fix: throttle cache key fixed for same scoped classes

[marslanabdulrauf]

Description

This pull request introduces namespacing to the cache keys used by custom throttling classes in API views. By prefixing each throttle's cache key, it ensures that rate-limiting buckets are unique to each throttle, preventing unintended sharing of rate limits across different API endpoints that might use the same scope name.

Improvements to throttling cache key namespacing:

• Added a get_cache_key method to the custom throttle class in lms/djangoapps/course_api/views.py to prefix the cache key with course_list., ensuring isolation of rate-limiting buckets for the course list API.
• Added a get_cache_key method to the custom throttle class in lms/djangoapps/course_api/views.py to prefix the cache key with course_id_list., ensuring isolation of rate-limiting buckets for the course ID list API.
• Added a get_cache_key method to the custom throttle class in openedx/core/djangoapps/enrollments/views.py to prefix the cache key with enrollment., ensuring isolation of rate-limiting buckets for the enrollment API.

Supporting information

https://github.com/mitodl/hq/issues/11918 (MIT Internal)

Testing instructions

1. Calling any API from following should not add throttle count for other API
   • /api/enrollment/v1/enrollment/
   • /api/courses/v1/courses/
   • /api/courses/v1/course_ids/

[openedx-webhooks]

Thanks for the pull request, @marslanabdulrauf!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[Copilot]

Pull request overview

This pull request adds cache-key namespacing to several custom DRF throttling classes so that throttles with the same scope (e.g., "user", "staff") do not unintentionally share the same rate-limit bucket across different API endpoints.

Changes:

• Prefixed EnrollmentUserThrottle cache keys with enrollment..
• Prefixed CourseListUserThrottle cache keys with course_list..
• Prefixed CourseIdListUserThrottle cache keys with course_id_list..

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
openedx/core/djangoapps/enrollments/views.py	Adds get_cache_key override to namespace enrollment throttle cache keys.
lms/djangoapps/course_api/views.py	Adds get_cache_key overrides to namespace course list and course-id list throttle cache keys.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[AhtishamShahid]

Hi, DRF supports scoped throttling; there might be no need for a cache key mechanism

https://www.django-rest-framework.org/api-guide/throttling/#scopedratethrottle

[marslanabdulrauf]

Hi, DRF supports scoped throttling; there might be no need for a cache key mechanism

https://www.django-rest-framework.org/api-guide/throttling/#scopedratethrottle

In our case we need UserRateThrottle which is scoped per user while ScopedRateThrottle is per specific parts of the API. It has no concept of varying the rate by "who" is calling.