state: limit refused writes per user

A write every node would refuse is rolled back by forking the document
at the heads before it, under the write lock, at a cost that grows with
the document's history. A user could ask for such writes in a loop.

Count each user's refused writes over the last minute. Past
--refused-writes-per-minute (default 10), its writes are answered 429
without being tried, until the oldest refusal leaves the minute.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/main.rs b/src/main.rs
index 8c12f41..880d793 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -267,6 +267,7 @@ async fn main() -> Result<()> {
             .filter_map(|line| access::sshsig::PublicKey::parse(line).ok())
             .collect(),
         key_logins_per_user: args.key_logins_per_user,
+        refused_writes_per_minute: args.refused_writes_per_minute,
         cors_origins: args.cors_origins.clone(),
         files,
         state_file,