Fix follow limit preventing re-following of a moved account

[Gargron]

ImportService already enforces follow limit.

[ClearlyClaire]

Seems sensible to me, the tests just need to be updated, as they assume rate limiting is enabled, while it's off by default (but on in all codepath that matter)

[ClearlyClaire]

Actually, I missed that the Import::RelationshipWorker calls FollowService without setting the with_rate_limit parameter, thus making it trivial to bypass the follow rate limiting by going through the import functionality.

[Gargron]

Right, I don’t think imports were ever rate limited, I’m not sure if there is a user-friendly way to do it. Like it would suck to only import 200 follows per day (or whatever) and force the user to re-submit the same file every day. We could maybe schedule individual follows into the future to align with the rate limit?

[ClearlyClaire]

Right, I don’t think imports were ever rate limited

I think right now they are, since this PR changes it? I'm not sure we should enforce this limit, but if we don't enforce it on list import, I don't know why we should have this limit at all.

[Gargron]

I think right now they are, since this PR changes it? I'm not sure we should enforce this limit, but if we don't enforce it on list import, I don't know why we should have this limit at all.

I realized you are mixing up rate limits and follow limits here. Imports were never rate limited, but they were (unintentionally) follow limited. This PR changes the latter, but not the former. The change in the spec is only due to the fact that the spec tests follow limits.

[ClearlyClaire]

Alright, I did indeed mix the total follow limit and the rate limiting (but the two being tied together in this PR doesn't help). Rate limiting indeed never applied to imports, it wasn't applied before this PR, and isn't after this PR either.

However, with this PR, the total follow limit can be bypassed by using the follow import functionality, as the service will refuse importing more than the total number of accounts the person is allowed to follow at once, but calling it repeatedly would just work.

[Gargron]

Fixed that

[ClearlyClaire]

Technically susceptible to race conditions, I think.

[ClearlyClaire]

There are other issues with this I did not think about:

• if you import a list that contains more than FollowLimitValidator.limit_for_account(@account) - @account.following_count accounts, it will silently cut off the list in whatever order it was provided even if most of those accounts are people you already follow
• in overwrite mode, it will make you unfollow everyone but not let you follow more than your limit minus your previous number of followed people

[ClearlyClaire]

I'm a bit uncomfortable with tying the total follow count limit and the rate limiting together in the Follow model validation, as well as with duplicating followers count logic, but the former is nitpicking and the latter is justified by the new Import validation, which is a clear improvement.

There's still the issue of possible race conditions that can be exploited to import more than the limit, but this can be addressed in a follow-up PR.