# Rate Limiting Middleware

## Overview
Sliding window rate limiting middleware with a limit of {{requests_per_window}} requests per {{window_seconds}} seconds, applied per {{strategy}}.

## Acceptance Criteria

### AC-1: Sliding Window Enforcement
- Track request counts in a {{window_seconds}}-second sliding window per {{strategy}}
- Block requests exceeding {{requests_per_window}} with HTTP 429
- Include `Retry-After` header indicating seconds until the window resets

### AC-2: Response Headers
- Include `X-RateLimit-Limit: {{requests_per_window}}` on all responses
- Include `X-RateLimit-Remaining` with current remaining count
- Include `X-RateLimit-Reset` with the Unix timestamp of window expiry

### AC-3: Strategy Configuration
- Apply limits by {{strategy}} (ip address, authenticated user ID, or API key)
- Fall back to IP-based limiting for unauthenticated requests
- Support per-route override limits via middleware options

### AC-4: Bypass and Exemptions
- Allow exemption list for internal service IPs
- Support admin-level bypass via a trusted header `X-Internal-Request: true`
- Log all exemptions for audit purposes

## Technical Notes
- Use atomic Redis operations (INCR + EXPIRE) to avoid race conditions
- Store counters in Redis with TTL equal to the window duration
- Degrade gracefully to allow-all if Redis is unavailable (fail open with alert)
