Limit 1 message every second for single user (#7631)

* limit 1 message every second for  single user

* increase message limit to 2 in a second

config/initializers/rack/attack.rb

@@ -22,4 +22,10 @@ class Rack::Attack
       request.env["HTTP_FASTLY_CLIENT_IP"].to_s
     end
   end
+
+  throttle("message_throttle", limit: 2, period: 1) do |request|
+    if request.path.starts_with?("/messages") && request.post? && request.env["HTTP_FASTLY_CLIENT_IP"].present?
+      request.env["HTTP_FASTLY_CLIENT_IP"].to_s
+    end
+  end
 end

spec/initializers/rack/attack_spec.rb

@@ -61,4 +61,39 @@ describe Rack::Attack, type: :request, throttle: true do
       end
     end
   end
+
+  describe "message_throttle" do
+    let(:user) { create(:user) }
+    let(:chat_channel) { create(:chat_channel) }
+    let(:new_message) do
+      {
+        message_markdown: "hi",
+        user_id: user.id,
+        temp_id: "sd78jdssd",
+        chat_channel_id: chat_channel.id
+      }
+    end
+
+    before do
+      allow(Pusher).to receive(:trigger).and_return(true)
+      sign_in user
+    end
+
+    it "throttles creating messages" do
+      headers = { "HTTP_FASTLY_CLIENT_IP" => "5.6.7.8" }
+      dif_headers = { "HTTP_FASTLY_CLIENT_IP" => "1.1.1.1" }
+
+      Timecop.freeze do
+        valid_responses = Array.new(2).map do
+          post messages_path, params: { message: new_message }, headers: headers
+        end
+        throttled_response = post messages_path, params: { message: new_message }, headers: headers
+        new_api_response = post messages_path, params: { message: new_message }, headers: dif_headers
+
+        valid_responses.each { |r| expect(r).not_to eq(429) }
+        expect(throttled_response).to eq(429)
+        expect(new_api_response).not_to eq(429)
+      end
+    end
+  end
 end