feat(api): limit number of domains per user

api/desecapi/migrations/0011_user_limit_domains.py

@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.3 on 2016-12-27 07:59
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('desecapi', '0010_auto_20161219_1242'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='limit_domains',
+            field=models.IntegerField(blank=True, default=5, null=True),
+        ),
+    ]

api/desecapi/models.py

@@ -51,6 +51,7 @@ class User(AbstractBaseUser):
     registration_remote_ip = models.CharField(max_length=1024, blank=True)
     captcha_required = models.BooleanField(default=False)
     created = models.DateTimeField(auto_now_add=True)
+    limit_domains = models.IntegerField(default=settings.LIMIT_USER_DOMAIN_COUNT_DEFAULT,null=True,blank=True)
 
     objects = MyUserManager()
 

api/desecapi/settings.py

@@ -156,3 +156,4 @@ NORECAPTCHA_WIDGET_TEMPLATE = 'captcha-widget.html'
 
 # abuse protection
 ABUSE_LOCK_ACCOUNT_BY_REGISTRATION_IP_PERIOD_HRS = 48
+LIMIT_USER_DOMAIN_COUNT_DEFAULT = 5

api/desecapi/tests/testdomains.py

@@ -189,3 +189,21 @@ class AuthenticatedDomainTests(APITestCase):
             response = self.client.post(url, data)
             self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
             self.assertEqual(len(mail.outbox), outboxlen)
+
+    def testLimitDomains(self):
+        httpretty.enable()
+        httpretty.register_uri(httpretty.POST, settings.POWERDNS_API + '/zones')
+
+        outboxlen = len(mail.outbox)
+
+        url = reverse('domain-list')
+        for i in range(settings.LIMIT_USER_DOMAIN_COUNT_DEFAULT-2):
+            data = {'name': utils.generateDomainname(), 'dyn': True}
+            response = self.client.post(url, data)
+            self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+            self.assertEqual(len(mail.outbox), outboxlen+i+1)
+
+        data = {'name': utils.generateDomainname(), 'dyn': True}
+        response = self.client.post(url, data)
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(len(mail.outbox), outboxlen + settings.LIMIT_USER_DOMAIN_COUNT_DEFAULT-2)

api/desecapi/views.py

@@ -51,6 +51,11 @@ class DomainList(generics.ListCreateAPIView):
             ex.status_code = 409
             raise ex
 
+        if self.request.user.limit_domains is not None and self.request.user.domains.count() >= self.request.user.limit_domains:
+            ex = ValidationError(detail={"detail": "You reached the maximum number of domains allowed for your account.", "code": "domain-limit"})
+            ex.status_code = 403
+            raise ex
+
         obj = serializer.save(owner=self.request.user)
 
         def sendDynDnsEmail(domain):