Node.js Token Bucket Rate Limiter

class TokenBucket {
  private tokens: number;
  private lastRefill: number;

  constructor(
    private maxTokens: number,
    private refillRate: number // tokens per second
  ) {
    this.tokens = maxTokens;
    this.lastRefill = Date.now();
  }

  private refill(): void {
    const now = Date.now();
    const elapsed = (now - this.lastRefill) / 1000;
    this.tokens = Math.min(
      this.maxTokens,
      this.tokens + elapsed * this.refillRate
    );
    this.lastRefill = now;
  }

  consume(tokens = 1): boolean {
    this.refill();
    if (this.tokens >= tokens) {
      this.tokens -= tokens;
      return true;
    }
    return false;
  }

  get remaining(): number {
    this.refill();
    return Math.floor(this.tokens);
  }
}

// Per-IP rate limiter
const buckets = new Map<string, TokenBucket>();

function getRateLimiter(key: string): TokenBucket {
  if (!buckets.has(key)) {
    buckets.set(key, new TokenBucket(100, 10)); // 100 burst, 10/sec
  }
  return buckets.get(key)!;
}

// Usage in HTTP handler
function handleRequest(ip: string): { allowed: boolean; remaining: number } {
  const limiter = getRateLimiter(ip);
  const allowed = limiter.consume();
  return { allowed, remaining: limiter.remaining };
}