A requests_per_second: 0 route crashes instead of blocking traffic

requests_per_second: 0 is a reasonable, sensible-looking way to configure "block all traffic on this route through the rate limiter" (e.g. temporarily killing a specific client's access without deleting their route or auth credential entirely). Instead of cleanly rejecting every request with 429, the route errors out on every single request -- the rate-limit check itself throws, which the gateway has no specific handling for, so it surfaces as an unhandled exception. What was meant to fully block a client instead breaks the route for everyone hitting it, in a way that is much harder to diagnose than a plain 429 would be.

The token bucket's Lua script computes an idle-expiry TTL for the bucket key with . When () is , divides by zero, producing , and then gets asked to expire a key in seconds -- which Redis rejects because requires an integer, raising a out of .

1. limiter = RateLimiter(FakeAsyncRedis()).
2. await limiter.check("route", "client", requests_per_second=0, burst=5, now=1000.0).
3. Observe: redis.exceptions.ResponseError: value is not an integer or out of range. Expected: returns a RateLimitResult with allowed=False.

This is a boundary condition that is invisible from reading the token bucket script's main logic in isolation -- the token-accounting math is completely correct for rate=0 on its own (tokens simply never refill, so the bucket empties and stays empty, which is exactly "block everything"). It is only the housekeeping line -- the TTL calculation added so idle buckets do not accumulate in Redis forever -- that assumes rate is always positive and blows up otherwise.

The TTL only exists so an idle bucket eventually expires from Redis instead of leaking forever; it was never meant to depend on the request actually succeeding or failing. Think about what a sane, finite TTL would be for a bucket that will never refill (rate=0), independent of the burst / rate formula that assumes refilling is happening at all -- and where in the Lua script (or in RateLimiter.check()'s Python side, before it ever calls the script) that special case belongs.