Align auth register throttle scope

Author: TThanos3000

.env.example

@@ -8,7 +8,7 @@ EMAIL_PASSWORD=
 EMAIL_HOST=
 EMAIL_PORT=
 
-DRF_THROTTLE_AUTH_USER_CREATE=5/min
+DRF_THROTTLE_AUTH_REGISTER=5/min
 DRF_THROTTLE_AUTH_RESEND_EMAIL=3/min
 DRF_THROTTLE_AUTH_RESET_PASSWORD=3/min
 DRF_THROTTLE_TOKEN_OBTAIN=10/min

docs/api-safety-fix-plan.md

@@ -12,6 +12,7 @@ Implemented in this PR:
   - `POST /api/token/`
   - `POST /programs/<id>/register_new/`
 - Added env-configurable rates in `REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]` without enabling global `DEFAULT_THROTTLE_CLASSES`.
+- Scoped rate keys are `auth_register`, `auth_resend_email`, `auth_reset_password`, `token_obtain`, and `program_register_new`.
 - Added `.env.example` entries for the new rates.
 - Added targeted tests that override each selected scope to `1/min` and assert the second request is throttled.
 

procollab/settings.py

@@ -164,8 +164,8 @@
         "rest_framework.renderers.AdminRenderer",
     ],
     "DEFAULT_THROTTLE_RATES": {
-        "auth_user_create": config(
-            "DRF_THROTTLE_AUTH_USER_CREATE", default="5/min", cast=str
+        "auth_register": config(
+            "DRF_THROTTLE_AUTH_REGISTER", default="5/min", cast=str
         ),
         "auth_resend_email": config(
             "DRF_THROTTLE_AUTH_RESEND_EMAIL", default="3/min", cast=str

users/tests/test_auth_throttling.py

@@ -24,7 +24,7 @@ def setUp(self):
         self.client = APIClient()
 
     @override_settings(
-        REST_FRAMEWORK=throttle_settings(auth_user_create="1/min")
+        REST_FRAMEWORK=throttle_settings(auth_register="1/min")
     )
     @patch("users.views.verify_email")
     def test_user_registration_post_is_scoped_throttled(self, verify_email_mock):

users/views.py

@@ -81,7 +81,7 @@ class UserList(ListCreateAPIView):
     filter_backends = (filters.DjangoFilterBackend,)
     filterset_class = UserFilter
     throttle_classes = [PostOnlyScopedRateThrottle]
-    throttle_scope = "auth_user_create"
+    throttle_scope = "auth_register"
 
     def get_permissions(self):
         if self.request.method == "POST":