kobotoolbox / kpi / 23179673250 / 2

82%

master: 76%

push

github

feat(qual): add per-user throttling for Automatic QA requests DEV-1449 (#6824)

### 📣 Summary
Adds a configurable per-user rate limit for automatic QA requests to
prevent users or scripts from triggering large bursts of Bedrock
requests through the supplement API.

### 📖 Description
Automatic QA requests trigger calls to external LLM providers (AWS
Bedrock). Currently there is no protection against a user sending a
large number of requests in a short time period.

Although the UI does not provide bulk operations, users could easily
send repeated requests via scripts (e.g. curl or API clients).

This PR introduces per-user rate limiting for Automatic QA requests. The
throttle:
- applies only to Automatic Bedrock QA requests (e.g.,
`AUTOMATIC_BEDROCK_QUAL`)
- is enforced on the submission supplement PATCH endpoint
- is per authenticated user
- limits requests to N requests per second (Configurable via Constance
`AUTOMATIC_QA_REQUESTS_PER_SECOND`, default: 5)

If a user exceeds the configured limit, the API returns: `HTTP 429 Too
Many Requests`

3821 of 11520 branches covered (33.17%)

19300 of 35257 relevant lines covered (54.74%)

0.55 hits per line