PostHog / PostHog/posthog

chore(signals): throttle report content edits

Open
#73,707 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
39.9k
Forks
3.4k
Avg merge
6h 51m
Merged PRs (30d)
232

Description

Problem

signals_reports_partial_update (partial_update in products/signals/backend/views.py) lets a project member edit a report's title and summary. It has no throttle of its own, and session-authenticated requests do not hit the default API-key throttles.

Each edit that actually changes a value writes to the report and, since #73704, emits one document_embeddings request per configured model. So a caller alternating between two values can drive embedding-worker and provider load in a loop.

Two things bound this today, which is why it is low rather than urgent:

  • The endpoint already no-ops when a value is unchanged (if "title" in data and data["title"] != report.title), so a plain replay of the same payload costs nothing and never reaches a save.
  • The per-edit embedding cost is not new. Before #73704's retraction work an edit emitted a live embedding of the new text; afterwards it emits a tombstone instead. Same number of requests either way.

Scope

Add throttling appropriate to a user-facing write endpoint, scoped per user or per team rather than per API key so session auth is covered. Worth checking whether other report write actions on the same viewset (state, bulk-state) want the same treatment, since they are equally session-reachable.

A cheaper complementary option: coalesce rapid successive edits to the same report so a burst produces one embedding write rather than one per keystroke-level save.

Context

Raised by automated review on #73704. Left out of that PR because it is a property of the edit endpoint rather than of what gets indexed, and belongs with the endpoint's owner.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in products/signals/backend/views.py at signals_reports_partial_update and inspect how report write actions are throttled, including state and bulk-state. Determine whether throttling or coalescing best fits the endpoint owner and whether related actions need the same protection. Done means session-authenticated edits are bounded per user or team without changing the existing no-op behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.