Rate Limiter

Design a thread-safe sliding-window rate limiter that enforces both per-user and global call limits. The key insight: use a timestamp list per identity - prune entries older than the window, check the length against the limit, then append. Thread safety requires a lock to make the check-then-append sequence atomic.

“Two gates matter: per-user AND global. Check global first - it is the cheaper gate. The lock wraps the entire check-then-append as one atomic unit. Sliding window beats fixed window: no artificial burst at the boundary.”

import time
import threading
from collections import defaultdict

class RateLimiter:
    def __init__(self, global_limit: int, user_limit: int, window_seconds: int = 60):
        self.global_limit = global_limit
        self.user_limit = user_limit
        self.window = window_seconds
        self.global_calls = []
        self.user_calls = defaultdict(list)
        self._lock = threading.Lock()

    def _prune(self, call_list: list) -> list:
        now = time.time()
        return [t for t in call_list if now - t < self.window]

    def is_allowed(self, user_id: str) -> bool:
        with self._lock:
            self.global_calls = self._prune(self.global_calls)
            self.user_calls[user_id] = self._prune(self.user_calls[user_id])

            if len(self.global_calls) >= self.global_limit:
                return False
            if len(self.user_calls[user_id]) >= self.user_limit:
                return False

            now = time.time()
            self.global_calls.append(now)
            self.user_calls[user_id].append(now)
        return True


# Usage
limiter = RateLimiter(global_limit=5, user_limit=3, window_seconds=60)
for i in range(1, 7):
    result = limiter.is_allowed("yash")
    status = "ALLOWED" if result else "BLOCKED"
    print(f"Call {i}: {status} | user={len(limiter.user_calls['yash'])}/3 | global={len(limiter.global_calls)}/5")

• 1Sliding Window via Timestamp List - Store a list of Unix timestamps per identity. On each request, prune entries older than the window, then check length. This gives a true rolling window - no artificial burst at the minute boundary like fixed-window approaches allow.
• 2Two-Level Limits - User and Global - Check global first (cheaper gate). If global passes, check per-user. This ordering ensures a single abusive user cannot exhaust the global budget before other users are checked.
• 3Thread Safety with Lock - The lock wraps the entire check-then-append sequence. Without it, two threads can both pass the length check before either appends - a classic TOCTOU race condition. One lock makes it one atomic operation.
• 4defaultdict for User State - defaultdict(list) auto-initializes an empty list for new user IDs. No need to check if the key exists before appending - clean and Pythonic.