How do you implement a custom rate limiter with token bucket algorithm?

Question

Accepted Answer

**Token bucket** — allows bursts while maintaining average rate.

```javascript
class TokenBucket {
    constructor(options) {
        this.capacity = options.capacity;
        this.tokens = options.capacity;
        this.refillRate = options.refillRate; // tokens per second
        this.lastRefill = Date.now();
    }

refill() {
        const now = Date.now();
        const elapsed = (now - this.lastRefill) / 1000;
        this.tokens = Math.min(
            this.capacity,
            this.tokens + elapsed * this.refillRate
        );
        this.lastRefill = now;
    }

consume(tokens = 1) {
        this.refill();
        if (this.tokens >= tokens) {
            this.tokens -= tokens;
            return true;
        }
        return false;
    }
}

// Express middleware
const buckets = new Map();

app.use((req, res, next) => {
    const ip = req.ip;
    if (!buckets.has(ip)) {
        buckets.set(ip, new TokenBucket({
            capacity: 10,
            refillRate: 1,
        }));
    }

const bucket = buckets.get(ip);
    if (!bucket.consume()) {
        return res.status(429).json({ error: "Rate limited" });
    }

next();
});
```

**Key points:**
- Allows burst up to capacity.
- Refills at steady rate.
- Better than fixed window for bursty traffic.

Node.js: How do you implement a custom rate limiter with token bucket algorithm?