[backend] Add Rate Limiting with @nestjs/throttler

[josueazc]

DESCRIPTION

The NestJS API has no rate limiting. Any actor can send unlimited requests to any endpoint, enabling abuse, DoS, and brute-force attacks against POST /auth/login. This task adds ThrottlerModule with sensible global and per-route defaults.

GOAL

API endpoints are protected by rate limiting. Abusive callers receive 429 Too Many Requests with a Retry-After header once they exceed the configured threshold.

REQUIREMENTS

• Install @nestjs/throttler in apps/api
• Configure ThrottlerModule globally in AppModule: default 100 req / 60 s per IP
• Stricter limits on sensitive endpoints: POST /auth/login (10 req/min), POST /bonds (20 req/min)
• Return standard 429 with a Retry-After header
• Add THROTTLE_TTL and THROTTLE_LIMIT to .env.example for configurability

ACCEPTANCE CRITERIA

• Sending 101 requests in 60s to a default endpoint returns 429 on the 101st
• POST /auth/login is blocked after 10 requests in 60s
• 429 response includes Retry-After header
• THROTTLE_* vars documented in .env.example
• Work follows Velar monorepo structure
• No legitimate request flow is broken
• Can be reviewed by the team

NOTES

Relevant files: apps/api/src/app.module.ts, apps/api/src/auth/auth.controller.ts, apps/api/src/bonds/bonds.controller.ts, apps/api/.env.example. Good first task — no blockchain knowledge required. Reference: https://docs.nestjs.com/security/rate-limiting

---

Difficulty: Beginner
Priority: Medium

[iamayushtiwari]

hi @josueazc,
I would love to work on this issue. Could you please assign it to me?I have reviewed the description and feel confident I can implement the required changes. If you have any specific pointers or preferences before I start, please let me know.

[Yerickmondra15]

Hi! I’d like to work on this issue.
I’ll implement rate limiting in the NestJS API using @nestjs/throttler, configure the global defaults, add stricter limits for the sensitive routes, and update the .env.example with the required THROTTLE_* variables.
I’ll make sure the implementation follows the Velar monorepo structure and that existing API flows keep working.
Thanks!

[grantfox-oss]

🦊 GrantFox — @Yerickmondra15 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #6)
2. Your PR will be reviewed by the Velar-Bonds maintainers

Good luck! Track your progress on GrantFox.