feat: tiered rate-limit policies driven by API key plan tier#440
Merged
greatest0fallt1me merged 1 commit intoJun 25, 2026
Merged
Conversation
- Add plan_tier column to api_keys (migration CalloraOrg#7) - Extend RateLimiterConfig with tierPolicies map - StoreBackedRateLimiter.check() resolves per-tier policy - Unknown tier warns + falls back to default - gatewayApiKeyAuth sets res.locals.apiKeyTier from DB record - proxyRoutes passes tier into rateLimiter.check() - 31 tests passing (tiered + existing suite) Closes CalloraOrg#389
|
@temisan0x Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
4 tasks
Contributor
|
tiered rate-limit policies driven by the api-key plan tier is a clean way to differentiate plans. i rebased it onto main — your |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #389
The gateway used one
maxRequests/windowMspair for every API key. This wires rate limits to each key'splan_tierinstead.How it works
0007addsplan_tiertoapi_keys(free/pro/enterprise, defaultfree)gatewayApiKeyAuthreadsplan_tierfrom the DB and setsres.locals.apiKeyTierproxyRoutespasses that tier intorateLimiter.check(apiKey, tier?)rateLimiterpicks the policy from a tier map; unknown or missing tiers fall back to the existing defaults (with a warning log for unknown values)Defaults: free 100/min, pro 500/min, enterprise 5000/min. You can override via
tierPoliciesonRateLimiterConfigif needed.Docs are in
docs/tiered-rate-limits.md.Testing
31 tests pass (
rateLimiter.test.ts+rateLimiter.tiered.test.ts) — per-tier ceilings, fallback behaviour, custom overrides, bucket isolation.Deploy note
Run
0007_add_plan_tier_to_api_keys.sqlbefore shipping.CI
npm run typecheckis already red onmain(~49 errors in webhook/settlement/vault files, etc.). None of those touch files in this PR.