Redis sliding-window rate limiter

import { randomUUID } from "node:crypto";
import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL ?? "redis://localhost:6379");

// Sliding-window log: one sorted-set member per request, scored by time in ms.
// Uses Redis TIME so app servers with drifting clocks agree on "now".
const SCRIPT = `
local key    = KEYS[1]
local window = tonumber(ARGV[1])
local limit  = tonumber(ARGV[2])
local t      = redis.call("TIME")
local now    = tonumber(t[1]) * 1000 + math.floor(tonumber(t[2]) / 1000)

redis.call("ZREMRANGEBYSCORE", key, 0, now - window)
local count = redis.call("ZCARD", key)

if count < limit then
  redis.call("ZADD", key, now, ARGV[3])
  redis.call("PEXPIRE", key, window)
  return {1, limit - count - 1, 0}
end

local oldest = redis.call("ZRANGE", key, 0, 0, "WITHSCORES")
return {0, 0, tonumber(oldest[2]) + window - now}
`;

export type RateLimitResult = {
  allowed: boolean;
  remaining: number;
  retryAfterMs: number;
};

export async function rateLimit(
  id: string,
  limit: number,
  windowMs: number,
): Promise<RateLimitResult> {
  const [allowed, remaining, retryAfterMs] = (await redis.eval(
    SCRIPT,
    1,
    `ratelimit:${id}`,
    windowMs,
    limit,
    randomUUID(),
  )) as [number, number, number];

  return { allowed: allowed === 1, remaining, retryAfterMs: Math.max(0, retryAfterMs) };
}