feat: Cache remote config (#26719)

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

posthog/api/remote_config.py

@@ -1,4 +1,6 @@
+import re
 from django.http import JsonResponse, Http404, HttpResponse
+from rest_framework.exceptions import ValidationError
 from rest_framework.views import APIView
 from posthog.models.remote_config import RemoteConfig
 
@@ -11,28 +13,38 @@ class BaseRemoteConfigAPIView(APIView):
     authentication_classes = []
     permission_classes = []
 
-    def get_object(self, token: str) -> RemoteConfig:
-        try:
-            return RemoteConfig.objects.get(team__api_token=token)
-        except RemoteConfig.DoesNotExist:
-            raise Http404()
+    def check_token(self, token: str):
+        # Simple check rather than involving a whole serializer
+        if len(token) > 200 or not re.match(r"^[a-zA-Z0-9_]+$", token):
+            raise ValidationError("Invalid token")
+        return token
 
 
 class RemoteConfigAPIView(BaseRemoteConfigAPIView):
     def get(self, request, token: str, *args, **kwargs):
-        resource = self.get_object(token)
-        return JsonResponse(resource.config)
+        try:
+            resource = RemoteConfig.get_config_via_token(self.check_token(token))
+        except RemoteConfig.DoesNotExist:
+            raise Http404()
+
+        return JsonResponse(resource)
 
 
 class RemoteConfigJSAPIView(BaseRemoteConfigAPIView):
     def get(self, request, token: str, *args, **kwargs):
-        resource = self.get_object(token)
-        script_content = resource.build_js_config()
+        try:
+            script_content = RemoteConfig.get_config_js_via_token(self.check_token(token))
+        except RemoteConfig.DoesNotExist:
+            raise Http404()
+
         return HttpResponse(script_content, content_type="application/javascript")
 
 
 class RemoteConfigArrayJSAPIView(BaseRemoteConfigAPIView):
     def get(self, request, token: str, *args, **kwargs):
-        resource = self.get_object(token)
-        script_content = resource.build_array_js_config()
+        try:
+            script_content = RemoteConfig.get_array_js_via_token(self.check_token(token))
+        except RemoteConfig.DoesNotExist:
+            raise Http404()
+
         return HttpResponse(script_content, content_type="application/javascript")