Merge lp:~maxiberta/canonical-identity-provider/registration-throttling into lp:canonical-identity-provider/release

[Maximiliano Bertacchini]

Update account registration throttling from 3600 req/h/IP to 360 req/h/IP.

[Adam Collard (adam-collard)]

review: Approve

=== modified file 'django_project/settings_base.py'
--- django_project/settings_base.py	2018-10-22 17:15:12 +0000
+++ django_project/settings_base.py	2018-12-20 20:30:44 +0000
@@ -582,6 +582,7 @@
 TESTING = False
 THOUSAND_SEPARATOR = ','
 THROTTLE_MAX_REQUESTS = 3600
+THROTTLE_MAX_REQUESTS_REGISTRATION = 360
 THROTTLE_WHITELIST_EMAIL_REGEXP_LIST = []
 TIMELOG_LOG = 'timelog.log'
 TIME_FORMAT = 'P'

=== modified file 'src/api/v20/handlers.py'
--- src/api/v20/handlers.py	2018-10-22 16:51:54 +0000
+++ src/api/v20/handlers.py	2018-12-20 20:30:44 +0000
@@ -277,7 +277,7 @@
     allowed_methods = ('POST',)
 
     @require_mime('json')
-    @throttle()
+    @throttle(max_requests=settings.THROTTLE_MAX_REQUESTS_REGISTRATION)
     def create(self, request):
         """Create/register a new account."""
         if not gargoyle.is_active('USER_REGISTRATION_API_ENABLED', request):

=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2018-10-22 16:51:54 +0000
+++ src/api/v20/tests/test_handlers.py	2018-12-20 20:30:44 +0000
@@ -601,10 +601,14 @@
         other_email = '[e-mail]'
         assert other_email != data['email']
 
-        with self.settings(THROTTLE_MAX_REQUESTS=2):
+        max_requests = settings.THROTTLE_MAX_REQUESTS_REGISTRATION
+        with patch('piston.utils.cache') as mock_cache:
+            mock_cache.get.return_value = (max_requests - 1, time.time() + 42)
             response = self.do_post(data, status_code=201)
             self.assert_account_created()
 
+        with patch('piston.utils.cache') as mock_cache:
+            mock_cache.get.return_value = (max_requests, time.time() + 42)
             data['email'] = other_email
             response = self.do_post(data, status_code=429)
             self.assertEqual(response['code'], 'TOO_MANY_REQUESTS')
@@ -2005,7 +2009,8 @@
         mock_cache.get.return_value = (
             settings.THROTTLE_MAX_REQUESTS, time.time() + 42.99)
 
-    def throttle_by_openid(self, openid):
+    def throttle_by_openid(self, openid,
+                           max_requests=settings.THROTTLE_MAX_REQUESTS):
         mock_cache = self.patch('piston.utils.cache')
 
         def mock_get(key, default=None, version=None):
@@ -2013,9 +2018,9 @@
             # the first part of the key is the requester username
             _, extra = key.split(':', 1)
             if openid in extra:
-                return settings.THROTTLE_MAX_REQUESTS, time.time() + 42.99
+                return max_requests, time.time() + 42.99
             else:
-                return settings.THROTTLE_MAX_REQUESTS - 1, time.time() + 42.99
+                return max_requests - 1, time.time() + 42.99
         mock_cache.get = mock_get
 
     throttle_by_email = throttle_by_token = throttle_by_openid
@@ -2116,7 +2121,9 @@
         self.assert_handler_not_throttled(
             request, data=json.dumps(data),
             content_type='application/json',
-            throttle_func=lambda: self.throttle_by_email(email))
+            throttle_func=lambda: self.throttle_by_email(
+                email,
+                max_requests=settings.THROTTLE_MAX_REQUESTS_REGISTRATION))
 
     def test_account_login_handler_throttled_by_email(self):
         url = reverse('api-login')