state: limit refused writes per user

A write every node would refuse is rolled back by forking the document
at the heads before it, under the write lock, at a cost that grows with
the document's history. A user could ask for such writes in a loop.

Count each user's refused writes over the last minute. Past
--refused-writes-per-minute (default 10), its writes are answered 429
without being tried, until the oldest refusal leaves the minute.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/api/mod.rs b/src/api/mod.rs
index 43d3c20..0dde808 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -341,6 +341,7 @@ pub(crate) fn store_status(error: StoreError, context: &str) -> ApiError {
         StoreError::Rejoining => StatusCode::SERVICE_UNAVAILABLE,
         StoreError::UnknownPolicy(_) => StatusCode::CONFLICT,
         StoreError::Refused(_) => StatusCode::FORBIDDEN,
+        StoreError::TooManyRefused => StatusCode::TOO_MANY_REQUESTS,
         other => {
             error!(error = %format!("{other:#}"), "{context}");
             return StatusCode::INTERNAL_SERVER_ERROR.into();