@upstash/ratelimit 0.1.0 → 0.1.3-rc.0

package/script/mod.js

@@ -1,18 +1,7 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./ratelimiter.js"), exports);
-__exportStar(require("./types.js"), exports);
+exports.MultiRegionRatelimit = exports.Ratelimit = void 0;
+var single_js_1 = require("./single.js");
+Object.defineProperty(exports, "Ratelimit", { enumerable: true, get: function () { return single_js_1.RegionRatelimit; } });
+var multi_js_1 = require("./multi.js");
+Object.defineProperty(exports, "MultiRegionRatelimit", { enumerable: true, get: function () { return multi_js_1.MultiRegionRatelimit; } });

package/script/multi.js

@@ -0,0 +1,232 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MultiRegionRatelimit = void 0;
+const duration_js_1 = require("./duration.js");
+const ratelimit_js_1 = require("./ratelimit.js");
+/**
+ * Ratelimiter using serverless redis from https://upstash.com/
+ *
+ * @example
+ * ```ts
+ * const { limit } = new MultiRegionRatelimit({
+ *    redis: Redis.fromEnv(),
+ *    limiter: MultiRegionRatelimit.fixedWindow(
+ *      10,     // Allow 10 requests per window of 30 minutes
+ *      "30 m", // interval of 30 minutes
+ *    )
+ * })
+ *
+ * ```
+ */
+class MultiRegionRatelimit extends ratelimit_js_1.Ratelimit {
+    /**
+     * Create a new Ratelimit instance by providing a `@upstash/redis` instance and the algorithn of your choice.
+     */
+    constructor(config) {
+        super({
+            prefix: config.prefix,
+            limiter: config.limiter,
+            ctx: { redis: config.redis },
+        });
+    }
+    /**
+     * Each requests inside a fixed time increases a counter.
+     * Once the counter reaches a maxmimum allowed number, all further requests are
+     * rejected.
+     *
+     * **Pro:**
+     *
+     * - Newer requests are not starved by old ones.
+     * - Low storage cost.
+     *
+     * **Con:**
+     *
+     * A burst of requests near the boundary of a window can result in a very
+     * high request rate because two windows will be filled with requests quickly.
+     *
+     * @param tokens - How many requests a user can make in each time window.
+     * @param window - A fixed timeframe
+     */
+    static fixedWindow(
+    /**
+     * How many requests are allowed per window.
+     */
+    tokens, 
+    /**
+     * The duration in which `tokens` requests are allowed.
+     */
+    window) {
+        const windowDuration = (0, duration_js_1.ms)(window);
+        const script = `
+    local key     = KEYS[1]
+    local id      = ARGV[1]
+    local window  = ARGV[2]
+    
+    redis.call("SADD", key, id)
+    local members = redis.call("SMEMBERS", key)
+    if #members == 1 then
+    -- The first time this key is set, the value will be 1.
+    -- So we only need the expire command once
+      redis.call("PEXPIRE", key, window)
+    end
+    
+    return members
+`;
+        return async function (ctx, identifier) {
+            const requestID = crypto.randomUUID();
+            const bucket = Math.floor(Date.now() / windowDuration);
+            const key = [identifier, bucket].join(":");
+            const dbs = ctx.redis.map((redis) => ({
+                redis,
+                request: redis.eval(script, [key], [requestID, windowDuration]),
+            }));
+            const firstResponse = await Promise.any(dbs.map((s) => s.request));
+            const usedTokens = firstResponse.length;
+            const remaining = tokens - usedTokens - 1;
+            /**
+             * If the length between two databases does not match, we sync the two databases
+             */
+            async function sync() {
+                const individualIDs = await Promise.all(dbs.map((s) => s.request));
+                const allIDs = Array.from(new Set(individualIDs.flatMap((_) => _)).values());
+                for (const db of dbs) {
+                    const ids = await db.request;
+                    /**
+                     * If the bucket in this db is already full, it doesn't matter which ids it contains.
+                     * So we do not have to sync.
+                     */
+                    if (ids.length >= tokens) {
+                        continue;
+                    }
+                    const diff = allIDs.filter((id) => !ids.includes(id));
+                    /**
+                     * Don't waste a request if there is nothing to send
+                     */
+                    if (diff.length === 0) {
+                        continue;
+                    }
+                    await db.redis.sadd(key, ...allIDs);
+                }
+            }
+            /**
+             * Do not await sync. This should not run in the critical path.
+             */
+            return {
+                success: remaining > 0,
+                limit: tokens,
+                remaining,
+                reset: (bucket + 1) * windowDuration,
+                pending: sync(),
+            };
+        };
+    }
+    /**
+     * Combined approach of `slidingLogs` and `fixedWindow` with lower storage
+     * costs than `slidingLogs` and improved boundary behavior by calcualting a
+     * weighted score between two windows.
+     *
+     * **Pro:**
+     *
+     * Good performance allows this to scale to very high loads.
+     *
+     * **Con:**
+     *
+     * Nothing major.
+     *
+     * @param tokens - How many requests a user can make in each time window.
+     * @param window - The duration in which the user can max X requests.
+     */
+    static slidingWindow(
+    /**
+     * How many requests are allowed per window.
+     */
+    tokens, 
+    /**
+     * The duration in which `tokens` requests are allowed.
+     */
+    window) {
+        const windowSize = (0, duration_js_1.ms)(window);
+        const script = `
+      local currentKey  = KEYS[1]           -- identifier including prefixes
+      local previousKey = KEYS[2]           -- key of the previous bucket
+      local tokens      = tonumber(ARGV[1]) -- tokens per window
+      local now         = ARGV[2]           -- current timestamp in milliseconds
+      local window      = ARGV[3]           -- interval in milliseconds
+      local requestID   = ARGV[4]           -- uuid for this request
+
+
+      local currentMembers = redis.call("SMEMBERS", currentKey)
+      local requestsInCurrentWindow = #currentMembers
+      local previousMembers = redis.call("SMEMBERS", previousKey)
+      local requestsInPreviousWindow = #previousMembers
+
+      local percentageInCurrent = ( now % window) / window
+      if requestsInPreviousWindow * ( 1 - percentageInCurrent ) + requestsInCurrentWindow >= tokens then
+        return {currentMembers, previousMembers}
+      end
+
+      redis.call("SADD", currentKey, requestID)
+      table.insert(currentMembers, requestID)
+      if requestsInCurrentWindow == 0 then 
+        -- The first time this key is set, the value will be 1.
+        -- So we only need the expire command once
+        redis.call("PEXPIRE", currentKey, window * 2 + 1000) -- Enough time to overlap with a new window + 1 second
+      end
+      return {currentMembers, previousMembers}
+      `;
+        const windowDuration = (0, duration_js_1.ms)(window);
+        return async function (ctx, identifier) {
+            const requestID = crypto.randomUUID();
+            const now = Date.now();
+            const currentWindow = Math.floor(now / windowSize);
+            const currentKey = [identifier, currentWindow].join(":");
+            const previousWindow = currentWindow - windowSize;
+            const previousKey = [identifier, previousWindow].join(":");
+            const dbs = ctx.redis.map((redis) => ({
+                redis,
+                request: redis.eval(script, [currentKey, previousKey], [tokens, now, windowDuration, requestID]),
+            }));
+            const percentageInCurrent = (now % windowDuration) / windowDuration;
+            const [current, previous] = await Promise.any(dbs.map((s) => s.request));
+            const usedTokens = previous.length * (1 - percentageInCurrent) +
+                current.length;
+            const remaining = tokens - usedTokens;
+            /**
+             * If a database differs from the consensus, we sync it
+             */
+            async function sync() {
+                const [individualIDs] = await Promise.all(dbs.map((s) => s.request));
+                const allIDs = Array.from(new Set(individualIDs.flatMap((_) => _)).values());
+                for (const db of dbs) {
+                    const [ids] = await db.request;
+                    /**
+                     * If the bucket in this db is already full, it doesn't matter which ids it contains.
+                     * So we do not have to sync.
+                     */
+                    if (ids.length >= tokens) {
+                        continue;
+                    }
+                    const diff = allIDs.filter((id) => !ids.includes(id));
+                    /**
+                     * Don't waste a request if there is nothing to send
+                     */
+                    if (diff.length === 0) {
+                        continue;
+                    }
+                    await db.redis.sadd(currentKey, ...allIDs);
+                }
+            }
+            /**
+             * Do not await sync. This should not run in the critical path.
+             */
+            return {
+                success: remaining > 0,
+                limit: tokens,
+                remaining,
+                reset: (currentWindow + 1) * windowDuration,
+                pending: sync(),
+            };
+        };
+    }
+}
+exports.MultiRegionRatelimit = MultiRegionRatelimit;

package/script/ratelimit.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Ratelimit = void 0;
+/**
+ * Ratelimiter using serverless redis from https://upstash.com/
+ *
+ * @example
+ * ```ts
+ * const { limit } = new Ratelimit({
+ *    redis: Redis.fromEnv(),
+ *    limiter: Ratelimit.slidingWindow(
+ *      10,     // Allow 10 requests per window of 30 minutes
+ *      "30 m", // interval of 30 minutes
+ *    )
+ * })
+ *
+ * ```
+ */
+class Ratelimit {
+    constructor(config) {
+        Object.defineProperty(this, "limiter", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "ctx", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "prefix", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /**
+         * Determine if a request should pass or be rejected based on the identifier and previously chosen ratelimit.
+         *
+         * Use this if you want to reject all requests that you can not handle right now.
+         *
+         * @example
+         * ```ts
+         *  const ratelimit = new Ratelimit({
+         *    redis: Redis.fromEnv(),
+         *    limiter: Ratelimit.slidingWindow(10, "10 s")
+         *  })
+         *
+         *  const { success } = await ratelimit.limit(id)
+         *  if (!success){
+         *    return "Nope"
+         *  }
+         *  return "Yes"
+         * ```
+         */
+        Object.defineProperty(this, "limit", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: async (identifier) => {
+                const key = [this.prefix, identifier].join(":");
+                return await this.limiter(this.ctx, key);
+            }
+        });
+        /**
+         * Block until the request may pass or timeout is reached.
+         *
+         * This method returns a promsie that resolves as soon as the request may be processed
+         * or after the timeoue has been reached.
+         *
+         * Use this if you want to delay the request until it is ready to get processed.
+         *
+         * @example
+         * ```ts
+         *  const ratelimit = new Ratelimit({
+         *    redis: Redis.fromEnv(),
+         *    limiter: Ratelimit.slidingWindow(10, "10 s")
+         *  })
+         *
+         *  const { success } = await ratelimit.blockUntilReady(id, 60_000)
+         *  if (!success){
+         *    return "Nope"
+         *  }
+         *  return "Yes"
+         * ```
+         */
+        Object.defineProperty(this, "blockUntilReady", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: async (
+            /**
+             * An identifier per user or api.
+             * Choose a userID, or api token, or ip address.
+             *
+             * If you want to limit your api across all users, you can set a constant string.
+             */
+            identifier, 
+            /**
+             * Maximum duration to wait in milliseconds.
+             * After this time the request will be denied.
+             */
+            timeout) => {
+                if (timeout <= 0) {
+                    throw new Error("timeout must be positive");
+                }
+                let res;
+                const deadline = Date.now() + timeout;
+                while (true) {
+                    res = await this.limit(identifier);
+                    if (res.success) {
+                        break;
+                    }
+                    if (res.reset === 0) {
+                        throw new Error("This should not happen");
+                    }
+                    const wait = Math.min(res.reset, deadline) - Date.now();
+                    await new Promise((r) => setTimeout(r, wait));
+                    if (Date.now() > deadline) {
+                        break;
+                    }
+                }
+                return res;
+            }
+        });
+        this.ctx = config.ctx;
+        this.limiter = config.limiter;
+        this.prefix = config.prefix ?? "@upstash/ratelimit";
+    }
+}
+exports.Ratelimit = Ratelimit;

package/script/{ratelimiter.js → single.js}

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Ratelimit = void 0;
+exports.RegionRatelimit = void 0;
 const duration_js_1 = require("./duration.js");
+const ratelimit_js_1 = require("./ratelimit.js");
 /**
  * Ratelimiter using serverless redis from https://upstash.com/
  *
@@ -17,142 +18,17 @@ const duration_js_1 = require("./duration.js");
  *
  * ```
  */
-class Ratelimit {
+class RegionRatelimit extends ratelimit_js_1.Ratelimit {
     /**
      * Create a new Ratelimit instance by providing a `@upstash/redis` instance and the algorithn of your choice.
      */
     constructor(config) {
-        Object.defineProperty(this, "redis", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
+        super({
+            prefix: config.prefix,
+            limiter: config.limiter,
+            ctx: { redis: config.redis },
         });
-        Object.defineProperty(this, "limiter", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "prefix", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        /**
-         * Determine if a request should pass or be rejected based on the identifier and previously chosen ratelimit.
-         *
-         * Use this if you want to reject all requests that you can not handle right now.
-         *
-         * @example
-         * ```ts
-         *  const ratelimit = new Ratelimit({
-         *    redis: Redis.fromEnv(),
-         *    limiter: Ratelimit.slidingWindow(10, "10 s")
-         *  })
-         *
-         *  const { success } = await ratelimit.limit(id)
-         *  if (!success){
-         *    return "Nope"
-         *  }
-         *  return "Yes"
-         * ```
-         */
-        Object.defineProperty(this, "limit", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: async (identifier) => {
-                const key = [this.prefix, identifier].join(":");
-                return await this.limiter({ redis: this.redis }, key);
-            }
-        });
-        /**
-         * Block until the request may pass or timeout is reached.
-         *
-         * This method returns a promsie that resolves as soon as the request may be processed
-         * or after the timeoue has been reached.
-         *
-         * Use this if you want to delay the request until it is ready to get processed.
-         *
-         * @example
-         * ```ts
-         *  const ratelimit = new Ratelimit({
-         *    redis: Redis.fromEnv(),
-         *    limiter: Ratelimit.slidingWindow(10, "10 s")
-         *  })
-         *
-         *  const { success } = await ratelimit.blockUntilReady(id, 60_000)
-         *  if (!success){
-         *    return "Nope"
-         *  }
-         *  return "Yes"
-         * ```
-         */
-        Object.defineProperty(this, "blockUntilReady", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: async (
-            /**
-             * An identifier per user or api.
-             * Choose a userID, or api token, or ip address.
-             *
-             * If you want to globally limit your api, you can set a constant string.
-             */
-            identifier, 
-            /**
-             * Maximum duration to wait in milliseconds.
-             * After this time the request will be denied.
-             */
-            timeout) => {
-                if (timeout <= 0) {
-                    throw new Error("timeout must be positive");
-                }
-                let res;
-                const deadline = Date.now() + timeout;
-                while (true) {
-                    res = await this.limit(identifier);
-                    if (res.success) {
-                        break;
-                    }
-                    if (res.reset === 0) {
-                        throw new Error("This should not happen");
-                    }
-                    const wait = Math.min(res.reset, deadline) - Date.now();
-                    await new Promise((r) => setTimeout(r, wait));
-                    if (Date.now() > deadline) {
-                        break;
-                    }
-                }
-                return res;
-            }
-        });
-        this.redis = config.redis;
-        this.limiter = config.limiter;
-        this.prefix = config.prefix ?? "@upstash/ratelimit";
     }
-    // EXPERIMENTAL
-    // static eventualWrite(tokens: number, window: Duration): Ratelimiter {
-    //   const windowDuration = ms(window);
-    //   return async function (ctx: Context, identifier: string) {
-    //     const bucket = Math.floor(Date.now() / windowDuration);
-    //     const key = [identifier, bucket].join(":");
-    //     const usedTokensAfterUpdate = (await ctx.redis.get<number>(key)) ?? 1;
-    //     ctx.redis.incr(key).then((res) => {
-    //       if (res === 1) {
-    //         ctx.redis.expire(key, windowDuration);
-    //       }
-    //     });
-    //     return {
-    //       success: usedTokensAfterUpdate <= tokens,
-    //       limit: tokens,
-    //       remaining: tokens - usedTokensAfterUpdate,
-    //       reset: (bucket + 1) * windowDuration,
-    //     };
-    //   };
-    // }
     /**
      * Each requests inside a fixed time increases a counter.
      * Once the counter reaches a maxmimum allowed number, all further requests are
@@ -203,6 +79,7 @@ class Ratelimit {
                 limit: tokens,
                 remaining: tokens - usedTokensAfterUpdate,
                 reset: (bucket + 1) * windowDuration,
+                pending: Promise.resolve(),
             };
         };
     }
@@ -274,6 +151,7 @@ class Ratelimit {
                 limit: tokens,
                 remaining,
                 reset: (currentWindow + 1) * windowSize,
+                pending: Promise.resolve(),
             };
         };
     }
@@ -353,8 +231,14 @@ class Ratelimit {
             const now = Date.now();
             const key = [identifier, Math.floor(now / intervalDuration)].join(":");
             const [remaining, reset] = (await ctx.redis.eval(script, [key], [maxTokens, intervalDuration, refillRate, now]));
-            return { success: remaining > 0, limit: maxTokens, remaining, reset };
+            return {
+                success: remaining > 0,
+                limit: maxTokens,
+                remaining,
+                reset,
+                pending: Promise.resolve(),
+            };
         };
     }
 }
-exports.Ratelimit = Ratelimit;
+exports.RegionRatelimit = RegionRatelimit;

package/script/types.js

@@ -1,5 +1,2 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Redis = void 0;
-const mod_js_1 = require("./deps/deno.land/x/upstash_redis@v1.3.3-alpha.1/mod.js");
-Object.defineProperty(exports, "Redis", { enumerable: true, get: function () { return mod_js_1.Redis; } });

package/types/mod.d.ts

@@ -1,2 +1,5 @@
-export * from "./ratelimiter.js";
-export * from "./types.js";
+export { RegionRatelimit as Ratelimit } from "./single.js";
+export type { RegionRatelimitConfig as RatelimitConfig } from "./single.js";
+export { MultiRegionRatelimit } from "./multi.js";
+export type { MultiRegionRatelimitConfig } from "./multi.js";
+export type { Algorithm } from "./types.js";

package/types/multi.d.ts

@@ -0,0 +1,98 @@
+import type { Duration } from "./duration.js";
+import type { Algorithm, MultiRegionContext } from "./types.js";
+import { Ratelimit } from "./ratelimit.js";
+import type { Redis } from "./types.js";
+export declare type MultiRegionRatelimitConfig = {
+    /**
+     * Instances of `@upstash/redis`
+     * @see https://github.com/upstash/upstash-redis#quick-start
+     */
+    redis: Redis[];
+    /**
+     * The ratelimiter function to use.
+     *
+     * Choose one of the predefined ones or implement your own.
+     * Available algorithms are exposed via static methods:
+     * - MultiRegionRatelimit.fixedWindow
+     */
+    limiter: Algorithm<MultiRegionContext>;
+    /**
+     * All keys in redis are prefixed with this.
+     *
+     * @default `@upstash/ratelimit`
+     */
+    prefix?: string;
+};
+/**
+ * Ratelimiter using serverless redis from https://upstash.com/
+ *
+ * @example
+ * ```ts
+ * const { limit } = new MultiRegionRatelimit({
+ *    redis: Redis.fromEnv(),
+ *    limiter: MultiRegionRatelimit.fixedWindow(
+ *      10,     // Allow 10 requests per window of 30 minutes
+ *      "30 m", // interval of 30 minutes
+ *    )
+ * })
+ *
+ * ```
+ */
+export declare class MultiRegionRatelimit extends Ratelimit<MultiRegionContext> {
+    /**
+     * Create a new Ratelimit instance by providing a `@upstash/redis` instance and the algorithn of your choice.
+     */
+    constructor(config: MultiRegionRatelimitConfig);
+    /**
+     * Each requests inside a fixed time increases a counter.
+     * Once the counter reaches a maxmimum allowed number, all further requests are
+     * rejected.
+     *
+     * **Pro:**
+     *
+     * - Newer requests are not starved by old ones.
+     * - Low storage cost.
+     *
+     * **Con:**
+     *
+     * A burst of requests near the boundary of a window can result in a very
+     * high request rate because two windows will be filled with requests quickly.
+     *
+     * @param tokens - How many requests a user can make in each time window.
+     * @param window - A fixed timeframe
+     */
+    static fixedWindow(
+    /**
+     * How many requests are allowed per window.
+     */
+    tokens: number, 
+    /**
+     * The duration in which `tokens` requests are allowed.
+     */
+    window: Duration): Algorithm<MultiRegionContext>;
+    /**
+     * Combined approach of `slidingLogs` and `fixedWindow` with lower storage
+     * costs than `slidingLogs` and improved boundary behavior by calcualting a
+     * weighted score between two windows.
+     *
+     * **Pro:**
+     *
+     * Good performance allows this to scale to very high loads.
+     *
+     * **Con:**
+     *
+     * Nothing major.
+     *
+     * @param tokens - How many requests a user can make in each time window.
+     * @param window - The duration in which the user can max X requests.
+     */
+    static slidingWindow(
+    /**
+     * How many requests are allowed per window.
+     */
+    tokens: number, 
+    /**
+     * The duration in which `tokens` requests are allowed.
+     */
+    window: Duration): Algorithm<MultiRegionContext>;
+}