Add project-scoped tag creation rate limiting

Jerry Setorequested to merge
617378-rate-limit-rest-create-tags into master

What does this MR do and why?

Limit tag creation requests across the REST API, GraphQL mutation, and UI to protect projects from excessive tag creation while allowing instance administrators to configure the hourly threshold.

Resolves https://gitlab.com/gitlab-org/gitlab/-/issues/617378

References

How to set up and validate locally

  1. Configure a limit: curl --request PUT --header "PRIVATE-TOKEN: TOKEN --url "http://gdk.test:3000/api/v4/application/settings?tags_create_limit=2"
  2. Test api
  curl -XPOST "http://gdk.test:3000/api/v4/projects/PROJECT_ID/repository/tags" \
  -H "PRIVATE-TOKEN: TOKEN" \
  --data "ref=main&tag_name=TAGNAME"
  1. test graphql
curl -XPOST 'http://gdk.test:3000/api/graphql' \
  -H "PRIVATE-TOKEN: TOKEN" \
  --header 'Content-Type: application/json' \
  --data-raw '{"query":"mutation {  tagCreate(    input: {projectPath: \"PROJECT_PATH\", ref: \"main\", name: \"TAGNAME2\"}  ) {    tag {      name    }  }}"}'
  1. Test creating tags through the UI (http://gdk.test:3000/root/test-ssh-signature/-/tags/new)

Check for the This endpoint has been requested too many times. Try again later. message after requests are rate limited.

  • Test commenting on a commit with the /tag quickaction.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #617378

Edited by Jerry Seto

Merge request reports