Read scoped throttle rates dynamically

Author: TThanos3000

core/throttling.py

@@ -1,7 +1,13 @@
 from rest_framework.throttling import ScopedRateThrottle
+from rest_framework.settings import api_settings
 
 
 class PostOnlyScopedRateThrottle(ScopedRateThrottle):
+    def get_rate(self):
+        if not getattr(self, "scope", None):
+            return None
+        return api_settings.DEFAULT_THROTTLE_RATES.get(self.scope)
+
     def allow_request(self, request, view):
         if request.method != "POST":
             return True

users/tests/test_auth_throttling.py

@@ -3,8 +3,11 @@
 from django.conf import settings
 from django.core.cache import cache
 from django.test import TestCase, override_settings
-from rest_framework.test import APIClient
+from rest_framework.response import Response
+from rest_framework.test import APIClient, APIRequestFactory
+from rest_framework.views import APIView
 
+from core.throttling import PostOnlyScopedRateThrottle
 from tests.constants import USER_CREATE_DATA
 from users.tests.helpers import build_user
 
@@ -18,10 +21,22 @@ def throttle_settings(**rates):
     return rest_framework
 
 
+class DummyPostOnlyThrottleView(APIView):
+    throttle_classes = [PostOnlyScopedRateThrottle]
+    throttle_scope = "auth_register"
+
+    def get(self, _request):
+        return Response({"ok": True})
+
+    def post(self, _request):
+        return Response({"ok": True})
+
+
 class AuthThrottleTests(TestCase):
     def setUp(self):
         cache.clear()
         self.client = APIClient()
+        self.factory = APIRequestFactory()
 
     @override_settings(
         REST_FRAMEWORK=throttle_settings(auth_register="1/min")
@@ -118,3 +133,39 @@ def test_password_reset_request_post_is_scoped_throttled(self, _email_message):
 
         self.assertNotEqual(first_response.status_code, 429)
         self.assertEqual(second_response.status_code, 429)
+
+    @override_settings(
+        REST_FRAMEWORK=throttle_settings(auth_register="1/min")
+    )
+    def test_post_only_throttle_allows_get_and_options(self):
+        view = DummyPostOnlyThrottleView.as_view()
+
+        for method in ("get", "options"):
+            for _ in range(2):
+                response = view(
+                    getattr(self.factory, method)(
+                        "/unused/",
+                        REMOTE_ADDR="203.0.113.14",
+                    )
+                )
+                self.assertNotEqual(response.status_code, 429)
+
+        first_response = view(
+            self.factory.post(
+                "/unused/",
+                {},
+                format="json",
+                REMOTE_ADDR="203.0.113.14",
+            )
+        )
+        second_response = view(
+            self.factory.post(
+                "/unused/",
+                {},
+                format="json",
+                REMOTE_ADDR="203.0.113.14",
+            )
+        )
+
+        self.assertEqual(first_response.status_code, 200)
+        self.assertEqual(second_response.status_code, 429)