blt/settings.py (1)

124-124: Consider placing ThrottlingMiddleware after authentication middleware

The throttling middleware is currently placed before AuthenticationMiddleware (line 119). This ordering may prevent the middleware from properly distinguishing between authenticated and anonymous users if such functionality is added in the future. Consider moving it after the authentication-related middleware but before static file serving middleware.

 MIDDLEWARE = (
     "django.contrib.sessions.middleware.SessionMiddleware",
     "blt.middleware.domain.DomainMiddleware",
     "django.middleware.locale.LocaleMiddleware",
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "allauth.account.middleware.AccountMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "django.middleware.security.SecurityMiddleware",
-    "blt.middleware.throttling.ThrottlingMiddleware",
     "whitenoise.middleware.WhiteNoiseMiddleware",
+    "blt.middleware.throttling.ThrottlingMiddleware",
     "tz_detect.middleware.TimezoneMiddleware",
     "blt.middleware.ip_restrict.IPRestrictMiddleware",
     "blt.middleware.user_visit_tracking.VisitTrackingMiddleware",
 )

blt/middleware/throttling.py (1)

12-18: Make throttle limits configurable via Django settings

The throttle limits and window are currently hardcoded. Consider making them configurable through Django settings for better flexibility across different environments.

+from django.conf import settings
+
 class ThrottlingMiddleware:
-    THROTTLE_LIMITS = {
-        "GET": 100,  # 100 GET requests per minute
-        "POST": 50,  # 50 POST requests per minute
-        "OTHER": 30,  # 30 other requests per minute
-    }
-    THROTTLE_WINDOW = 60  # 60 seconds
-    EXEMPT_PATHS = ["/admin/", "/static/", "/media/"]
+    THROTTLE_LIMITS = getattr(settings, 'THROTTLE_LIMITS', {
+        "GET": 100,
+        "POST": 50,
+        "OTHER": 30,
+    })
+    THROTTLE_WINDOW = getattr(settings, 'THROTTLE_WINDOW', 60)
+    EXEMPT_PATHS = getattr(settings, 'THROTTLE_EXEMPT_PATHS', ["/admin/", "/static/", "/media/"])

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting

website/tests/test_middleware.py (1)

33-33: Fix missing f-string prefix.

The assertion message uses string interpolation syntax but lacks the required f-string prefix.

-            self.assertEqual(response.status_code, 200, "Request {i+1} should be allowed")
+            self.assertEqual(response.status_code, 200, f"Request {i+1} should be allowed")

blt/middleware/throttling.py (1)

113-124: Consider edge cases in IP extraction.

The IP extraction logic is solid, but consider handling edge cases where x_forwarded_for might be empty or contain invalid values.

 def get_client_ip(self, request):
     """Extract client IP from request."""
     x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
-    ip = x_forwarded_for.split(",")[0].strip() if x_forwarded_for else request.META.get("REMOTE_ADDR")
+    if x_forwarded_for:
+        ip = x_forwarded_for.split(",")[0].strip()
+        # Handle empty string after strip
+        if not ip:
+            ip = request.META.get("REMOTE_ADDR")
+    else:
+        ip = request.META.get("REMOTE_ADDR")

website/tests/test_middleware.py (2)

25-38: Add validation for throttle response headers.

The test verifies the 429 status code but should also validate the Retry-After header is set correctly.

 # 101st request should be throttled
 request = self.factory.get("/some-path", REMOTE_ADDR=ip)
 response = self.middleware(request)
 self.assertEqual(response.status_code, 429, "101st request should be throttled")
+self.assertIn("Retry-After", response)
+self.assertEqual(response["Retry-After"], "60")  # Default THROTTLE_WINDOW

---

18-23: Consider testing cache key isolation.

The tests are well-structured, but consider adding a test to verify that different HTTP methods for the same IP are tracked separately (e.g., GET vs POST requests).

Add a new test method:

def test_different_methods_tracked_separately(self):
    """Test that different HTTP methods for same IP are tracked separately."""
    ip = "192.168.1.1"
    
    # Make 100 GET requests
    for i in range(100):
        request = self.factory.get("/some-path", REMOTE_ADDR=ip)
        response = self.middleware(request)
        self.assertEqual(response.status_code, 200)
    
    # POST requests should still be allowed (different cache key)
    for i in range(50):
        request = self.factory.post("/some-path", REMOTE_ADDR=ip)
        response = self.middleware(request)
        self.assertEqual(response.status_code, 200)

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting

website/test_throttling_middleware.py (1)

60-71: Simplify the DRF mock creation for better readability.

The test logic is sound and effectively validates DRF view exemptions, but the inline mock creation is complex and reduces readability.

Consider extracting the mock creation to a helper method:

+   def _create_drf_request(self, path, ip):
+       """Helper to create a request that appears to be routed to a DRF view."""
+       request = self.factory.get(path, REMOTE_ADDR=ip)
+       request.resolver_match = type(
+           "resolver", (), {"func": type("func", (), {"cls": MockDRFView, "is_api_view": True})}
+       )()
+       return request

    def test_drf_views_not_throttled(self):
        """Test that DRF views are exempt from throttling."""
        ip = "192.168.1.1"

        # Make many requests to DRF view
        for i in range(150):
-           request = self.factory.get("/api/test/", REMOTE_ADDR=ip)
-           request.resolver_match = type(
-               "resolver", (), {"func": type("func", (), {"cls": MockDRFView, "is_api_view": True})}
-           )()
+           request = self._create_drf_request("/api/test/", ip)
            response = self.middleware(request)
            self.assertEqual(response.status_code, 200, f"DRF request {i+1} should not be throttled")

Additionally, consider testing different HTTP methods beyond just GET requests to ensure comprehensive coverage of the throttling middleware.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting

website/test_throttling_middleware.py (1)

63-74: Simplify the mock resolver match creation.

The nested type() calls create a fragile and hard-to-read mock structure. Consider using a more straightforward approach.

Simplify the mock resolver_match creation:

    def test_drf_views_not_throttled(self):
        """Test that DRF views are exempt from throttling."""
        ip = "192.168.1.1"

        # Make many requests to DRF view
        for i in range(150):
            request = self.factory.get("/api/test/", REMOTE_ADDR=ip)
-           request.resolver_match = type(
-               "resolver", (), {"func": type("func", (), {"cls": MockDRFView, "is_api_view": True})}
-           )()
+           # Create a simple mock resolver match
+           class MockResolver:
+               def __init__(self):
+                   self.func = MockDRFView
+                   self.func.cls = MockDRFView
+                   self.func.is_api_view = True
+           
+           request.resolver_match = MockResolver()
            response = self.middleware(request)
            self.assertEqual(response.status_code, 200, f"DRF request {i+1} should not be throttled")

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting