Bug 1117807 - Setup requests throttling

tests/webapp/api/test_objectstore_api.py

@@ -100,7 +100,7 @@ def test_objectstore_with_bad_secret(job_sample, jm):
     tjc.add(tj)
 
     resp = test_utils.post_collection(
-        jm.project, tjc, status=403, consumer_secret='not so secret'
+        jm.project, tjc, status=403, consumer_secret='not-so-secret'
         )
 
     assert resp.status_int == 403
@@ -120,7 +120,7 @@ def test_objectstore_with_bad_key(job_sample, jm):
     tjc.add(tj)
 
     resp = test_utils.post_collection(
-        jm.project, tjc, status=403, consumer_key='wrong key'
+        jm.project, tjc, status=403, consumer_key='wrong-key'
         )
 
     assert resp.status_int == 403

tests/webapp/api/test_resultset_api.py

@@ -314,7 +314,7 @@ def test_resultset_with_bad_key(sample_resultset, jm, initial_data):
         trsc.add(rs)
 
     resp = test_utils.post_collection(
-        jm.project, trsc, status=403, consumer_key="horrible key"
+        jm.project, trsc, status=403, consumer_key="horrible-key"
         )
 
     assert resp.status_int == 403

treeherder/settings/base.py

@@ -273,7 +273,15 @@ REST_FRAMEWORK = {
     'DEFAULT_RENDERER_CLASSES': (
         'rest_framework.renderers.JSONRenderer',
     ),
-    'EXCEPTION_HANDLER': 'treeherder.webapp.api.exceptions.exception_handler'
+    'EXCEPTION_HANDLER': 'treeherder.webapp.api.exceptions.exception_handler',
+    'DEFAULT_THROTTLE_CLASSES': (
+        'treeherder.webapp.api.throttling.OauthKeyThrottle',
+    ),
+    'DEFAULT_THROTTLE_RATES': {
+        'jobs': '120/minute',
+        'objectstore': '120/minute',
+        'resultset': '120/minute'
+    }
 }
 
 SITE_URL = "http://local.treeherder.mozilla.org"

treeherder/webapp/api/jobs.py

@@ -17,6 +17,7 @@ class JobsViewSet(viewsets.ViewSet):
     This viewset is responsible for the jobs endpoint.
 
     """
+    throttle_scope = 'jobs'
 
     @with_jobs
     def retrieve(self, request, project, jm, pk=None):

treeherder/webapp/api/objectstore.py

@@ -17,6 +17,7 @@ class ObjectstoreViewSet(viewsets.ViewSet):
     Update will not be implemented as JobModel will always do
     a conditional create and then an update.
     """
+    throttle_scope = 'objectstore'
 
     @with_jobs
     @oauth_required

treeherder/webapp/api/resultset.py

@@ -65,6 +65,7 @@ class ResultSetViewSet(viewsets.ViewSet):
 
     ``result sets`` are synonymous with ``pushes`` in the ui
     """
+    throttle_scope = 'resultset'
 
     @with_jobs
     def list(self, request, project, jm):

treeherder/webapp/api/throttling.py

@@ -0,0 +1,17 @@
+from rest_framework import throttling
+
+
+class OauthKeyThrottle(throttling.ScopedRateThrottle):
+    def get_cache_key(self, request, view):
+        """
+        If `view.throttle_scope` is not set, don't apply this throttle.
+        Otherwise generate the unique cache key by concatenating the oauth key
+        with the '.throttle_scope` property of the view.
+        """
+        ident = request.GET.get('oauth_consumer_key', None)
+        if not ident:
+            return None
+        return self.cache_format % {
+            'scope': self.scope,
+            'ident': ident
+        }