Struct RateLimiter 

pub struct RateLimiter { /* private fields */ }

Per-user token buckets, one per (user, Class).

Algorithm

A classic token bucket, refilled continuously rather than on a timer: capacity is one minute’s allowance, tokens accrue at per_minute / 60 per second, and each admitted request spends one. A bucket is refilled lazily when it is read, so there is no background thread and no periodic sweep — which is what lets this stay synchronous, allocation-light, and free on an idle node.

Capacity equal to a full minute means an agent may burst a minute’s worth at once and then proceeds at the sustained rate, which is the shape real agent traffic has: a batch of work, then a wait.

Bounds

The map holds one entry per (authenticated user, class) that has been seen. Usernames come from the operator’s --auth-file, and the caller only consults the limiter for authenticated users, so the map is bounded by the credential count times two and cannot be grown by an unauthenticated caller.

Implementations

impl RateLimiter

pub fn new( api_per_minute: Option<NonZeroU32>, git_per_minute: Option<NonZeroU32>, ) -> Self

A limiter with the given requests-per-minute ceilings. None for a class means that class is not limited.

The ceilings are NonZeroU32 so that “limit to zero” — a value that refuses every request forever and has no sensible Retry-After — is not representable.

pub fn is_active(&self) -> bool

Whether any class is limited at all.

pub fn check(&self, user: &str, class: Class) -> Option<u64>

Spends one token for user in class.

None admits the request. Some(seconds) refuses it and is the Retry-After the caller should answer with: the whole seconds until one token has accrued, never less than one.

pub fn check_at(&self, user: &str, class: Class, now: Instant) -> Option<u64>

RateLimiter::check against a caller-supplied clock reading, so refill can be proved without sleeping through it.