Multi-level throttling

[bwillis]

👋 Hello and thanks for the great work on rack-attack!

I have a question: Is there a way to separate different levels of throttling?

The basic use-case is to have throttling before authentication and after authentication so that we don't have to perform some sort of authentication within rack-attack itself, like the solution proposed in #47.

We've used some form of the following before:

# application_controller
request.env["authenticated_user"] = current_user
raise 'Sloooow down' if Rack::Attack.throttles.any? { |_name, throttle| throttle.matched_by?(request) }

# rack_attack
throttle('throttle authenticated users', limit: 200, period: 60.seconds) do |req|
  next unless req.env["authenticated_user"]

  req.env["authenticated_user"].id
end

I'd be curious if others have looked into solving this type of problem before. Thanks!