chore(server): clean up throttler (#6326)

packages/backend/server/src/core/auth/controller.ts

@@ -14,7 +14,11 @@ import {
 } from '@nestjs/common';
 import type { Request, Response } from 'express';
 
-import { PaymentRequiredException, URLHelper } from '../../fundamentals';
+import {
+  PaymentRequiredException,
+  Throttle,
+  URLHelper,
+} from '../../fundamentals';
 import { UserService } from '../user';
 import { validators } from '../utils/validators';
 import { CurrentUser } from './current-user';
@@ -27,6 +31,7 @@ class SignInCredential {
   password?: string;
 }
 
+@Throttle('strict')
 @Controller('/api/auth')
 export class AuthController {
   constructor(
@@ -158,6 +163,7 @@ export class AuthController {
     return this.url.safeRedirect(res, redirectUri);
   }
 
+  @Throttle('default', { limit: 1200 })
   @Public()
   @Get('/session')
   async currentSessionUser(@CurrentUser() user?: CurrentUser) {
@@ -166,6 +172,7 @@ export class AuthController {
     };
   }
 
+  @Throttle('default', { limit: 1200 })
   @Public()
   @Get('/sessions')
   async currentSessionUsers(@Req() req: Request) {

packages/backend/server/src/core/auth/guard.ts

@@ -54,6 +54,7 @@ export class AuthGuard implements CanActivate, OnModuleInit {
       const user = await this.auth.getUser(sessionToken, userSeq);
 
       if (user) {
+        req.sid = sessionToken;
         req.user = user;
       }
     }

packages/backend/server/src/core/auth/resolver.ts

@@ -1,8 +1,4 @@
-import {
-  BadRequestException,
-  ForbiddenException,
-  UseGuards,
-} from '@nestjs/common';
+import { BadRequestException, ForbiddenException } from '@nestjs/common';
 import {
   Args,
   Context,
@@ -16,7 +12,7 @@ import {
 } from '@nestjs/graphql';
 import type { Request, Response } from 'express';
 
-import { CloudThrottlerGuard, Config, Throttle } from '../../fundamentals';
+import { Config, Throttle } from '../../fundamentals';
 import { UserService } from '../user';
 import { UserType } from '../user/types';
 import { validators } from '../utils/validators';
@@ -43,7 +39,7 @@ export class ClientTokenType {
  * Sign up/in rate limit: 10 req/m
  * Other rate limit: 5 req/m
  */
-@UseGuards(CloudThrottlerGuard)
+@Throttle('strict')
 @Resolver(() => UserType)
 export class AuthResolver {
   constructor(
@@ -53,12 +49,6 @@ export class AuthResolver {
     private readonly token: TokenService
   ) {}
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Public()
   @Query(() => UserType, {
     name: 'currentUser',
@@ -69,12 +59,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 20,
-      ttl: 60,
-    },
-  })
   @ResolveField(() => ClientTokenType, {
     name: 'token',
     deprecationReason: 'use [/api/auth/authorize]',
@@ -101,12 +85,6 @@ export class AuthResolver {
   }
 
   @Public()
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async signUp(
     @Context() ctx: { req: Request; res: Response },
@@ -122,12 +100,6 @@ export class AuthResolver {
   }
 
   @Public()
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async signIn(
     @Context() ctx: { req: Request; res: Response },
@@ -141,12 +113,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async changePassword(
     @CurrentUser() user: CurrentUser,
@@ -172,12 +138,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async changeEmail(
     @CurrentUser() user: CurrentUser,
@@ -202,12 +162,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendChangePasswordEmail(
     @CurrentUser() user: CurrentUser,
@@ -235,12 +189,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendSetPasswordEmail(
     @CurrentUser() user: CurrentUser,
@@ -273,12 +221,6 @@ export class AuthResolver {
   // 4. user open confirm email page from new email
   // 5. user click confirm button
   // 6. send notification email
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendChangeEmail(
     @CurrentUser() user: CurrentUser,
@@ -299,12 +241,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendVerifyChangeEmail(
     @CurrentUser() user: CurrentUser,
@@ -347,12 +283,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendVerifyEmail(
     @CurrentUser() user: CurrentUser,
@@ -367,12 +297,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async verifyEmail(
     @CurrentUser() user: CurrentUser,