Zakaria El OrcheandClaude Opus 5
439588c19f
Swagger UI, Redoc or Scalar, each configured with its own options under the names its own documentation gives them, or no page at all. What a UI does not name still passes through, so a bundle's whole option set stays reachable without this extension tracking it. The page is rendered once at boot and the document is encoded once per revision, so a request to any of the three routes hands out bytes rather than building them: the spec used to be serialized again on every single request. /openapi/swagger becomes /openapi/docs, because the path names what is served and not which bundle happens to serve it. That page also named a preset that lives in a bundle it never loaded, and BaseLayout never needed it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
flash-ext-limiter
Rate limiting for the Flash HTTP server. Zero-allocation hot-path, lock-free counters, pluggable key resolvers, and two built-in algorithms.
What it provides
| Component | Description |
|---|---|
@Limit |
Annotation for class-based handlers — processed once at boot |
Guard |
Programmatic middleware factory for lambda routes |
LimiterConfig |
Resolver registry — map string names to key-extraction lambdas |
FIXED_WINDOW |
Clock-aligned counter reset; minimal memory |
TOKEN_BUCKET |
Continuous refill; absorbs bursts smoothly |
Dependency
<dependency>
<groupId>dev.relism</groupId>
<artifactId>flash-ext-limiter</artifactId>
<version>1.0-SNAPSHOT</version>
</dependency>
Quick start
// Default install — only the built-in "ip" resolver available
FlashApp.create(8080)
.install(new LimiterExtension())
.scan("com.example.handlers");
// With custom resolvers
LimiterConfig conf = new LimiterConfig()
.registerResolver("auth_user", req ->
SecurityIdentity.current() != null ? SecurityIdentity.current().principal().name() : "anonymous");
FlashApp.create(8080)
.install(new LimiterExtension(conf))
.scan("com.example.handlers");
Installation order
Install LimiterExtension before authentication extensions. Rate-limit checks
then short-circuit over-limit requests before expensive token validation runs.
app.install(new LimiterExtension(conf)) // ← first
.install(new OidcExtension(oidcConf)) // ← second
.scan("com.example");
Docs
| File | Contents |
|---|---|
| key-resolvers.md | Resolver registration, built-in defaults, custom logic |
| annotation.md | @Limit reference — all fields and examples |
| guard.md | Guard for lambda routes — all overloads |
| strategies.md | FIXED_WINDOW vs TOKEN_BUCKET — algorithm reference |
| http-headers.md | HTTP compliance — headers and 429 response |