Caching & Rate Limiting

const requestsPerSec = 2_000;
const dbMs = 20;      // a database read
const cacheMs = 1;    // a Redis GET on the same network

for (const hitRatio of [0, 0.5, 0.9, 0.99]) {
  const dbReadsPerSec = Math.round(requestsPerSec * (1 - hitRatio));
  // a miss pays for the cache lookup AND the database read
  const avgMs = hitRatio * cacheMs + (1 - hitRatio) * (cacheMs + dbMs);
  console.log(`hit ratio ${String(hitRatio * 100).padStart(2)}%  db reads/s ${String(dbReadsPerSec).padStart(4)}  avg latency ${avgMs.toFixed(1)} ms`);
}

// hit ratio  0%  db reads/s 2000  avg latency 21.0 ms
// hit ratio 50%  db reads/s 1000  avg latency 11.0 ms
// hit ratio 90%  db reads/s  200  avg latency 3.0 ms
// hit ratio 99%  db reads/s   20  avg latency 1.2 ms

const TTL_MS = 30_000;
const MAX_ENTRIES = 100;
const cache = new Map(); // key -> { value, expiresAt }

let clock = 0;                 // fake time so we can jump forward
const now = () => clock;
let databaseReads = 0;

async function readDatabase(id) {
  databaseReads++;
  return { id, name: 'Keyboard', loadedAt: now() };
}

async function getProduct(id) {
  const key = `product:${id}`;
  const entry = cache.get(key);

  if (entry && entry.expiresAt > now()) {
    return entry.value;                       // hit
  }
  cache.delete(key);                          // expired (or absent)

  const product = await readDatabase(id);     // miss: go to the source of truth

  if (cache.size >= MAX_ENTRIES) {
    cache.delete(cache.keys().next().value);  // evict the oldest insertion
  }
  cache.set(key, { value: product, expiresAt: now() + TTL_MS });
  return product;
}

(async () => {
  const log = async (label, id) => {
    const p = await getProduct(id);
    console.log(`${label.padEnd(18)} loadedAt=${p.loadedAt} reads=${databaseReads} size=${cache.size}`);
  };
  await log('t=0      id 42', 42);  // miss
  await log('t=0      id 42', 42);  // hit
  clock = 29_999;
  await log('t=29.999 id 42', 42);  // still a hit
  clock = 30_000;
  await log('t=30     id 42', 42);  // expired -> miss
  await log('t=30     id 7', 7);    // different key -> miss
})();

// t=0      id 42     loadedAt=0 reads=1 size=1
// t=0      id 42     loadedAt=0 reads=1 size=1
// t=29.999 id 42     loadedAt=0 reads=1 size=1
// t=30     id 42     loadedAt=30000 reads=2 size=1
// t=30     id 7      loadedAt=30000 reads=3 size=2

import { createClient } from 'redis';
import { db } from './db.mjs'; // your data access layer

const redis = createClient({ url: process.env.REDIS_URL });
redis.on('error', (err) => console.error('redis error', err));
await redis.connect();

const TTL_SECONDS = 30;
const productKey = (id) => `product:${id}:v1`;

export async function getProduct(id) {
  const key = productKey(id);
  try {
    const cached = await redis.get(key);          // a string, or null on a miss
    if (cached !== null) return JSON.parse(cached);
  } catch (err) {
    console.warn('cache read failed, falling back to db', err.message);
  }

  const product = await db.findProduct(id);
  if (product) {
    redis.set(key, JSON.stringify(product), { EX: TTL_SECONDS })
      .catch((err) => console.warn('cache write failed', err.message));
  }
  return product;
}

export async function updateProduct(id, changes) {
  await db.updateProduct(id, changes);              // 1. the source of truth first
  await redis.del(productKey(id));                  // 2. then invalidate
}

const { setTimeout: sleep } = require('node:timers/promises');

const db = { 'product:42': { price: 100 } };
const cache = new Map();
const start = Date.now();
const log = (msg) => console.log(`${String(Date.now() - start).padStart(3)}ms  ${msg}`);

// Reader: cache-aside miss path, but its database reply is slow.
async function reader() {
  if (cache.has('product:42')) return log('reader: hit');
  const row = { ...db['product:42'] };   // reads price 100 ...
  log(`reader: miss, read price ${row.price} from db`);
  await sleep(100);                      // ... GC pause / slow network before storing
  cache.set('product:42', row);
  log(`reader: stored price ${row.price} in cache`);
}

// Writer: update the database, then delete the cache entry.
async function writer() {
  await sleep(30);
  db['product:42'] = { price: 80 };
  log('writer: committed price 80');
  cache.delete('product:42');
  log('writer: deleted cache entry');
}

(async () => {
  await Promise.all([reader(), writer()]);
  log(`final: db=${db['product:42'].price}, cache=${cache.get('product:42').price}  <- stale until TTL`);
})();

//   0ms  reader: miss, read price 100 from db
//  33ms  writer: committed price 80
//  33ms  writer: deleted cache entry
// 103ms  reader: stored price 100 in cache
// 103ms  final: db=80, cache=100  <- stale until TTL
//   (the exact ms vary by a few; the order doesn't)

const { setTimeout: sleep } = require('node:timers/promises');

let databaseReads = 0;
async function readDatabase(id) {
  databaseReads++;
  await sleep(50);                          // a 50 ms query
  return { id, name: 'Keyboard' };
}

const TTL_MS = 30_000;
const cache = new Map();     // key -> { value, expiresAt }
const inFlight = new Map();  // key -> Promise of the value

async function getNaive(id) {
  const key = `product:${id}`;
  const entry = cache.get(key);
  if (entry && entry.expiresAt > Date.now()) return entry.value;
  const value = await readDatabase(id);
  cache.set(key, { value, expiresAt: Date.now() + TTL_MS });
  return value;
}

function getCoalesced(id) {
  const key = `product:${id}`;
  const entry = cache.get(key);
  if (entry && entry.expiresAt > Date.now()) return Promise.resolve(entry.value);

  const pending = inFlight.get(key);
  if (pending) return pending;              // someone is already loading it: wait for them

  const load = readDatabase(id)
    .then((value) => {
      cache.set(key, { value, expiresAt: Date.now() + TTL_MS });
      return value;
    })
    .finally(() => inFlight.delete(key));   // runs on success AND failure
  inFlight.set(key, load);
  return load;
}

(async () => {
  const many = (fn) => Promise.all(Array.from({ length: 1000 }, () => fn(42)));

  await many(getNaive);
  console.log('naive:     1000 concurrent misses ->', databaseReads, 'database reads');

  cache.clear();
  databaseReads = 0;
  const results = await many(getCoalesced);
  console.log('coalesced: 1000 concurrent misses ->', databaseReads, 'database read');
  console.log('same object for every caller?', results.every((r) => r === results[0]));
  console.log('inFlight size after settle:', inFlight.size);

  await many(getCoalesced);
  console.log('second wave (cache warm) -> total reads still', databaseReads);
})();

// naive:     1000 concurrent misses -> 1000 database reads
// coalesced: 1000 concurrent misses -> 1 database read
// same object for every caller? true
// inFlight size after settle: 0
// second wave (cache warm) -> total reads still 1

const express = require('express');
const request = require('supertest');

let handlerRuns = 0;
const app = express();
console.log("app.get('etag') =", app.get('etag'));

app.get('/products/42', (req, res) => {
  handlerRuns++;
  res.set('Cache-Control', 'private, max-age=0, must-revalidate');
  res.json({ id: 42, name: 'Keyboard', price: 100 });
});

(async () => {
  const first = await request(app).get('/products/42');
  const etag = first.headers.etag;
  console.log('1st:', first.status, 'ETag', etag, 'Content-Length', first.headers['content-length'], 'handlerRuns', handlerRuns);

  const second = await request(app).get('/products/42').set('If-None-Match', etag);
  console.log('2nd:', second.status, 'body', JSON.stringify(second.text), 'Content-Length', second.headers['content-length'], 'ETag', second.headers.etag, 'handlerRuns', handlerRuns);

  const third = await request(app).get('/products/42').set('If-None-Match', 'W/"stale"');
  console.log('3rd:', third.status, 'handlerRuns', handlerRuns);

  const post = express();
  post.post('/x', (req, res) => res.json({ ok: true }));
  const p1 = await request(post).post('/x');
  const p2 = await request(post).post('/x').set('If-None-Match', p1.headers.etag);
  console.log('POST with matching If-None-Match:', p2.status);

  const strong = express();
  strong.set('etag', 'strong');
  strong.get('/', (req, res) => res.json({ id: 42 }));
  console.log("etag 'strong':", (await request(strong).get('/')).headers.etag);

  const off = express();
  off.set('etag', false);
  off.get('/', (req, res) => res.json({ id: 42 }));
  console.log('etag false:', (await request(off).get('/')).headers.etag);
})();

// app.get('etag') = weak
// 1st: 200 ETag W/"27-lho5pbu6kHLoOtH8z39dEnwP3CU" Content-Length 39 handlerRuns 1
// 2nd: 304 body "" Content-Length undefined ETag W/"27-lho5pbu6kHLoOtH8z39dEnwP3CU" handlerRuns 2
// 3rd: 200 handlerRuns 3
// POST with matching If-None-Match: 200
// etag 'strong': "9-NSscY66S6NKRWG5blkTNB7gbOO8"
// etag false: undefined

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100 // Limit each IP to 100 requests per windowMs
});
app.use(limiter);

const LIMIT = 5;
const WINDOW = 10_000;

// Fixed window: one counter per aligned window [0,10s), [10s,20s), ...
function fixedWindow() {
  const counts = new Map();
  return (t) => {
    const w = Math.floor(t / WINDOW);
    const n = (counts.get(w) ?? 0) + 1;
    counts.set(w, n);
    return n <= LIMIT;
  };
}

// Sliding log: remember every accepted timestamp in the last WINDOW ms.
function slidingLog() {
  const log = [];
  return (t) => {
    while (log.length && log[0] <= t - WINDOW) log.shift();
    if (log.length >= LIMIT) return false;
    log.push(t);
    return true;
  };
}

// Sliding window counter: current count + previous count weighted by overlap.
function slidingCounter() {
  const counts = new Map();
  return (t) => {
    const w = Math.floor(t / WINDOW);
    const prev = counts.get(w - 1) ?? 0;
    const curr = counts.get(w) ?? 0;
    const overlap = 1 - (t % WINDOW) / WINDOW;   // share of the previous window still "inside"
    const estimate = prev * overlap + curr;
    if (estimate >= LIMIT) return false;
    counts.set(w, curr + 1);
    return true;
  };
}

// 5 requests at t=9.0s..9.4s, then 5 more at t=10.0s..10.4s
const times = [9000, 9100, 9200, 9300, 9400, 10000, 10100, 10200, 10300, 10400];
for (const [name, make] of [['fixed window', fixedWindow], ['sliding log', slidingLog], ['sliding counter', slidingCounter]]) {
  const allow = make();
  const marks = times.map((t) => (allow(t) ? '✓' : '✗')).join(' ');
  console.log(name.padEnd(16), marks, ' accepted:', (marks.match(/✓/g) || []).length);
}

// fixed window     ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓  accepted: 10
// sliding log      ✓ ✓ ✓ ✓ ✓ ✗ ✗ ✗ ✗ ✗  accepted: 5
// sliding counter  ✓ ✓ ✓ ✓ ✓ ✗ ✓ ✗ ✗ ✗  accepted: 6

const express = require('express');
const { rateLimit } = require('express-rate-limit');
const request = require('supertest');
const { setTimeout: sleep } = require('node:timers/promises');

// --- fake database --------------------------------------------------------
let dbReads = 0;
async function findProduct(tenant, id) {
  dbReads++;
  await sleep(20);
  return { tenant, id, name: 'Keyboard', price: 100 };
}

// --- cache-aside with coalescing -------------------------------------------
const cache = new Map();
const inFlight = new Map();
const TTL_MS = 30_000;
function cached(key, load) {
  const hit = cache.get(key);
  if (hit && hit.expiresAt > Date.now()) return Promise.resolve(hit.value);
  if (inFlight.has(key)) return inFlight.get(key);
  const p = load()
    .then((value) => { cache.set(key, { value, expiresAt: Date.now() + TTL_MS }); return value; })
    .finally(() => inFlight.delete(key));
  inFlight.set(key, p);
  return p;
}

// --- app --------------------------------------------------------------------
const app = express();

app.use(rateLimit({ windowMs: 60_000, limit: 100, standardHeaders: 'draft-8', legacyHeaders: false })); // broad, per IP

function authenticate(req, res, next) {      // stand-in: real code verifies a token
  const user = req.get('x-api-key');
  if (!user) return res.status(401).json({ error: 'missing API key' });
  req.user = { id: user, tenant: 'acme' };
  next();
}

const perUser = rateLimit({
  windowMs: 60_000,
  limit: 3,
  keyGenerator: (req) => `user:${req.user.id}`,
  standardHeaders: 'draft-8',
  legacyHeaders: false,
  message: { error: 'quota exceeded' },
});

app.get('/api/products/:id', authenticate, perUser, async (req, res) => {
  const { tenant } = req.user;
  const key = `t:${tenant}:product:${req.params.id}:v1`;
  const product = await cached(key, () => findProduct(tenant, req.params.id));
  res.json(product);
});

(async () => {
  const get = (user) => {
    const t = request(app).get('/api/products/42');
    return user ? t.set('x-api-key', user) : t;
  };
  const show = (label, r) => console.log(label.padEnd(24), r.status, JSON.stringify(r.body).slice(0, 40).padEnd(40), 'dbReads', dbReads);

  show('no key', await get());
  show('rohit #1 (miss)', await get('rohit'));
  show('rohit #2 (hit)', await get('rohit'));
  show('neha  #1 (hit)', await get('neha'));
  show('rohit #3 (hit)', await get('rohit'));
  show('rohit #4 (over quota)', await get('rohit'));
  show('neha  #2 (hit)', await get('neha'));
})();

// no key                   401 {"error":"missing API key"}              dbReads 0
// rohit #1 (miss)          200 {"tenant":"acme","id":"42","name":"Keybo dbReads 1
// rohit #2 (hit)           200 {"tenant":"acme","id":"42","name":"Keybo dbReads 1
// neha  #1 (hit)           200 {"tenant":"acme","id":"42","name":"Keybo dbReads 1
// rohit #3 (hit)           200 {"tenant":"acme","id":"42","name":"Keybo dbReads 1
// rohit #4 (over quota)    429 {"error":"quota exceeded"}               dbReads 1
// neha  #2 (hit)           200 {"tenant":"acme","id":"42","name":"Keybo dbReads 1