feat(api): scope dynDNS throttling by domain, fixes #560

api/api/settings.py

@@ -109,7 +109,7 @@ REST_FRAMEWORK = {
         # ScopedRatesThrottle
         'account_management_active': ['3/min'],  # things with side effect, e.g. sending mail or zone creation on signup
         'account_management_passive': ['10/min'],  # things like GET'ing v/* or auth/* URLs, or creating/deleting tokens
-        'dyndns': ['1/min'],  # dynDNS updates; anything above 1/min is a client misconfiguration
+        'dyndns': ['1/min'],  # dynDNS updates, domain-scoped; anything above 1/min is a client misconfiguration
         'dns_api_read': ['10/s', '50/min'],  # DNS API requests that do not involve pdns
         'dns_api_write_domains': ['10/s', '300/min', '1000/h'],  # domains/ endpoint
         'dns_api_write_rrsets': ['2/s', '15/min', '30/h', '300/d'],  # rrsets/ endpoint, domain-scoped on the view

api/desecapi/views.py

@@ -291,6 +291,10 @@ class DynDNS12UpdateView(generics.GenericAPIView):
     serializer_class = serializers.RRsetSerializer
     throttle_scope = 'dyndns'
 
+    @property
+    def throttle_scope_bucket(self):
+        return self.domain.name
+
     def _find_ip(self, params, version):
         if version == 4:
             look_for = '.'

docs/rate-limits.rst

@@ -28,7 +28,8 @@ the API.  When several rates are given, all are enforced at the same time.
 +--------------------------------+----------+-------------------------------------------------------------------------------------------+
 | ``account_management_passive`` | 10/min   | Account activities with internal effects (e.g. viewing account details, creating a token) |
 +--------------------------------+----------+-------------------------------------------------------------------------------------------+
-| ``dyndns``                     | 1/min    | dynDNS updates                                                                            |
+| ``dyndns``                     | 1/min    | dynDNS updates (per domain).  If you need to keep subdomains in sync, consider setting up |
+|                                |          | a ``CNAME`` redirect in our web interface.                                                |
 +--------------------------------+----------+-------------------------------------------------------------------------------------------+
 | ``dns_api_read``               | 10/s     | DNS read operations (e.g. fetching an RRset)                                              |
 |                                |          |                                                                                           |