feat: execute Batch 2 of pre-launch backend code fixes

- B2: Add brute-force login protection via Redis
- B3/B4: Add GDPR DELETE /users/me and PATCH /users/me
- B5: Strict MIME/size validation for S3 uploads (refactored to createPresignedPost)
- B6: Invite abuse limits (max 20 per group, 10/hr per user)
- B7: Nightly cron job to purge expired refresh tokens
- B8: Include payerName in ExpenseDto API response

Author: Arun-kushwaha007

apps/backend/package.json

@@ -13,8 +13,9 @@
     "seed": "ts-node prisma/seed.ts"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.888.0",
-    "@aws-sdk/s3-request-presigner": "^3.888.0",
+    "@aws-sdk/client-s3": "^3.1037.0",
+    "@aws-sdk/s3-presigned-post": "^3.1037.0",
+    "@aws-sdk/s3-request-presigner": "^3.1037.0",
     "@fairshare/shared-types": "workspace:*",
     "@nestjs/common": "^11.0.0",
     "@nestjs/config": "^4.0.0",
@@ -23,6 +24,7 @@
     "@nestjs/passport": "^11.0.5",
     "@nestjs/platform-express": "^11.0.0",
     "@nestjs/platform-socket.io": "^11.1.14",
+    "@nestjs/schedule": "^6.1.3",
     "@nestjs/throttler": "^6.4.0",
     "@nestjs/websockets": "^11.1.14",
     "@opentelemetry/api": "^1.9.0",

apps/backend/src/app.module.ts

@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 import { APP_GUARD } from '@nestjs/core';
 import { ConfigModule } from '@nestjs/config';
+import { ScheduleModule } from '@nestjs/schedule';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { AppConfigModule } from './config/app-config.module';
 import { AuthModule } from './auth/auth.module';
@@ -21,6 +22,7 @@ import { HealthModule } from './health/health.module';
 import { PaymentsModule } from './payments/payments.module';
 import { ObservabilityModule } from './observability/observability.module';
 import { JobsModule } from './jobs/jobs.module';
+import { CronModule } from './cron/cron.module';
 
 @Module({
   imports: [
@@ -34,6 +36,7 @@ import { JobsModule } from './jobs/jobs.module';
         limit: 100,
       },
     ]),
+    ScheduleModule.forRoot(),
     AppConfigModule,
     PrismaModule,
     RedisModule,
@@ -42,6 +45,7 @@ import { JobsModule } from './jobs/jobs.module';
     HealthModule,
     PaymentsModule,
     JobsModule,
+    CronModule,
     ObservabilityModule,
     ActivityModule,
     AuthModule,

apps/backend/src/auth/auth.module.ts

@@ -9,13 +9,15 @@ import { AuthService } from './auth.service';
 import { JwtStrategy } from './strategies/jwt.strategy';
 
 import { GroupsModule } from '../groups/groups.module';
+import { RedisModule } from '../redis/redis.module';
 
 @Module({
   imports: [
     AppConfigModule,
     PrismaModule,
     PassportModule,
     GroupsModule,
+    RedisModule,
     JwtModule.registerAsync({
       imports: [AppConfigModule],
       inject: [AppConfigService],

apps/backend/src/auth/auth.service.ts

@@ -12,6 +12,7 @@ import { LoginDto } from './dto/login.dto';
 import { RegisterDto } from './dto/register.dto';
 import { GoogleLoginDto } from './dto/google-login.dto';
 import { setActiveUsers } from '../observability/metrics';
+import { RedisService } from '../redis/redis.service';
 
 import { GroupsService } from '../groups/groups.service';
 
@@ -24,6 +25,7 @@ export class AuthService {
     private readonly jwtService: JwtService,
     private readonly config: AppConfigService,
     private readonly groupsService: GroupsService,
+    private readonly redisService: RedisService,
   ) {}
 
   async register(dto: RegisterDto): Promise<AuthTokensDto> {
@@ -65,18 +67,27 @@ export class AuthService {
     const email = dto.email.toLowerCase();
     this.logger.log(`Login attempt email=${email}`);
 
+    const failedCount = await this.redisService.getFailedLoginCount(email);
+    if (failedCount >= 5) {
+      this.logger.warn(`Login failed rate-limit email=${email}`);
+      throw new UnauthorizedException('Too many failed attempts. Try again in 15 minutes.');
+    }
+
     const user = await this.prisma.user.findUnique({ where: { email } });
     if (!user) {
+      await this.redisService.incrementFailedLogin(email);
       this.logger.warn(`Login failed user-not-found email=${email}`);
       throw new UnauthorizedException('Invalid credentials');
     }
 
     const valid = await compare(dto.password, user.passwordHash);
     if (!valid) {
+      await this.redisService.incrementFailedLogin(email);
       this.logger.warn(`Login failed invalid-password userId=${user.id}`);
       throw new UnauthorizedException('Invalid credentials');
     }
 
+    await this.redisService.clearFailedLogin(email);
     this.logger.log(`Login success userId=${user.id} email=${email}`);
     return this.issueTokens(user.id, user.email);
   }

apps/backend/src/cron/cron.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { PrismaModule } from '../common/prisma.module';
+import { CronService } from './cron.service';
+
+@Module({
+  imports: [PrismaModule],
+  providers: [CronService],
+})
+export class CronModule {}

apps/backend/src/cron/cron.service.ts

@@ -0,0 +1,28 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Cron, CronExpression } from '@nestjs/schedule';
+import { PrismaService } from '../common/prisma.service';
+
+@Injectable()
+export class CronService {
+  private readonly logger = new Logger(CronService.name);
+
+  constructor(private readonly prisma: PrismaService) {}
+
+  @Cron(CronExpression.EVERY_DAY_AT_MIDNIGHT)
+  async purgeExpiredRefreshTokens() {
+    this.logger.log('Running nightly cron job: purgeExpiredRefreshTokens');
+    try {
+      const result = await this.prisma.refreshToken.deleteMany({
+        where: {
+          OR: [
+            { expiresAt: { lt: new Date() } },
+            { revokedAt: { not: null } },
+          ],
+        },
+      });
+      this.logger.log(`Purged ${result.count} expired/revoked refresh tokens.`);
+    } catch (error) {
+      this.logger.error('Failed to purge refresh tokens', error instanceof Error ? error.stack : undefined);
+    }
+  }
+}

apps/backend/src/expenses/expenses.service.ts

@@ -41,7 +41,7 @@ export class ExpensesService {
     if (idempotencyKey) {
       const existingByKey = await this.prisma.expense.findUnique({
         where: { idempotencyKey },
-        include: { splits: true, receipt: true },
+        include: { splits: true, receipt: true, payer: { select: { name: true } } },
       });
       if (existingByKey) {
         return this.toExpenseDto(existingByKey);
@@ -84,7 +84,7 @@ export class ExpensesService {
       if (idempotencyKey && this.isUniqueConstraintError(error)) {
         const existing = await this.prisma.expense.findUnique({
           where: { idempotencyKey },
-          include: { splits: true, receipt: true },
+          include: { splits: true, receipt: true, payer: { select: { name: true } } },
         });
         if (existing) {
           return this.toExpenseDto(existing);
@@ -112,7 +112,7 @@ export class ExpensesService {
     } else {
       const rows = await this.prisma.expense.findMany({
         where: { groupId },
-        include: { splits: true, receipt: true },
+        include: { splits: true, receipt: true, payer: { select: { name: true } } },
         orderBy: { createdAt: 'desc' },
       });
       expenses = rows.map((row) => this.toExpenseDto(row));
@@ -185,7 +185,7 @@ export class ExpensesService {
   }
 
   async getById(id: string): Promise<ExpenseDto> {
-    const expense = await this.prisma.expense.findUnique({ where: { id }, include: { splits: true, receipt: true } });
+    const expense = await this.prisma.expense.findUnique({ where: { id }, include: { splits: true, receipt: true, payer: { select: { name: true } } } });
     if (!expense) {
       throw new NotFoundException('Expense not found');
     }
@@ -200,7 +200,7 @@ export class ExpensesService {
         description: dto.description,
         category: dto.category,
       },
-      include: { splits: true, receipt: true },
+      include: { splits: true, receipt: true, payer: { select: { name: true } } },
     });
 
     await this.activityService.log({
@@ -533,7 +533,7 @@ export class ExpensesService {
 
     return tx.expense.findUniqueOrThrow({
       where: { id: createdExpense.id },
-      include: { splits: true, receipt: true },
+      include: { splits: true, receipt: true, payer: { select: { name: true } } },
     });
   }
 
@@ -692,11 +692,15 @@ export class ExpensesService {
     receipt: {
       fileKey: string;
     } | null;
+    payer?: {
+      name: string;
+    } | null;
   }): ExpenseDto {
     return {
       id: expense.id,
       groupId: expense.groupId,
       payerId: expense.payerId,
+      payerName: expense.payer?.name,
       description: expense.description,
       totalAmountCents: expense.totalAmountCents.toString(),
       currency: expense.currency as 'USD' | 'EUR' | 'INR',

apps/backend/src/groups/groups.service.ts

@@ -529,8 +529,23 @@ export class GroupsService {
     dto: InviteMemberDto,
   ): Promise<{ success: true }> {
     await this.assertMembership(groupId, actorUserId);
+    
+    // Rate limit: 10 invites per hour per user
+    const userInviteCount = await this.redis.incrementInviteRateLimit(actorUserId);
+    if (userInviteCount > 10) {
+      throw new ForbiddenException('You have exceeded your invite limit (10 per hour)');
+    }
+
     const email = dto.email.toLowerCase();
 
+    // Check pending invites limit
+    const pendingCount = await this.prisma.groupInvite.count({
+      where: { groupId },
+    });
+    if (pendingCount >= 20) {
+      throw new ForbiddenException('This group has too many pending invites (max 20)');
+    }
+
     const user = await this.prisma.user.findUnique({ where: { email } });
     if (!user) {
       await this.prisma.groupInvite.upsert({

apps/backend/src/receipts/receipts.service.ts

@@ -55,7 +55,7 @@ export class ReceiptsService {
       expenseId,
     });
 
-    const uploadUrl = await this.s3.getPresignedUploadUrl(fileKey, RECEIPT_MIME_TYPES[extension]);
-    return { uploadUrl, fileKey };
+    const { url: uploadUrl, fields: uploadFields } = await this.s3.getPresignedUploadUrl(fileKey, RECEIPT_MIME_TYPES[extension]);
+    return { uploadUrl, uploadFields, fileKey };
   }
 }

apps/backend/src/redis/redis.service.ts

@@ -69,6 +69,51 @@ export class RedisService {
     }
   }
 
+  async incrementFailedLogin(email: string): Promise<number> {
+    try {
+      const key = `login:fail:${email}`;
+      const count = await this.redis.incr(key);
+      if (count === 1) {
+        await this.redis.expire(key, 15 * 60); // 15 minutes
+      }
+      return count;
+    } catch (error) {
+      this.logger.warn(`Redis incr skipped for login:fail:${email}`);
+      return 0; // Fallback to allow if Redis is down
+    }
+  }
+
+  async clearFailedLogin(email: string): Promise<void> {
+    try {
+      await this.redis.del(`login:fail:${email}`);
+    } catch (error) {
+      this.logger.warn(`Redis del skipped for login:fail:${email}`);
+    }
+  }
+
+  async getFailedLoginCount(email: string): Promise<number> {
+    try {
+      const count = await this.redis.get(`login:fail:${email}`);
+      return count ? parseInt(count, 10) : 0;
+    } catch (error) {
+      return 0;
+    }
+  }
+
+  async incrementInviteRateLimit(userId: string): Promise<number> {
+    try {
+      const key = `invite:rate:${userId}`;
+      const count = await this.redis.incr(key);
+      if (count === 1) {
+        await this.redis.expire(key, 60 * 60); // 1 hour
+      }
+      return count;
+    } catch (error) {
+      this.logger.warn(`Redis incr skipped for invite:rate:${userId}`);
+      return 0;
+    }
+  }
+
   private async safeGet(key: string): Promise<string | null> {
     try {
       return await this.redis.get(key);