fix(pleroma_api): rate limit emoji reactions

The emoji reaction create and delete endpoints had no rate limiter.
Apply :statuses_actions like the other status actions, plus a per-status
:status_id_action bucket ("status_id_action:emoji_react") in the same way
favourite and reblog do.

lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex

@@ -12,6 +12,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
   alias Pleroma.Web.CommonAPI
   alias Pleroma.Web.MastodonAPI.StatusView
   alias Pleroma.Web.Plugs.OAuthScopesPlug
+  alias Pleroma.Web.Plugs.RateLimiter
 
   plug(Pleroma.Web.ApiSpec.CastAndValidate)
   plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action in [:create, :delete])
@@ -22,6 +23,14 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
     when action == :index
   )
 
+  plug(
+    RateLimiter,
+    [name: :status_id_action, bucket_name: "status_id_action:emoji_react", params: [:id]]
+    when action in [:create, :delete]
+  )
+
+  plug(RateLimiter, [name: :statuses_actions] when action in [:create, :delete])
+
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.EmojiReactionOperation
 
   action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs

@@ -477,4 +477,53 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionControllerTest do
            |> get("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
            |> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
   end
+
+  describe "rate limiting" do
+    test "PUT and DELETE share a per-status limit", %{conn: conn} do
+      clear_config([:rate_limit, :status_id_action], {60_000, 2})
+      user = insert(:user)
+      %{id: activity_id} = insert(:note_activity)
+      %{id: other_activity_id} = insert(:note_activity)
+      conn = prepare_conn_of_user(conn, user)
+
+      conn
+      |> put("/api/v1/pleroma/statuses/#{activity_id}/reactions/☕")
+      |> json_response_and_validate_schema(200)
+
+      conn
+      |> delete("/api/v1/pleroma/statuses/#{activity_id}/reactions/☕")
+      |> json_response_and_validate_schema(200)
+
+      assert conn
+             |> put("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
+             |> json_response(429) == %{"error" => "Throttled"}
+
+      conn
+      |> put("/api/v1/pleroma/statuses/#{other_activity_id}/reactions/🐈")
+      |> json_response_and_validate_schema(200)
+    end
+
+    test "PUT and DELETE count against statuses_actions", %{conn: conn} do
+      clear_config([:rate_limit, :statuses_actions], {60_000, 2})
+      user = insert(:user)
+      [first, second, third] = insert_list(3, :note_activity)
+      conn = prepare_conn_of_user(conn, user)
+
+      conn
+      |> put("/api/v1/pleroma/statuses/#{first.id}/reactions/☕")
+      |> json_response_and_validate_schema(200)
+
+      conn
+      |> delete("/api/v1/pleroma/statuses/#{first.id}/reactions/☕")
+      |> json_response_and_validate_schema(200)
+
+      assert conn
+             |> put("/api/v1/pleroma/statuses/#{second.id}/reactions/☕")
+             |> json_response(429) == %{"error" => "Throttled"}
+
+      assert conn
+             |> delete("/api/v1/pleroma/statuses/#{third.id}/reactions/☕")
+             |> json_response(429) == %{"error" => "Throttled"}
+    end
+  end
 end