feat: rate-limit badges/mfa endpoints and complete OpenAPI docs - #1336
Merged
RUKAYAT-CODER merged 1 commit intoAug 26, 2026
Merged
Conversation
- badges: throttle state-changing admin handlers (create/seed) with CustomThrottleGuard + THROTTLE presets; wire ThrottlerModule and register BadgesController in GamificationModule. Reads stay unthrottled - mfa: throttle setup/verify/disable (strictest on code verification) and wire ThrottlerModule in AuthModule; document 429 - assessment: add missing 400/401/404 response annotations - tenancy: add @apiresponse (success + 404/400) to every handler
walexjnr
force-pushed
the
feat/rate-limit-and-openapi-badges-mfa
branch
from
August 26, 2026 13:12
efe03cf to
c8fee45
Compare
|
@walexjnr Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Contributor
|
Thank you for contributing to the project. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR hardens two sensitive endpoint groups with rate limiting and completes OpenAPI documentation on two others.
CustomThrottleGuard+ documentedTHROTTLEpresets to the state-changing admin handlers (create,seed), returning429when exceeded. Read endpoints (badge browsing, leaderboards) stay unthrottled so normal usage is unaffected.ThrottlerModuleis wired inGamificationModule, andBadgesController(previously unregistered) is now registered there.setup/verify/disable(strictest preset on the brute-forceable code paths) viaCustomThrottleGuard, and wiresThrottlerModuleinAuthModule. Exceeding a limit returns429.400/401/404response annotations.@ApiResponse(success +404/400) to every handler, referencing theTenantschema where applicable.Limits come from the shared, documented
THROTTLEpresets rather than hardcoded magic numbers.Testing
pnpm run typecheckpnpm run lint:cipnpm run buildIssues
Closes #1329
Closes #1323
Closes #1316
Closes #1315