feat: add request rate limiting

src/app.rs

@@ -1,11 +1,11 @@
 use crate::{
-    config::AppConfig, error::AppError, pokemon::PokeApiClient, service::PokedexService,
-    telemetry::Telemetry, translation::TranslationClient,
+    config::AppConfig, error::AppError, pokemon::PokeApiClient, rate_limit::RateLimiter,
+    service::PokedexService, telemetry::Telemetry, translation::TranslationClient,
 };
 use axum::{
     Json, Router,
     extract::{MatchedPath, Path, Request, State},
-    http::header,
+    http::{StatusCode, header},
     middleware,
     response::{IntoResponse, Response},
     routing::get,
@@ -23,14 +23,16 @@ use tower_http::{
 pub struct AppState {
     service: Arc<PokedexService>,
     telemetry: Arc<Telemetry>,
+    rate_limiter: Arc<RateLimiter>,
 }
 
 impl AppState {
     #[must_use]
-    pub fn new(service: PokedexService, telemetry: Telemetry) -> Self {
+    pub fn new(service: PokedexService, telemetry: Telemetry, rate_limiter: RateLimiter) -> Self {
         Self {
             service: Arc::new(service),
             telemetry: Arc::new(telemetry),
+            rate_limiter: Arc::new(rate_limiter),
         }
     }
 
@@ -40,7 +42,12 @@ impl AppState {
         let translations =
             TranslationClient::new(&config.translations_base_url, config.request_timeout)?;
         let service = PokedexService::new(pokemon, translations, telemetry.metrics());
-        Ok(Self::new(service, telemetry))
+        Ok(Self::new(
+            service,
+            telemetry,
+            RateLimiter::new(config.rate_limit_per_second, config.rate_limit_burst)
+                .map_err(|_| AppError::Internal)?,
+        ))
     }
 }
 
@@ -60,6 +67,10 @@ pub fn create_app(state: AppState) -> Router {
         .route("/pokemon/{name}", get(get_pokemon))
         .route("/pokemon/translated/{name}", get(get_translated_pokemon))
         .with_state(state.clone())
+        .layer(middleware::from_fn_with_state(
+            state.clone(),
+            enforce_rate_limit,
+        ))
         .layer(middleware::from_fn_with_state(state, record_http_metrics))
         .layer(tracing_layers)
 }
@@ -73,6 +84,22 @@ async fn metrics(State(state): State<AppState>) -> Result<impl IntoResponse, App
     Ok(([(header::CONTENT_TYPE, "text/plain; version=0.0.4")], body))
 }
 
+async fn enforce_rate_limit(
+    State(state): State<AppState>,
+    req: Request,
+    next: middleware::Next,
+) -> Response {
+    if state.rate_limiter.try_acquire() {
+        next.run(req).await
+    } else {
+        (
+            StatusCode::TOO_MANY_REQUESTS,
+            Json(serde_json::json!({ "error": "rate limit exceeded" })),
+        )
+            .into_response()
+    }
+}
+
 async fn record_http_metrics(
     State(state): State<AppState>,
     req: Request,
@@ -120,8 +147,8 @@ struct HealthResponse {
 mod tests {
     use super::{AppState, create_app};
     use crate::{
-        pokemon::PokeApiClient, service::PokedexService, telemetry::Telemetry,
-        translation::TranslationClient,
+        pokemon::PokeApiClient, rate_limit::RateLimiter, service::PokedexService,
+        telemetry::Telemetry, translation::TranslationClient,
     };
     use axum::{
         body::{Body, to_bytes},
@@ -256,6 +283,38 @@ mod tests {
         assert!(body.contains("upstream_client_requests"));
     }
 
+    #[tokio::test]
+    async fn rate_limit_rejects_requests_over_the_configured_burst() {
+        let pokeapi = MockServer::start().await;
+        let translations = MockServer::start().await;
+        let telemetry = Telemetry::new("test-service");
+        let app = create_app(AppState::new(
+            PokedexService::new(
+                PokeApiClient::new(pokeapi.uri(), Duration::from_secs(1))
+                    .expect("client should build"),
+                TranslationClient::new(translations.uri(), Duration::from_secs(1))
+                    .expect("client should build"),
+                telemetry.metrics(),
+            ),
+            telemetry,
+            RateLimiter::new(0.01, 1).expect("rate limiter should build"),
+        ));
+
+        let first = app
+            .clone()
+            .oneshot(request("/health"))
+            .await
+            .expect("request should be handled");
+        let second = app
+            .oneshot(request("/health"))
+            .await
+            .expect("request should be handled");
+
+        assert_eq!(first.status(), StatusCode::OK);
+        assert_eq!(second.status(), StatusCode::TOO_MANY_REQUESTS);
+        assert_eq!(json_body(second).await["error"], "rate limit exceeded");
+    }
+
     #[tokio::test]
     async fn pokemon_endpoint_maps_missing_pokemon_to_404() {
         let pokeapi = MockServer::start().await;
@@ -308,6 +367,7 @@ mod tests {
                 telemetry.metrics(),
             ),
             telemetry,
+            RateLimiter::new(100.0, 100).expect("rate limiter should build"),
         )
     }