Rate Limiting

# Sorted Set sliding window
ZREMRANGEBYSCORE rate:user:1001 0 <now-60000>
ZCARD rate:user:1001
# < limit ise:
ZADD rate:user:1001 <now> "<now>:<random>"
PEXPIRE rate:user:1001 60000

public class RateLimiterService
{
    private readonly IDatabase _redis;

    private static readonly LuaScript _slidingWindowScript = LuaScript.Prepare(@"
        local key = @key
        local limit = tonumber(@limit)
        local window = tonumber(@window)
        local now = tonumber(@now)
        redis.call('ZREMRANGEBYSCORE', key, 0, now - window)
        local count = redis.call('ZCARD', key)
        if count < limit then
            redis.call('ZADD', key, now, now .. ':' .. math.random(1000000))
            redis.call('PEXPIRE', key, window)
            return count + 1
        end
        return -1
    ");

    public RateLimiterService(IConnectionMultiplexer mux)
        => _redis = mux.GetDatabase();

    public async Task<RateLimitResult> CheckAsync(string clientId, int limit, TimeSpan window)
    {
        var result = (int)await _redis.ScriptEvaluateAsync(_slidingWindowScript, new
        {
            key = (RedisKey)$"rate:{clientId}",
            limit,
            window = (long)window.TotalMilliseconds,
            now = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()
        });

        return new RateLimitResult
        {
            IsAllowed = result > 0,
            CurrentCount = result > 0 ? result : limit,
            Limit = limit
        };
    }
}

// Middleware
public class RateLimitMiddleware
{
    private readonly RequestDelegate _next;
    private readonly RateLimiterService _rateLimiter;

    public RateLimitMiddleware(RequestDelegate next, RateLimiterService rateLimiter)
    {
        _next = next;
        _rateLimiter = rateLimiter;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        var clientId = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";
        var result = await _rateLimiter.CheckAsync(clientId, limit: 100, TimeSpan.FromMinutes(1));

        context.Response.Headers["X-RateLimit-Limit"] = "100";
        context.Response.Headers["X-RateLimit-Remaining"] =
            Math.Max(0, 100 - result.CurrentCount).ToString();

        if (!result.IsAllowed)
        {
            context.Response.StatusCode = 429;
            await context.Response.WriteAsync("Rate limit exceeded");
            return;
        }

        await _next(context);
    }
}