From cd70242043918dbb3d7f5cbca6fa9a67c5b3b2d5 Mon Sep 17 00:00:00 2001 From: Hugh Brown Date: Tue, 3 Mar 2026 16:46:48 -0700 Subject: [PATCH] docs: fix rate limiter docstrings to reflect sliding-window algorithm The module and class docstrings incorrectly described the implementation as a "token-bucket" limiter when it actually uses a sliding-window log (deque of timestamps with pruning). Co-Authored-By: Claude Opus 4.6 --- backend/app/core/rate_limit.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/backend/app/core/rate_limit.py b/backend/app/core/rate_limit.py index 5f2ed3d2..b1f2abaf 100644 --- a/backend/app/core/rate_limit.py +++ b/backend/app/core/rate_limit.py @@ -1,6 +1,10 @@ -"""Simple in-memory token-bucket rate limiter for abuse prevention. +"""Simple in-memory sliding-window rate limiter for abuse prevention. This provides per-IP rate limiting without external dependencies. +Each key maintains a sliding window of recent request timestamps; +a request is allowed only when the number of timestamps within the +window is below the configured maximum. + For multi-process or distributed deployments, a Redis-based limiter should be used instead. """ @@ -16,7 +20,7 @@ _CLEANUP_INTERVAL = 128 class InMemoryRateLimiter: - """Token-bucket rate limiter keyed by arbitrary string (typically client IP).""" + """Sliding-window rate limiter keyed by arbitrary string (typically client IP).""" def __init__(self, *, max_requests: int, window_seconds: float) -> None: self._max_requests = max_requests