consolidate/refactor submission throttles

[eviljeff]

currently some of our logic for throttling submissions is contained in VersionView().check_throttles itself, which makes it difficult to reuse in other classes. We should rewrite it into either a utility function, or entirely within DRF throttle classes that can be reused more easily.

[AlexandraMoga]

@eviljeff does this issue affect only addon submission throttling or every other API throttling we have in place?

[eviljeff]

The refactoring touched devhub and the existing addon signing api (used by webext) as well as the new addon submisison API - there shouldn't be any changes in what's enforced though. And the throttle limits are supposed to be shared across all methods (addon signing API; devhub submission of a validated upload; addon submission API with a validated upload).

[AlexandraMoga]

@eviljeff I've verified this issue on stage where rate limiting is active. I've created submissions from Devhub, the signing API and the new addons submission API. My results are as follows:

User restrictions:

• addons per user/minute => 3 submissions allowed (as expected)
• addons per user/hour => 10 submissions allowed. It used to be more than that and I'm not sure when the rule changed?
• addons per user/day => 24 submissions allowed (same as it was reported in Add rate limiting per day #8357)

IP restrictions:

• this needs to be tested further

With regards to the new addon submission API, we don't seem to have any rate limit for the api/v5/addons/upload/ endpoint. Should we add one?

[eviljeff]

* addons per user/hour => 10 submissions allowed. It used to be more than that and I'm not sure when the rule changed?

#8367

With regards to the new addon submission API, we don't seem to have any rate limit for the api/v5/addons/upload/ endpoint. Should we add one?

I deliberately didn't add any, because a user could end up having to submit multiple uploads if they didn't test with the linter before submission, or for non-linter validation error, so the existing limits would be too low. But we potentially should have_some_ throttling - could you file a follow-up issue to look into it?

[AlexandraMoga]

* addons per user/hour => 10 submissions allowed. It used to be more than that and I'm not sure when the rule changed?

#8367

Verified by me even 😅

But we potentially should have_some_ throttling - could you file a follow-up issue to look into it?

Filed #8537