FIX: Add bookmark limits (#11725)

Adds a bookmark search per page limit, a total bookmark creation limit, and a rate limit per day for bookmark creation.

app/models/bookmark.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Bookmark < ActiveRecord::Base
+  BOOKMARK_LIMIT = 2000
+
   self.ignored_columns = [
     "delete_when_reminder_sent" # TODO(2021-07-22): remove
   ]
@@ -37,6 +39,7 @@ class Bookmark < ActiveRecord::Base
 
   validate :unique_per_post_for_user
   validate :ensure_sane_reminder_at_time
+  validate :bookmark_limit_not_reached
   validates :name, length: { maximum: 100 }
 
   # we don't care whether the post or topic is deleted,
@@ -65,6 +68,11 @@ class Bookmark < ActiveRecord::Base
     end
   end
 
+  def bookmark_limit_not_reached
+    return if user.bookmarks.count < BOOKMARK_LIMIT
+    self.errors.add(:base, I18n.t("bookmarks.errors.too_many", user_bookmarks_url: "#{Discourse.base_url}/my/activity/bookmarks"))
+  end
+
   def no_reminder?
     self.reminder_at.blank? && self.reminder_type.blank?
   end

app/models/user_bookmark_list.rb

@@ -5,13 +5,17 @@ class UserBookmarkList
 
   PER_PAGE = 20
 
-  attr_reader :bookmarks
+  attr_reader :bookmarks, :per_page
   attr_accessor :more_bookmarks_url
 
   def initialize(user:, guardian:, params:)
     @user = user
     @guardian = guardian
-    @params = params.merge(per_page: PER_PAGE)
+    @params = params
+
+    @params.merge!(per_page: PER_PAGE) if params[:per_page].blank?
+    @params[:per_page] = PER_PAGE if @params[:per_page] > PER_PAGE
+
     @bookmarks = []
   end
 
@@ -21,6 +25,6 @@ class UserBookmarkList
   end
 
   def per_page
-    @per_page ||= PER_PAGE
+    @per_page ||= @params[:per_page]
   end
 end