feat: throttle and time out outbound DeviantArt requests

DeviantArt fronts its API with CloudFront + WAF, which bans egress IPs
that hit it too hard. devianter issues requests with a bare http.Client,
so unbounded concurrent handlers each pulled ~150-200 KB of JSON, which
both risked a ban and could exhaust the process under a bot flood.

Wrap the default transport to bound rate and concurrency for
deviantart.com and add timeouts. Other hosts (wixmp image CDN) pass
straight through, so media stays fast, and ProxyFromEnvironment is
preserved so HTTPS_PROXY egress still works.

2 files changed, 205 insertions, 0 deletions

diff --git a/app/httpclient.go b/app/httpclient.go
new file mode 100644
index 0000000..d3e5d50
--- /dev/null
+++ b/app/httpclient.go
@@ -0,0 +1,68 @@
+package app
+
+import (
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+)
+
+// DeviantArt fronts its API with AWS CloudFront + WAF, which bans egress IPs that
+// hit it too hard. Under a bot flood, unbounded concurrent handlers each fetch
+// ~150-200 KB of DA JSON, which both hammers that IP (risking a ban) and can OOM
+// the process. devianter makes its requests with a bare &http.Client{}, so they go
+// through http.DefaultTransport — we wrap it here to bound the rate and concurrency
+// of calls to deviantart.com and to add timeouts. Requests to other hosts (e.g.
+// wixmp image CDN) are passed straight through, so media stays fast.
+//
+// http.ProxyFromEnvironment is preserved, so HTTPS_PROXY (VPN egress) still applies.
+
+// Tunables (kept in source; safe defaults). Lower is gentler on the DA IP.
+var (
+	daMinInterval   = 400 * time.Millisecond // minimum gap between DA request starts
+	daMaxConcurrent = 2                      // max simultaneous in-flight DA requests
+)
+
+type daThrottle struct {
+	base http.RoundTripper
+	sem  chan struct{}
+	mu   sync.Mutex
+	last time.Time
+}
+
+func (t *daThrottle) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Only throttle DeviantArt's WAF-protected API host; let everything else fly.
+	if !strings.Contains(req.URL.Hostname(), "deviantart.com") {
+		return t.base.RoundTrip(req)
+	}
+
+	// Concurrency cap: block until a slot frees up (backpressure under floods).
+	t.sem <- struct{}{}
+	defer func() { <-t.sem }()
+
+	// Rate cap: enforce a minimum interval between request starts.
+	t.mu.Lock()
+	if wait := daMinInterval - time.Since(t.last); wait > 0 {
+		time.Sleep(wait)
+	}
+	t.last = time.Now()
+	t.mu.Unlock()
+
+	return t.base.RoundTrip(req)
+}
+
+// InstallDAThrottle wraps http.DefaultTransport with the rate/concurrency limits and
+// timeouts above. Call once at startup, before any DeviantArt request is made.
+func InstallDAThrottle() {
+	// Clone the default transport so we keep its Proxy (ProxyFromEnvironment) and
+	// connection-pool defaults, then tighten timeouts to bound hung connections.
+	base := http.DefaultTransport.(*http.Transport).Clone()
+	base.TLSHandshakeTimeout = 10 * time.Second
+	base.ResponseHeaderTimeout = 20 * time.Second
+	base.ExpectContinueTimeout = 2 * time.Second
+
+	http.DefaultTransport = &daThrottle{
+		base: base,
+		sem:  make(chan struct{}, daMaxConcurrent),
+	}
+}
diff --git a/app/httpclient_test.go b/app/httpclient_test.go
new file mode 100644
index 0000000..650360e
--- /dev/null
+++ b/app/httpclient_test.go
@@ -0,0 +1,137 @@
+package app
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+)
+
+// stubTransport records how many requests reached it and returns an empty 200.
+type stubTransport struct {
+	mu sync.Mutex
+	n  int
+}
+
+func (s *stubTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	s.mu.Lock()
+	s.n++
+	s.mu.Unlock()
+	return httptest.NewRecorder().Result(), nil
+}
+
+func newTestThrottle(base http.RoundTripper, gap time.Duration, max int) *daThrottle {
+	return &daThrottle{base: base, sem: make(chan struct{}, max)}
+}
+
+// DeviantArt requests must be spaced by at least daMinInterval.
+func TestThrottleRateLimitsDeviantArt(t *testing.T) {
+	stub := &stubTransport{}
+	tr := newTestThrottle(stub, daMinInterval, daMaxConcurrent)
+
+	start := time.Now()
+	const n = 3
+	for i := 0; i < n; i++ {
+		req, _ := http.NewRequest("GET", "https://www.deviantart.com/_puppy/x", nil)
+		if _, err := tr.RoundTrip(req); err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+	}
+	elapsed := time.Since(start)
+
+	// n requests => at least (n-1) gaps between them.
+	if want := time.Duration(n-1) * daMinInterval; elapsed < want {
+		t.Errorf("DA requests were not throttled: %d requests took %v, want >= %v", n, elapsed, want)
+	}
+	if stub.n != n {
+		t.Errorf("expected all %d requests to reach the base transport, got %d", n, stub.n)
+	}
+}
+
+// Non-DA hosts (e.g. the wixmp image CDN) must not be slowed down.
+func TestThrottleSkipsOtherHosts(t *testing.T) {
+	stub := &stubTransport{}
+	tr := newTestThrottle(stub, daMinInterval, daMaxConcurrent)
+
+	start := time.Now()
+	for i := 0; i < 5; i++ {
+		req, _ := http.NewRequest("GET", "https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/f/x.jpg", nil)
+		if _, err := tr.RoundTrip(req); err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+	}
+
+	if elapsed := time.Since(start); elapsed >= daMinInterval {
+		t.Errorf("non-DA host was throttled: 5 requests took %v, want < %v", elapsed, daMinInterval)
+	}
+	if stub.n != 5 {
+		t.Errorf("expected 5 requests through, got %d", stub.n)
+	}
+}
+
+// Concurrent callers must never exceed daMaxConcurrent in-flight DA requests.
+func TestThrottleCapsConcurrency(t *testing.T) {
+	var (
+		mu       sync.Mutex
+		inFlight int
+		peak     int
+	)
+	counting := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		mu.Lock()
+		inFlight++
+		if inFlight > peak {
+			peak = inFlight
+		}
+		mu.Unlock()
+
+		time.Sleep(20 * time.Millisecond) // hold the slot
+
+		mu.Lock()
+		inFlight--
+		mu.Unlock()
+		return httptest.NewRecorder().Result(), nil
+	})
+
+	tr := newTestThrottle(counting, daMinInterval, daMaxConcurrent)
+
+	var wg sync.WaitGroup
+	for i := 0; i < 6; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			req, _ := http.NewRequest("GET", "https://www.deviantart.com/_puppy/x", nil)
+			tr.RoundTrip(req)
+		}()
+	}
+	wg.Wait()
+
+	if peak > daMaxConcurrent {
+		t.Errorf("concurrency cap breached: peak %d in-flight DA requests, max %d", peak, daMaxConcurrent)
+	}
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+// InstallDAThrottle must preserve proxy-from-environment so HTTPS_PROXY (VPN
+// egress) keeps working, and must not panic on a repeat call.
+func TestInstallDAThrottlePreservesProxy(t *testing.T) {
+	orig := http.DefaultTransport
+	defer func() { http.DefaultTransport = orig }()
+
+	InstallDAThrottle()
+
+	th, ok := http.DefaultTransport.(*daThrottle)
+	if !ok {
+		t.Fatalf("DefaultTransport was not wrapped, got %T", http.DefaultTransport)
+	}
+	base, ok := th.base.(*http.Transport)
+	if !ok {
+		t.Fatalf("base transport is not *http.Transport, got %T", th.base)
+	}
+	if base.Proxy == nil {
+		t.Error("base transport lost its Proxy func: HTTPS_PROXY / VPN egress would break")
+	}
+}