Implementing Rate Limiting

const conn = new Map();
function allow(ip, max = 5, windowMs = 60000) {
  const now = Date.now();
  const arr = (conn.get(ip) ?? []).filter(t => now - t < windowMs);
  arr.push(now);
  conn.set(ip, arr);
  return arr.length <= max;
}

class TokenBucket {
  constructor(capacity, refillPerSec) {
    this.capacity = capacity; this.tokens = capacity;
    this.rate = refillPerSec; this.last = Date.now();
  }
  take(n = 1) {
    const now = Date.now();
    this.tokens = Math.min(this.capacity, this.tokens + (now - this.last) / 1000 * this.rate);
    this.last = now;
    if (this.tokens < n) return false;
    this.tokens -= n; return true;
  }
}

const hits = [];
function allow(limit = 100, windowMs = 60000) {
  const now = Date.now();
  while (hits.length && now - hits[0] > windowMs) hits.shift();
  if (hits.length >= limit) return false;
  hits.push(now); return true;
}

ws.send(JSON.stringify({ "type":"err","code":429,"retryAfter":1000 }));
// or close on repeated abuse
ws.close(1008, "rate-limit");