state: limit refused writes per user

A write every node would refuse is rolled back by forking the document
at the heads before it, under the write lock, at a cost that grows with
the document's history. A user could ask for such writes in a loop.

Count each user's refused writes over the last minute. Past
--refused-writes-per-minute (default 10), its writes are answered 429
without being tried, until the oldest refusal leaves the minute.

1 files changed, 3 insertions, 0 deletions

diff --git a/src/document/store.rs b/src/document/store.rs
index e04ef41..fb28a4b 100644
--- a/src/document/store.rs
+++ b/src/document/store.rs
@@ -185,6 +185,9 @@ pub(crate) enum StoreError {
     /// the write is rolled back.
     #[error("every node would refuse this write: {0}")]
     Refused(String),
+    /// The user's writes were refused too often of late (`state::refused`): not tried.
+    #[error("too many of your writes refused of late: try again in a while")]
+    TooManyRefused,
     #[error(transparent)]
     Doc(#[from] automerge::AutomergeError),
     #[error(transparent)]