[add] added maximum client and demo client protection

- default demo clients can no longer be modified/deleted when in demo mode
 - increased default demo reset to 60 minutes

app/controllers/clients_controller.rb

@@ -9,6 +9,7 @@ class ClientsController < ApplicationController
   before_action :authorize_perm_w, only: %i[update_ipv4 destroy_ipv4]
   before_action :authorize_perm_x, only: %i[create update index show destroy]
   before_action :client_authorized, except: [:show_public_ipv4]
+  before_action :demo, only: %i[create update destroy] if ENV['RAILS_API_DEMO']
 
   # URL Methods
   # POST /admin/client
@@ -22,6 +23,7 @@ class ClientsController < ApplicationController
     # create new client or update existing
     if client.nil?
       client ||= Client.new_client(client_params)
+      return head(429) if client.nil? # reached max client count
     else
       # return 406 if request is trying to remove perm_x from last admin account to prevent lockout
       # TODO: move this into the model (update)
@@ -217,4 +219,11 @@ class ClientsController < ApplicationController
   def client_authorized
     return head(403) unless @authorized
   end
+
+  # TODO: put this into a demo environment
+  def demo
+    demo_clients = %w[admin read_client write_client]
+    request_params = params.key?(:name) ? params[:name] : ''
+    return head(406) if demo_clients.include? request_params
+  end
 end

app/models/client.rb

@@ -3,6 +3,8 @@
 class Client < ApplicationRecord
 
   def self.new_client(params)
+    return nil if count >= RynDNS::Application::MAX_CLIENTS
+
     perm_string = params[:permission] || 'w' # create write client by default
     perm_rwx = Client.parse_perm_string(perm_string)
 
@@ -28,7 +30,7 @@ class Client < ApplicationRecord
   def gen_api_key
     api_key = SecureRandom.hex(32)
     self.api_key = api_key
-    "#{RynDNS::Application::API_KEY_PREFIX}.#{self.name_id}.#{api_key}"
+    "#{RynDNS::Application::API_KEY_PREFIX}.#{name_id}.#{api_key}"
   end
 
   def api_key