`ratelimit` guard against misconfiguration causing `attempt to subtract with overflow`

[chrisjsimpson]

Raising PR with repro which will hopefully be illustrative

[chrisjsimpson]

On bad wifi quick repro is:

Maybe could be guarded against with an additional validation when the builder is used ~MaxTokensLowerThanInitialAvailable etc

git diff HEAD^ --patch > out.patch

diff --git a/ratelimit/src/lib.rs b/ratelimit/src/lib.rs
index eccf261..43afab1 100644
--- a/ratelimit/src/lib.rs
+++ b/ratelimit/src/lib.rs
@@ -68,6 +68,8 @@ pub enum Error {
     RefillAmountTooHigh,
     #[error("refill interval in nanoseconds exceeds maximum u64")]
     RefillIntervalTooLong,
+    #[error("max tokens cannot be lower than the initial_available")]
+    MaxTokensLowerThanInitialAvailable,
 }
 
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
@@ -158,6 +160,9 @@ impl Ratelimiter {
 
         if amount < parameters.refill_amount {
             Err(Error::MaxTokensTooLow)
+        } else if parameters.refill_amount < self.available() {
+
+            Err(Error::MaxTokensLowerThanInitialAvailable)
         } else {
             parameters.capacity = amount;
             loop {
@@ -252,7 +257,15 @@ impl Ratelimiter {
 
         if available + amount >= parameters.capacity {
             // we will fill the bucket up to the capacity
-            let to_add = parameters.capacity - available;
+            eprintln!("About to perform subtraction {} - {}", parameters.capacity, available);
+            let to_add: u64;
+            // Never attempt to take away more from capacity
+            //if available > parameters.capacity {
+            //    to_add = parameters.refill_amount
+            //} else {
+            //    to_add = parameters.capacity - available;
+            //}
+            to_add = parameters.capacity - available;
             self.available.fetch_add(to_add, Ordering::Release);
 
             // and increment the number of tokens dropped
@@ -468,6 +481,25 @@ mod tests {
         assert!(count <= 1400);
     }
 
+
+    // quick test that a ratelimiter never wraps
+    #[test]
+    pub fn reproduce_panic() {
+        let rl = Ratelimiter::builder(1, Duration::from_secs(5))
+            .max_tokens(1)
+            .initial_available(5)
+            .build()
+            .unwrap();
+
+            // Consume 1 token
+            rl.try_wait().is_ok();
+            // Sleep for same duration as 5
+            std::thread::sleep(Duration::from_secs(5));
+            // Try to consume again (will Panic)
+            rl.try_wait();
+    }
+
+
     // quick test that an idle ratelimiter doesn't build up excess capacity
     #[test]
     pub fn idle() {