# Throttle rules — token bucket algorithm, evaluated in order, first match wins.
#
# burst:  max tokens in the bucket (peak request allowance)
# refill: tokens added per second (sustained request rate)
#
# Each * is a capture group: {0}, {1}, etc. in bucketKey.
#
# Two signatures are emitted per request:
#   1. instanceId:userId:path   (matches 3-segment patterns like *:*:/reports/*)
#   2. instanceId:userId         (matches 2-segment patterns like *:1234)
#
# Use the short form (*:*) for user/instance-level rules.
# Use the long form (*:*:/path) for path-specific rules.
#
# Examples (uncomment as needed):
#
# --- Block a specific user ---
# - pattern: "*:1234"
#   burst: 0
#   refill: 0
#
# --- Block an entire instance ---
# - pattern: "5678:*"
#   burst: 0
#   refill: 0
#
# --- Tight limit on a heavy endpoint ---
# - pattern: "*:*:/reports/*"
#   burst: 5
#   refill: 1
#   bucketKey: "reports:{0}:{1}"  # {0}=instanceId, {1}=userId
#
# --- Higher limit for a high-traffic instance ---
# - pattern: "9999:*"
#   burst: 500
#   refill: 50
#   bucketKey: "user:9999:{0}"  # {0}=userId
#
# --- Limit file uploads per user ---
# - pattern: "*:*:/files"
#   burst: 10
#   refill: 2
#   bucketKey: "files:{0}:{1}"

# Default — rate limit per user
- pattern: "*:*"
  burst: 100
  refill: 10
  bucketKey: "user:{0}:{1}"  # {0}=instanceId, {1}=userId
