Last Comment Bug 848869 - Limit the API submission per day
: Limit the API submission per day
Status: RESOLVED FIXED
p=2
:
Product: Marketplace
Classification: Server Software
Component: API (show other bugs)
: 1.0
: All All
: P4 normal (vote)
: 2013-04-11
Assigned To: Chuck Harmston [:chuck]
:
Mentors:
Depends on: 858287
Blocks:
  Show dependency treegraph
 
Reported: 2013-03-07 10:16 PST by Andrew Williamson [:eviljeff]
Modified: 2013-04-09 15:28 PDT (History)
4 users (show)
See Also:
QA Whiteboard:
Iteration: ---
Points: ---


Attachments

Description Andrew Williamson [:eviljeff] 2013-03-07 10:16:57 PST
Currently anyone with an API key can submit any number of apps via it - i.e. thousands a day!  Even when we have the capacity to review that many (which we don't currently) it would still be sensible to be able to limit the number an individual user can submit.

The capability to set a limit is important right now (once its in place then changing it from 10 to 1000 or visa versa shouldn't be a big problem)
Comment 1 Andy McKay [:andym] 2013-03-07 10:33:42 PST
We should do this either per person or per tier. So that the average developer can be limited to 10 submissions per day and partners (or some other blessed status) can do a few thousand.

Ideally we need to rate limit all the API, not just the submission.
Comment 2 Andrew Williamson [:eviljeff] 2013-03-07 10:44:05 PST
(In reply to Andy McKay [:andym] from comment #1)
> We should do this either per person or per tier. So that the average
> developer can be limited to 10 submissions per day and partners (or some
> other blessed status) can do a few thousand.

yeah, agreed.  We could manually add those with a blessed status to a group and either give them a significantly higher limit or have a limit free group for phonegap type partners.
Comment 3 Andrew Williamson [:eviljeff] 2013-03-07 10:58:09 PST
An Apps:APINoLimit permission or similar.
Comment 4 Chuck Harmston [:chuck] 2013-04-09 10:43:33 PDT
Landed:
https://github.com/mozilla/zamboni/compare/2835697c1cff...f74f1a8b5e65

Two major changes here:
1) Users with the Apps:APIUnthrottled permission will never be throttled on API requests
2) The app creation endpoint is now throttled at 10 requests/day.

Let me know how this works out for you!

Note You need to log in before you can comment on or make changes to this bug.