Request Cost accounting - adding a cost for various api request actions.

[wezell]

This PR Implements a request cost accounting system that tracks API usage and provides optional rate limiting using a leaky token bucket algorithm.

Key Features

Request Cost Tracking

• Assigns cost values to expensive operations (ES queries, file operations, image processing, etc.)
• Uses ByteBuddy AOP to intercept annotated methods via @RequestCost
• Adds x-dotrequest-cost response header showing request cost
• Periodic logging of request metrics (requests, total cost, avg cost per request)

Optional Rate Limiting

• Leaky token bucket implementation (LeakyTokenBucketImpl)
• Adds x-dotratelimit-toks-max response header showing how many tokens remain in bucket and the max bucket value.
• Configurable via RATE_LIMIT_ENABLED, RATE_LIMIT_REFILL_PER_SECOND, RATE_LIMIT_MAX_BUCKET_SIZE
• Disabled by default.
• When enabled, it will subtract the cost of any request from the tokens in the bucket. The bucket will refill at the rate of RATE_LIMIT_REFILL_PER_SECOND. If the bucket is empty, the rate limiter will reject requests with a 429 or To Many Request error when tokens are exhausted.

Accounting Modes

If you are logged in, you can add a query parameter dotAccounting to any request to get an accounting of its cost, e.g.

https://local.dotcms.site:8443/?dotAccounting=LOG

• NONE - No tracking
• HEADER - Cost in response header (default)
• LOG - Detailed logging per operation
• HTML - Visual report for debugging (admin only)

Configuration with defaults

  REQUEST_COST_ACCOUNTING_ENABLED=true     # Enable/disable cost reporting
  REQUEST_COST_TIME_WINDOW_SECONDS=60      # Cost Logging interval
  RATE_LIMIT_ENABLED=false                 # Enable hard rate limiting
  RATE_LIMIT_REFILL_PER_SECOND=500         # Token refill rate
  RATE_LIMIT_MAX_BUCKET_SIZE=10000         # Max tokens
  RATE_LIMIT_ADD_HEADER_INFO=true          # Adds header which reports on number of tokens remaining

Tests

• Added unit tests for RequestCostApi, RequestCostFilter, RequestCostRequestListener, LeakyTokenBucketImpl and RequestCostReport for validation.
• Integration tests verify HTML report behavior and accounting stability across requests.

To Do

• Create a new LeakyTokenBucketImpl that reads token and bucket information from reddit for use across load balanced systems.
• Log expensive requests, e.g. log any request > 1000 tokens

ref: #32886

This PR fixes: #32886

[sfreudenthaler]

my friend Claude and I agree that this is good to go 🥇 🤖