Claude Code के साथ Implement Rate Limiting कैसे करें

なぜレート制限がज़रूरीか

APIを公開する際、レート制限はserviceの安定運用に不可欠 है।DDoS攻撃の防御、リソースの公平な配分、コストmanagement आदि、多くの目的で使われ है।Claude Code का उपयोग करके、要件に合ったレート制限のimplementationをकम समय मेंgenerateでき है।

tokenバケットアルゴリズム

もっとも一般的なレート制限アルゴリズムをTypeScriptでimplement करते हैं。

> tokenバケットアルゴリズムでレート制限をimplement करो。
> Redisを使ったスケーラブルなimplementationにして。

import Redis from "ioredis";

const redis = new Redis();

interface RateLimitResult {
  allowed: boolean;
  remaining: number;
  resetAt: number;
}

export async function checkRateLimit(
  key: string,
  maxTokens: number,
  refillRate: number, // token/秒
  windowSeconds: number
): Promise<RateLimitResult> {
  const now = Date.now();
  const luaScript = `
    local key = KEYS[1]
    local max_tokens = tonumber(ARGV[1])
    local refill_rate = tonumber(ARGV[2])
    local now = tonumber(ARGV[3])
    local window = tonumber(ARGV[4])

    local data = redis.call('HMGET', key, 'tokens', 'last_refill')
    local tokens = tonumber(data[1]) or max_tokens
    local last_refill = tonumber(data[2]) or now

    -- tokenの補充
    local elapsed = (now - last_refill) / 1000
    tokens = math.min(max_tokens, tokens + elapsed * refill_rate)

    local allowed = tokens >= 1
    if allowed then
      tokens = tokens - 1
    end

    redis.call('HMSET', key, 'tokens', tokens, 'last_refill', now)
    redis.call('EXPIRE', key, window)

    return {allowed and 1 or 0, math.floor(tokens), now + math.floor((1 - tokens) / refill_rate * 1000)}
  `;

  const result = await redis.eval(
    luaScript, 1, key,
    maxTokens, refillRate, now, windowSeconds
  ) as number[];

  return {
    allowed: result[0] === 1,
    remaining: result[1],
    resetAt: result[2],
  };
}

Express middleware के रूप मेंuse करना

उपरोक्तのロジックをExpressmiddlewareに組み込み है।

import { Request, Response, NextFunction } from "express";
import { checkRateLimit } from "./rate-limiter";

interface RateLimitOptions {
  maxRequests: number;
  windowSeconds: number;
  keyGenerator?: (req: Request) => string;
}

export function rateLimit(options: RateLimitOptions) {
  const {
    maxRequests,
    windowSeconds,
    keyGenerator = (req) => req.ip || "unknown",
  } = options;

  return async (req: Request, res: Response, next: NextFunction) => {
    const key = `rate_limit:${keyGenerator(req)}`;
    const result = await checkRateLimit(
      key, maxRequests, maxRequests / windowSeconds, windowSeconds
    );

    res.setHeader("X-RateLimit-Limit", maxRequests);
    res.setHeader("X-RateLimit-Remaining", result.remaining);
    res.setHeader("X-RateLimit-Reset", Math.ceil(result.resetAt / 1000));

    if (!result.allowed) {
      return res.status(429).json({
        error: "Too Many Requests",
        message: "request数がऊपर限に達し हुआ।しばらく待って से再試行して करें।",
        retryAfter: Math.ceil((result.resetAt - Date.now()) / 1000),
      });
    }

    next();
  };
}

// Usage example
import express from "express";
const app = express();

// API全体に適用：1分あたり60request
app.use("/api", rateLimit({ maxRequests: 60, windowSeconds: 60 }));

// authenticationendpointはより厳しく：1分あたり5request
app.use("/api/auth", rateLimit({
  maxRequests: 5,
  windowSeconds: 60,
  keyGenerator: (req) => `auth:${req.ip}`,
}));

Redisなしの簡易implementation

小規模なProjectではインメモリでのimplementationも有効 है।

const requestCounts = new Map<string, { count: number; resetAt: number }>();

export function simpleRateLimit(maxRequests: number, windowMs: number) {
  // Periodic cleanup
  setInterval(() => {
    const now = Date.now();
    for (const [key, data] of requestCounts) {
      if (data.resetAt < now) requestCounts.delete(key);
    }
  }, windowMs);

  return (req: Request, res: Response, next: NextFunction) => {
    const key = req.ip || "unknown";
    const now = Date.now();
    const record = requestCounts.get(key);

    if (!record || record.resetAt < now) {
      requestCounts.set(key, { count: 1, resetAt: now + windowMs });
      return next();
    }

    if (record.count >= maxRequests) {
      return res.status(429).json({ error: "Too Many Requests" });
    }

    record.count++;
    next();
  };
}

レート制限 के साथ combineてsearchfeaturesをimplement करना方法はsearchfeaturesのimplementationदेखें。APIの設計全般के बारे मेंはClaude Codeのintroduction guideभी reference के लिएなり है।

Summary

Claude Code का उपयोग करके、tokenバケット सेRedisintegration तक、Projectに合ったレート制限を素早くimplementationでき है।security要件を自然言語で伝えれば、appropriateなアルゴリズムとsettings値を提案してくれ है।

विस्तार से जानने के लिएClaude Codeofficial documentationをदेखें。