Rate limiter
Pick the algorithm by what you can afford to get wrong.

RateLimiter (interface)
  allow(String key): boolean

TokenBucketLimiter

SlidingWindowLogLimiter

FixedWindowLimiter

RateLimiterRegistry
  Map<Tier, RateLimiterFactory> factories
  limiterFor(clientId): RateLimiter

RateLimitRule
  int capacity
  double refillPerSec
  Duration window

How they connect:
  TokenBucketLimiter implements RateLimiter
  SlidingWindowLogLimiter implements RateLimiter
  FixedWindowLimiter implements RateLimiter
  RateLimiterRegistry uses RateLimiter

interface RateLimiter { boolean allow(String key); }

/** Token bucket: refill continuously at `ratePerSec`, up to `capacity`. Allows bursts up to `capacity`. */
class TokenBucketLimiter implements RateLimiter {
    private static final class Bucket {
        double tokens; long lastRefillNanos;
        Bucket(double tokens, long now) { this.tokens = tokens; this.lastRefillNanos = now; }
    }
    private final double capacity, ratePerNano;
    private final LongSupplier nanoClock;
    private final ConcurrentHashMap<String, Bucket> buckets = new ConcurrentHashMap<>();

    TokenBucketLimiter(int capacity, double ratePerSec, LongSupplier nanoClock) {
        this.capacity = capacity; this.ratePerNano = ratePerSec / 1_000_000_000.0; this.nanoClock = nanoClock;
    }

    public boolean allow(String key) {
        long now = nanoClock.getAsLong();
        Bucket b = buckets.computeIfAbsent(key, k -> new Bucket(capacity, now));
        synchronized (b) {                                         // per-key lock
            double refill = (now - b.lastRefillNanos) * ratePerNano;
            b.tokens = Math.min(capacity, b.tokens + refill);
            b.lastRefillNanos = now;
            if (b.tokens >= 1) { b.tokens -= 1; return true; }
            return false;
        }
    }
}

/** Sliding window log: exact; memory is O(limit) per key. */
class SlidingWindowLogLimiter implements RateLimiter {
    private final int limit; private final long windowNanos; private final LongSupplier nanoClock;
    private final ConcurrentHashMap<String, Deque<Long>> logs = new ConcurrentHashMap<>();

    SlidingWindowLogLimiter(int limit, Duration window, LongSupplier nanoClock) {
        this.limit = limit; this.windowNanos = window.toNanos(); this.nanoClock = nanoClock;
    }
    public boolean allow(String key) {
        long now = nanoClock.getAsLong();
        Deque<Long> log = logs.computeIfAbsent(key, k -> new ArrayDeque<>());
        synchronized (log) {
            while (!log.isEmpty() && now - log.peekFirst() >= windowNanos) log.pollFirst();
            if (log.size() < limit) { log.addLast(now); return true; }
            return false;
        }
    }
}

/** Fixed window: cheapest; allows up to 2x the limit across a window boundary. */
class FixedWindowLimiter implements RateLimiter {
    private record Window(long id, AtomicInteger count) {}
    private final int limit; private final long windowNanos; private final LongSupplier nanoClock;
    private final ConcurrentHashMap<String, Window> windows = new ConcurrentHashMap<>();

    FixedWindowLimiter(int limit, Duration window, LongSupplier nanoClock) {
        this.limit = limit; this.windowNanos = window.toNanos(); this.nanoClock = nanoClock;
    }
    public boolean allow(String key) {
        long windowId = nanoClock.getAsLong() / windowNanos;
        Window w = windows.compute(key, (k, cur) ->
                (cur == null || cur.id() != windowId) ? new Window(windowId, new AtomicInteger()) : cur);
        return w.count().incrementAndGet() <= limit;
    }
}

enum Tier { FREE, PREMIUM, INTERNAL }

class RateLimiterRegistry {
    private final Map<Tier, RateLimiter> limiters;
    private final Function<String, Tier> tierResolver;            // clientId → tier (from config / DB)
    RateLimiterRegistry(Map<Tier, RateLimiter> limiters, Function<String, Tier> tierResolver) {
        this.limiters = limiters; this.tierResolver = tierResolver;
    }
    public boolean allow(String clientId) {
        return limiters.get(tierResolver.apply(clientId)).allow(clientId);
    }
}

// Usage
var registry = new RateLimiterRegistry(Map.of(
        Tier.FREE,     new TokenBucketLimiter(10, 10, System::nanoTime),
        Tier.PREMIUM,  new TokenBucketLimiter(200, 100, System::nanoTime),
        Tier.INTERNAL, key -> true),                               // no limit
    clientId -> lookupTier(clientId));