استفاده از SoftLimit بجای RateLimit در API

public class SoftRateLimitMiddleware
{
    private readonly RequestDelegate _next;
    private readonly SoftRateLimitOptions _options;
    private readonly ConcurrentDictionary<string, SlidingCounter> _counters = new();
    private readonly Random _random = new();

    public SoftRateLimitMiddleware(RequestDelegate next, IOptions<SoftRateLimitOptions> options)
    {
        _next = next;
        _options = options.Value;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        var ip = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";
        var counter = _counters.GetOrAdd(ip, _ => new SlidingCounter());

        counter.Increment();

        var recentRequests = counter.RequestsInLastSecond();
        if (recentRequests > _options.RequestsPerSecond)
        {
            var baseDelay = _random.Next(_options.MinDelayMs, _options.MaxDelayMs);

            if (recentRequests > _options.AggressiveThreshold)
            {
                // Scale delay up to 2x for very aggressive traffic
                var scale = Math.Min(2.0, (double)recentRequests / _options.AggressiveThreshold);
                baseDelay = (int)(baseDelay * scale);
            }

            await Task.Delay(baseDelay);
        }

        await _next(context);
    }

    private class SlidingCounter
    {
        private readonly ConcurrentQueue<DateTime> _timestamps = new();

        public void Increment()
        {
            var now = DateTime.UtcNow;
            _timestamps.Enqueue(now);

            while (_timestamps.TryPeek(out var ts) && ts < now.AddSeconds(-1))
                _timestamps.TryDequeue(out _);
        }

        public int RequestsInLastSecond()
        {
            var cutoff = DateTime.UtcNow.AddSeconds(-1);
            return _timestamps.Count(ts => ts >= cutoff);
        }
    }
}

public class SoftRateLimitOptions
{
    public int RequestsPerSecond { get; set; }
    public int AggressiveThreshold { get; set; }
    public int MinDelayMs { get; set; }
    public int MaxDelayMs { get; set; }
}

{
  "SoftRateLimit": {
    "RequestsPerSecond": 10,
    "AggressiveThreshold": 100,
    "MinDelayMs": 5000,
    "MaxDelayMs": 20000
  }
}

app.UseRouting();

// Soft limit should come BEFORE:
app.UseMiddleware<SoftRateLimitMiddleware>();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();