fix: Make Redis path atomic via EVAL + use hash key with TTL

- Switch Redis storage to a single hash key (cluster compatibility)
- Perform read/compute/write atomically with EVAL
- Keep first-hit behavior (no cost on missing state)
- Add EX-based TTL to avoid key buildup

Author: falvaradorodriguez

apisix/plugins/limit-req/util.lua

@@ -20,54 +20,64 @@ local max               = math.max
 local ngx_now           = ngx.now
 local ngx_null          = ngx.null
 local tonumber          = tonumber
+local core              = require("apisix.core")
 
 
 local _M = {version = 0.1}
 
 
+local script = core.string.compress_script([=[
+  local state_key  = KEYS[1]             -- state_key (hash), fields: "excess", "last"    
+  local rate       = tonumber(ARGV[1])   -- req/s
+  local now        = tonumber(ARGV[2])   -- ms
+  local burst      = tonumber(ARGV[3])   -- req/s
+  local commit     = tonumber(ARGV[4])   -- 1/0
+
+  local vals = redis.call("HMGET", state_key, "excess", "last")
+  local prev_excess = tonumber(vals[1] or "0")
+  local prev_last   = tonumber(vals[2] or "0")
+
+  local new_excess
+  if prev_last > 0 then
+    local elapsed = math.abs(now - prev_last)
+    new_excess = math.max(prev_excess - rate * (elapsed) / 1000 + 1000, 0)
+  else
+    new_excess = 0
+  end
+
+  if new_excess > burst then
+    return {0, new_excess}
+  end
+
+  if commit == 1 then
+    redis.call("HMSET", state_key, "excess", new_excess, "last", now)
+    redis.call("EXPIRE", state_key, 60)
+  end
+
+  return {1, new_excess}
+]=])
+
+
 -- the "commit" argument controls whether should we record the event in shm.
 function _M.incoming(self, red, key, commit)
     local rate = self.rate
     local now = ngx_now() * 1000
 
-    key = "limit_req" .. ":" .. key
-    local excess_key = key .. "excess"
-    local last_key = key .. "last"
+    local state_key = "limit_req:{" .. key .. "}:state"
 
-    local excess, err = red:get(excess_key)
-    if err then
-        return nil, err
-    end
-    local last, err = red:get(last_key)
-    if err then
+    local commit_flag = commit and "1" or "0"
+
+    local res, err = red:eval(script, 1, state_key,
+                              rate, now, self.burst, commit_flag)
+    if not res then
         return nil, err
     end
 
-    if excess ~= ngx_null and last ~= ngx_null then
-        excess = tonumber(excess)
-        last = tonumber(last)
-        local elapsed = now - last
-        excess = max(excess - rate * abs(elapsed) / 1000 + 1000, 0)
-
-        if excess > self.burst then
-            return nil, "rejected"
-        end
-    else
-        excess = 0
-    end
+    local allowed = tonumber(res[1]) == 1
+    local excess  = tonumber(res[2]) or 0
 
-    if commit then
-        local ok
-        local err
-        ok, err = red:set(excess_key, excess)
-        if not ok then
-            return nil, err
-        end
-
-        ok, err = red:set(last_key, now)
-        if not ok then
-            return nil, err
-        end
+    if not allowed then
+        return nil, "rejected"
     end
 
     -- return the delay in seconds, as well as excess