We need to define tiers of logged-in (browser) users, so we don't disrupt power user's work while still preventing scrapers from simply creating accounts.
Context:
Power users often use Gadgets and other features that can, for a while, create a large number of requests, when the user performs certain tasks. If enforce a rate limit of e.g. 5000 API requests per hours, that would only affect a small fraction of logged in users (less that 0.1%), in total numbers about 20 for a given hour. However, these users are very active community members performing important tasks, and letting them hit an API rate limit will prevent them from working efficiently and may break the site for them in unpredictable and confusing ways.
Ideas and considerations:
- temp accounts should have a separate user class and the same limit as anons
- whether or not the client is a browser should not impact the rate limiting, but is useful for metrics. Do we need to duplicate all classes?
- New users should be distinguished from established users that have undergone some level of community scrutiny (similar to autoconfirmed status).
- the daily limit of an established user perhaps doesn't have to be higher than the effective daily limit of a regular user or simple logged-in bot. But their hourly limit needs to be higher.
- The global edit count (perhaps together with account age and confirmed email) could be a simple and good-enough signal for considering a user "established" (no longer new). This would be the global equivalent of newbie vs autoconfirmed.
- Do we need a "power user" tier beyond new user and established user? Based on wmfGetGlobalgroups? That's slow, but has the right signal.
- We could detect if the user is blocked anywhere, but temporary blocks happens quite frequently for operational reasons. Probably not a good signal.