feat(app): implement throttling guard for enhanced request management

Author: maksberegovoi

.env.example

@@ -3,6 +3,7 @@ PORT=3000
 NODE_ENV=development
 COOKIE_SECRET=same-serious-secret
 CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
+SKIP_THROTTLE=false
 
 # --- POSTGRES ---
 DB_USERNAME=admin

libs/bootstrap/src/bootstrap.ts

@@ -1,8 +1,6 @@
 import { Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { NestFactory } from '@nestjs/core';
-import { setupThrottler } from './setups/throttler';
-import { DEFAULT_THROTTLER_OPTIONS } from './configs/throttler';
 import { setupCors, setupSwagger } from './setups';
 import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
 import type { BootstrapOptions } from './interfaces/options.interface';
@@ -30,17 +28,10 @@ export async function bootstrapApp(options: BootstrapOptions) {
         setupApp,
         useCookieParser = true,
         useCors = true,
-        throttlerOptions = DEFAULT_THROTTLER_OPTIONS,
         swaggerOptions,
     } = options;
 
-    let rootModule = appModule;
-
-    if (throttlerOptions) {
-        rootModule = setupThrottler(rootModule, throttlerOptions);
-    }
-
-    const app = await NestFactory.create<NestFastifyApplication>(rootModule, adapter, {
+    const app = await NestFactory.create<NestFastifyApplication>(appModule, adapter, {
         rawBody: true,
     });
     const logger = new Logger(serviceName[0].toUpperCase() + serviceName.slice(1));

libs/bootstrap/src/configs/throttler.ts

@@ -9,6 +9,14 @@ export const ConfigSchema = z.object({
     PORT: z.coerce.number().default(3000),
     NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
     COOKIE_SECRET: z.string({ error: 'COOKIE_SECRET is missing' }),
+    SKIP_THROTTLE: z
+        .preprocess((value) => {
+            if (typeof value === 'string') {
+                return value.toLowerCase() === 'true';
+            }
+            return value;
+        }, z.boolean())
+        .default(false),
     DB_USERNAME: z.string({ error: 'DB_USERNAME is missing' }),
     DB_PASSWORD: z.string({ error: 'DB_PASSWORD is missing' }),
     DB_DATABASE: z.string({ error: 'DB_DATABASE is missing' }),

libs/config/src/config.schema.ts

@@ -3,7 +3,7 @@ import { ConfigModule } from '@libs/config';
 import { DatabaseModule } from '@libs/database';
 import { ConfigService } from '@nestjs/config';
 import * as schema from '../../shared/entities';
-import { APP_FILTER, APP_PIPE } from '@nestjs/core';
+import { APP_FILTER, APP_GUARD, APP_PIPE } from '@nestjs/core';
 import { ZodValidationPipe } from 'nestjs-zod';
 import { PrometheusModule } from '@willsoto/nestjs-prometheus';
 import { HealthModule } from '@libs/health';
@@ -18,10 +18,20 @@ import { MailAdapter } from '@shared/adapters/mail';
 import { MigrationService } from '@shared/migration';
 import { TeamsModule } from '../teams';
 import { ProjectsModule } from '../projects';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 
 @Module({
     imports: [
         ConfigModule,
+        ThrottlerModule.forRootAsync({
+            inject: [ConfigService],
+            useFactory: (cfg: ConfigService) => [
+                {
+                    ttl: 60000,
+                    limit: cfg.get<boolean>('SKIP_THROTTLE') ? 999999 : 100,
+                },
+            ],
+        }),
         PrometheusModule.registerAsync({
             useFactory: () => ({
                 path: 'dump',
@@ -61,6 +71,10 @@ import { ProjectsModule } from '../projects';
         HealthModule.register('gateway'),
     ],
     providers: [
+        {
+            provide: APP_GUARD,
+            useClass: ThrottlerGuard,
+        },
         MigrationService,
         {
             provide: 'IMailPort',