Applying rate limits only when API response is successful

[ahmad-taha]

Hello everyone 👋

And thank you, James, and everyone who contributed to this fantastic library. Why did I not hear about this sooner?😄

Although django-ratelimit takes care of many use cases, mine was a bit different. I have internal APIs for our website where I need to apply rate limits only when the API response returns success.
For example, I was adding a rate limit to an internal API handler that sends SMS OTPs to users for phone verification. There can be many cases where API fails to send OTP, and it shouldn't rate limit users based on our errors.

Therefore, I have made a decorator similar to @ratelimit, which only applies rate limit when the view response is JSON and contains {"success":True}.

Note: I am no Python expert and have not contributed much online in the past, so please let me know if there are any potential downsides to this or if there is anything that can be done to improve the code base or make it more efficient.

I thought of sharing this in case anyone may have a similar use case. This can be modified based on the website's specific usage and style.

# Decorator similar to @ratelimit as provided by Django-ratelimit but only applies rate limits when response contains {"success":True}
def api_ratelimit(*args, **kwargs):
    def decorator(func):
        @wraps(func)
        def wrapper(request, *r_args, **r_kwargs):
            # Set group to function name if not provided
            kwargs['group'] = kwargs.get('group', func.__name__)

            # Checking if rate limit has been exceeded using get_usage
            # is_ratelimited can't be used here because it returns true only when count > limit (due to the way it's supposed to be used)
            check_usage = get_usage(request, *args, **kwargs)
            if check_usage is not None and check_usage['count'] >= check_usage['limit']:
                return JsonResponse({"success":False, "message":"Too many requests. Please try again later. [RT]"})

            # Call the view function
            response = func(request, *r_args, **r_kwargs)

            # Get the JSON response
            try:
                response_data = json.loads(response.content)
            except:
                return response

            # Increment the rate limit counter if response contains {"success":True}
            if response_data.get("success") == True:
                kwargs_copy = kwargs.copy() # Create a copy of kwargs to avoid modifying the original kwargs
                kwargs_copy['increment'] = True
                is_ratelimited(request, *args, **kwargs_copy)

            return response
        return wrapper
    return decorator

So now whenever I need to use rate limiting on my APIs, I can simply do the following.

@api_ratelimit(key='ip', rate='5/h')
@api_ratelimit(key='ip', rate='15/24h')
@api_ratelimit(key='user', rate='15/24h')
def view_function(request):
   # ...