Rate limiting with Redis and Rack::Attack

                  class Rack::Attack
  Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(url: ENV['REDIS_URL'])

  safelist('allow-localhost') do |req|
    req.ip == '127.0.0.1' || req.ip == '::1'
  end

  throttle('api/v1/auth', limit: 5, period: 1.minute) do |req|
    req.ip if req.path.start_with?('/api/v1/auth') && req.post?
  end

  throttle('api/v1/authenticated', limit: 300, period: 5.minutes) do |req|
    if req.path.start_with?('/api/v1') && req.env['HTTP_AUTHORIZATION'].present?
      token = req.env['HTTP_AUTHORIZATION'].split(' ').last
      payload = JwtService.decode(token)
      payload['user_id'] if payload
    end
  end

  throttle('api/v1/anonymous', limit: 60, period: 5.minutes) do |req|
    req.ip if req.path.start_with?('/api/v1') && req.env['HTTP_AUTHORIZATION'].blank?
  end

  self.throttled_response = ->(env) {
    retry_after = (env['rack.attack.match_data'] || {})[:period]
    [
      429,
      { 'Content-Type' => 'application/json', 'Retry-After' => retry_after.to_s },
      [{ error: 'RATE_LIMIT_EXCEEDED', retry_after: retry_after }.to_json]
    ]
  }
end