@upstash/ratelimit 2.1.0-rc → 2.2.0

package/dist/index.mjs

@@ -114,33 +114,30 @@ var DYNAMIC_LIMIT_KEY_SUFFIX = ":dynamic:global";
 var DEFAULT_PREFIX = "@upstash/ratelimit";
 
 // src/duration.ts
+var MULTIPLIERS = {
+  ms: 1,
+  s: 1e3,
+  m: 1e3 * 60,
+  h: 1e3 * 60 * 60,
+  d: 1e3 * 60 * 60 * 24,
+  w: 1e3 * 60 * 60 * 24 * 7
+};
 function ms(d) {
-  const match = d.match(/^(\d+)\s?(ms|s|m|h|d)$/);
+  const match = d.match(/^(\d+(?:\.\d+)?)\s?(ms|s|m|h|d|w)$/);
   if (!match) {
     throw new Error(`Unable to parse window size: ${d}`);
   }
-  const time = Number.parseInt(match[1]);
+  const time = Number.parseFloat(match[1]);
   const unit = match[2];
-  switch (unit) {
-    case "ms": {
-      return time;
-    }
-    case "s": {
-      return time * 1e3;
-    }
-    case "m": {
-      return time * 1e3 * 60;
-    }
-    case "h": {
-      return time * 1e3 * 60 * 60;
-    }
-    case "d": {
-      return time * 1e3 * 60 * 60 * 24;
-    }
-    default: {
-      throw new Error(`Unable to parse window size: ${d}`);
-    }
+  const multiplier = MULTIPLIERS[unit];
+  if (multiplier === void 0) {
+    throw new Error(`Unable to parse window size: ${d}`);
   }
+  const result = Math.round(time * multiplier);
+  if (result < 1) {
+    throw new Error(`Window size must be at least 1 ms, got: ${d}`);
+  }
+  return result;
 }
 
 // src/hash.ts
@@ -165,7 +162,7 @@ var fixedWindowLimitScript = `#!lua flags=allow-key-locking
 
   -- Check for dynamic limit
   local effectiveLimit = tokens
-  if dynamicLimitKey ~= "" then
+  if dynamicLimitKey and dynamicLimitKey ~= "" then
     local dynamicLimit = redis.call("GET", dynamicLimitKey)
     if dynamicLimit then
       effectiveLimit = tonumber(dynamicLimit)
@@ -188,7 +185,7 @@ var fixedWindowRemainingTokensScript = `#!lua flags=allow-key-locking
 
   -- Check for dynamic limit
   local effectiveLimit = tokens
-  if dynamicLimitKey ~= "" then
+  if dynamicLimitKey and dynamicLimitKey ~= "" then
     local dynamicLimit = redis.call("GET", dynamicLimitKey)
     if dynamicLimit then
       effectiveLimit = tonumber(dynamicLimit)
@@ -214,7 +211,7 @@ var slidingWindowLimitScript = `#!lua flags=allow-key-locking
 
   -- Check for dynamic limit
   local effectiveLimit = tokens
-  if dynamicLimitKey ~= "" then
+  if dynamicLimitKey and dynamicLimitKey ~= "" then
     local dynamicLimit = redis.call("GET", dynamicLimitKey)
     if dynamicLimit then
       effectiveLimit = tonumber(dynamicLimit)
@@ -257,7 +254,7 @@ var slidingWindowRemainingTokensScript = `#!lua flags=allow-key-locking
 
   -- Check for dynamic limit
   local effectiveLimit = tokens
-  if dynamicLimitKey ~= "" then
+  if dynamicLimitKey and dynamicLimitKey ~= "" then
     local dynamicLimit = redis.call("GET", dynamicLimitKey)
     if dynamicLimit then
       effectiveLimit = tonumber(dynamicLimit)
@@ -292,7 +289,7 @@ var tokenBucketLimitScript = `#!lua flags=allow-key-locking
 
   -- Check for dynamic limit
   local effectiveLimit = maxTokens
-  if dynamicLimitKey ~= "" then
+  if dynamicLimitKey and dynamicLimitKey ~= "" then
     local dynamicLimit = redis.call("GET", dynamicLimitKey)
     if dynamicLimit then
       effectiveLimit = tonumber(dynamicLimit)
@@ -319,8 +316,12 @@ var tokenBucketLimitScript = `#!lua flags=allow-key-locking
     refilledAt = refilledAt + numRefills * interval
   end
 
-  -- Only reject if tokens are 0 and we're consuming (not refunding)
-  if tokens == 0 and incrementBy > 0 then
+  -- Only reject when consuming (not refunding) and there are not enough tokens
+  -- for this request. Checking tokens == 0 only covered incrementBy == 1: with
+  -- a larger rate (e.g. 2 tokens left, incrementBy 5) the request fell through,
+  -- drove tokens negative and still wrote it back, so a rejected request
+  -- consumed tokens and a single large rate could lock the identifier out.
+  if incrementBy > 0 and tokens < incrementBy then
     return {-1, refilledAt + interval, effectiveLimit}
   end
 
@@ -342,7 +343,7 @@ var tokenBucketRemainingTokensScript = `#!lua flags=allow-key-locking
 
   -- Check for dynamic limit
   local effectiveLimit = maxTokens
-  if dynamicLimitKey ~= "" then
+  if dynamicLimitKey and dynamicLimitKey ~= "" then
     local dynamicLimit = redis.call("GET", dynamicLimitKey)
     if dynamicLimit then
       effectiveLimit = tonumber(dynamicLimit)
@@ -499,31 +500,31 @@ var SCRIPTS = {
     fixedWindow: {
       limit: {
         script: fixedWindowLimitScript,
-        hash: "4ef8749b9e927b157546ebad13061fa86b9ffc2e"
+        hash: "b2efc02798c8e9b471a10f9b1d5745db89923ff3"
       },
       getRemaining: {
         script: fixedWindowRemainingTokensScript,
-        hash: "e62252cb05b4676b27a5d396da02f0ca0d375d88"
+        hash: "823cb2a5a902d69681244f5e28e5ebb8f2a89edd"
       }
     },
     slidingWindow: {
       limit: {
         script: slidingWindowLimitScript,
-        hash: "5cd9665be7533e4dfabb3581021737fc69b41ae8"
+        hash: "74740bb3d7792848093cdef586b6b6037c455fd6"
       },
       getRemaining: {
         script: slidingWindowRemainingTokensScript,
-        hash: "1bdbbdb2082bb557084518c64486d7d5a29d1bfe"
+        hash: "7ca36169e0fc9caedd81b4eef8e99854c157f9b5"
       }
     },
     tokenBucket: {
       limit: {
         script: tokenBucketLimitScript,
-        hash: "8f7286b9b0f65d631f760ba615f7b3c598a569a3"
+        hash: "d60be5bd3d83482ae229309f1f7425424f891204"
       },
       getRemaining: {
         script: tokenBucketRemainingTokensScript,
-        hash: "08d3b3381c507b6f7bfec1bbfa0a6053434b16bd"
+        hash: "40daf4a441df736f5c99f8b77bbe176c909e5de4"
       }
     },
     cachedFixedWindow: {
@@ -848,7 +849,7 @@ var Ratelimit = class {
         throw new Error("This should not happen");
       }
       const wait = Math.min(res.reset, deadline) - Date.now();
-      await new Promise((r) => setTimeout(r, wait));
+      await new Promise((r) => setTimeout(r, wait > 0 ? wait : 100));
       if (Date.now() > deadline) {
         break;
       }
@@ -1037,7 +1038,7 @@ var Ratelimit = class {
 };
 
 // src/version.ts
-var VERSION = "2.1.0-rc";
+var VERSION = "2.2.0";
 
 // src/telemetry.ts
 var taggedClients = /* @__PURE__ */ new WeakSet();
@@ -1499,11 +1500,11 @@ var RegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const dynamicLimitKey = ctx.dynamicLimits ? `${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}` : "";
+        const dynamicLimitKeys = ctx.dynamicLimits ? [`${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}`] : [];
         const [usedTokensAfterUpdate, effectiveLimit] = await safeEval(
           ctx,
           SCRIPTS.singleRegion.fixedWindow.limit,
-          [key, dynamicLimitKey],
+          [key, ...dynamicLimitKeys],
           [tokens, windowDuration, incrementBy]
         );
         const success = usedTokensAfterUpdate <= effectiveLimit;
@@ -1527,11 +1528,11 @@ var RegionRatelimit = class extends Ratelimit {
       async getRemaining(ctx, identifier) {
         const bucket = Math.floor(Date.now() / windowDuration);
         const key = [identifier, bucket].join(":");
-        const dynamicLimitKey = ctx.dynamicLimits ? `${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}` : "";
+        const dynamicLimitKeys = ctx.dynamicLimits ? [`${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}`] : [];
         const [remaining, effectiveLimit] = await safeEval(
           ctx,
           SCRIPTS.singleRegion.fixedWindow.getRemaining,
-          [key, dynamicLimitKey],
+          [key, ...dynamicLimitKeys],
           [tokens]
         );
         return {
@@ -1593,11 +1594,11 @@ var RegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const dynamicLimitKey = ctx.dynamicLimits ? `${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}` : "";
+        const dynamicLimitKeys = ctx.dynamicLimits ? [`${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}`] : [];
         const [remainingTokens, effectiveLimit] = await safeEval(
           ctx,
           SCRIPTS.singleRegion.slidingWindow.limit,
-          [currentKey, previousKey, dynamicLimitKey],
+          [currentKey, previousKey, ...dynamicLimitKeys],
           [tokens, now, windowSize, incrementBy]
         );
         const success = remainingTokens >= 0;
@@ -1623,11 +1624,11 @@ var RegionRatelimit = class extends Ratelimit {
         const currentKey = [identifier, currentWindow].join(":");
         const previousWindow = currentWindow - 1;
         const previousKey = [identifier, previousWindow].join(":");
-        const dynamicLimitKey = ctx.dynamicLimits ? `${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}` : "";
+        const dynamicLimitKeys = ctx.dynamicLimits ? [`${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}`] : [];
         const [remaining, effectiveLimit] = await safeEval(
           ctx,
           SCRIPTS.singleRegion.slidingWindow.getRemaining,
-          [currentKey, previousKey, dynamicLimitKey],
+          [currentKey, previousKey, ...dynamicLimitKeys],
           [tokens, now, windowSize]
         );
         return {
@@ -1682,11 +1683,11 @@ var RegionRatelimit = class extends Ratelimit {
             };
           }
         }
-        const dynamicLimitKey = ctx.dynamicLimits ? `${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}` : "";
+        const dynamicLimitKeys = ctx.dynamicLimits ? [`${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}`] : [];
         const [remaining, reset, effectiveLimit] = await safeEval(
           ctx,
           SCRIPTS.singleRegion.tokenBucket.limit,
-          [identifier, dynamicLimitKey],
+          [identifier, ...dynamicLimitKeys],
           [maxTokens, intervalDuration, refillRate, now, incrementBy]
         );
         const success = remaining >= 0;
@@ -1706,11 +1707,11 @@ var RegionRatelimit = class extends Ratelimit {
         };
       },
       async getRemaining(ctx, identifier) {
-        const dynamicLimitKey = ctx.dynamicLimits ? `${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}` : "";
+        const dynamicLimitKeys = ctx.dynamicLimits ? [`${ctx.prefix}${DYNAMIC_LIMIT_KEY_SUFFIX}`] : [];
         const [remainingTokens, refilledAt, effectiveLimit] = await safeEval(
           ctx,
           SCRIPTS.singleRegion.tokenBucket.getRemaining,
-          [identifier, dynamicLimitKey],
+          [identifier, ...dynamicLimitKeys],
           [maxTokens]
         );
         const freshRefillAt = Date.now() + intervalDuration;
@@ -1778,7 +1779,7 @@ var RegionRatelimit = class extends Ratelimit {
         const hit = typeof ctx.cache.get(key) === "number";
         if (hit) {
           const cachedTokensAfterUpdate = ctx.cache.incr(key, incrementBy);
-          const success = cachedTokensAfterUpdate < tokens;
+          const success = cachedTokensAfterUpdate <= tokens;
           const pending = success ? safeEval(
             ctx,
             SCRIPTS.singleRegion.cachedFixedWindow.limit,