Rate limit the request of reviews

[PGijsbers]

We should be able to limit the amount of assets which may be submitted for review per user per time period. This would be a guard against users congesting the review pipeline. For systematic uploads/data migrations, a similar pattern as connectors could be followed where special credentials are requested which can bypass the review process.

[areebahmeddd]

Hi, could i pick this issue up? thanks!

[dipak0000812]

hey @PGijsbers,
I’d like to work on this. I’ll start by analyzing the current review submission flow and propose a rate-limiting strategy (likely per-user + configurable time window).

[Vivekgupta008]

Hey @PGijsbers @fkiraly @geetu040, I went through the codebase. Here's what I found:
There are two submission endpoints that both need rate limiting - POST /submissions (batch, v1) and POST /{resource}/submit/{id} (single, v2). Connectors already bypass the review process by setting status=PUBLISHED directly and a MySQL trigger-based bypass exists in triggers.py for data migrations.

My proposed approach:
Create a check_submission_rate_limit function that queries the existing submission table to count recent submissions - no schema migration needed and raise 429 when the limit is exceeded. Also we would skip the check for connectors (user.is_connector) and admins (user.is_admin), since connectors already bypass review and admins need unrestricted moderation access.
We should make limits configurable via the existing TOML config (max_submissions_per_window, submission_window_hours).
What would be a reasonable default limit? I was thinking something like 10 submissions per 24 hours. Would love to hear your thoughts.

[Mridul-Dev123]

Hi, I'd like to work on this. Planning to approach it by adding a configurable per-user rate limit as a FastAPI dependency for the POST /submissions endpoint. The implementation would:

Add a [rate_limits] section to

config.default.toml
with max_submissions_per_user and submission_window_seconds settings
Create a new dependency in src/dependencies/rate_limiter.py using an in-memory rolling window tracked by user's subject identifier
Wire it into

_submit_resource
in

review_router.py
via Depends()
Bypass rate limiting for connector users (platform roles), as mentioned in the issue
Add tests covering the limit, time window expiry, connector bypass, and multi-user isolation
Could you assign this to me?