feat: implement throttling guard and update throttling configuration for improved rate limiting

Author: tomast1337

server/src/app.module.ts

@@ -1,7 +1,7 @@
 import { Logger, Module } from '@nestjs/common';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { MongooseModule, MongooseModuleFactoryOptions } from '@nestjs/mongoose';
-import { ThrottlerModule } from '@nestjs/throttler';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { MailerModule } from '@nestjs-modules/mailer';
 import { HandlebarsAdapter } from '@nestjs-modules/mailer/dist/adapters/handlebars.adapter';
 
@@ -15,6 +15,7 @@ import { SeedModule } from './seed/seed.module';
 import { SongModule } from './song/song.module';
 import { SongBrowserModule } from './song-browser/song-browser.module';
 import { UserModule } from './user/user.module';
+import { APP_GUARD } from '@nestjs/core';
 
 @Module({
   imports: [
@@ -67,19 +68,8 @@ import { UserModule } from './user/user.module';
     // Throttler
     ThrottlerModule.forRoot([
       {
-        name: 'short',
-        ttl: 1000,
-        limit: 3,
-      },
-      {
-        name: 'medium',
-        ttl: 10000,
-        limit: 20,
-      },
-      {
-        name: 'long',
-        ttl: 60000,
-        limit: 100,
+        ttl: 60,
+        limit: 256, // 256 requests per minute
       },
     ]),
     SongModule,
@@ -92,7 +82,13 @@ import { UserModule } from './user/user.module';
     MailingModule,
   ],
   controllers: [],
-  providers: [ParseTokenPipe],
+  providers: [
+    ParseTokenPipe,
+    {
+      provide: APP_GUARD,
+      useClass: ThrottlerGuard,
+    },
+  ],
   exports: [ParseTokenPipe],
 })
 export class AppModule {

server/src/auth/auth.controller.ts

@@ -12,7 +12,7 @@ import { AuthGuard } from '@nestjs/passport';
 import { ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
 import type { Request, Response } from 'express';
 
-import { UseThrottle } from '@server/Throttle/Throttles';
+import { Throttle } from '@nestjs/throttler';
 import { AuthService } from './auth.service';
 import { MagicLinkEmailStrategy } from './strategies/magicLinkEmail.strategy';
 
@@ -27,7 +27,13 @@ export class AuthController {
     private readonly magicLinkEmailStrategy: MagicLinkEmailStrategy,
   ) {}
 
-  @UseThrottle('very-long')
+  @Throttle({
+    default: {
+      // one every 1 hour
+      ttl: 60 * 60 * 1000,
+      limit: 1,
+    },
+  })
   @Post('login/magic-link')
   @ApiOperation({
     summary: