feat: add per-user rate limits for translation and activity endpoints

Prevent translation and activity API endpoints from overwhelming the
database by adding configurable per-user rate limits (100 req / 5 min),
matching the existing export endpoint pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: JanCizmar

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/ProjectActivityController.kt

@@ -9,6 +9,7 @@ import io.swagger.v3.oas.annotations.Parameter
 import io.swagger.v3.oas.annotations.media.ExampleObject
 import io.swagger.v3.oas.annotations.tags.Tag
 import io.tolgee.activity.ActivityService
+import io.tolgee.configuration.tolgee.TolgeeProperties
 import io.tolgee.constants.Feature
 import io.tolgee.exceptions.NotFoundException
 import io.tolgee.hateoas.activity.ModifiedEntityModel
@@ -21,6 +22,7 @@ import io.tolgee.model.views.activity.ProjectActivityView
 import io.tolgee.security.ProjectHolder
 import io.tolgee.security.authentication.AllowApiAccess
 import io.tolgee.security.authorization.RequiresProjectPermissions
+import io.tolgee.security.ratelimit.RateLimitService
 import io.tolgee.service.branching.BranchService
 import io.tolgee.service.project.ProjectFeatureGuard
 import org.springdoc.core.annotations.ParameterObject
@@ -33,6 +35,7 @@ import org.springframework.web.bind.annotation.PathVariable
 import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.RequestParam
 import org.springframework.web.bind.annotation.RestController
+import java.time.Duration
 
 @Suppress("MVCPathVariableInspection", "SpringJavaInjectionPointsAutowiringInspection")
 @RestController
@@ -48,6 +51,8 @@ class ProjectActivityController(
   private val modifiedEntityModelAssembler: ModifiedEntityModelAssembler,
   private val branchService: BranchService,
   private val projectFeatureGuard: ProjectFeatureGuard,
+  private val rateLimitService: RateLimitService,
+  private val tolgeeProperties: TolgeeProperties,
 ) {
   @Operation(summary = "Get project activity")
   @GetMapping("")
@@ -57,6 +62,11 @@ class ProjectActivityController(
     @ParameterObject pageable: Pageable,
     @RequestParam(required = false) branch: String? = null,
   ): PagedModel<ProjectActivityModel> {
+    rateLimitService.checkPerUserRateLimit(
+      "activity",
+      limit = tolgeeProperties.rateLimits.activityRequestLimit,
+      refillDuration = Duration.ofMillis(tolgeeProperties.rateLimits.activityRequestWindow),
+    )
     projectFeatureGuard.checkIfUsed(Feature.BRANCHING, branch)
     val views =
       activityService.findProjectActivity(

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/translation/TranslationsController.kt

@@ -16,6 +16,7 @@ import io.tolgee.activity.RequestActivity
 import io.tolgee.activity.data.ActivityType
 import io.tolgee.api.v2.controllers.IController
 import io.tolgee.component.ProjectLastModifiedManager
+import io.tolgee.configuration.tolgee.TolgeeProperties
 import io.tolgee.constants.Feature
 import io.tolgee.constants.Message
 import io.tolgee.dtos.queryResults.TranslationHistoryView
@@ -41,6 +42,7 @@ import io.tolgee.security.authentication.AllowApiAccess
 import io.tolgee.security.authentication.AuthenticationFacade
 import io.tolgee.security.authorization.RequiresProjectPermissions
 import io.tolgee.security.authorization.UseDefaultPermissions
+import io.tolgee.security.ratelimit.RateLimitService
 import io.tolgee.service.key.ScreenshotService
 import io.tolgee.service.language.LanguageService
 import io.tolgee.service.project.ProjectFeatureGuard
@@ -74,6 +76,7 @@ import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.RequestParam
 import org.springframework.web.bind.annotation.RestController
 import org.springframework.web.context.request.WebRequest
+import java.time.Duration
 
 @Suppress("MVCPathVariableInspection", "SpringJavaInjectionPointsAutowiringInspection")
 @RestController
@@ -107,6 +110,8 @@ class TranslationsController(
   private val translationSuggestionService: TranslationSuggestionService,
   private val projectLastModifiedManager: ProjectLastModifiedManager,
   private val projectFeatureGuard: ProjectFeatureGuard,
+  private val rateLimitService: RateLimitService,
+  private val tolgeeProperties: TolgeeProperties,
 ) : IController {
   @GetMapping(value = ["/{languages}"])
   @Operation(
@@ -167,6 +172,11 @@ When null, resulting file will be a flat key-value object.
   ): ResponseEntity<Map<String, Any>>? {
     projectFeatureGuard.checkIfUsed(Feature.BRANCHING, branch)
     return projectLastModifiedManager.onlyWhenProjectDataChanged(request) {
+      rateLimitService.checkPerUserRateLimit(
+        "translations",
+        limit = tolgeeProperties.rateLimits.translationRequestLimit,
+        refillDuration = Duration.ofMillis(tolgeeProperties.rateLimits.translationRequestWindow),
+      )
       val permittedTags =
         securityService
           .filterViewPermissionByTag(projectId = projectHolder.project.id, languageTags = languages)
@@ -251,6 +261,11 @@ When null, resulting file will be a flat key-value object.
     params: GetTranslationsParams,
     @ParameterObject pageable: Pageable,
   ): KeysWithTranslationsPageModel {
+    rateLimitService.checkPerUserRateLimit(
+      "translations",
+      limit = tolgeeProperties.rateLimits.translationRequestLimit,
+      refillDuration = Duration.ofMillis(tolgeeProperties.rateLimits.translationRequestWindow),
+    )
     projectFeatureGuard.checkIfUsed(Feature.BRANCHING, params.branch)
     val languages =
       languageService.getLanguagesForTranslationsView(

backend/data/src/main/kotlin/io/tolgee/configuration/tolgee/RateLimitProperties.kt

@@ -62,6 +62,20 @@ class RateLimitProperties(
   var exportRequestLimit: Int = 100,
   @DocProperty(description = "Size, in milliseconds, of the time window for export-based limiting.")
   var exportRequestWindow: Long = 5 * 60 * 1000,
+  @DocProperty(description = "Amount of translation requests a user can do in a single time window.")
+  var translationRequestLimit: Int = 100,
+  @DocProperty(
+    description = "Size, in milliseconds, of the time window for translation-based limiting.",
+    defaultExplanation = "= 5 minutes",
+  )
+  var translationRequestWindow: Long = 5 * 60 * 1000,
+  @DocProperty(description = "Amount of activity requests a user can do in a single time window.")
+  var activityRequestLimit: Int = 100,
+  @DocProperty(
+    description = "Size, in milliseconds, of the time window for activity-based limiting.",
+    defaultExplanation = "= 5 minutes",
+  )
+  var activityRequestWindow: Long = 5 * 60 * 1000,
   @DocProperty(
     description =
       "Number of rate limit violations before the server stops responding to the client.\n" +