Middleware zur Ratenbegrenzung mit gleitendem Fenster via atomare Redis Lua-Skripte

import time
from django.core.cache import cache
from django.http import JsonResponse
 
SLIDING_WINDOW_LUA = """
local key = KEYS[1]
local now = tonumber(ARGV[1])
local clearBefore = now - tonumber(ARGV[2])
local limit = tonumber(ARGV[3])
 
redis.call('ZREMRANGEBYSCORE', key, 0, clearBefore)
local currentRequests = redis.call('ZCARD', key)
 
if currentRequests < limit then
    redis.call('ZADD', key, now, now)
    redis.call('EXPIRE', key, tonumber(ARGV[2]))
    return 1
else
    return 0
end
"""
 
class SlidingWindowRateLimitMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response
 
    def __call__(self, request):
        client_ip = request.META.get('REMOTE_ADDR', 'unknown')
        cache_key = f"ratelimit:{client_ip}"
        now = time.time()
        
        # 100 requests per 60 seconds limit
        allowed = cache.client.get_client().eval(SLIDING_WINDOW_LUA, 1, cache_key, now, 60, 100)
        if not allowed:
            return JsonResponse({"error": "Too many requests"}, status=429)
        
        return self.get_response(request)