---
title: "mova-serve-ratelimit — Mova code model"
description: "Mova code model of tools/mova-serve/src/ratelimit.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/ratelimit.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Translate](https://md.translate.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/ratelimit.rs.groupant/>

# mova-serve-ratelimit

The groupant beside tools/mova-serve/src/ratelimit.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/mova-serve/src/ratelimit.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/mova-serve/src/ratelimit.rs)
- **repository folder:** [`tools/mova-serve/src/ratelimit.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/mova-serve/src/ratelimit.rs.groupant)

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **Approximant** | partial | [Approximant](#approximant) |
| **Ast** | partial | `syntax.json` |
| **Cost** | symbolic source derived | [Cost](#cost) |
| **Descriptant** | present | [Descriptant](#descriptant) |
| **Invariant** | partial | [Invariant](#invariant) |
| **Tests** | executed bounded checks | [Tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| relation | type | label | where |
|---|---|---|---|
| Behavior complement | behavior complement | partial source derived model | [Behavior complement](#behavior-complement) |
| Reverse reconstruction | reverse reconstruction | partial source derived model | [Reverse reconstruction](#reverse-reconstruction) |
| Model presence | model presence | partial source derived model | [Model presence](#model-presence) |

## Model text


### Descriptant

Per-client token buckets (burst, refill rate) held in memory, pruned of full buckets; the client address from the
proxy's last X-Forwarded-For hop when the connection is local.

### Approximant

`take(ip, t, c) = Ok iff min(burst, tokens + (t − last)·rate) ≥ min(c, burst)`.

### Invariant

0 ≤ tokens ≤ burst; granted tokens over t seconds ≤ burst + rate·t; at most max_clients addresses after a
prune.

### Cost

O(log n) a call; a prune O(n log n) when the map overflows.

### Behavior complement

Writes nothing; no daily counts (those are `quota`).

### Reverse reconstruction

A refusal's wait recovers the missing tokens (wait·rate).

### Model presence

Time is passed in, so every check is exact.

### Tests

`ratelimit::tests`: the burst then the rate, the bound burst + rate·t over a 50 s flood, the negative control (a
covering rate lets it all through), pruning, the proxy hop trusted only from loopback.

## Provenance

- **source SHA-256:** `56cb85fb7ad8964d…`
- **repository commit:** `2e25d7bfae9a`