feat: enforce backend rate limiting and secure refresh cookies

Author: Arun-kushwaha007

apps/backend/package.json

@@ -34,7 +34,8 @@
                          "prisma":  "^6.4.1",
                          "reflect-metadata":  "^0.2.2",
                          "rxjs":  "^7.8.1",
-                         "@sentry/node":  "^10.6.0"
+                         "@sentry/node":  "^10.6.0",
+                         "@nestjs/throttler":  "^6.4.0"
                      },
     "devDependencies":  {
                             "@nestjs/cli":  "^11.0.0",

apps/backend/src/app.module.ts

@@ -1,5 +1,7 @@
-import { Module } from '@nestjs/common';
+import { Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
 import { ConfigModule } from '@nestjs/config';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { AppConfigModule } from './config/app-config.module';
 import { AuthModule } from './auth/auth.module';
 import { UsersModule } from './users/users.module';
@@ -18,6 +20,12 @@ import { ActivityModule } from './activity/activity.module';
 @Module({
   imports: [
     ConfigModule.forRoot({ isGlobal: true }),
+    ThrottlerModule.forRoot([
+      {
+        ttl: 60_000,
+        limit: 100,
+      },
+    ]),
     AppConfigModule,
     PrismaModule,
     RedisModule,
@@ -33,5 +41,11 @@ import { ActivityModule } from './activity/activity.module';
     ReceiptsModule,
     NotificationsModule,
   ],
+  providers: [
+    {
+      provide: APP_GUARD,
+      useClass: ThrottlerGuard,
+    },
+  ],
 })
 export class AppModule {}

apps/backend/src/auth/auth.controller.ts

@@ -1,4 +1,5 @@
-import { Body, Controller, Post } from '@nestjs/common';
+import { Body, Controller, Post, Req, Res } from '@nestjs/common';
+import { Request, Response } from 'express';
 import { AuthService } from './auth.service';
 import { RegisterDto } from './dto/register.dto';
 import { LoginDto } from './dto/login.dto';
@@ -9,17 +10,35 @@ export class AuthController {
   constructor(private readonly authService: AuthService) {}
 
   @Post('register')
-  register(@Body() dto: RegisterDto) {
-    return this.authService.register(dto);
+  async register(@Body() dto: RegisterDto, @Res({ passthrough: true }) res: Response) {
+    const payload = await this.authService.register(dto);
+    this.authService.setRefreshTokenCookie(res, payload.refreshToken);
+    return payload;
   }
 
   @Post('login')
-  login(@Body() dto: LoginDto) {
-    return this.authService.login(dto);
+  async login(@Body() dto: LoginDto, @Res({ passthrough: true }) res: Response) {
+    const payload = await this.authService.login(dto);
+    this.authService.setRefreshTokenCookie(res, payload.refreshToken);
+    return payload;
   }
 
   @Post('google')
-  google(@Body() dto: GoogleLoginDto) {
-    return this.authService.googleLogin(dto);
+  async google(@Body() dto: GoogleLoginDto, @Res({ passthrough: true }) res: Response) {
+    const payload = await this.authService.googleLogin(dto);
+    this.authService.setRefreshTokenCookie(res, payload.refreshToken);
+    return payload;
+  }
+
+  @Post('refresh')
+  async refresh(@Req() req: Request & { cookies?: Record<string, string> }, @Res({ passthrough: true }) res: Response) {
+    const token = req.cookies?.refresh_token;
+    if (!token) {
+      return { message: 'Missing refresh token' };
+    }
+
+    const payload = await this.authService.refresh(token);
+    this.authService.setRefreshTokenCookie(res, payload.refreshToken);
+    return payload;
   }
 }

apps/backend/src/auth/auth.service.ts

@@ -2,6 +2,7 @@ import { Injectable, UnauthorizedException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { compare, hash } from 'bcrypt';
 import { randomUUID } from 'crypto';
+import { Response } from 'express';
 import { AuthTokensDto } from '@fairshare/shared-types';
 import { PrismaService } from '../common/prisma.service';
 import { AppConfigService } from '../config/app-config.service';
@@ -74,7 +75,9 @@ export class AuthService {
     });
 
     const matched = await Promise.any(
-      tokens.map(async (token) => ((await compare(refreshToken, token.tokenHash)) ? token : Promise.reject(new Error('No match')))),
+      tokens.map(async (token) =>
+        (await compare(refreshToken, token.tokenHash)) ? token : Promise.reject(new Error('No match')),
+      ),
     ).catch(() => null);
 
     if (!matched) {
@@ -89,6 +92,16 @@ export class AuthService {
     return this.issueTokens(payload.sub, payload.email);
   }
 
+  setRefreshTokenCookie(res: Response, refreshToken: string): void {
+    res.cookie('refresh_token', refreshToken, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'lax',
+      path: '/api/v1/auth/refresh',
+      maxAge: 7 * 24 * 60 * 60 * 1000,
+    });
+  }
+
   private async issueTokens(userId: string, email: string): Promise<AuthTokensDto> {
     const payload: JwtPayload = { sub: userId, email };