chore(server): clean up throttler (#6326)

packages/backend/server/src/core/auth/controller.ts

@@ -14,7 +14,11 @@ import {
 } from '@nestjs/common';
 import type { Request, Response } from 'express';
 
-import { PaymentRequiredException, URLHelper } from '../../fundamentals';
+import {
+  PaymentRequiredException,
+  Throttle,
+  URLHelper,
+} from '../../fundamentals';
 import { UserService } from '../user';
 import { validators } from '../utils/validators';
 import { CurrentUser } from './current-user';
@@ -27,6 +31,7 @@ class SignInCredential {
   password?: string;
 }
 
+@Throttle('strict')
 @Controller('/api/auth')
 export class AuthController {
   constructor(
@@ -158,6 +163,7 @@ export class AuthController {
     return this.url.safeRedirect(res, redirectUri);
   }
 
+  @Throttle('default', { limit: 1200 })
   @Public()
   @Get('/session')
   async currentSessionUser(@CurrentUser() user?: CurrentUser) {
@@ -166,6 +172,7 @@ export class AuthController {
     };
   }
 
+  @Throttle('default', { limit: 1200 })
   @Public()
   @Get('/sessions')
   async currentSessionUsers(@Req() req: Request) {

packages/backend/server/src/core/auth/guard.ts

@@ -54,6 +54,7 @@ export class AuthGuard implements CanActivate, OnModuleInit {
       const user = await this.auth.getUser(sessionToken, userSeq);
 
       if (user) {
+        req.sid = sessionToken;
         req.user = user;
       }
     }

packages/backend/server/src/core/auth/resolver.ts

@@ -1,8 +1,4 @@
-import {
-  BadRequestException,
-  ForbiddenException,
-  UseGuards,
-} from '@nestjs/common';
+import { BadRequestException, ForbiddenException } from '@nestjs/common';
 import {
   Args,
   Context,
@@ -16,7 +12,7 @@ import {
 } from '@nestjs/graphql';
 import type { Request, Response } from 'express';
 
-import { CloudThrottlerGuard, Config, Throttle } from '../../fundamentals';
+import { Config, Throttle } from '../../fundamentals';
 import { UserService } from '../user';
 import { UserType } from '../user/types';
 import { validators } from '../utils/validators';
@@ -43,7 +39,7 @@ export class ClientTokenType {
  * Sign up/in rate limit: 10 req/m
  * Other rate limit: 5 req/m
  */
-@UseGuards(CloudThrottlerGuard)
+@Throttle('strict')
 @Resolver(() => UserType)
 export class AuthResolver {
   constructor(
@@ -53,12 +49,6 @@ export class AuthResolver {
     private readonly token: TokenService
   ) {}
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Public()
   @Query(() => UserType, {
     name: 'currentUser',
@@ -69,12 +59,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 20,
-      ttl: 60,
-    },
-  })
   @ResolveField(() => ClientTokenType, {
     name: 'token',
     deprecationReason: 'use [/api/auth/authorize]',
@@ -101,12 +85,6 @@ export class AuthResolver {
   }
 
   @Public()
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async signUp(
     @Context() ctx: { req: Request; res: Response },
@@ -122,12 +100,6 @@ export class AuthResolver {
   }
 
   @Public()
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async signIn(
     @Context() ctx: { req: Request; res: Response },
@@ -141,12 +113,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async changePassword(
     @CurrentUser() user: CurrentUser,
@@ -172,12 +138,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType)
   async changeEmail(
     @CurrentUser() user: CurrentUser,
@@ -202,12 +162,6 @@ export class AuthResolver {
     return user;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendChangePasswordEmail(
     @CurrentUser() user: CurrentUser,
@@ -235,12 +189,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendSetPasswordEmail(
     @CurrentUser() user: CurrentUser,
@@ -273,12 +221,6 @@ export class AuthResolver {
   // 4. user open confirm email page from new email
   // 5. user click confirm button
   // 6. send notification email
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendChangeEmail(
     @CurrentUser() user: CurrentUser,
@@ -299,12 +241,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendVerifyChangeEmail(
     @CurrentUser() user: CurrentUser,
@@ -347,12 +283,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async sendVerifyEmail(
     @CurrentUser() user: CurrentUser,
@@ -367,12 +297,6 @@ export class AuthResolver {
     return !res.rejected.length;
   }
 
-  @Throttle({
-    default: {
-      limit: 5,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Boolean)
   async verifyEmail(
     @CurrentUser() user: CurrentUser,

packages/backend/server/src/core/user/management.ts

@@ -1,8 +1,4 @@
-import {
-  BadRequestException,
-  ForbiddenException,
-  UseGuards,
-} from '@nestjs/common';
+import { BadRequestException, ForbiddenException } from '@nestjs/common';
 import {
   Args,
   Context,
@@ -13,7 +9,6 @@ import {
   Resolver,
 } from '@nestjs/graphql';
 
-import { CloudThrottlerGuard, Throttle } from '../../fundamentals';
 import { CurrentUser } from '../auth/current-user';
 import { sessionUser } from '../auth/service';
 import { EarlyAccessType, FeatureManagementService } from '../features';
@@ -24,11 +19,6 @@ registerEnumType(EarlyAccessType, {
   name: 'EarlyAccessType',
 });
 
-/**
- * User resolver
- * All op rate limit: 10 req/m
- */
-@UseGuards(CloudThrottlerGuard)
 @Resolver(() => UserType)
 export class UserManagementResolver {
   constructor(
@@ -36,12 +26,6 @@ export class UserManagementResolver {
     private readonly feature: FeatureManagementService
   ) {}
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Int)
   async addToEarlyAccess(
     @CurrentUser() currentUser: CurrentUser,
@@ -62,12 +46,6 @@ export class UserManagementResolver {
     }
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Int)
   async removeEarlyAccess(
     @CurrentUser() currentUser: CurrentUser,
@@ -83,12 +61,6 @@ export class UserManagementResolver {
     return this.feature.removeEarlyAccess(user.id);
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Query(() => [UserType])
   async earlyAccessUsers(
     @Context() ctx: { isAdminQuery: boolean },

packages/backend/server/src/core/user/resolver.ts

@@ -1,4 +1,4 @@
-import { BadRequestException, UseGuards } from '@nestjs/common';
+import { BadRequestException } from '@nestjs/common';
 import {
   Args,
   Int,
@@ -14,7 +14,6 @@ import { isNil, omitBy } from 'lodash-es';
 
 import type { FileUpload } from '../../fundamentals';
 import {
-  CloudThrottlerGuard,
   EventEmitter,
   PaymentRequiredException,
   Throttle,
@@ -35,11 +34,6 @@ import {
   UserType,
 } from './types';
 
-/**
- * User resolver
- * All op rate limit: 10 req/m
- */
-@UseGuards(CloudThrottlerGuard)
 @Resolver(() => UserType)
 export class UserResolver {
   constructor(
@@ -51,12 +45,7 @@ export class UserResolver {
     private readonly event: EventEmitter
   ) {}
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
+  @Throttle('strict')
   @Query(() => UserOrLimitedUser, {
     name: 'user',
     description: 'Get user by email',
@@ -90,7 +79,6 @@ export class UserResolver {
     };
   }
 
-  @Throttle({ default: { limit: 10, ttl: 60 } })
   @ResolveField(() => UserQuotaType, { name: 'quota', nullable: true })
   async getQuota(@CurrentUser() me: User) {
     const quota = await this.quota.getUserQuota(me.id);
@@ -98,7 +86,6 @@ export class UserResolver {
     return quota.feature;
   }
 
-  @Throttle({ default: { limit: 10, ttl: 60 } })
   @ResolveField(() => Int, {
     name: 'invoiceCount',
     description: 'Get user invoice count',
@@ -109,7 +96,6 @@ export class UserResolver {
     });
   }
 
-  @Throttle({ default: { limit: 10, ttl: 60 } })
   @ResolveField(() => [FeatureType], {
     name: 'features',
     description: 'Enabled features of a user',
@@ -118,12 +104,6 @@ export class UserResolver {
     return this.feature.getActivatedUserFeatures(user.id);
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType, {
     name: 'uploadAvatar',
     description: 'Upload user avatar',
@@ -153,12 +133,6 @@ export class UserResolver {
     });
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => UserType, {
     name: 'updateProfile',
   })
@@ -180,12 +154,6 @@ export class UserResolver {
     );
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => RemoveAvatar, {
     name: 'removeAvatar',
     description: 'Remove user avatar',
@@ -201,12 +169,6 @@ export class UserResolver {
     return { success: true };
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => DeleteAccount)
   async deleteAccount(
     @CurrentUser() user: CurrentUser

packages/backend/server/src/core/workspaces/management.ts

@@ -1,4 +1,4 @@
-import { ForbiddenException, UseGuards } from '@nestjs/common';
+import { ForbiddenException } from '@nestjs/common';
 import {
   Args,
   Int,
@@ -9,13 +9,11 @@ import {
   Resolver,
 } from '@nestjs/graphql';
 
-import { CloudThrottlerGuard, Throttle } from '../../fundamentals';
 import { CurrentUser } from '../auth';
 import { FeatureManagementService, FeatureType } from '../features';
 import { PermissionService } from './permission';
 import { WorkspaceType } from './types';
 
-@UseGuards(CloudThrottlerGuard)
 @Resolver(() => WorkspaceType)
 export class WorkspaceManagementResolver {
   constructor(
@@ -23,12 +21,6 @@ export class WorkspaceManagementResolver {
     private readonly permission: PermissionService
   ) {}
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Int)
   async addWorkspaceFeature(
     @CurrentUser() currentUser: CurrentUser,
@@ -42,12 +34,6 @@ export class WorkspaceManagementResolver {
     return this.feature.addWorkspaceFeatures(workspaceId, feature);
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Mutation(() => Int)
   async removeWorkspaceFeature(
     @CurrentUser() currentUser: CurrentUser,
@@ -61,12 +47,6 @@ export class WorkspaceManagementResolver {
     return this.feature.removeWorkspaceFeature(workspaceId, feature);
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 60,
-    },
-  })
   @Query(() => [WorkspaceType])
   async listWorkspaceFeatures(
     @CurrentUser() user: CurrentUser,

packages/backend/server/src/core/workspaces/resolvers/blob.ts

@@ -2,7 +2,6 @@ import {
   ForbiddenException,
   Logger,
   PayloadTooLargeException,
-  UseGuards,
 } from '@nestjs/common';
 import {
   Args,
@@ -17,11 +16,7 @@ import { SafeIntResolver } from 'graphql-scalars';
 import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
 
 import type { FileUpload } from '../../../fundamentals';
-import {
-  CloudThrottlerGuard,
-  MakeCache,
-  PreventCache,
-} from '../../../fundamentals';
+import { MakeCache, PreventCache } from '../../../fundamentals';
 import { CurrentUser } from '../../auth';
 import { FeatureManagementService, FeatureType } from '../../features';
 import { QuotaManagementService } from '../../quota';
@@ -29,7 +24,6 @@ import { WorkspaceBlobStorage } from '../../storage';
 import { PermissionService } from '../permission';
 import { Permission, WorkspaceBlobSizes, WorkspaceType } from '../types';
 
-@UseGuards(CloudThrottlerGuard)
 @Resolver(() => WorkspaceType)
 export class WorkspaceBlobResolver {
   logger = new Logger(WorkspaceBlobResolver.name);

packages/backend/server/src/core/workspaces/resolvers/history.ts

@@ -1,4 +1,3 @@
-import { UseGuards } from '@nestjs/common';
 import {
   Args,
   Field,
@@ -12,7 +11,6 @@ import {
 } from '@nestjs/graphql';
 import type { SnapshotHistory } from '@prisma/client';
 
-import { CloudThrottlerGuard } from '../../../fundamentals';
 import { CurrentUser } from '../../auth';
 import { DocHistoryManager } from '../../doc';
 import { DocID } from '../../utils/doc';
@@ -31,7 +29,6 @@ class DocHistoryType implements Partial<SnapshotHistory> {
   timestamp!: Date;
 }
 
-@UseGuards(CloudThrottlerGuard)
 @Resolver(() => WorkspaceType)
 export class DocHistoryResolver {
   constructor(

packages/backend/server/src/core/workspaces/resolvers/page.ts

@@ -1,4 +1,4 @@
-import { BadRequestException, UseGuards } from '@nestjs/common';
+import { BadRequestException } from '@nestjs/common';
 import {
   Args,
   Field,
@@ -12,7 +12,6 @@ import {
 import type { WorkspacePage as PrismaWorkspacePage } from '@prisma/client';
 import { PrismaClient } from '@prisma/client';
 
-import { CloudThrottlerGuard } from '../../../fundamentals';
 import { CurrentUser } from '../../auth';
 import { DocID } from '../../utils/doc';
 import { PermissionService, PublicPageMode } from '../permission';
@@ -38,7 +37,6 @@ class WorkspacePage implements Partial<PrismaWorkspacePage> {
   public!: boolean;
 }
 
-@UseGuards(CloudThrottlerGuard)
 @Resolver(() => WorkspaceType)
 export class PagePermissionResolver {
   constructor(

packages/backend/server/src/core/workspaces/resolvers/workspace.ts

@@ -4,7 +4,6 @@ import {
   Logger,
   NotFoundException,
   PayloadTooLargeException,
-  UseGuards,
 } from '@nestjs/common';
 import {
   Args,
@@ -22,7 +21,6 @@ import { applyUpdate, Doc } from 'yjs';
 
 import type { FileUpload } from '../../../fundamentals';
 import {
-  CloudThrottlerGuard,
   EventEmitter,
   MailService,
   MutexService,
@@ -48,7 +46,6 @@ import { defaultWorkspaceAvatar } from '../utils';
  * Public apis rate limit: 10 req/m
  * Other rate limit: 120 req/m
  */
-@UseGuards(CloudThrottlerGuard)
 @Resolver(() => WorkspaceType)
 export class WorkspaceResolver {
   private readonly logger = new Logger(WorkspaceResolver.name);
@@ -191,12 +188,7 @@ export class WorkspaceResolver {
     });
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 30,
-    },
-  })
+  @Throttle('strict')
   @Public()
   @Query(() => WorkspaceType, {
     description: 'Get public workspace by id',
@@ -422,15 +414,10 @@ export class WorkspaceResolver {
     }
   }
 
-  @Throttle({
-    default: {
-      limit: 10,
-      ttl: 30,
-    },
-  })
+  @Throttle('strict')
   @Public()
   @Query(() => InvitationType, {
-    description: 'Update workspace',
+    description: 'send workspace invitation',
   })
   async getInviteInfo(@Args('inviteId') inviteId: string) {
     const workspaceId = await this.prisma.workspaceUserPermission