====== RateLimiter ======

**Layer:** ''Core'' · **Source:** ''lib/core/RateLimiter.php:21'' (lines 21–219)

----
<code>
class RateLimiter
</code>

RateLimiter

File-based sliding window rate limiter for API endpoints.
Uses IP address as the default key. Stores request timestamps
in per-key files under the cache directory.

Compatible with PHP 7.4+.

======= Docblock Metadata =======

^ Tag ^ Value ^
| ''@category'' | Core Class |
| ''@author'' | Blogware Team |
| ''@license'' | MIT |
| ''@version'' | 1.0 |

======= Inheritance =======

//No parent, interface or trait. This is a root type.//

======= Constants (2) =======

^ Visibility ^ Name ^ Value ^ Line ^
| ''-'' | ''DEFAULT_LIMIT'' | ''60;'' | 26 |
| ''-'' | ''DEFAULT_WINDOW'' | ''60;'' | 31 |

======= Properties (1) =======

^ Visibility ^ Type ^ Name ^ Default ^ Line ^
| ''private'' | ''(untyped)'' | ''$cacheDir'' |  | 38 |

======= Methods (8) =======

^ Visibility ^ Method ^ Summary ^ Line ^
| public | ''__construct()'' | Constructor | 45 |
| private | ''ensureCacheDir()'' | Ensure the cache directory exists and is writable | 56 |
| public | ''check()'' | Check if the current request exceeds the rate limit | 72 |
| private | ''readTimestamps()'' | Read timestamps from file, filtering out expired ones | 119 |
| private | ''writeTimestamps()'' | Write timestamps to file | 148 |
| private | ''getClientKey()'' | Generate a unique key for the current client | 167 |
| public | ''reset()'' | Reset rate limit for a specific key | 178 |
| public | ''cleanup()'' | Clean up expired rate limit files | 196 |


======== __construct() ========

<code>
public function __construct($cacheDir = null)
</code>

//lines 45–49 (5)//

Constructor

^  Parameter ^  Type ^  Default ^  Description ^
|  ''$cacheDir'' |  ''(untyped)'' |  ''null'' |  Override cache directory path |


======== ensureCacheDir() ========

<code>
private function ensureCacheDir()
</code>

//lines 56–61 (6)//

Ensure the cache directory exists and is writable

//Takes no parameters.//

**Returns:** ''(none declared)'' — void


======== check() ========

<code>
public function check($key = null, $limit = self::DEFAULT_LIMIT, $window = self::DEFAULT_WINDOW, $namespace = &#039;&#039;)
</code>

//lines 72–110 (39)//

Check if the current request exceeds the rate limit

^  Parameter ^  Type ^  Default ^  Description ^
|  ''$key'' |  ''(untyped)'' |  ''null'' |  Unique identifier (default: client IP) |
|  ''$limit'' |  ''(untyped)'' |  ''self::DEFAULT_LIMIT'' |  Maximum requests allowed in the window |
|  ''$window'' |  ''(untyped)'' |  ''self::DEFAULT_WINDOW'' |  Window size in seconds |
|  ''$namespace'' |  ''(untyped)'' |  '''''' |  Optional counter namespace (e.g. 'read' vs 'write') |

**Returns:** ''(none declared)'' — array Result with limit, remaining, reset, retry_after, allowed


======== readTimestamps() ========

<code>
private function readTimestamps($file, $windowStart)
</code>

//lines 119–138 (20)//

Read timestamps from file, filtering out expired ones

^  Parameter ^  Type ^  Default ^  Description ^
|  ''$file'' |  ''(untyped)'' |  //required// |  File path |
|  ''$windowStart'' |  ''(untyped)'' |  //required// |  Earliest valid timestamp |

**Returns:** ''(none declared)'' — array Valid timestamps


======== writeTimestamps() ========

<code>
private function writeTimestamps($file, $timestamps, $windowStart)
</code>

//lines 148–155 (8)//

Write timestamps to file

^  Parameter ^  Type ^  Default ^  Description ^
|  ''$file'' |  ''(untyped)'' |  //required// |  File path |
|  ''$timestamps'' |  ''(untyped)'' |  //required// |  Timestamps to write |
|  ''$windowStart'' |  ''(untyped)'' |  //required// |  Earliest valid timestamp |

**Returns:** ''(none declared)'' — void


======== getClientKey() ========

<code>
private function getClientKey()
</code>

//lines 167–170 (4)//

Generate a unique key for the current client

Always keys on the client IP address. Previously the bucket key was
derived from the attacker-controlled X-API-Key header when present,
which let a client pick a fresh bucket per request and bypass the
rate limit entirely.

//Takes no parameters.//

**Returns:** ''(none declared)'' — string


======== reset() ========

<code>
public function reset($key = null)
</code>

//lines 178–188 (11)//

Reset rate limit for a specific key

^  Parameter ^  Type ^  Default ^  Description ^
|  ''$key'' |  ''(untyped)'' |  ''null'' |  Unique identifier |

**Returns:** ''(none declared)'' — bool


======== cleanup() ========

<code>
public function cleanup($maxAge = 3600)
</code>

//lines 196–218 (23)//

Clean up expired rate limit files

^  Parameter ^  Type ^  Default ^  Description ^
|  ''$maxAge'' |  ''(untyped)'' |  ''3600'' |  Maximum age in seconds before file is considered stale |

**Returns:** ''(none declared)'' — int Number of files cleaned


----

//This page is generated from source by 'tools/gendoc'. Edits will be overwritten.//