rate limits: rework rate limit implementation.

Rework the rate limit implementation to make it more flexible:

* Allow setting different rate limits for different actions. Before we
  had a single rate limit for all write actions. Now different
  controller endpoints can have different limits.

* Allow actions to be rate limited by user ID, by IP address, or both.
  Before actions were only limited by user ID, which meant non-logged-in
  actions like creating new accounts or attempting to login couldn't be rate
  limited. Also, because actions were limited by user ID only, you could
  use multiple accounts with the same IP to get around limits.

Other changes:

* Remove the API Limit field from user profile pages.
* Remove the `remaining_api_limit` field from the `/profile.json` endpoint.
* Rename the `X-Api-Limit` header to `X-Rate-Limit` and change it from a
  number to a JSON object containing all the rate limit info
  (including the refill rate, the burst factor, the cost of the call,
  and the current limits).
* Fix a potential race condition where, if you flooded requests fast
  enough, you could exceed the rate limit. This was because we checked
  and updated the rate limit in two separate steps, which was racy;
  simultaneous requests could pass the check before the update happened.
  The new code uses some tricky SQL to check and update multiple limits
  in a single statement.

db/migrate/20170106012138_create_token_buckets.rb

@@ -5,6 +5,6 @@ class CreateTokenBuckets < ActiveRecord::Migration[4.2]
   end
 
   def down
-    raise NotImplementedError
+    drop_table :token_buckets
   end
 end

db/migrate/20210303195217_replace_token_buckets_with_rate_limits.rb

@@ -0,0 +1,24 @@
+require_relative "20170106012138_create_token_buckets"
+
+class ReplaceTokenBucketsWithRateLimits < ActiveRecord::Migration[6.1]
+  def change
+    revert CreateTokenBuckets
+
+    create_table :rate_limits do |t|
+      t.timestamps null: false
+      t.boolean :limited, null: false, default: false
+      t.float :points, null: false
+      t.string :action, null: false
+      t.string :key, null: false
+
+      t.index [:key, :action], unique: true
+    end
+
+    reversible do |dir|
+      dir.up do
+        execute "ALTER TABLE rate_limits SET UNLOGGED"
+        execute "ALTER TABLE rate_limits SET (fillfactor = 50)"
+      end
+    end
+  end
+end

db/structure.sql

@@ -2929,6 +2929,41 @@ CREATE SEQUENCE public.posts_id_seq
 ALTER SEQUENCE public.posts_id_seq OWNED BY public.posts.id;
 
 
+--
+-- Name: rate_limits; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE UNLOGGED TABLE public.rate_limits (
+    id bigint NOT NULL,
+    created_at timestamp(6) without time zone NOT NULL,
+    updated_at timestamp(6) without time zone NOT NULL,
+    limited boolean DEFAULT false NOT NULL,
+    points double precision NOT NULL,
+    action character varying NOT NULL,
+    key character varying NOT NULL
+)
+WITH (fillfactor='50');
+
+
+--
+-- Name: rate_limits_id_seq; Type: SEQUENCE; Schema: public; Owner: -
+--
+
+CREATE SEQUENCE public.rate_limits_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+--
+-- Name: rate_limits_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: -
+--
+
+ALTER SEQUENCE public.rate_limits_id_seq OWNED BY public.rate_limits.id;
+
+
 --
 -- Name: saved_searches; Type: TABLE; Schema: public; Owner: -
 --
@@ -3085,17 +3120,6 @@ CREATE SEQUENCE public.tags_id_seq
 ALTER SEQUENCE public.tags_id_seq OWNED BY public.tags.id;
 
 
---
--- Name: token_buckets; Type: TABLE; Schema: public; Owner: -
---
-
-CREATE UNLOGGED TABLE public.token_buckets (
-    user_id integer,
-    last_touched_at timestamp without time zone NOT NULL,
-    token_count real NOT NULL
-);
-
-
 --
 -- Name: uploads; Type: TABLE; Schema: public; Owner: -
 --
@@ -4352,6 +4376,13 @@ ALTER TABLE ONLY public.post_votes ALTER COLUMN id SET DEFAULT nextval('public.p
 ALTER TABLE ONLY public.posts ALTER COLUMN id SET DEFAULT nextval('public.posts_id_seq'::regclass);
 
 
+--
+-- Name: rate_limits id; Type: DEFAULT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.rate_limits ALTER COLUMN id SET DEFAULT nextval('public.rate_limits_id_seq'::regclass);
+
+
 --
 -- Name: saved_searches id; Type: DEFAULT; Schema: public; Owner: -
 --
@@ -4739,6 +4770,14 @@ ALTER TABLE ONLY public.posts
     ADD CONSTRAINT posts_pkey PRIMARY KEY (id);
 
 
+--
+-- Name: rate_limits rate_limits_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.rate_limits
+    ADD CONSTRAINT rate_limits_pkey PRIMARY KEY (id);
+
+
 --
 -- Name: saved_searches saved_searches_pkey; Type: CONSTRAINT; Schema: public; Owner: -
 --
@@ -7280,6 +7319,13 @@ CREATE INDEX index_posts_on_uploader_id ON public.posts USING btree (uploader_id
 CREATE INDEX index_posts_on_uploader_ip_addr ON public.posts USING btree (uploader_ip_addr);
 
 
+--
+-- Name: index_rate_limits_on_key_and_action; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE UNIQUE INDEX index_rate_limits_on_key_and_action ON public.rate_limits USING btree (key, action);
+
+
 --
 -- Name: index_saved_searches_on_labels; Type: INDEX; Schema: public; Owner: -
 --
@@ -7385,13 +7431,6 @@ CREATE INDEX index_tags_on_name_trgm ON public.tags USING gin (name public.gin_t
 CREATE INDEX index_tags_on_post_count ON public.tags USING btree (post_count);
 
 
---
--- Name: index_token_buckets_on_user_id; Type: INDEX; Schema: public; Owner: -
---
-
-CREATE UNIQUE INDEX index_token_buckets_on_user_id ON public.token_buckets USING btree (user_id);
-
-
 --
 -- Name: index_uploads_on_referer_url; Type: INDEX; Schema: public; Owner: -
 --
@@ -7964,6 +8003,7 @@ INSERT INTO "schema_migrations" (version) VALUES
 ('20210127000201'),
 ('20210127012303'),
 ('20210214095121'),
-('20210214101614');
+('20210214101614'),
+('20210303195217');