Create a "Flood control" sub-module to limit points that can be added/deducted over a configurable amount of time

Based on a conversation with Berdir, I did more brainstorming on this. Here are what I think are the essentials for a flood control module from a functional perspective.

1. Create flood control limits based on the following:

a) Operation

b) Points category

c) User (kind of a global mode across all operations and categories for that user)

We may also need a special case for a) above when it involves an operation supplied by Userpoints Node and Comments. If points are awarded for adding a node, we may need a way to specify a more specific flood control based on the content type.

2. We need a way to exempt certain points transactions from flood controls (if, for instance, a privileged administrator is manually awarding the points). This could probably be done with an extra checkbox setting on the add/edit transaction form (in the "Status" section) that allows you to exempt a transaction from flood controls.

3. We need a setting to specify if a positive points award, negative points award, or both counts toward the flood control. For instance, in some use cases we may want a flood control to prevent lots of positive points awards, but to allow numerous negative ones (such as when a bunch of transactions are expiring). Perhaps we need a separate setting to exempt "expiry" transactions if desired?

4. We need a setting to specify a time duration to apply to the flood control, including both the number and the unit of time. This would allow us to specify a flood control based on periods like 3 minutes, 1 hour, 10 hours, 3 daya, 2 weeks, and 1 year.

5. We need to figure out a UI for managing these flood control "rules". One possibility would be something similar to Private Message module's global user blocking rules page.

Thoughts?

--Ben

Berdir,

All excellent points. Let me clarify what I meant in c) and also revise what I said in 1. Here's what I'm now thinking:

1. Create flood control limits based on the following:

a) Operation

b) Points category

c) Points: This would be a flood control limit based on the total number of points awarded in a given period of time. The operation or points category wouldn't matter. Basically, it would be impossible to earn more points (of any variety) than the flood control limit allows.

Then, for each flood control rule, we would have some checkboxes available for specifying the "Flood control scope". Basically, this is whether the rule should apply to an individual user or globally to all users. The user setting would be the common use case so that a given user is limited from earning more than the allowed points. But the global setting would be useful if you wanted to say that "there are 100 points to be earned during this hour and the first users to act get the points... once the points are used up there are no more left." Actually, I can think of a third option: Limit the scope to a particular role. This way, you could say that "premium" users have a different flood control limit than regular authenticated users.

As for the UI, maybe something similar to what is used in User Relationships for the relationship type? Basically, each relationship type has its own add/edit page, but then they are summarized on the main page. Is that more along the lines of what you mean?

--Ben

Berdir made a good point in IRC that I wanted to document here:

We also need to be able to configure the "action" to take if a flood control limit is violated. Possible options include:

* Mark as pending
* Mark as declined
* Mark as expired
* Block with a user message
* Block without a user message (silently)
* Mark as "blocked" (this would be a new status level that we would create specifically for flood control)

We'd probably also need a way to specify an automated (and possible manual description) for why the transaction was blocked, declined, etc.

--Ben