Build and Review a Configurable Node.js Token-Bucket Rate Limiter

Build a Node.js Express application that reads a configuration file and exposes an API governed by a token-bucket rate limiter. Then explain the implementation's architecture as if reviewing the submitted code with another engineer.

Constraints & Assumptions

• Use the token-bucket algorithm, with a configured capacity and token refill rate.
• The application must read configuration from a file and return an appropriate allowed or rate-limited API response.
• Practice clarification: implement one initially full, in-memory bucket for one endpoint in one Node.js process. Each request costs one token. This makes the unspecified bucket scope explicit; discuss how changing the scope affects the architecture.
• Invalid configuration should prevent the service from starting. No persistence or multi-process coordination is assumed for the initial implementation.

Clarifying Questions to Ask

• Is a bucket shared by the endpoint or assigned per user, API key, or client address?
• Should bursts up to capacity be allowed immediately, and should unused tokens accumulate only up to capacity?
• Does a denied request consume tokens? What response should tell a caller when another attempt may succeed?