 
 - Publish to rubygems.org instead of GitLab's RubyGems registry (which is

data/README.md

@@ -5,7 +5,7 @@ A rate-limited, token-refreshing HTTP client for the NationBuilder API, for use
 It provides two pieces:
 
 - `NbApiClient::Request` — makes a single authenticated API call, transparently retrying on rate limits and refreshing expired OAuth tokens.
-- `NbApiClient::RateLimiter` — a Redis-backed sliding-window rate limiter shared across every process/thread in your fleet, so you don't blow through NationBuilder's server-side rate limit when running many workers.
+- `NbApiClient::RateLimiter` — a sliding-window rate limiter, backed by your configured `cache_store` (defaults to `Rails.cache`), shared across every process/thread in your fleet, so you don't blow through NationBuilder's server-side rate limit when running many workers. If no `cache_store` is configured, rate limiting is disabled entirely.
 
 ## Installation
 
@@ -57,8 +57,9 @@ NbApiClient.configure do |config|
   config.unauthorized_error_threshold = 25
   config.unauthorized_error_window = 5 * 60
 
-  # Cache store used to count those unauthorized responses. Defaults to
-  # Rails.cache; must respond to #increment(key, amount, options).
+  # Cache store used to count those unauthorized responses, and (below) to
+  # back the sliding-window rate limiter. Defaults to Rails.cache; must
+  # respond to #increment(key, amount, options), #decrement, and #read.
   config.cache_store = Rails.cache
 
   # Logger for rate-limit/retry warnings. Defaults to Rails.logger.
@@ -69,12 +70,11 @@ NbApiClient.configure do |config|
   # rather stub HTTP at a lower level (e.g. WebMock/VCR) in your test suite.
   config.short_circuit_in_test = true
 
-  # Sliding-window rate limit enforced via Redis across every process.
+  # Sliding-window rate limit enforced via `cache_store` across every process.
+  # Disabled entirely if `cache_store` is nil.
   config.rate_limit = 200               # requests
   config.rate_limit_window_seconds = 10 # per this many seconds
   config.rate_limit_max_wait_seconds = 120
-  config.rate_limit_pool_size = 6        # Redis connection pool size
-  config.redis_url = ENV.fetch("REDIS_URL", "redis://localhost:6379/0")
 end
 ```
 
@@ -99,8 +99,6 @@ bundle install
 bundle exec rake test
 ```
 
-The two Lua-script integration tests in `rate_limiter_test.rb` are skipped automatically if no Redis is reachable at `REDIS_URL`.
-
 ## Releasing a new version
 
 1. Bump `NbApiClient::VERSION` in `lib/nb_api_client/version.rb` and add an entry to `CHANGELOG.md`.

data/lib/nb_api_client/configuration.rb

@@ -31,14 +31,13 @@ module NbApiClient
     attr_accessor :max_token_retries
 
     # Sliding-window rate limit: at most `rate_limit` requests per `rate_limit_window_seconds`,
-    # enforced across all processes via Redis.
+    # enforced across all processes via `cache_store` (above). If `cache_store` is nil,
+    # rate limiting is disabled entirely.
     attr_accessor :rate_limit
     attr_accessor :rate_limit_window_seconds
     attr_accessor :rate_limit_max_wait_seconds
     attr_accessor :rate_limit_poll_interval
     attr_accessor :rate_limit_max_jitter
-    attr_accessor :rate_limit_pool_size
-    attr_accessor :redis_url
 
     def initialize
       @cache_store = (defined?(Rails) && Rails.respond_to?(:cache)) ? Rails.cache : nil
@@ -55,8 +54,6 @@ module NbApiClient
       @rate_limit_max_wait_seconds = ENV.fetch("API_RATE_MAX_WAIT_SECONDS", 120).to_i
       @rate_limit_poll_interval = 0.25
       @rate_limit_max_jitter = 0.25
-      @rate_limit_pool_size = ENV.fetch("RATE_LIMITER_POOL_SIZE", 6).to_i
-      @redis_url = ENV.fetch("REDIS_URL", "redis://localhost:6379/0")
     end
   end
 end

data/lib/nb_api_client/rate_limiter.rb

@@ -1,42 +1,21 @@
 # frozen_string_literal: true
 
 module NbApiClient
-  # A global (cross-process, cross-thread) distributed rate limiter backed by Redis.
-  # Implements a sliding-window algorithm in a Lua script (atomic ZADD/ZREMRANGEBYSCORE/ZCARD
-  # on a sorted set) to enforce "N requests per window" across every process sharing the
-  # same Redis. All callers share one window (configure via NbApiClient.configure).
+  # A global (cross-process, cross-thread) distributed rate limiter backed by
+  # configuration.cache_store (the same store used for unauthorized-response
+  # tracking; defaults to Rails.cache). Implements a "sliding window counter"
+  # algorithm: each window is divided into fixed buckets, and the previous
+  # bucket's count is weighted by how much of it still overlaps the sliding
+  # window. This approximates a true sliding window without requiring
+  # sorted-set support, so it works with any ActiveSupport::Cache::Store
+  # (memory, Redis, Memcached, ...). All callers share one window (configure
+  # via NbApiClient.configure).
+  #
+  # If no cache_store is configured, rate limiting is disabled entirely (every
+  # request is allowed through immediately).
   class RateLimiter
     class RateLimitExhausted < StandardError; end
 
-    # 1. Remove all entries older than (now - window) to slide the window
-    # 2. Count remaining entries in the set
-    # 3. If under the limit, add a new entry (scored by timestamp) and return the new count
-    # 4. If at/over the limit, return -1 (rejected)
-    #
-    # The sorted set key is given a TTL of 2*window as a safety net to avoid
-    # unbounded memory growth if traffic stops entirely.
-    ACQUIRE_SLOT_SCRIPT = <<~LUA
-      local key = KEYS[1]
-      local limit = tonumber(ARGV[1])
-      local window = tonumber(ARGV[2])
-      local now = tonumber(ARGV[3])
-      local member = ARGV[4]
-
-      -- Prune entries outside the sliding window
-      redis.call('ZREMRANGEBYSCORE', key, '-inf', now - window)
-
-      local count = redis.call('ZCARD', key)
-
-      if count < limit then
-        redis.call('ZADD', key, now, member)
-        -- Safety-net expiry so the key doesn't live forever if traffic stops
-        redis.call('EXPIRE', key, window * 2)
-        return count + 1
-      else
-        return -1
-      end
-    LUA
-
     # Blocks until a request slot is available, then yields to the caller.
     # Raises RateLimitExhausted if the wait exceeds configuration.rate_limit_max_wait_seconds.
     def self.with_limit(&block)
@@ -66,33 +45,45 @@ module NbApiClient
           waited += sleep_time
         end
       end
-    rescue ConnectionPool::TimeoutError, Redis::BaseError, RedisClient::Error => e
-      # Fail open: if Redis is unavailable, allow the request through.
+    rescue RateLimitExhausted
+      raise
+    rescue StandardError => e
+      # Fail open: if the cache store is unavailable, allow the request through.
       # NbApiClient::Request's 429 handling acts as a safety net.
-      config.logger&.warn("[NbApiClient::RateLimiter] Redis error, failing open: #{e.class} - #{e.message}")
+      config.logger&.warn("[NbApiClient::RateLimiter] cache store error, failing open: #{e.class} - #{e.message}")
       yield
     end
 
     private
 
     # Attempts to acquire a slot in the sliding window.
-    # Returns the new count (positive) on success, or -1 if the window is full.
+    # Returns the new (weighted) count (positive) on success, or -1 if the window is full.
+    # Always succeeds (returns 1) if no cache_store is configured, i.e. rate limiting is disabled.
     def try_acquire_slot
       config = NbApiClient.configuration
+      store = config.cache_store
+      return 1 unless store
+
+      window = config.rate_limit_window_seconds
       now = Process.clock_gettime(Process::CLOCK_REALTIME)
-      member = "#{now}:#{SecureRandom.hex(4)}"
+      current_bucket = (now / window).floor
+      previous_bucket = current_bucket - 1
+      elapsed_in_current = now - (current_bucket * window)
+      previous_weight = [(window - elapsed_in_current) / window, 0.0].max
 
-      redis do |conn|
-        conn.eval(
-          ACQUIRE_SLOT_SCRIPT,
-          keys: [@key],
-          argv: [config.rate_limit.to_s, config.rate_limit_window_seconds.to_s, now.to_s, member]
-        )
-      end
-    end
+      # Safety-net expiry so bucket keys don't live forever if traffic stops.
+      current_count = store.increment("#{@key}:#{current_bucket}", 1, expires_in: window * 2)
+      previous_count = store.read("#{@key}:#{previous_bucket}") || 0
 
-    def redis(&block)
-      NbApiClient.connection_pool.with(&block)
+      weighted_count = current_count + (previous_count * previous_weight)
+
+      if weighted_count <= config.rate_limit
+        weighted_count
+      else
+        # Undo the increment so this rejected attempt doesn't count against the window.
+        store.decrement("#{@key}:#{current_bucket}", 1)
+        -1
+      end
     end
   end
 end

data/lib/nb_api_client/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NbApiClient
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/nb_api_client.rb

@@ -10,8 +10,6 @@ require "active_support/core_ext/object/inclusion"
 require "httparty"
 require "addressable/uri"
 require "oauth2"
-require "redis"
-require "connection_pool"
 
 require_relative "nb_api_client/version"
 require_relative "nb_api_client/configuration"
@@ -28,14 +26,5 @@ module NbApiClient
     def configure
       yield(configuration)
     end
-
-    # Lazily built so it always reflects the redis_url/pool_size in effect the
-    # first time a request needs it (i.e. after any NbApiClient.configure block
-    # has run).
-    def connection_pool
-      @connection_pool ||= ConnectionPool.new(size: configuration.rate_limit_pool_size, timeout: 3) {
-        Redis.new(url: configuration.redis_url)
-      }
-    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nb_api_client
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Alex Flint
@@ -66,34 +66,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: redis
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: connection_pool
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.4'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.4'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -123,7 +95,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '5.0'
 description: Wraps NationBuilder API requests with OAuth token refresh, deauthorization
-  handling, and a Redis-backed sliding-window rate limiter shared across processes.
+  handling, and a cache-store-backed sliding-window rate limiter shared across processes.
 email:
 executables: []
 extensions: []