Module rate_limiter 

Per-identity token-bucket rate limiter.

Two independent buckets per key (identity): one metered in requests, one in tokens. Each bucket refills linearly toward its cap based on elapsed wall time.

Identity resolution order (first match wins):

1. Authorization: Bearer <token> — the authenticated client’s key.
2. First entry of X-Forwarded-For — when Atlas sits behind a reverse proxy or load balancer. Trusted because Atlas is typically deployed behind a tenant-operated proxy.
3. Socket peer address — fallback for unauthenticated direct calls.

Env configuration (all default 0 = disabled, pure passthrough): ATLAS_RATE_LIMIT_RPM — requests per minute cap ATLAS_RATE_LIMIT_TPM — tokens per minute cap ATLAS_RATE_LIMIT_BURST_RPM — max request burst (default = RPM) ATLAS_RATE_LIMIT_BURST_TPM — max token burst (default = TPM)

The limiter keeps the static “effectively unlimited” headers byte-for-byte when both RPM and TPM are 0 so existing deployments see no behavior change.

Structs

BucketSnapshot

Snapshot of a bucket’s remaining budget — used to populate the x-ratelimit-*-remaining / -reset response headers.

RateDecision

RateLimitConfig

Configuration for the limiter. Zero means “disabled” for that bucket.

RateLimiter

Shared concurrent rate-limiter state.

RequestContext

Per-request context carried from the rate-limit middleware into the handler so the streaming true-up can refund over-estimated tokens once the actual usage is known. Injected into Request::extensions_mut() by the middleware when the limiter is enabled; extracted by handlers that want to refund.

Enums

DenialReason

Functions

extract_identity

Resolve a stable identity from the request headers + peer addr. Used by the axum middleware; exposed here so tests can reuse it.