Change 959046 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ReportIncident@master] api: Implement rate limits for endpoint

https://gerrit.wikimedia.org/r/959046

One proposal:

limit submissions to 1 per 24 hour period for non-autoconfirmed users
limit submissions to 5 per 24 hour period for autoconfirmed users

Should we have a wider conversation about this elsewhere (so without blocking this task) and maybe consult some product/community people?

I see that a new account might be less trustworthy, but wondering if they might also be more vulnerable...

Change 959046 merged by jenkins-bot:

[mediawiki/extensions/ReportIncident@master] api: Implement rate limits for endpoint

https://gerrit.wikimedia.org/r/959046

In T345813#9253539, @Tchanders wrote:

One proposal:

limit submissions to 1 per 24 hour period for non-autoconfirmed users
limit submissions to 5 per 24 hour period for autoconfirmed users

Should we have a wider conversation about this elsewhere (so without blocking this task) and maybe consult some product/community people?

I see that a new account might be less trustworthy, but wondering if they might also be more vulnerable...

Ack. I will leave that for @Madalina and @JSengupta-WMF to think about. The rate limits are basically an earlier version of what we are doing in T348322: Set up anti abuse measures, the idea being to make it a little harder for people with bad intentions to spam the people processing this form.

For MTP we can agree on a fixed number but for future versions, I feel we should revisit the one size fits all model. As @Tchanders mentioned, "I see that a new account might be less trustworthy, but wondering if they might also be more vulnerable..." this needs more thought.

Suggested QA steps:

1. Install ReportIncident extension
2. Create a new account (or use an account that does not have the autoconfirmed group and has not been used to submit an incident report within the last day)
3. Go to a user talk page
4. Open the DevTools 'Network' tab
5. Click on Report in the Tools menu
6. Navigate to step 2 and fill out the form with valid data
7. Submit the form
8. Verification step 1: Verify that the API request has either a status code of 200 or 204.
9. Perform steps 5 to 7 again
10. Verification step 2: Verify that the API request fails with the status code of 429.

Showing an error message to the user when they hit the rate limit will come in T338804.

Test wiki created on Patch demo by DJacksonA using patch(es) linked to this task:
https://patchdemo.wmflabs.org/wikis/a5932c8782/w

I have verified the code implementation will limit submissions of 1 per 24 hour period for non-autoconfirmed users, and have also verified the limit submissions of 5 per 24 hour period for autoconfirmed users.
Great work as always @Dreamy_Jazz, and thank you for the QA Steps!!!!

Below is a screenshot with a (non-autoconfirmed) user's form data from page 2 of the Report Incident:

Below is a screenshot with a status of 204 (non-autoconfirmed user):

Below is a screenshot with a status of 429 on more than 1 submission of Report Incident for (non-autoconfirmed user):

Below is a screenshot with an (autoconfirmed) user's form data from page 2 of the Report Incident:

Below is a screenshot with a status of 204 (autoconfirmed user):

Below is a screenshot with a status of 429 on more than 5 submissions of Report Incident for (autoconfirmed):

Below is a screenshot with an (autoconfirmed from Patch Demo) user's form data from page 2 of the Report Incident:

Below is a screenshot with a status of 204 (autoconfirmed user from Patch Demo):

Below is a screenshot with a status of 429 on more than 5 submissions of Report Incident for (autoconfirmed user from Patch Demo):

Test wiki on Patch demo by DJacksonA using patch(es) linked to this task was deleted:

https://patchdemo.wmflabs.org/wikis/a5932c8782/w/