Add 2nd response for container api bulk delete

The bulk delete api endpoint for container registries can
only be called once per hour. If a user calls the endpoint more
than once per hour, they will now receive a 400 error with a
descriptive message.

1 files changed, 10 insertions, 0 deletions

diff --git a/lib/api/container_registry.rb b/lib/api/container_registry.rb
index 7d9b5e1a598..7dad20a822a 100644
--- a/lib/api/container_registry.rb
+++ b/lib/api/container_registry.rb
@@ -68,6 +68,9 @@ module API
       delete ':id/registry/repositories/:repository_id/tags', requirements: REGISTRY_ENDPOINT_REQUIREMENTS do
         authorize_admin_container_image!
 
+        message = 'This request has already been made. You can run this at most once an hour for a given container repository'
+        render_api_error!(message, 400) unless obtain_new_cleanup_container_lease
+
         CleanupContainerRepositoryWorker.perform_async(current_user.id, repository.id,
           declared_params.except(:repository_id)) # rubocop: disable CodeReuse/ActiveRecord
 
@@ -123,6 +126,13 @@ module API
         authorize! :admin_container_image, repository
       end
 
+      def obtain_new_cleanup_container_lease
+        Gitlab::ExclusiveLease
+          .new("container_repository:cleanup_tags:#{repository.id}",
+               timeout: 1.hour)
+          .try_obtain
+      end
+
       def repository
         @repository ||= user_project.container_repositories.find(params[:repository_id])
       end