@dotdo/postgres 0.1.0

package/src/middleware/rate-limit-concurrent.test.ts

@@ -0,0 +1,794 @@
+/**
+ * RED Phase Tests for Concurrent Request Rate Limiting
+ * Task: postgres-1odt.1 - [RED] Add concurrent request rate limit tests
+ *
+ * These tests verify rate limiting behavior under concurrent request conditions.
+ * The tests are designed to fail initially (RED phase of TDD) because:
+ * 1. The in-memory storage implementation lacks atomic operations
+ * 2. Race conditions exist in the current sliding window algorithm
+ * 3. No proper mutex/locking mechanism exists for concurrent access
+ *
+ * Once the GREEN phase (postgres-1odt.2) implements proper concurrency handling,
+ * these tests should pass.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Hono } from 'hono'
+import {
+  rateLimit,
+  tokenBucket,
+  SlidingWindowRateLimiter,
+  TokenBucketRateLimiter,
+  InMemoryRateLimitStorage,
+} from './rate-limit'
+import type { RateLimitStorage, RateLimitWindow } from './rate-limit'
+
+// ============================================================================
+// Helper Functions
+// ============================================================================
+
+/**
+ * Creates an array of concurrent requests to the same endpoint
+ */
+function createConcurrentRequests(
+  app: Hono,
+  count: number,
+  ip: string,
+  path = '/test'
+): Promise<Response>[] {
+  return Array(count)
+    .fill(null)
+    .map(() => app.request(path, { headers: { 'CF-Connecting-IP': ip } }))
+}
+
+/**
+ * Analyzes responses from concurrent requests
+ */
+function analyzeResponses(responses: Response[]): {
+  successCount: number
+  limitedCount: number
+  errorCount: number
+} {
+  return {
+    successCount: responses.filter((r) => r.status === 200).length,
+    limitedCount: responses.filter((r) => r.status === 429).length,
+    errorCount: responses.filter((r) => r.status !== 200 && r.status !== 429).length,
+  }
+}
+
+// ============================================================================
+// Atomic Operations Tests (RED - Expected to Fail)
+// ============================================================================
+
+describe('Concurrent request rate limiting - Atomic operations', () => {
+  let storage: InMemoryRateLimitStorage
+
+  beforeEach(() => {
+    storage = new InMemoryRateLimitStorage()
+  })
+
+  /**
+   * This test verifies that exactly N requests succeed when the limit is N,
+   * even under high concurrency. Currently FAILS due to race conditions.
+   */
+  it.fails('should enforce EXACT rate limit under concurrent requests', async () => {
+    const app = new Hono()
+    const LIMIT = 10
+
+    app.use(
+      '*',
+      rateLimit({
+        requests: LIMIT,
+        windowMs: 60000,
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Make 100 concurrent requests with a limit of 10
+    const requests = createConcurrentRequests(app, 100, '1.2.3.4')
+    const responses = await Promise.all(requests)
+    const { successCount, limitedCount } = analyzeResponses(responses)
+
+    // With proper atomic operations, EXACTLY 10 should succeed
+    // This test will FAIL because race conditions allow more than 10
+    expect(successCount).toBe(LIMIT)
+    expect(limitedCount).toBe(90)
+  })
+
+  /**
+   * This test verifies that the rate limiter uses atomic increment operations.
+   * Currently FAILS because the check-then-increment pattern is not atomic.
+   */
+  it.fails('should use atomic check-and-increment for rate limiting', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 5,
+      windowMs: 60000,
+      subWindows: 6,
+      storage,
+    })
+
+    // Make 20 concurrent checks on the same key
+    const promises = Array(20)
+      .fill(null)
+      .map(() => limiter.check('atomic-test-key'))
+
+    const results = await Promise.all(promises)
+    const allowedCount = results.filter((r) => !r.limited).length
+    const limitedCount = results.filter((r) => r.limited).length
+
+    // With atomic operations, exactly 5 should be allowed
+    // This test will FAIL because check-then-increment is not atomic
+    expect(allowedCount).toBe(5)
+    expect(limitedCount).toBe(15)
+  })
+
+  /**
+   * This test verifies that concurrent requests don't corrupt the window state.
+   * Currently FAILS because multiple concurrent read-modify-write cycles race.
+   */
+  it.fails('should maintain consistent window state under concurrent updates', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 100,
+      windowMs: 60000,
+      subWindows: 10,
+      storage,
+    })
+
+    // Make 50 concurrent requests
+    const promises = Array(50)
+      .fill(null)
+      .map(() => limiter.check('consistency-test-key'))
+
+    await Promise.all(promises)
+
+    // Read the final state directly from storage
+    const finalState = await storage.get('consistency-test-key')
+
+    // The total count should equal the number of allowed requests
+    // This test will FAIL if any updates were lost due to race conditions
+    expect(finalState).not.toBeNull()
+    expect(finalState!.total).toBe(50)
+  })
+
+  /**
+   * Tests that token bucket handles concurrent requests atomically
+   */
+  it.fails('should enforce exact token bucket limits under concurrency', async () => {
+    const app = new Hono()
+    const BUCKET_SIZE = 10
+
+    app.use(
+      '*',
+      tokenBucket({
+        bucketSize: BUCKET_SIZE,
+        tokensPerSecond: 0, // No refill during test
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Make 30 concurrent requests with bucket size of 10
+    const requests = createConcurrentRequests(app, 30, '1.2.3.4')
+    const responses = await Promise.all(requests)
+    const { successCount } = analyzeResponses(responses)
+
+    // With atomic token consumption, exactly 10 should succeed
+    // This test will FAIL because token consumption is not atomic
+    expect(successCount).toBe(BUCKET_SIZE)
+  })
+})
+
+// ============================================================================
+// Thread Safety Tests (RED - Expected to Fail)
+// ============================================================================
+
+describe('Concurrent request rate limiting - Thread safety', () => {
+  let storage: InMemoryRateLimitStorage
+
+  beforeEach(() => {
+    storage = new InMemoryRateLimitStorage()
+  })
+
+  /**
+   * Tests that rapid successive concurrent batches maintain correct state.
+   * Currently FAILS because there's no locking between batches.
+   */
+  it.fails('should handle rapid successive concurrent batches correctly', async () => {
+    const app = new Hono()
+    app.use(
+      '*',
+      rateLimit({
+        requests: 10,
+        windowMs: 60000,
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Send 3 rapid bursts of 5 concurrent requests each
+    const burst1 = Promise.all(createConcurrentRequests(app, 5, '1.2.3.4'))
+    const burst2 = Promise.all(createConcurrentRequests(app, 5, '1.2.3.4'))
+    const burst3 = Promise.all(createConcurrentRequests(app, 5, '1.2.3.4'))
+
+    const [responses1, responses2, responses3] = await Promise.all([burst1, burst2, burst3])
+    const allResponses = [...responses1, ...responses2, ...responses3]
+    const { successCount } = analyzeResponses(allResponses)
+
+    // With proper thread safety, exactly 10 should succeed
+    // This test will FAIL due to race conditions between bursts
+    expect(successCount).toBe(10)
+  })
+
+  /**
+   * Tests that rate limit state is not corrupted under stress.
+   * Currently FAILS because of read-modify-write race conditions.
+   */
+  it.fails('should not corrupt state under high concurrency stress', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 1000,
+      windowMs: 60000,
+      subWindows: 10,
+      storage,
+    })
+
+    // Create a stress test with 200 concurrent requests
+    const promises = Array(200)
+      .fill(null)
+      .map(() => limiter.check('stress-test-key'))
+
+    await Promise.all(promises)
+
+    // Verify state integrity
+    const state = await storage.get('stress-test-key')
+    expect(state).not.toBeNull()
+
+    // The sum of counts should equal total
+    const countsSum = state!.counts.reduce((a, b) => a + b, 0)
+    expect(countsSum).toBe(state!.total)
+
+    // Total should be 200 (all requests were within limit)
+    expect(state!.total).toBe(200)
+  })
+
+  /**
+   * Tests interleaved operations from multiple concurrent users
+   */
+  it.fails('should maintain isolation between concurrent users', async () => {
+    const app = new Hono()
+    app.use(
+      '*',
+      rateLimit({
+        requests: 5,
+        windowMs: 60000,
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Create interleaved requests from two users
+    const user1Requests = Array(10)
+      .fill(null)
+      .map(() => app.request('/test', { headers: { 'CF-Connecting-IP': 'user1' } }))
+
+    const user2Requests = Array(10)
+      .fill(null)
+      .map(() => app.request('/test', { headers: { 'CF-Connecting-IP': 'user2' } }))
+
+    // Interleave the requests
+    const interleaved = user1Requests.flatMap((r, i) => [r, user2Requests[i]!])
+    const responses = await Promise.all(interleaved)
+
+    // Separate responses by user
+    const user1Responses = responses.filter((_, i) => i % 2 === 0)
+    const user2Responses = responses.filter((_, i) => i % 2 === 1)
+
+    const user1Stats = analyzeResponses(user1Responses)
+    const user2Stats = analyzeResponses(user2Responses)
+
+    // Each user should have exactly 5 successful requests
+    // This test may fail if operations on one user affect another
+    expect(user1Stats.successCount).toBe(5)
+    expect(user2Stats.successCount).toBe(5)
+  })
+})
+
+// ============================================================================
+// Window Boundary Tests (RED - Expected to Fail)
+// ============================================================================
+
+describe('Concurrent request rate limiting - Window boundaries', () => {
+  let storage: InMemoryRateLimitStorage
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+    storage = new InMemoryRateLimitStorage()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  /**
+   * Tests concurrent requests at the exact window boundary.
+   * Currently FAILS because rotation logic is not atomic.
+   */
+  it.fails('should handle concurrent requests at window rotation atomically', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 5,
+      windowMs: 10000, // 10 second window
+      subWindows: 2, // 5 second sub-windows
+      storage,
+    })
+
+    // Make initial requests to fill one sub-window
+    await limiter.check('boundary-test')
+    await limiter.check('boundary-test')
+    await limiter.check('boundary-test')
+
+    // Advance to exactly the sub-window boundary
+    vi.advanceTimersByTime(5000)
+
+    // Now make concurrent requests at the rotation point
+    // These should trigger window rotation while handling the request
+    const promises = Array(10)
+      .fill(null)
+      .map(() => limiter.check('boundary-test'))
+
+    const results = await Promise.all(promises)
+    const allowed = results.filter((r) => !r.limited).length
+
+    // Window rotated, so we should have room for 2 more requests (5 - 3 = 2)
+    // Plus the rotated requests freed up some capacity
+    // This test will FAIL if rotation is not atomic with the check
+    expect(allowed).toBeLessThanOrEqual(5) // Should never exceed limit
+  })
+
+  /**
+   * Tests that window reset is handled correctly under concurrent load.
+   */
+  it.fails('should handle concurrent requests during window reset correctly', async () => {
+    const app = new Hono()
+    app.use(
+      '*',
+      rateLimit({
+        requests: 5,
+        windowMs: 5000, // 5 second window
+        subWindows: 5,
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Exhaust the rate limit
+    for (let i = 0; i < 5; i++) {
+      await app.request('/test', { headers: { 'CF-Connecting-IP': '1.2.3.4' } })
+    }
+
+    // Advance time to trigger window reset
+    vi.advanceTimersByTime(5001)
+
+    // Now make concurrent requests right after reset
+    const requests = createConcurrentRequests(app, 20, '1.2.3.4')
+    const responses = await Promise.all(requests)
+    const { successCount } = analyzeResponses(responses)
+
+    // After reset, exactly 5 should succeed
+    // This test will FAIL if reset handling is not atomic
+    expect(successCount).toBe(5)
+  })
+
+  /**
+   * Tests sliding window accuracy under concurrent partial window expiry.
+   */
+  it.fails('should maintain accurate counts during partial window expiry', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 10,
+      windowMs: 20000, // 20 second window
+      subWindows: 4, // 5 second sub-windows
+      storage,
+    })
+
+    // Fill first sub-window with 5 requests
+    for (let i = 0; i < 5; i++) {
+      await limiter.check('partial-expiry-test')
+    }
+
+    // Advance by one sub-window (5 seconds)
+    vi.advanceTimersByTime(5000)
+
+    // Make concurrent requests - some should succeed, some should fail
+    // based on the sliding window calculation
+    const promises = Array(10)
+      .fill(null)
+      .map(() => limiter.check('partial-expiry-test'))
+
+    const results = await Promise.all(promises)
+    const allowed = results.filter((r) => !r.limited).length
+
+    // With 5 requests in the window and limit of 10, we should allow 5 more
+    // This test will FAIL if the count calculation races with request processing
+    expect(allowed).toBe(5)
+  })
+})
+
+// ============================================================================
+// Distributed Rate Limiting Tests (RED - Expected to Fail)
+// ============================================================================
+
+describe('Concurrent request rate limiting - Distributed scenarios', () => {
+  /**
+   * Simulates distributed rate limiting with eventual consistency.
+   * Tests that rate limits are eventually enforced correctly.
+   */
+  it.fails('should enforce global rate limit across distributed instances with shared storage', async () => {
+    // Create a shared storage that simulates network latency
+    const sharedStorage = new InMemoryRateLimitStorage()
+    const latencyMs = 10
+
+    const createDelayedStorage = (): RateLimitStorage => ({
+      async get(key: string): Promise<RateLimitWindow | null> {
+        await new Promise((r) => setTimeout(r, latencyMs))
+        return sharedStorage.get(key)
+      },
+      async set(key: string, data: RateLimitWindow, ttlMs: number): Promise<void> {
+        await new Promise((r) => setTimeout(r, latencyMs))
+        return sharedStorage.set(key, data, ttlMs)
+      },
+    })
+
+    // Create two "instances" with the same shared storage
+    const app1 = new Hono()
+    app1.use(
+      '*',
+      rateLimit({
+        requests: 10,
+        windowMs: 60000,
+        storage: createDelayedStorage(),
+      })
+    )
+    app1.get('/test', (c) => c.text('app1'))
+
+    const app2 = new Hono()
+    app2.use(
+      '*',
+      rateLimit({
+        requests: 10,
+        windowMs: 60000,
+        storage: createDelayedStorage(),
+      })
+    )
+    app2.get('/test', (c) => c.text('app2'))
+
+    // Make concurrent requests to both instances
+    const requests = [
+      ...Array(15)
+        .fill(null)
+        .map(() => app1.request('/test', { headers: { 'CF-Connecting-IP': '1.2.3.4' } })),
+      ...Array(15)
+        .fill(null)
+        .map(() => app2.request('/test', { headers: { 'CF-Connecting-IP': '1.2.3.4' } })),
+    ]
+
+    const responses = await Promise.all(requests)
+    const { successCount } = analyzeResponses(responses)
+
+    // With proper distributed rate limiting, exactly 10 should succeed globally
+    // This test will FAIL because of eventual consistency issues
+    expect(successCount).toBe(10)
+  })
+
+  /**
+   * Tests rate limiting with storage that has compare-and-swap semantics.
+   * Currently there's no CAS support, so this will fail.
+   */
+  it.fails('should support compare-and-swap for atomic distributed updates', async () => {
+    // This test requires CAS semantics which don't exist yet
+    const storage = new InMemoryRateLimitStorage()
+
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 5,
+      windowMs: 60000,
+      subWindows: 6,
+      storage,
+    })
+
+    // Make concurrent requests that should use CAS
+    const promises = Array(20)
+      .fill(null)
+      .map(() => limiter.check('cas-test-key'))
+
+    const results = await Promise.all(promises)
+    const allowed = results.filter((r) => !r.limited).length
+
+    // With CAS, exactly 5 should be allowed
+    expect(allowed).toBe(5)
+  })
+
+  /**
+   * Tests that rate limit data is persisted correctly under concurrent writes.
+   */
+  it.fails('should persist rate limit data correctly under concurrent writes', async () => {
+    const storage = new InMemoryRateLimitStorage()
+
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 100,
+      windowMs: 60000,
+      subWindows: 10,
+      storage,
+    })
+
+    // Make 50 concurrent writes
+    const writePromises = Array(50)
+      .fill(null)
+      .map(() => limiter.check('persistence-test'))
+
+    await Promise.all(writePromises)
+
+    // Verify the persisted state is correct
+    const state = await storage.get('persistence-test')
+
+    expect(state).not.toBeNull()
+    expect(state!.total).toBe(50) // All 50 writes should be recorded
+    expect(state!.counts.reduce((a, b) => a + b, 0)).toBe(50)
+  })
+})
+
+// ============================================================================
+// Rate Limit Reset Under Concurrency Tests (RED - Expected to Fail)
+// ============================================================================
+
+describe('Concurrent request rate limiting - Reset behavior', () => {
+  let storage: InMemoryRateLimitStorage
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+    storage = new InMemoryRateLimitStorage()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  /**
+   * Tests that reset happens exactly once even with concurrent requests.
+   */
+  it.fails('should reset window exactly once under concurrent reset triggers', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 5,
+      windowMs: 5000,
+      subWindows: 5,
+      storage,
+    })
+
+    // Fill the window
+    for (let i = 0; i < 5; i++) {
+      await limiter.check('reset-once-test')
+    }
+
+    // Move past the window expiry
+    vi.advanceTimersByTime(5001)
+
+    // Make concurrent requests that will all try to reset the window
+    const promises = Array(20)
+      .fill(null)
+      .map(() => limiter.check('reset-once-test'))
+
+    const results = await Promise.all(promises)
+    const allowed = results.filter((r) => !r.limited).length
+
+    // After reset, exactly 5 should be allowed
+    // This test will FAIL if multiple resets occur or reset races with checks
+    expect(allowed).toBe(5)
+  })
+
+  /**
+   * Tests gradual refill under concurrent token bucket requests.
+   */
+  it.fails('should handle concurrent requests during token refill correctly', async () => {
+    const limiter = new TokenBucketRateLimiter({
+      bucketSize: 10,
+      tokensPerSecond: 5, // 5 tokens per second
+      tokensPerRequest: 1,
+      storage,
+    })
+
+    // Drain the bucket
+    for (let i = 0; i < 10; i++) {
+      await limiter.check('refill-test')
+    }
+
+    // Advance time to refill 5 tokens
+    vi.advanceTimersByTime(1000)
+
+    // Make concurrent requests for the refilled tokens
+    const promises = Array(15)
+      .fill(null)
+      .map(() => limiter.check('refill-test'))
+
+    const results = await Promise.all(promises)
+    const allowed = results.filter((r) => !r.limited).length
+
+    // Should allow exactly 5 (the refilled tokens)
+    // This test will FAIL if refill calculation races with token consumption
+    expect(allowed).toBe(5)
+  })
+
+  /**
+   * Tests that remaining count is accurate under concurrent access.
+   */
+  it.fails('should report accurate remaining count under concurrent access', async () => {
+    const app = new Hono()
+    app.use(
+      '*',
+      rateLimit({
+        requests: 10,
+        windowMs: 60000,
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Make 5 concurrent requests
+    const requests = createConcurrentRequests(app, 5, '1.2.3.4')
+    const responses = await Promise.all(requests)
+
+    // Get all remaining counts
+    const remainingCounts = responses.map((r) =>
+      parseInt(r.headers.get('X-RateLimit-Remaining') || '0', 10)
+    )
+
+    // With atomic operations, remaining counts should be consecutive
+    // E.g., [9, 8, 7, 6, 5] in some order
+    const sortedCounts = [...remainingCounts].sort((a, b) => b - a)
+    const expectedCounts = [9, 8, 7, 6, 5]
+
+    // This test will FAIL if counts are duplicated due to race conditions
+    expect(sortedCounts).toEqual(expectedCounts)
+  })
+})
+
+// ============================================================================
+// High-Load Stress Tests (RED - Expected to Fail)
+// ============================================================================
+
+describe('Concurrent request rate limiting - High load stress tests', () => {
+  let storage: InMemoryRateLimitStorage
+
+  beforeEach(() => {
+    storage = new InMemoryRateLimitStorage()
+  })
+
+  /**
+   * Tests rate limiting under extreme concurrency.
+   */
+  it.fails('should maintain correct limits under extreme concurrency', async () => {
+    const app = new Hono()
+    const LIMIT = 50
+
+    app.use(
+      '*',
+      rateLimit({
+        requests: LIMIT,
+        windowMs: 60000,
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Make 500 concurrent requests
+    const requests = createConcurrentRequests(app, 500, '1.2.3.4')
+    const responses = await Promise.all(requests)
+    const { successCount, limitedCount, errorCount } = analyzeResponses(responses)
+
+    // With proper concurrency handling:
+    // - Exactly 50 should succeed
+    // - Exactly 450 should be rate limited
+    // - No errors should occur
+    expect(errorCount).toBe(0)
+    expect(successCount).toBe(LIMIT)
+    expect(limitedCount).toBe(450)
+  })
+
+  /**
+   * Tests that rate limiting works correctly with many concurrent users.
+   */
+  it.fails('should handle many concurrent users correctly', async () => {
+    const app = new Hono()
+    const LIMIT = 3
+    const NUM_USERS = 20
+    const REQUESTS_PER_USER = 10
+
+    app.use(
+      '*',
+      rateLimit({
+        requests: LIMIT,
+        windowMs: 60000,
+        storage,
+      })
+    )
+    app.get('/test', (c) => c.text('ok'))
+
+    // Create requests for all users concurrently
+    const allRequests: Promise<Response>[] = []
+    for (let user = 0; user < NUM_USERS; user++) {
+      const userIp = `user-${user}`
+      for (let req = 0; req < REQUESTS_PER_USER; req++) {
+        allRequests.push(app.request('/test', { headers: { 'CF-Connecting-IP': userIp } }))
+      }
+    }
+
+    const responses = await Promise.all(allRequests)
+
+    // Group responses by user and verify each user has exactly LIMIT successes
+    for (let user = 0; user < NUM_USERS; user++) {
+      const userResponses = responses.slice(user * REQUESTS_PER_USER, (user + 1) * REQUESTS_PER_USER)
+      const { successCount } = analyzeResponses(userResponses)
+
+      // Each user should have exactly LIMIT successful requests
+      // This test will FAIL if user isolation is compromised under load
+      expect(successCount).toBe(LIMIT)
+    }
+  })
+
+  /**
+   * Tests memory consistency under sustained high load.
+   */
+  it.fails('should maintain memory consistency under sustained load', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 1000,
+      windowMs: 60000,
+      subWindows: 10,
+      storage,
+    })
+
+    // Simulate sustained load with multiple batches
+    const batches = 10
+    const requestsPerBatch = 100
+
+    for (let batch = 0; batch < batches; batch++) {
+      const promises = Array(requestsPerBatch)
+        .fill(null)
+        .map(() => limiter.check('sustained-load-key'))
+
+      await Promise.all(promises)
+    }
+
+    // Verify final state is consistent
+    const state = await storage.get('sustained-load-key')
+    expect(state).not.toBeNull()
+
+    const totalRequests = batches * requestsPerBatch // 1000
+    expect(state!.total).toBe(totalRequests)
+    expect(state!.counts.reduce((a, b) => a + b, 0)).toBe(totalRequests)
+  })
+
+  /**
+   * Tests that no requests are lost under high concurrency.
+   */
+  it.fails('should not lose any requests under high concurrency', async () => {
+    const limiter = new SlidingWindowRateLimiter({
+      requests: 10000, // High limit so nothing is rate limited
+      windowMs: 60000,
+      subWindows: 10,
+      storage,
+    })
+
+    const totalRequests = 500
+
+    // Make all requests concurrently
+    const promises = Array(totalRequests)
+      .fill(null)
+      .map(() => limiter.check('no-loss-key'))
+
+    const results = await Promise.all(promises)
+
+    // All should succeed (within limit)
+    const allowed = results.filter((r) => !r.limited).length
+    expect(allowed).toBe(totalRequests)
+
+    // Verify storage reflects all requests
+    const state = await storage.get('no-loss-key')
+    expect(state).not.toBeNull()
+    expect(state!.total).toBe(totalRequests)
+  })
+})