Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@chronark
Copy link
Contributor

@chronark chronark commented Nov 14, 2025

What does this PR do?

Add a possible implementation of using unkey's multiratelimiting. (https://www.unkey.com/docs/api-reference/v2/ratelimit/apply-multiple-rate-limit-checks)

To application developers this just allows specifying multiple checks in the checkRateLimitAndThrowError function:

await checkRateLimitAndThrowError([
      {
        rateLimitingType: "common",
        identifier: piiHasher.hash(req.nextUrl.pathname),
      },
      {
        rateLimitingType: "common",
        identifier: piiHasher.hash(`${req.nextUrl.pathname}-${requestorIp}`),
        opts: {
          limit: 5000,
        },
      },
    ]);

Under the hood this replaces the @unkey/ratelimit sdk with the underlying @unkey/api sdk while preserving the same behavior around timeouts and fallbacks.


It's not really finished and can be cleaned up some more, but I wanted to get some feedback on the direction first before spending time on that.
For API keys I left the original code for now, cause it's irrelevant to show what I have in mind.

I also don't care if you close this cause you want to do it differently :)

I'll leave some more comments throughout this PR.

Mandatory Tasks (DO NOT REMOVE)

  • I have self-reviewed the code (A decent size PR without self-review might be rejected).
  • I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
  • I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

It should just work as before. The check in the middleware now does 2 checks, one for path and one for path+ip

Checklist

@vercel
Copy link

vercel bot commented Nov 14, 2025

@chronark is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

if (onRateLimiterResponse) onRateLimiterResponse(response);
const { success, reset } = response;
if (!success) {
export async function checkRateLimitAndThrowError(req: RateLimitHelper | RateLimitHelper[]) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could be cleaned up but for backwards compatibility I just changed it to accept both a single req or an array

export { type RatelimitResponse };
export const API_KEY_RATE_LIMIT = 30;

const configs = {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same as before but we're not using the @unkey/ratelimit anymore cause it doesn't support multiLimit yet

retryConfig: {
strategy: "backoff",
backoff: {
initialInterval: 10,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this could use some finetuning

The @unkey/ratelimit sdk used the default backoff, which was much higher, now we have the option to play with it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant