fix(server): skip throttle for currentUser (#6700)

packages/backend/server/src/fundamentals/index.ts

@@ -27,7 +27,7 @@ export {
 export type { PrismaTransaction } from './prisma';
 export * from './storage';
 export { type StorageProvider, StorageProviderFactory } from './storage';
-export { CloudThrottlerGuard, Throttle } from './throttler';
+export { CloudThrottlerGuard, SkipThrottle, Throttle } from './throttler';
 export {
   getRequestFromHost,
   getRequestResponseFromContext,

packages/backend/server/src/fundamentals/throttler/decorators.ts

@@ -1,7 +1,7 @@
 import { applyDecorators, SetMetadata } from '@nestjs/common';
 import { SkipThrottle, Throttle as RawThrottle } from '@nestjs/throttler';
 
-export type Throttlers = 'default' | 'strict';
+export type Throttlers = 'default' | 'strict' | 'authenticated';
 export const THROTTLER_PROTECTED = 'affine_throttler:protected';
 
 /**
@@ -10,8 +10,9 @@ export const THROTTLER_PROTECTED = 'affine_throttler:protected';
  * If a Controller or Query do not protected behind a Throttler,
  * it will never be rate limited.
  *
- * - Ease: 120 calls within 60 seconds
- * - Strict: 10 calls within 60 seconds
+ * - default: 120 calls within 60 seconds
+ * - strict: 10 calls within 60 seconds
+ * - authenticated: no rate limit for authenticated users, apply [default] throttler for unauthenticated users
  *
  * @example
  *

packages/backend/server/src/fundamentals/throttler/index.ts

@@ -166,10 +166,12 @@ export class CloudThrottlerGuard extends ThrottlerGuard {
   }
 
   getSpecifiedThrottler(context: ExecutionContext) {
-    return this.reflector.getAllAndOverride<Throttlers | undefined>(
+    const throttler = this.reflector.getAllAndOverride<Throttlers | undefined>(
       THROTTLER_PROTECTED,
       [context.getHandler(), context.getClass()]
     );
+
+    return throttler === 'authenticated' ? undefined : throttler;
   }
 }