cutting

apps/api/Dockerfile.api

@@ -32,7 +32,12 @@ RUN apk add --no-cache --virtual .build-deps \
     "libc-dev" \
     "linux-headers" \
     && \
-    pip install -r requirements.txt --compile --no-cache-dir \
+    pip install -r requirements.txt \
+    --trusted-host pypi.org \
+    --trusted-host pypi.python.org \
+    --trusted-host files.pythonhosted.org \
+    --compile --no-cache-dir --default-timeout=100 --retries 5 \
+
     && \
     apk del .build-deps \
     && \

apps/api/plane/api/rate_limit.py

@@ -11,7 +11,7 @@
 
 class ApiKeyRateThrottle(SimpleRateThrottle):
     scope = "api_key"
-    rate = os.environ.get("API_KEY_RATE_LIMIT", "60/minute")
+    rate = os.environ.get("API_KEY_RATE_LIMIT", "10000/minute")
 
     def get_cache_key(self, request, view):
         # Retrieve the API key from the request header
@@ -52,7 +52,7 @@ def allow_request(self, request, view):
 
 class ServiceTokenRateThrottle(SimpleRateThrottle):
     scope = "service_token"
-    rate = "300/minute"
+    rate = "10000/minute"
 
     def get_cache_key(self, request, view):
         # Retrieve the API key from the request header

apps/api/plane/api/rate_limit.py.backup

@@ -0,0 +1,91 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# python imports
+import os
+
+# Third party imports
+from rest_framework.throttling import SimpleRateThrottle
+
+
+class ApiKeyRateThrottle(SimpleRateThrottle):
+    scope = "api_key"
+    rate = os.environ.get("API_KEY_RATE_LIMIT", "60/minute")
+
+    def get_cache_key(self, request, view):
+        # Retrieve the API key from the request header
+        api_key = request.headers.get("X-Api-Key")
+        if not api_key:
+            return None  # Allow the request if there's no API key
+
+        # Use the API key as part of the cache key
+        return f"{self.scope}:{api_key}"
+
+    def allow_request(self, request, view):
+        allowed = super().allow_request(request, view)
+
+        if allowed:
+            now = self.timer()
+            # Calculate the remaining limit and reset time
+            history = self.cache.get(self.key, [])
+
+            # Remove old histories
+            while history and history[-1] <= now - self.duration:
+                history.pop()
+
+            # Calculate the requests
+            num_requests = len(history)
+
+            # Check available requests
+            available = self.num_requests - num_requests
+
+            # Unix timestamp for when the rate limit will reset
+            reset_time = int(now + self.duration)
+
+            # Add headers
+            request.META["X-RateLimit-Remaining"] = max(0, available)
+            request.META["X-RateLimit-Reset"] = reset_time
+
+        return allowed
+
+
+class ServiceTokenRateThrottle(SimpleRateThrottle):
+    scope = "service_token"
+    rate = "300/minute"
+
+    def get_cache_key(self, request, view):
+        # Retrieve the API key from the request header
+        api_key = request.headers.get("X-Api-Key")
+        if not api_key:
+            return None  # Allow the request if there's no API key
+
+        # Use the API key as part of the cache key
+        return f"{self.scope}:{api_key}"
+
+    def allow_request(self, request, view):
+        allowed = super().allow_request(request, view)
+
+        if allowed:
+            now = self.timer()
+            # Calculate the remaining limit and reset time
+            history = self.cache.get(self.key, [])
+
+            # Remove old histories
+            while history and history[-1] <= now - self.duration:
+                history.pop()
+
+            # Calculate the requests
+            num_requests = len(history)
+
+            # Check available requests
+            available = self.num_requests - num_requests
+
+            # Unix timestamp for when the rate limit will reset
+            reset_time = int(now + self.duration)
+
+            # Add headers
+            request.META["X-RateLimit-Remaining"] = max(0, available)
+            request.META["X-RateLimit-Reset"] = reset_time
+
+        return allowed

apps/api/plane/authentication/rate_limit.py

@@ -3,6 +3,7 @@
 # See the LICENSE file for details.
 
 # Third party imports
+import os
 from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
 from rest_framework import status
 from rest_framework.response import Response
@@ -15,7 +16,7 @@
 
 
 class AuthenticationThrottle(AnonRateThrottle):
-    rate = "30/minute"
+    rate = "10000/minute"
     scope = "authentication"
 
     def throttle_failure_view(self, request, *args, **kwargs):
@@ -31,10 +32,10 @@ def throttle_failure_view(self, request, *args, **kwargs):
 class EmailVerificationThrottle(UserRateThrottle):
     """
     Throttle for email verification code generation.
-    Limits to 3 requests per hour per user to prevent abuse.
+    Limits to 10000 requests per hour per user to prevent abuse.
     """
 
-    rate = "3/hour"
+    rate = "10000/hour"
     scope = "email_verification"
 
     def throttle_failure_view(self, request, *args, **kwargs):

apps/api/plane/authentication/rate_limit.py.backup

@@ -0,0 +1,47 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+# Third party imports
+from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
+from rest_framework import status
+from rest_framework.response import Response
+
+# Module imports
+from plane.authentication.adapter.error import (
+    AuthenticationException,
+    AUTHENTICATION_ERROR_CODES,
+)
+
+
+class AuthenticationThrottle(AnonRateThrottle):
+    rate = "30/minute"
+    scope = "authentication"
+
+    def throttle_failure_view(self, request, *args, **kwargs):
+        try:
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
+                error_message="RATE_LIMIT_EXCEEDED",
+            )
+        except AuthenticationException as e:
+            return Response(e.get_error_dict(), status=status.HTTP_429_TOO_MANY_REQUESTS)
+
+
+class EmailVerificationThrottle(UserRateThrottle):
+    """
+    Throttle for email verification code generation.
+    Limits to 3 requests per hour per user to prevent abuse.
+    """
+
+    rate = "3/hour"
+    scope = "email_verification"
+
+    def throttle_failure_view(self, request, *args, **kwargs):
+        try:
+            raise AuthenticationException(
+                error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
+                error_message="RATE_LIMIT_EXCEEDED",
+            )
+        except AuthenticationException as e:
+            return Response(e.get_error_dict(), status=status.HTTP_429_TOO_MANY_REQUESTS)

apps/api/plane/db/models/workspace.py

@@ -326,7 +326,7 @@ class NavigationControlPreference(models.TextChoices):
     display_filters = models.JSONField(default=get_default_display_filters)
     display_properties = models.JSONField(default=get_default_display_properties)
     rich_filters = models.JSONField(default=dict)
-    navigation_project_limit = models.IntegerField(default=10)
+    navigation_project_limit = models.IntegerField(default=0, help_text="0 means unlimited")
     navigation_control_preference = models.CharField(
         max_length=25,
         choices=NavigationControlPreference.choices,