feat(ai-rate-limiting): add expression-based limit strategy

[nic-6443]

Description

This PR adds the expression limit strategy to the ai-rate-limiting plugin.

Expression strategy

The expression limit strategy allows defining rate limit groups using lua-resty-expr expressions. Each group can have its own count, time_window, and matching expression. When a request matches multiple groups, the first matching group is used. If no group matches, the request is passed through without rate limiting.

This enables fine-grained AI token rate limiting based on request attributes (headers, query params, variables, etc.).

Example config

{
  "limit_strategy": "expression",
  "cost_expr": "input_tokens + completion_tokens",
  "limit_groups": [
    {
      "expression": [["http_x_model", "==", "gpt-4"]],
      "count": 500,
      "time_window": 60
    },
    {
      "expression": [["http_x_model", "==", "gpt-3.5"]],
      "count": 1000,
      "time_window": 60
    }
  ]
}

Checklist

• Expression strategy implementation with schema, compile, eval functions
• Handle edge cases: negative, NaN, Inf token usage
• Safe expression environment (upstream usage keys cannot shadow built-in functions)
• 13 test cases covering expression rate limiting scenarios

Note on remaining header accuracy

The X-AI-RateLimit-Remaining header currently shows a value that is off by 1 (e.g., 499 instead of 500) due to the limit-count module deducting cost during the access-phase dry-run peek. This will be fixed in a follow-up PR after apisix-build-tools#455 merges and a new apisix-runtime is released with lua-resty-limit-traffic v1.2.0, which supports cost=0 for non-deducting peeks.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds an expression-based token cost strategy to the ai-rate-limiting plugin so users can compute rate-limit cost from provider-specific usage fields via a Lua arithmetic expression.

Changes:

• Extends limit_strategy with "expression" and adds cost_expr to the plugin schema.
• Introduces sandboxed compilation/evaluation of expressions against ctx.llm_raw_usage.
• Adds a dedicated test suite covering schema validation and (non-)streaming Anthropic scenarios.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 13 comments.

File	Description
apisix/plugins/ai-rate-limiting.lua	Adds expression strategy, schema field, and runtime expression evaluation for token-cost calculation.
t/plugin/ai-rate-limiting-expression.t	Adds integration tests validating expression config and Anthropic streaming/non-streaming behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nic-6443]

Fixed the CI failure in TEST 13: when the expression evaluates to a negative value that gets clamped to 0, calling rate_limit() with cost=0 triggers an assertion failure in resty.limit.count's incoming function (dict:incr(key, 0, ...)). The fix skips the rate_limit() call entirely when used_tokens == 0 since there's nothing to deduct.