ThrottleApi Middleware & Other questions

BurnNoticeSpy

The API Throttling Documentation shows how to throttle requests on routes and the specific example given shows how to do so on the Post Model:

  if (Post::where('user_id', $actor->id)->where('created_at', '>=', new DateTime('-10 seconds'))->exists()) {
        return true;
    }

How can i limit requests on a custom endpoint that doesn't add data; but rather simply pulls a discussion column value on request? Since it doesn't have a reference point like the created_at above, how shall i decide the throttling condition? Looking for ideas...

My second question is regarding the FoF Byōbu extension. Firstly, thank you @luceos for putting in the hard work to make this the only working private messaging extension currently.

Using the API, how can i exclude private discussions from appearing on results? The is:private gambit works, but i can't use -is:private to exclude. If this isn't available, could i get some suggestions on what work i should do to make this a reality?

Thanks !

luceos

BurnNoticeSpy The is:private gambit works, but i can't use -is:private to exclude. If this isn't available, could i get some suggestions on what work i should do to make this a reality?

It might have been removed during the performance rewrite. You can find the code in the PrivateGambit class if you want to take a crack at it.

clarkwinkelmann

BurnNoticeSpy How can i limit requests on a custom endpoint that doesn't add data

You will have to store that data yourself if it's not already available. You might need to use a full middleware or other Flarum events if you want to only log the time of the last successful action, because logging from the throttling extender might trigger more than one time per action if extensions call for a check again from their own code.

I believe Laravel has an implementation that's filesystem-based for its default rate limiting feature, which you might be able to port to Flarum. Otherwise for best performance you might want to use something like Redis to store the access logs of actors that can be quickly checked by the throttling extender afterwards.

You could also create a new MySQL table and log data that way, but it might not be the most performant option if you have many users and many API users.