API throttling with custom Redis-based limiter

class RateLimiter
  def initialize(key:, limit:, window:)
    @key = "rate_limit:#{key}"
    @limit = limit
    @window = window
  end

  def allowed?
    now = Time.current.to_i
    window_start = now - @window

    Redis.current.multi do |pipeline|
      # Remove old entries
      pipeline.zremrangebyscore(@key, '-inf', window_start)

      # Add current request
      pipeline.zadd(@key, now, "#{now}-#{SecureRandom.hex(8)}")

      # Count requests in window
      pipeline.zcard(@key)

      # Set expiry
      pipeline.expire(@key, @window + 1)
    end.last <= @limit
  end

  def remaining
    now = Time.current.to_i
    window_start = now - @window

    Redis.current.zremrangebyscore(@key, '-inf', window_start)
    count = Redis.current.zcard(@key)

    [@limit - count, 0].max
  end

  def reset_at
    now = Time.current.to_i
    window_start = now - @window

    oldest = Redis.current.zrange(@key, 0, 0, with_scores: true).first
    return now + @window unless oldest

    oldest[1].to_i + @window
  end
end