1
窗口=60秒，限制=5次
2

3
时间轴: 10:00:00  10:00:30  10:01:00  10:01:10
4
请求:     ①②③      ④⑤       检查      ⑥
5

6
在 10:01:10 检查时：
7
├─ 删除 10:00:10 之前的请求 (①②③被删除)
8
├─ 保留 ④⑤ (在窗口内)
9
├─ 当前计数=2，允许⑥通过

1
-- 判断和操作是一体的，不会出现：
2
-- "判断时未超限，但执行时已超限" 的情况
3
if next > max then
4
  return 0;
5
else
6
  redis.call("zadd", key, now, now)
7
  return next
8
end

1
@Target(ElementType.METHOD)
2
@Retention(RetentionPolicy.RUNTIME)
3
public @interface RateLimiter {
4
    // 原有参数
5
    long max() default 5;
6
    long timeout() default 1;
7
    TimeUnit timeUnit() default TimeUnit.MINUTES;
8

9
    // 新增惩罚机制参数
10
    boolean enablePunishment() default false;        // 是否启用惩罚
11
    long warningThreshold() default 10;              // 警告阈值
12
    long banThreshold() default 20;                  // 封禁阈值
13
    long banDuration() default 30;                   // 封禁时长
14
    TimeUnit banTimeUnit() default TimeUnit.MINUTES; // 封禁时间单位
15
}

1
@Service
2
public class EnhancedRateLimiterService {
3

4
    private static final String VIOLATION_KEY_PREFIX = "violation:";
5
    private static final String BAN_KEY_PREFIX = "ban:";
6

7
    public RateLimitResult checkRateLimit(String key, RateLimiter config) {
8
        // 1. 检查是否被封禁
9
        if (isBanned(key)) {
10
            return RateLimitResult.banned("用户已被封禁");
11
        }
12

13
        // 2. 执行正常限流检查
14
        boolean normalLimited = executeNormalRateLimit(key, config);
15

16
        if (!normalLimited) {
17
            return RateLimitResult.allowed();
18
        }
19

20
        // 3. 记录违规次数
21
        long violationCount = recordViolation(key);
22

23
        // 4. 根据违规次数分级处理
24
        if (config.enablePunishment()) {
25
            return handleViolation(key, violationCount, config);
26
        }
27

28
        return RateLimitResult.rejected("请求过于频繁");
29
    }
30

31
    private RateLimitResult handleViolation(String key, long count, RateLimiter config) {
32
        if (count >= config.banThreshold()) {
33
            // 封禁用户
34
            banUser(key, config.banDuration(), config.banTimeUnit());
35
            return RateLimitResult.banned("违规次数过多，已被封禁 " +
36
                config.banDuration() + " " + config.banTimeUnit().name().toLowerCase());
37

38
        } else if (count >= config.warningThreshold()) {
39
            // 警告
40
            return RateLimitResult.warning("警告：继续违规将被封禁，当前违规次数：" + count);
41
        }
42

43
        return RateLimitResult.rejected("请求过于频繁，违规次数：" + count);
44
    }
45
}

1
-- enhanced_rate_limit.lua
2
local key = KEYS[1]
3
local violation_key = KEYS[2]
4
local ban_key = KEYS[3]
5

6
local now = tonumber(ARGV[1])
7
local ttl = tonumber(ARGV[2])
8
local expired = tonumber(ARGV[3])
9
local max = tonumber(ARGV[4])
10
local ban_duration = tonumber(ARGV[5])
11
local ban_threshold = tonumber(ARGV[6])
12

13
-- 检查是否被封禁
14
local ban_expire = redis.call('GET', ban_key)
15
if ban_expire and tonumber(ban_expire) > now then
16
    return {-1, tonumber(ban_expire) - now} -- 返回剩余封禁时间
17
end
18

19
-- 正常限流逻辑
20
redis.call('zremrangebyscore', key, 0, expired)
21
local current = tonumber(redis.call('zcard', key))
22

23
if current < max then
24
    redis.call("zadd", key, now, now)
25
    redis.call("pexpire", key, ttl)
26
    return {current + 1, 0}
27
else
28
    -- 记录违规
29
    local violation_count = redis.call('INCR', violation_key)
30
    redis.call('EXPIRE', violation_key, 3600) -- 违规记录1小时过期
31

32
    -- 检查是否需要封禁
33
    if violation_count >= ban_threshold then
34
        redis.call('SET', ban_key, now + ban_duration)
35
        redis.call('EXPIRE', ban_key, ban_duration / 1000)
36
        return {-2, ban_duration} -- 触发封禁
37
    end
38

39
    return {0, violation_count} -- 返回违规次数
40
end

1
@RestController
2
public class EnhancedTestController {
3

4
    @RateLimiter(
5
        max = 5,
6
        timeout = 1,
7
        timeUnit = TimeUnit.MINUTES,
8
        enablePunishment = true,
9
        warningThreshold = 3,
10
        banThreshold = 5,
11
        banDuration = 30,
12
        banTimeUnit = TimeUnit.MINUTES
13
    )
14
    @GetMapping("/test1")
15
    public ResponseEntity<Dict> test1() {
16
        return ResponseEntity.ok(
17
            Dict.create()
18
                .set("msg", "hello,world!")
19
                .set("description", "正常访问")
20
        );
21
    }
22
}

1
@Data
2
@AllArgsConstructor
3
public class RateLimitResult {
4
    private boolean allowed;
5
    private String message;
6
    private long remainingTime; // 剩余封禁时间（秒）
7
    private int violationCount; // 违规次数
8

9
    public static RateLimitResult allowed() {
10
        return new RateLimitResult(true, "允许访问", 0, 0);
11
    }
12

13
    public static RateLimitResult banned(String message) {
14
        return new RateLimitResult(false, message, 0, 0);
15
    }
16

17
    public static RateLimitResult warning(String message) {
18
        return new RateLimitResult(true, message, 0, 0);
19
    }
20
}