Overview
The API has no rate limiting, no security headers, and starts happily with missing secrets. @nestjs/throttler is installed but never registered. Before this repo invites public contributions against a deployed instance, the basics must be in place.
What to Build
- Rate limiting:
ThrottlerModule.forRootAsync() from env (THROTTLE_TTL, THROTTLE_LIMIT), ThrottlerGuard global; stricter per-route limits on POST /api/auth/login and /api/auth/register (e.g. 5/min)
- Headers: add
helmet middleware in main.ts
- Env validation: Joi or Zod schema on
ConfigModule.forRoot() — required vars (JWT_SECRET, JWT_REFRESH_SECRET, DB vars) fail fast at boot with a descriptive error; no hardcoded secret fallbacks anywhere
- CORS: keep the existing
FRONTEND_URL origin config, but reject wildcard in production mode
References
- Current bootstrap:
backend/src/main.ts, backend/src/app.module.ts
- Blocked by [BE-01] (auth routes must exist to be rate-limited)
Acceptance Criteria
Overview
The API has no rate limiting, no security headers, and starts happily with missing secrets.
@nestjs/throttleris installed but never registered. Before this repo invites public contributions against a deployed instance, the basics must be in place.What to Build
ThrottlerModule.forRootAsync()from env (THROTTLE_TTL,THROTTLE_LIMIT),ThrottlerGuardglobal; stricter per-route limits onPOST /api/auth/loginand/api/auth/register(e.g. 5/min)helmetmiddleware inmain.tsConfigModule.forRoot()— required vars (JWT_SECRET,JWT_REFRESH_SECRET, DB vars) fail fast at boot with a descriptive error; no hardcoded secret fallbacks anywhereFRONTEND_URLorigin config, but reject wildcard in production modeReferences
backend/src/main.ts,backend/src/app.module.tsAcceptance Criteria
429with aRetry-Afterheader