@Component
public class FixedWindowRateLimiter {

    @Autowired
    private StringRedisTemplate redisTemplate;

    /**
     * 固定窗口限流
     * @param key   限流 key（如 "rate:user:1001"）
     * @param max    窗口內(nèi)最大請(qǐng)求數(shù)
     * @param window 窗口大?。耄?
     * @return true 通過，false 被限
     */
    public boolean tryAcquire(String key, long max, long window) {
        // INCR 原子自增
        Long count = redisTemplate.opsForValue().increment(key);
        if (count == 1) {
            // 第一次訪問，設(shè)置過期時(shí)間
            redisTemplate.expire(key, window, TimeUnit.SECONDS);
        }
        return count <= max;
    }
}

@RestController
public class TestController {

    @Autowired
    private FixedWindowRateLimiter rateLimiter;

    @GetMapping("/api/test")
    public ResultVO<?> test() {
        // 限制每個(gè)用戶每秒最多 5 次
        if (!rateLimiter.tryAcquire("rate:user:1001", 5, 1)) {
            return ResultVO.error(429, "請(qǐng)求太頻繁，請(qǐng)稍后");
        }
        return ResultVO.success("成功");
    }
}

@Component
public class SlidingWindowRateLimiter {

    @Autowired
    private StringRedisTemplate redisTemplate;

    /**
     * 滑動(dòng)窗口限流
     * @param key      限流 key
     * @param max      窗口內(nèi)最大請(qǐng)求數(shù)
     * @param window   窗口大?。ê撩耄?
     * @return true 通過，false 被限
     */
    public boolean tryAcquire(String key, long max, long windowMs) {
        long now = System.currentTimeMillis();
        long windowStart = now - windowMs;

        // 使用 Lua 腳本保證原子性
        String luaScript =
            "redis.call('ZREMRANGEBYSCORE', KEYS[1], 0, ARGV[1]) " +    // 移除窗口外的記錄
            "local count = redis.call('ZCARD', KEYS[1]) " +             // 統(tǒng)計(jì)窗口內(nèi)請(qǐng)求數(shù)
            "if count < tonumber(ARGV[2]) then " +
            "  redis.call('ZADD', KEYS[1], ARGV[3], ARGV[3]) " +        // 加入當(dāng)前請(qǐng)求
            "  redis.call('EXPIRE', KEYS[1], ARGV[4]) " +               // 設(shè)置過期（秒）
            "  return 1 " +
            "else " +
            "  return 0 " +
            "end";

        Long result = redisTemplate.execute(
            new DefaultRedisScript<>(luaScript, Long.class),
            Collections.singletonList(key),
            String.valueOf(windowStart),
            String.valueOf(max),
            String.valueOf(now),
            String.valueOf(windowMs / 1000 + 1)
        );

        return Long.valueOf(1).equals(result);
    }
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface RateLimit {

    /** 限流 key（支持 SpEL） */
    String key() default "";

    /** 限流維度：用戶、IP、接口 */
    String type() default "user";  // user、ip、api

    /** 最大請(qǐng)求數(shù) */
    long max() default 10;

    /** 窗口大小（秒） */
    long window() default 1;
}

@Aspect
@Component
public class RateLimitAspect {

    @Autowired
    private SlidingWindowRateLimiter rateLimiter;

    @Around("@annotation(rateLimit)")
    public Object around(ProceedingJoinPoint pjp, RateLimit rateLimit) throws Throwable {
        // 構(gòu)建 key
        String key = buildKey(rateLimit, pjp);

        // 執(zhí)行限流
        boolean acquired = rateLimiter.tryAcquire(
                key, rateLimit.max(), rateLimit.window() * 1000);

        if (!acquired) {
            throw new RuntimeException("請(qǐng)求太頻繁，請(qǐng)稍后重試");
        }

        return pjp.proceed();
    }

    private String buildKey(RateLimit rateLimit, ProceedingJoinPoint pjp) {
        String prefix = "rate:";

        switch (rateLimit.type()) {
            case "ip":
                // 從請(qǐng)求中獲取 IP（需要注入 RequestContextHolder）
                HttpServletRequest request = ((ServletRequestAttributes)
                    RequestContextHolder.getRequestAttributes()).getRequest();
                String ip = request.getRemoteAddr();
                return prefix + "ip:" + ip;

            case "api":
                // 按接口限流
                String methodName = pjp.getSignature().toShortString();
                return prefix + "api:" + methodName;

            default:
                // 按用戶限流（需要從 Token 獲取用戶 ID）
                String userId = StpUtil.getLoginIdAsString();
                return prefix + "user:" + userId;
        }
    }
}

// 全局異常處理
@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(RuntimeException.class)
    public ResultVO<?> handle(RuntimeException e) {
        if (e.getMessage().contains("請(qǐng)求太頻繁")) {
            return ResultVO.error(429, "請(qǐng)求太頻繁，請(qǐng)稍后重試");
        }
        return ResultVO.error(500, e.getMessage());
    }
}

@RestController
@RequestMapping("/api")
public class OrderController {

    @PostMapping("/order")
    @RateLimit(key = "createOrder", type = "user", max = 5, window = 10)
    public ResultVO<?> createOrder(@RequestBody OrderDTO dto) {
        // 每個(gè)用戶 10 秒內(nèi)最多 5 次下單
        return ResultVO.success("下單成功");
    }

    @GetMapping("/product/list")
    @RateLimit(type = "api", max = 100, window = 1)
    public ResultVO<?> list() {
        // 接口級(jí)別限流：每秒最多 100 次
        return ResultVO.success("商品列表");
    }
}

@RestController
@RequestMapping("/api/seckill")
public class SeckillController {

    @Autowired
    private SeckillService seckillService;

    @PostMapping("/do/{productId}")
    @RateLimit(type = "user", max = 1, window = 10)    // 每個(gè)用戶10秒只能秒殺1次
    public ResultVO<?> doSeckill(@PathVariable Long productId) {
        long userId = StpUtil.getLoginIdAsLong();
        return seckillService.doSeckill(productId, userId, "用戶");
    }
}

用戶請(qǐng)求
  ↓
① 限流（Redis 滑動(dòng)窗口）→ 被限返回"操作頻繁"
  ↓
② 參數(shù)校驗(yàn) → 不合法直接返回
  ↓
③ 時(shí)間校驗(yàn) → 沒開始/已結(jié)束直接返回
  ↓
④ 重復(fù)提交校驗(yàn)（SETNX）→ 已提交直接返回
  ↓
⑤ Redis 預(yù)減庫(kù)存 → 庫(kù)存不足直接返回
  ↓
⑥ 數(shù)據(jù)庫(kù)扣庫(kù)存（樂觀鎖）→ 失敗回滾
  ↓
⑦ 生成訂單

@GetMapping("/api/public")
@RateLimit(type = "ip", max = 30, window = 60)
public ResultVO<?> publicApi() {
    // 同一 IP 每分鐘最多 30 次
    return ResultVO.success("公開接口");
}

public static String getRealIp(HttpServletRequest request) {
    String ip = request.getHeader("X-Forwarded-For");
    if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
        ip = request.getHeader("X-Real-IP");
    }
    if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
        ip = request.getRemoteAddr();
    }
    // 多個(gè)代理時(shí)取第一個(gè)
    if (ip != null && ip.contains(",")) {
        ip = ip.split(",")[0].trim();
    }
    return ip;
}

rate-limit:
  defaults:
    max: 10
    window: 1
  rules:
    - key: "createOrder"
      max: 5
      window: 10
    - key: "seckill"
      max: 1
      window: 10
    - key: "publicApi"
      max: 30
      window: 60

@ConfigurationProperties(prefix = "rate-limit")
@Data
public class RateLimitProperties {
    private Rule defaults = new Rule();
    private List<Rule> rules = new ArrayList<>();

    @Data
    public static class Rule {
        private String key;
        private long max;
        private long window;
    }
}

# 快速請(qǐng)求測(cè)試限流效果
for i in {1..20}; do
  curl -X POST http://localhost:9090/api/order
  echo ""
done

# 正常返回：{"code":200,"message":"下單成功"}
# 被限返回：{"code":429,"message":"請(qǐng)求太頻繁，請(qǐng)稍后重試"}