@upstash/ratelimit 2.0.5 → 2.0.7

package/dist/index.d.mts

@@ -12,7 +12,7 @@ type EphemeralCache = {
     blockUntil: (identifier: string, reset: number) => void;
     set: (key: string, value: number) => void;
     get: (key: string) => number | null;
-    incr: (key: string) => number;
+    incr: (key: string, incrementAmount?: number) => number;
     pop: (key: string) => void;
     empty: () => void;
     size: () => number;
@@ -497,7 +497,7 @@ declare class MultiRegionRatelimit extends Ratelimit<MultiRegionContext> {
     window: Duration): Algorithm<MultiRegionContext>;
 }
 
-type Redis = Pick<Redis$1, "get" | "set">;
+type Redis = Pick<Redis$1, "evalsha" | "get" | "set">;
 type RegionRatelimitConfig = {
     /**
      * Instance of `@upstash/redis`

package/dist/index.d.ts

@@ -12,7 +12,7 @@ type EphemeralCache = {
     blockUntil: (identifier: string, reset: number) => void;
     set: (key: string, value: number) => void;
     get: (key: string) => number | null;
-    incr: (key: string) => number;
+    incr: (key: string, incrementAmount?: number) => number;
     pop: (key: string) => void;
     empty: () => void;
     size: () => number;
@@ -497,7 +497,7 @@ declare class MultiRegionRatelimit extends Ratelimit<MultiRegionContext> {
     window: Duration): Algorithm<MultiRegionContext>;
 }
 
-type Redis = Pick<Redis$1, "get" | "set">;
+type Redis = Pick<Redis$1, "evalsha" | "get" | "set">;
 type RegionRatelimitConfig = {
     /**
      * Instance of `@upstash/redis`

package/dist/index.js

@@ -115,9 +115,9 @@ var Cache = class {
   get(key) {
     return this.cache.get(key) || null;
   }
-  incr(key) {
+  incr(key, incrementAmount = 1) {
     let value = this.cache.get(key) ?? 0;
-    value += 1;
+    value += incrementAmount;
     this.cache.set(key, value);
     return value;
   }
@@ -168,13 +168,7 @@ var safeEval = async (ctx, script, keys, args) => {
     return await ctx.redis.evalsha(script.hash, keys, args);
   } catch (error) {
     if (`${error}`.includes("NOSCRIPT")) {
-      const hash = await ctx.redis.scriptLoad(script.script);
-      if (hash !== script.hash) {
-        console.warn(
-          "Upstash Ratelimit: Expected hash and the hash received from Redis are different. Ratelimit will work as usual but performance will be reduced."
-        );
-      }
-      return await ctx.redis.evalsha(hash, keys, args);
+      return await ctx.redis.eval(script.script, keys, args);
     }
     throw error;
   }
@@ -211,7 +205,7 @@ var slidingWindowLimitScript = `
   local tokens      = tonumber(ARGV[1]) -- tokens per window
   local now         = ARGV[2]           -- current timestamp in milliseconds
   local window      = ARGV[3]           -- interval in milliseconds
-  local incrementBy = ARGV[4]           -- increment rate per request at a given value, default is 1
+  local incrementBy = tonumber(ARGV[4]) -- increment rate per request at a given value, default is 1
 
   local requestsInCurrentWindow = redis.call("GET", currentKey)
   if requestsInCurrentWindow == false then
@@ -225,12 +219,14 @@ var slidingWindowLimitScript = `
   local percentageInCurrent = ( now % window ) / window
   -- weighted requests to consider from the previous window
   requestsInPreviousWindow = math.floor(( 1 - percentageInCurrent ) * requestsInPreviousWindow)
-  if requestsInPreviousWindow + requestsInCurrentWindow >= tokens then
+
+  -- Only check limit if not refunding (negative rate)
+  if incrementBy > 0 and requestsInPreviousWindow + requestsInCurrentWindow >= tokens then
     return -1
   end
 
   local newValue = redis.call("INCRBY", currentKey, incrementBy)
-  if newValue == tonumber(incrementBy) then
+  if newValue == incrementBy then
     -- The first time this key is set, the value will be equal to incrementBy.
     -- So we only need the expire command once
     redis.call("PEXPIRE", currentKey, window * 2 + 1000) -- Enough time to overlap with a new window + 1 second
@@ -287,7 +283,8 @@ var tokenBucketLimitScript = `
     refilledAt = refilledAt + numRefills * interval
   end
 
-  if tokens == 0 then
+  -- Only reject if tokens are 0 and we're consuming (not refunding)
+  if tokens == 0 and incrementBy > 0 then
     return {-1, refilledAt + interval}
   end
 
@@ -295,7 +292,10 @@ var tokenBucketLimitScript = `
   local expireAt = math.ceil(((maxTokens - remaining) / refillRate)) * interval
         
   redis.call("HSET", key, "refilledAt", refilledAt, "tokens", remaining)
-  redis.call("PEXPIRE", key, expireAt)
+
+  if (expireAt > 0) then
+    redis.call("PEXPIRE", key, expireAt)
+  end
   return {remaining, refilledAt + interval}
 `;
 var tokenBucketIdentifierNotFound = -1;
@@ -383,7 +383,9 @@ var slidingWindowLimitScript2 = `
 	end
 
 	local percentageInCurrent = ( now % window) / window
-	if requestsInPreviousWindow * (1 - percentageInCurrent ) + requestsInCurrentWindow >= tokens then
+
+	-- Only check limit if not refunding (negative rate)
+	if incrementBy > 0 and requestsInPreviousWindow * (1 - percentageInCurrent ) + requestsInCurrentWindow + incrementBy > tokens then
 	  return {currentFields, previousFields, false}
 	end
 
@@ -461,7 +463,7 @@ var SCRIPTS = {
     slidingWindow: {
       limit: {
         script: slidingWindowLimitScript,
-        hash: "e1391e429b699c780eb0480350cd5b7280fd9213"
+        hash: "9b7842963bd73721f1a3011650c23c0010848ee3"
       },
       getRemaining: {
         script: slidingWindowRemainingTokensScript,
@@ -471,7 +473,7 @@ var SCRIPTS = {
     tokenBucket: {
       limit: {
         script: tokenBucketLimitScript,
-        hash: "5bece90aeef8189a8cfd28995b479529e270b3c6"
+        hash: "d1f857ebbdaeca90ccd2cd4eada61d7c8e5db1ca"
       },
       getRemaining: {
         script: tokenBucketRemainingTokensScript,
@@ -503,7 +505,7 @@ var SCRIPTS = {
     slidingWindow: {
       limit: {
         script: slidingWindowLimitScript2,
-        hash: "cb4fdc2575056df7c6d422764df0de3a08d6753b"
+        hash: "1e7ca8dcd2d600a6d0124a67a57ea225ed62921b"
       },
       getRemaining: {
         script: slidingWindowRemainingTokensScript2,
@@ -979,7 +981,11 @@ var MultiRegionRatelimit = class extends Ratelimit {
     const windowDuration = ms(window);
     return () => ({
       async limit(ctx, identifier, rate) {
-        if (ctx.cache) {
+        const requestId = randomId();
+        const bucket = Math.floor(Date.now() / windowDuration);
+        const key = [identifier, bucket].join(":");
+        const incrementBy = rate ?? 1;
+        if (ctx.cache && incrementBy > 0) {
           const { blocked, reset: reset2 } = ctx.cache.isBlocked(identifier);
           if (blocked) {
             return {
@@ -992,10 +998,6 @@ var MultiRegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const requestId = randomId();
-        const bucket = Math.floor(Date.now() / windowDuration);
-        const key = [identifier, bucket].join(":");
-        const incrementBy = rate ? Math.max(1, rate) : 1;
         const dbs = ctx.regionContexts.map((regionContext) => ({
           redis: regionContext.redis,
           request: safeEval(
@@ -1006,24 +1008,29 @@ var MultiRegionRatelimit = class extends Ratelimit {
           )
         }));
         const firstResponse = await Promise.any(dbs.map((s) => s.request));
-        const usedTokens = firstResponse.reduce((accTokens, usedToken, index) => {
-          let parsedToken = 0;
-          if (index % 2) {
-            parsedToken = Number.parseInt(usedToken);
-          }
-          return accTokens + parsedToken;
-        }, 0);
+        const usedTokens = firstResponse.reduce(
+          (accTokens, usedToken, index) => {
+            let parsedToken = 0;
+            if (index % 2) {
+              parsedToken = Number.parseInt(usedToken);
+            }
+            return accTokens + parsedToken;
+          },
+          0
+        );
         const remaining = tokens - usedTokens;
         async function sync() {
           const individualIDs = await Promise.all(dbs.map((s) => s.request));
-          const allIDs = [...new Set(
-            individualIDs.flat().reduce((acc, curr, index) => {
-              if (index % 2 === 0) {
-                acc.push(curr);
-              }
-              return acc;
-            }, [])
-          ).values()];
+          const allIDs = [
+            ...new Set(
+              individualIDs.flat().reduce((acc, curr, index) => {
+                if (index % 2 === 0) {
+                  acc.push(curr);
+                }
+                return acc;
+              }, [])
+            ).values()
+          ];
           for (const db of dbs) {
             const usedDbTokensRequest = await db.request;
             const usedDbTokens = usedDbTokensRequest.reduce(
@@ -1037,12 +1044,15 @@ var MultiRegionRatelimit = class extends Ratelimit {
               0
             );
             const dbIdsRequest = await db.request;
-            const dbIds = dbIdsRequest.reduce((ids, currentId, index) => {
-              if (index % 2 === 0) {
-                ids.push(currentId);
-              }
-              return ids;
-            }, []);
+            const dbIds = dbIdsRequest.reduce(
+              (ids, currentId, index) => {
+                if (index % 2 === 0) {
+                  ids.push(currentId);
+                }
+                return ids;
+              },
+              []
+            );
             if (usedDbTokens >= tokens) {
               continue;
             }
@@ -1055,10 +1065,14 @@ var MultiRegionRatelimit = class extends Ratelimit {
             }
           }
         }
-        const success = remaining > 0;
+        const success = remaining >= 0;
         const reset = (bucket + 1) * windowDuration;
-        if (ctx.cache && !success) {
-          ctx.cache.blockUntil(identifier, reset);
+        if (ctx.cache) {
+          if (!success) {
+            ctx.cache.blockUntil(identifier, reset);
+          } else if (incrementBy < 0) {
+            ctx.cache.pop(identifier);
+          }
         }
         return {
           success,
@@ -1081,13 +1095,16 @@ var MultiRegionRatelimit = class extends Ratelimit {
           )
         }));
         const firstResponse = await Promise.any(dbs.map((s) => s.request));
-        const usedTokens = firstResponse.reduce((accTokens, usedToken, index) => {
-          let parsedToken = 0;
-          if (index % 2) {
-            parsedToken = Number.parseInt(usedToken);
-          }
-          return accTokens + parsedToken;
-        }, 0);
+        const usedTokens = firstResponse.reduce(
+          (accTokens, usedToken, index) => {
+            let parsedToken = 0;
+            if (index % 2) {
+              parsedToken = Number.parseInt(usedToken);
+            }
+            return accTokens + parsedToken;
+          },
+          0
+        );
         return {
           remaining: Math.max(0, tokens - usedTokens),
           reset: (bucket + 1) * windowDuration
@@ -1098,14 +1115,11 @@ var MultiRegionRatelimit = class extends Ratelimit {
         if (ctx.cache) {
           ctx.cache.pop(identifier);
         }
-        await Promise.all(ctx.regionContexts.map((regionContext) => {
-          safeEval(
-            regionContext,
-            RESET_SCRIPT,
-            [pattern],
-            [null]
-          );
-        }));
+        await Promise.all(
+          ctx.regionContexts.map((regionContext) => {
+            safeEval(regionContext, RESET_SCRIPT, [pattern], [null]);
+          })
+        );
       }
     });
   }
@@ -1130,7 +1144,14 @@ var MultiRegionRatelimit = class extends Ratelimit {
     const windowDuration = ms(window);
     return () => ({
       async limit(ctx, identifier, rate) {
-        if (ctx.cache) {
+        const requestId = randomId();
+        const now = Date.now();
+        const currentWindow = Math.floor(now / windowSize);
+        const currentKey = [identifier, currentWindow].join(":");
+        const previousWindow = currentWindow - 1;
+        const previousKey = [identifier, previousWindow].join(":");
+        const incrementBy = rate ?? 1;
+        if (ctx.cache && incrementBy > 0) {
           const { blocked, reset: reset2 } = ctx.cache.isBlocked(identifier);
           if (blocked) {
             return {
@@ -1143,13 +1164,6 @@ var MultiRegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const requestId = randomId();
-        const now = Date.now();
-        const currentWindow = Math.floor(now / windowSize);
-        const currentKey = [identifier, currentWindow].join(":");
-        const previousWindow = currentWindow - 1;
-        const previousKey = [identifier, previousWindow].join(":");
-        const incrementBy = rate ? Math.max(1, rate) : 1;
         const dbs = ctx.regionContexts.map((regionContext) => ({
           redis: regionContext.redis,
           request: safeEval(
@@ -1161,37 +1175,49 @@ var MultiRegionRatelimit = class extends Ratelimit {
           )
         }));
         const percentageInCurrent = now % windowDuration / windowDuration;
-        const [current, previous, success] = await Promise.any(dbs.map((s) => s.request));
+        const [current, previous, success] = await Promise.any(
+          dbs.map((s) => s.request)
+        );
         if (success) {
           current.push(requestId, incrementBy.toString());
         }
-        const previousUsedTokens = previous.reduce((accTokens, usedToken, index) => {
-          let parsedToken = 0;
-          if (index % 2) {
-            parsedToken = Number.parseInt(usedToken);
-          }
-          return accTokens + parsedToken;
-        }, 0);
-        const currentUsedTokens = current.reduce((accTokens, usedToken, index) => {
-          let parsedToken = 0;
-          if (index % 2) {
-            parsedToken = Number.parseInt(usedToken);
-          }
-          return accTokens + parsedToken;
-        }, 0);
-        const previousPartialUsed = Math.ceil(previousUsedTokens * (1 - percentageInCurrent));
+        const previousUsedTokens = previous.reduce(
+          (accTokens, usedToken, index) => {
+            let parsedToken = 0;
+            if (index % 2) {
+              parsedToken = Number.parseInt(usedToken);
+            }
+            return accTokens + parsedToken;
+          },
+          0
+        );
+        const currentUsedTokens = current.reduce(
+          (accTokens, usedToken, index) => {
+            let parsedToken = 0;
+            if (index % 2) {
+              parsedToken = Number.parseInt(usedToken);
+            }
+            return accTokens + parsedToken;
+          },
+          0
+        );
+        const previousPartialUsed = Math.ceil(
+          previousUsedTokens * (1 - percentageInCurrent)
+        );
         const usedTokens = previousPartialUsed + currentUsedTokens;
         const remaining = tokens - usedTokens;
         async function sync() {
           const res = await Promise.all(dbs.map((s) => s.request));
-          const allCurrentIds = [...new Set(
-            res.flatMap(([current2]) => current2).reduce((acc, curr, index) => {
-              if (index % 2 === 0) {
-                acc.push(curr);
-              }
-              return acc;
-            }, [])
-          ).values()];
+          const allCurrentIds = [
+            ...new Set(
+              res.flatMap(([current2]) => current2).reduce((acc, curr, index) => {
+                if (index % 2 === 0) {
+                  acc.push(curr);
+                }
+                return acc;
+              }, [])
+            ).values()
+          ];
           for (const db of dbs) {
             const [current2, _previous, _success] = await db.request;
             const dbIds = current2.reduce((ids, currentId, index) => {
@@ -1200,13 +1226,16 @@ var MultiRegionRatelimit = class extends Ratelimit {
               }
               return ids;
             }, []);
-            const usedDbTokens = current2.reduce((accTokens, usedToken, index) => {
-              let parsedToken = 0;
-              if (index % 2) {
-                parsedToken = Number.parseInt(usedToken);
-              }
-              return accTokens + parsedToken;
-            }, 0);
+            const usedDbTokens = current2.reduce(
+              (accTokens, usedToken, index) => {
+                let parsedToken = 0;
+                if (index % 2) {
+                  parsedToken = Number.parseInt(usedToken);
+                }
+                return accTokens + parsedToken;
+              },
+              0
+            );
             if (usedDbTokens >= tokens) {
               continue;
             }
@@ -1220,8 +1249,12 @@ var MultiRegionRatelimit = class extends Ratelimit {
           }
         }
         const reset = (currentWindow + 1) * windowDuration;
-        if (ctx.cache && !success) {
-          ctx.cache.blockUntil(identifier, reset);
+        if (ctx.cache) {
+          if (!success) {
+            ctx.cache.blockUntil(identifier, reset);
+          } else if (incrementBy < 0) {
+            ctx.cache.pop(identifier);
+          }
         }
         return {
           success: Boolean(success),
@@ -1258,14 +1291,11 @@ var MultiRegionRatelimit = class extends Ratelimit {
         if (ctx.cache) {
           ctx.cache.pop(identifier);
         }
-        await Promise.all(ctx.regionContexts.map((regionContext) => {
-          safeEval(
-            regionContext,
-            RESET_SCRIPT,
-            [pattern],
-            [null]
-          );
-        }));
+        await Promise.all(
+          ctx.regionContexts.map((regionContext) => {
+            safeEval(regionContext, RESET_SCRIPT, [pattern], [null]);
+          })
+        );
       }
     });
   }
@@ -1314,7 +1344,8 @@ var RegionRatelimit = class extends Ratelimit {
       async limit(ctx, identifier, rate) {
         const bucket = Math.floor(Date.now() / windowDuration);
         const key = [identifier, bucket].join(":");
-        if (ctx.cache) {
+        const incrementBy = rate ?? 1;
+        if (ctx.cache && incrementBy > 0) {
           const { blocked, reset: reset2 } = ctx.cache.isBlocked(identifier);
           if (blocked) {
             return {
@@ -1327,7 +1358,6 @@ var RegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const incrementBy = rate ? Math.max(1, rate) : 1;
         const usedTokensAfterUpdate = await safeEval(
           ctx,
           SCRIPTS.singleRegion.fixedWindow.limit,
@@ -1337,8 +1367,12 @@ var RegionRatelimit = class extends Ratelimit {
         const success = usedTokensAfterUpdate <= tokens;
         const remainingTokens = Math.max(0, tokens - usedTokensAfterUpdate);
         const reset = (bucket + 1) * windowDuration;
-        if (ctx.cache && !success) {
-          ctx.cache.blockUntil(identifier, reset);
+        if (ctx.cache) {
+          if (!success) {
+            ctx.cache.blockUntil(identifier, reset);
+          } else if (incrementBy < 0) {
+            ctx.cache.pop(identifier);
+          }
         }
         return {
           success,
@@ -1401,7 +1435,8 @@ var RegionRatelimit = class extends Ratelimit {
         const currentKey = [identifier, currentWindow].join(":");
         const previousWindow = currentWindow - 1;
         const previousKey = [identifier, previousWindow].join(":");
-        if (ctx.cache) {
+        const incrementBy = rate ?? 1;
+        if (ctx.cache && incrementBy > 0) {
           const { blocked, reset: reset2 } = ctx.cache.isBlocked(identifier);
           if (blocked) {
             return {
@@ -1414,7 +1449,6 @@ var RegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const incrementBy = rate ? Math.max(1, rate) : 1;
         const remainingTokens = await safeEval(
           ctx,
           SCRIPTS.singleRegion.slidingWindow.limit,
@@ -1423,8 +1457,12 @@ var RegionRatelimit = class extends Ratelimit {
         );
         const success = remainingTokens >= 0;
         const reset = (currentWindow + 1) * windowSize;
-        if (ctx.cache && !success) {
-          ctx.cache.blockUntil(identifier, reset);
+        if (ctx.cache) {
+          if (!success) {
+            ctx.cache.blockUntil(identifier, reset);
+          } else if (incrementBy < 0) {
+            ctx.cache.pop(identifier);
+          }
         }
         return {
           success,
@@ -1482,7 +1520,9 @@ var RegionRatelimit = class extends Ratelimit {
     const intervalDuration = ms(interval);
     return () => ({
       async limit(ctx, identifier, rate) {
-        if (ctx.cache) {
+        const now = Date.now();
+        const incrementBy = rate ?? 1;
+        if (ctx.cache && incrementBy > 0) {
           const { blocked, reset: reset2 } = ctx.cache.isBlocked(identifier);
           if (blocked) {
             return {
@@ -1495,8 +1535,6 @@ var RegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const now = Date.now();
-        const incrementBy = rate ? Math.max(1, rate) : 1;
         const [remaining, reset] = await safeEval(
           ctx,
           SCRIPTS.singleRegion.tokenBucket.limit,
@@ -1504,8 +1542,12 @@ var RegionRatelimit = class extends Ratelimit {
           [maxTokens, intervalDuration, refillRate, now, incrementBy]
         );
         const success = remaining >= 0;
-        if (ctx.cache && !success) {
-          ctx.cache.blockUntil(identifier, reset);
+        if (ctx.cache) {
+          if (!success) {
+            ctx.cache.blockUntil(identifier, reset);
+          } else if (incrementBy < 0) {
+            ctx.cache.pop(identifier);
+          }
         }
         return {
           success,
@@ -1577,10 +1619,10 @@ var RegionRatelimit = class extends Ratelimit {
         const bucket = Math.floor(Date.now() / windowDuration);
         const key = [identifier, bucket].join(":");
         const reset = (bucket + 1) * windowDuration;
-        const incrementBy = rate ? Math.max(1, rate) : 1;
+        const incrementBy = rate ?? 1;
         const hit = typeof ctx.cache.get(key) === "number";
         if (hit) {
-          const cachedTokensAfterUpdate = ctx.cache.incr(key);
+          const cachedTokensAfterUpdate = ctx.cache.incr(key, incrementBy);
           const success = cachedTokensAfterUpdate < tokens;
           const pending = success ? safeEval(
             ctx,