ar-jun-fs9/api-rate-limiter

Purpose and Entry Points

A Django/DRF service that authenticates requests by API key and enforces fixed-window, per-key/per-endpoint quotas backed by Redis. Runtime entry points are manage.py for management/local serving, rate_limiter_project/wsgi.py for WSGI deployment, and rate_limiter_project/asgi.py for ASGI deployment.

Project Composition and Routing

The Django project owns global settings and root routing; the api app supplies the public API and landing page. Root URL dispatch should connect Django admin and app routes through rate_limiter_project/urls.py, while endpoint-level paths are defined in api/urls.py. The browser-facing documentation page is api/templates/home.html.

Paths: rate_limiter_project/settings.py, rate_limiter_project/urls.py, api/urls.py

API-Key Domain and Administration

API credentials are persistent Django model data, UUID-based and associated with an owner and potentially a custom limit. Django admin is the operational boundary for creating and managing keys; request-time validation consults the database before quota processing. Serialization support is separated for DRF-facing model representation.

Paths: api/models.py, api/admin.py, api/serializers.py

Rate-Limiting Control Stage

RateLimitedAPIView is the central policy/enforcement abstraction. Endpoint views inherit it to establish endpoint-specific max_requests values and a shared expiry window. For each request it requires X-API-Key, rejects missing or invalid credentials with 401, derives a Redis counter namespace from the key and endpoint class, then checks/increments quota. Exhausted quota returns 429; admitted requests receive remaining-quota headers.

Paths: api/rate_limit.py, api/views.py

Endpoint Execution Flow

Client requests enter Django routing, select an API view, and pass through the rate-limit base class before endpoint business responses are produced. The defined API surface includes test, hello, profile, login, and purchase routes; login has a higher quota and purchase a distinct one. This design keeps endpoint payload behavior in concrete views while centralizing authorization and quota decisions.

Paths: api/urls.py, api/views.py, api/rate_limit.py

State, Infrastructure, and Deployment Boundaries

Persistent API-key records use Django’s configured database and are introduced by api/migrations/0001_initial.py. Ephemeral distributed counters live in Redis, configured from REDIS_URL in project settings and intended for Upstash Redis; TTL expiration resets each fixed window. The project targets Python/Django with Django REST Framework, supports Redis TLS URLs, and includes Gunicorn for production hosting (documented Render deployment).

Paths: rate_limiter_project/settings.py, api/migrations/0001_initial.py, requirements.txt

Primary Failure and Response Contract

The authentication boundary returns 401 for absent or unknown keys. The Redis quota boundary returns 429 once the counter reaches its configured limit. Successful requests expose X-RateLimit-Limit and X-RateLimit-Remaining, allowing clients to adapt without needing access to Redis or the credential database.

Paths: api/rate_limit.py, api/views.py