Allow disabling search throttling via config or envvar

config/initializers/config.rb

@@ -31,5 +31,5 @@
 
   # Parse numeric values as integers instead of strings.
   #
-  # config.env_parse_values = true
+  config.env_parse_values = true
 end

config/initializers/rack-attack.rb

@@ -2,33 +2,36 @@
   req.ip if req.post? && req.path.start_with?("/users/sign_in")
 end
 
-Rack::Attack.throttle("searches/ip", limit: 15, period: 15.minutes) do |req|
-  # don't throttle requests with a q, because it's more likely to be a real user
-  next if req.params['q'].present?
+# throttle bot-like search queries if configured
+if Settings.throttle_searches
+  Rack::Attack.throttle("searches/ip", limit: 15, period: 15.minutes) do |req|
+    # don't throttle requests with a q, because it's more likely to be a real user
+    next if req.params['q'].present?
 
-  # only throttle search queries
-  next unless req.path.ends_with?("/catalog")
+    # only throttle search queries
+    next unless req.path.ends_with?("/catalog")
 
-  # don't throttle the first couple pages of a search result
-  next if req.params['page'].present? && req.params['page'].to_i < 10
+    # don't throttle the first couple pages of a search result
+    next if req.params['page'].present? && req.params['page'].to_i < 10
 
-  req.ip
-end
+    req.ip
+  end
 
-Rack::Attack.throttled_response_retry_after_header = true
+  Rack::Attack.throttled_response_retry_after_header = true
 
-Rack::Attack.throttled_responder = lambda do |request|
-  match_data = request.env['rack.attack.match_data']
-  now = match_data[:epoch_time]
+  Rack::Attack.throttled_responder = lambda do |request|
+    match_data = request.env['rack.attack.match_data']
+    now = match_data[:epoch_time]
 
-  headers = {
-    'RateLimit-Limit' => match_data[:limit].to_s,
-    'RateLimit-Remaining' => '0',
-    'RateLimit-Reset' => (now + (match_data[:period] - now % match_data[:period])).to_s
-  }
+    headers = {
+      'RateLimit-Limit' => match_data[:limit].to_s,
+      'RateLimit-Remaining' => '0',
+      'RateLimit-Reset' => (now + (match_data[:period] - now % match_data[:period])).to_s
+    }
 
-  [ 429, headers, ["Throttled\n"]]
+    [ 429, headers, ["Throttled\n"]]
+  end
 end
 
-# Always allow Stanford traffic
+# always allow Stanford traffic
 Rack::Attack.safelist_ip("171.64.0.0/14")

config/settings.yml

@@ -25,6 +25,7 @@ contact:
 data_dir: tmp/data
 
 allow_robots: false
+throttle_searches: false
 
 feature_flags:
   allow_json_upload: true