API rate limiting

[tombch]

Onyx does not include any rate limiting of the API - this would be quite useful to prevent overusage by users.

The limiting should not be global; staff accounts (is_staff = True) should retain generous/unrestricted access whereas regular users have burst and sustain limits.

It might also be useful to have different limits for different API endpoints.

Django REST framework includes a UserRateThrottle class, which could be extended with a check for staff status by doing something like:

from rest_framework.throttling import UserRateThrottle


class BurstRateThrottle(UserRateThrottle):
    scope = "burst"

    def allow_request(self, request, view):
        if request.user.is_staff:
            return True
        else:
            return super().allow_request(request, view)


class SustainedRateThrottle(UserRateThrottle):
    scope = "sustained"

    def allow_request(self, request, view):
        if request.user.is_staff:
            return True
        else:
            return super().allow_request(request, view)

and then in settings.py:

    "DEFAULT_THROTTLE_CLASSES": [
        "rest_framework.throttling.AnonRateThrottle",
        "internal.throttling.BurstRateThrottle",
        "internal.throttling.SustainedRateThrottle",
    ],
    "DEFAULT_THROTTLE_RATES": {
        "anon": "10/min",
        "burst": "100/min", # Perhaps some other value
        "sustained": "10000/day", # Perhaps some other value
    },

The django cache would also need configuring.