If "X-RateLimit-Remaining: 1", allow one additional API request

index.js

@@ -29,15 +29,15 @@ module.exports = function (app, db) {
         }
 
         // do not allow negative remaining
-        limit.remaining = Math.max(Number(limit.remaining) - 1, 0)
+        limit.remaining = Math.max(Number(limit.remaining) - 1, -1)
         db.set(key, JSON.stringify(limit), 'PX', opts.expire, function (e) {
           if (!opts.skipHeaders) {
             res.set('X-RateLimit-Limit', limit.total)
-            res.set('X-RateLimit-Remaining', limit.remaining)
             res.set('X-RateLimit-Reset', Math.ceil(limit.reset / 1000)) // UTC epoch seconds
+            res.set('X-RateLimit-Remaining', Math.max(limit.remaining,0))
           }
 
-          if (limit.remaining) return next()
+          if (limit.remaining >= 0) return next()
 
           var after = (limit.reset - Date.now()) / 1000
 

tests/index.js

@@ -21,7 +21,7 @@ describe('rate-limiter', function () {
   })
 
   it('should work', function (done) {
-    var map = [10, 9, 8, 7, 6, 5, 4, 3, 2]
+    var map = [10, 9, 8, 7, 6, 5, 4, 3, 2, 1]
     var clock = sinon.useFakeTimers()
 
     limiter({