Elamur Groupantsmova-serve-ratelimit
The groupant beside tools/mova-serve/src/ratelimit.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| Approximant | partial | Approximant |
| Ast | partial | syntax.json |
| Cost | symbolic source derived | Cost |
| Descriptant | present | Descriptant |
| Invariant | partial | Invariant |
| Tests | executed bounded checks | Tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| relation | type | label | where |
|---|---|---|---|
| Behavior complement | behavior complement | partial source derived model | Behavior complement |
| Reverse reconstruction | reverse reconstruction | partial source derived model | Reverse reconstruction |
| Model presence | model presence | partial source derived model | Model presence |
Model text
Descriptant
Per-client token buckets (burst, refill rate) held in memory, pruned of full buckets; the client address from the proxy's last X-Forwarded-For hop when the connection is local.
Approximant
take(ip, t, c) = Ok iff min(burst, tokens + (t − last)·rate) ≥ min(c, burst).
Invariant
0 ≤ tokens ≤ burst; granted tokens over t seconds ≤ burst + rate·t; at most max_clients addresses after a prune.
Cost
O(log n) a call; a prune O(n log n) when the map overflows.
Behavior complement
Writes nothing; no daily counts (those are quota).
Reverse reconstruction
A refusal's wait recovers the missing tokens (wait·rate).
Model presence
Time is passed in, so every check is exact.
Tests
ratelimit::tests: the burst then the rate, the bound burst + rate·t over a 50 s flood, the negative control (a
covering rate lets it all through), pruning, the proxy hop trusted only from loopback.
Provenance
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/mova-serve/src/ratelimit.rs.groupant/