fix(rate-limit): honor zero token refill rate

deploy/helm/smg/templates/_helpers.tpl

@@ -276,7 +276,7 @@ Called from the router Deployment template.
 - {{ .Values.history.oracle.password | quote }}
 {{- end }}
 {{- end }}
-{{- if gt (int .Values.auth.rateLimitTokensPerSecond) 0 }}
+{{- if ge (int .Values.auth.rateLimitTokensPerSecond) 0 }}
 - "--rate-limit-tokens-per-second"
 - {{ .Values.auth.rateLimitTokensPerSecond | quote }}
 {{- end }}

model_gateway/src/app_context.rs

@@ -497,7 +497,7 @@ impl AppContextBuilder {
             n => {
                 let rate_limit_tokens = config
                     .rate_limit_tokens_per_second
-                    .filter(|&t| t > 0)
+                    .filter(|&t| t >= 0)
                     .unwrap_or(n);
                 Some(Arc::new(TokenBucket::new(
                     n as usize,
@@ -715,6 +715,28 @@ mod tests {
     use super::*;
     use crate::config::types::PolicyConfig;
 
+    #[tokio::test]
+    async fn explicit_zero_rate_limit_disables_refill() {
+        let config = RouterConfig {
+            max_concurrent_requests: 10,
+            rate_limit_tokens_per_second: Some(0),
+            ..RouterConfig::default()
+        };
+        let bucket = AppContextBuilder::new()
+            .maybe_rate_limiter(&config)
+            .rate_limiter
+            .expect("rate limiter should be enabled");
+
+        assert!(bucket.try_acquire(10.0).is_ok());
+        // The previous fallback used max_concurrent_requests as the refill
+        // rate, which would add more than one token during this wait.
+        tokio::time::sleep(Duration::from_millis(150)).await;
+        assert!(bucket.try_acquire(1.0).is_err());
+
+        bucket.return_tokens_sync(1.0);
+        assert!(bucket.try_acquire(1.0).is_ok());
+    }
+
     fn config_with_policy(policy: PolicyConfig) -> RouterConfig {
         RouterConfig {
             policy,