RateLimitConfig.java

package com.checkout.paymentgw.gateway.ratelimit;

import org.springframework.cloud.gateway.filter.ratelimit.KeyResolver;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import reactor.core.publisher.Mono;

/**
 * Rate-limit key strategy. Prefer {@code X-Merchant-Id} (set by the JWT validator
 * after token verification) and fall back to the remote address for unauthenticated
 * health-check style traffic.
 */
@Configuration
public class RateLimitConfig {

    @Bean
    KeyResolver merchantKeyResolver() {
        return exchange -> {
            String merchantId = exchange.getRequest().getHeaders().getFirst("X-Merchant-Id");
            if (merchantId == null || merchantId.isBlank()) {
                merchantId = exchange.getRequest().getRemoteAddress() != null
                        ? exchange.getRequest().getRemoteAddress().getAddress().getHostAddress()
                        : "anonymous";
            }
            return Mono.just(merchantId);
        };
    }
}