pycurb 0.2.2__tar.gz → 0.2.3__tar.gz

{pycurb-0.2.2 → pycurb-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pycurb
-Version: 0.2.2
+Version: 0.2.3
 Summary: A framework-agnostic Python rate limit library
 Author-email: Oluwaseun Ogunsanu <ogunsanu17@gmail.com>
 License-Expression: Apache-2.0

{pycurb-0.2.2 → pycurb-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pycurb"
-version = "0.2.2"
+version = "0.2.3"
 description = "A framework-agnostic Python rate limit library"
 readme = "README.md"
 license = "Apache-2.0"

{pycurb-0.2.2 → pycurb-0.2.3}/src/pycurb/core/storage/memory.py

@@ -79,7 +79,9 @@ class MemoryStorage(Storage):
         with lock:
             tokens, last_refill_time = self._token.get(key, (float(capacity), now))
 
-            time_elapsed = now - last_refill_time
+            # Clamp elapsed at zero: a clock regression must not silently
+            # refill tokens (negative elapsed would drain them).
+            time_elapsed = max(now - last_refill_time, 0.0)
             tokens_during_elapsed = time_elapsed * refill_rate
 
             new_tokens = min(tokens + tokens_during_elapsed, float(capacity))
@@ -102,7 +104,11 @@ class MemoryStorage(Storage):
         with lock:
             queue_size, last_leak_time = self._leaky.get(key, (0, now))
 
-            leaked = math.floor((now - last_leak_time) * leak_rate)
+            # Clamp elapsed at zero: with negative elapsed, floor() of a
+            # negative number yields -1 and the queue would silently grow
+            # (queue - (-1)) on every clock regression.
+            elapsed = max(now - last_leak_time, 0.0)
+            leaked = math.floor(elapsed * leak_rate)
             new_queue = max(queue_size - leaked, 0)
 
             # Preserve fractional leak tracking history

{pycurb-0.2.2 → pycurb-0.2.3}/src/pycurb/core/storage/memory_async.py

@@ -79,7 +79,9 @@ class AsyncMemoryStorage(AsyncStorage):
         async with lock:
             tokens, last_refill_time = self._token.get(key, (float(capacity), now))
 
-            time_elapsed = now - last_refill_time
+            # Clamp elapsed at zero: a clock regression must not silently
+            # refill tokens (negative elapsed would drain them).
+            time_elapsed = max(now - last_refill_time, 0.0)
             tokens_during_elapsed = time_elapsed * refill_rate
 
             new_tokens = min(tokens + tokens_during_elapsed, float(capacity))
@@ -102,7 +104,11 @@ class AsyncMemoryStorage(AsyncStorage):
         async with lock:
             queue_size, last_leak_time = self._leaky.get(key, (0, now))
 
-            leaked = math.floor((now - last_leak_time) * leak_rate)
+            # Clamp elapsed at zero: with negative elapsed, floor() of a
+            # negative number yields -1 and the queue would silently grow
+            # (queue - (-1)) on every clock regression.
+            elapsed = max(now - last_leak_time, 0.0)
+            leaked = math.floor(elapsed * leak_rate)
             new_queue = max(queue_size - leaked, 0)
 
             # Preserve fractional leak tracking history

{pycurb-0.2.2 → pycurb-0.2.3}/src/pycurb/core/storage/redis.py

@@ -184,7 +184,9 @@ class RedisStorage(Storage):
             last_refill = now
         end
 
-        local elapsed = now - last_refill
+        -- Clamp elapsed at zero: a clock regression or out-of-order
+        -- timestamp must not silently refill tokens.
+        local elapsed = math.max(now - last_refill, 0)
         local tokens_during_elapsed = elapsed * rate
         local new_tokens = math.min(capacity, tokens + tokens_during_elapsed)
 
@@ -249,7 +251,10 @@ class RedisStorage(Storage):
             last_leak = now
         end
 
-        local elapsed = now - last_leak
+        -- Clamp elapsed at zero: with negative elapsed, floor() of a
+        -- negative number yields -1 and the queue would silently grow
+        -- (queue - (-1)) on every clock regression.
+        local elapsed = math.max(now - last_leak, 0)
         local leaked = math.floor(elapsed * rate)
         local new_queue = math.max(queue_size - leaked, 0)
 

{pycurb-0.2.2 → pycurb-0.2.3}/src/pycurb/core/storage/redis_async.py

@@ -188,7 +188,9 @@ class AsyncRedisStorage(AsyncStorage):
             last_refill = now
         end
 
-        local elapsed = now - last_refill
+        -- Clamp elapsed at zero: a clock regression or out-of-order
+        -- timestamp must not silently refill tokens.
+        local elapsed = math.max(now - last_refill, 0)
         local tokens_during_elapsed = elapsed * rate
         local new_tokens = math.min(capacity, tokens + tokens_during_elapsed)
 
@@ -257,7 +259,10 @@ class AsyncRedisStorage(AsyncStorage):
             last_leak = now
         end
 
-        local elapsed = now - last_leak
+        -- Clamp elapsed at zero: with negative elapsed, floor() of a
+        -- negative number yields -1 and the queue would silently grow
+        -- (queue - (-1)) on every clock regression.
+        local elapsed = math.max(now - last_leak, 0)
         local leaked = math.floor(elapsed * rate)
         local new_queue = math.max(queue_size - leaked, 0)
 

{pycurb-0.2.2 → pycurb-0.2.3}/src/pycurb.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pycurb
-Version: 0.2.2
+Version: 0.2.3
 Summary: A framework-agnostic Python rate limit library
 Author-email: Oluwaseun Ogunsanu <ogunsanu17@gmail.com>
 License-Expression: Apache-2.0