設計限流器（Rate Limiter）

public class TokenBucket
{
    private readonly int _capacity;       // 桶的最大容量
    private readonly double _refillRate;  // 每秒填充幾個 token
    private double _tokens;
    private DateTime _lastRefill;
    private readonly object _lock = new();
 
    public TokenBucket(int capacity, double refillRate)
    {
        _capacity = capacity;
        _refillRate = refillRate;
        _tokens = capacity;
        _lastRefill = DateTime.UtcNow;
    }
 
    public bool TryConsume(int tokens = 1)
    {
        lock (_lock)
        {
            Refill();
            if (_tokens < tokens) return false;
            _tokens -= tokens;
            return true;
        }
    }
 
    private void Refill()
    {
        var now = DateTime.UtcNow;
        var elapsed = (now - _lastRefill).TotalSeconds;
        _tokens = Math.Min(_capacity, _tokens + elapsed * _refillRate);
        _lastRefill = now;
    }
}

async function isAllowed(
  userId: string,
  windowMs: number,
  maxRequests: number
): Promise<boolean> {
  const now = Date.now();
  const key = `ratelimit:${userId}`;
 
  // Redis pipeline: 原子操作
  const pipeline = redis.pipeline();
  pipeline.zremrangebyscore(key, 0, now - windowMs); // 移除過期紀錄
  pipeline.zadd(key, now, `${now}:${Math.random()}`); // 加入當前請求
  pipeline.zcard(key); // 計算窗口內請求數
  pipeline.expire(key, Math.ceil(windowMs / 1000)); // 設定 key 過期
 
  const results = await pipeline.exec();
  const count = results![2][1] as number;
  return count <= maxRequests;
}
 
// Middleware
app.use(async (req, res, next) => {
  const allowed = await isAllowed(req.userId, 60_000, 100); // 每分鐘 100 次
  if (!allowed) {
    res.set("Retry-After", "60");
    res.status(429).json({ error: "Rate limit exceeded" });
    return;
  }
  next();
});