feat(back): provide custom request throttler tracker and trust proxy IP

Author: GordiNoki

apps/backend/src/app/app.module.ts

@@ -1,9 +1,9 @@
 import { Module } from '@nestjs/common';
-import { APP_FILTER, APP_GUARD } from '@nestjs/core';
+import { APP_FILTER } from '@nestjs/core';
 import { LoggerModule, Params as PinoParams } from 'nestjs-pino';
 import pino from 'pino';
 import { ConfigModule, ConfigService } from '@nestjs/config';
-import { ThrottlerGuard, ThrottlerModule, seconds } from '@nestjs/throttler';
+import { ThrottlerModule, seconds } from '@nestjs/throttler';
 import { SentryModule } from '@sentry/nestjs/setup';
 import { ScheduleModule } from '@nestjs/schedule';
 import * as Sentry from '@sentry/node';
@@ -186,10 +186,6 @@ import { ValkeyModule } from './modules/valkey/valkey.module';
     {
       provide: APP_FILTER,
       useClass: ExceptionHandlerFilter
-    },
-    {
-      provide: APP_GUARD,
-      useClass: ThrottlerGuard
     }
   ]
 })

apps/backend/src/app/modules/auth/auth.module.ts

@@ -10,6 +10,7 @@ import { JwtGuard } from './jwt/jwt.guard';
 import { JwtAuthService } from './jwt/jwt-auth.service';
 import { SteamOpenIDService } from './steam/steam-openid.service';
 import { LimitedGuard } from './limited.guard';
+import { UserIPThrottlerGuard } from './user-ip-throttler.guard';
 
 @Module({
   imports: [
@@ -35,6 +36,12 @@ import { LimitedGuard } from './limited.guard';
       provide: APP_GUARD,
       useClass: LimitedGuard
     },
+    {
+      // Provide throttler guard here instread of the app module
+      // so that it runs after the request user is set
+      provide: APP_GUARD,
+      useClass: UserIPThrottlerGuard
+    },
     JwtAuthService,
     SteamOpenIDService
   ]

apps/backend/src/app/modules/auth/user-ip-throttler.guard.ts

@@ -0,0 +1,13 @@
+import { ThrottlerGuard } from '@nestjs/throttler';
+import { Injectable } from '@nestjs/common';
+import { FastifyRequest } from 'fastify';
+
+@Injectable()
+export class UserIPThrottlerGuard extends ThrottlerGuard {
+  protected async getTracker(req: FastifyRequest): Promise<string> {
+    const ip = req.ips.length > 0 ? req.ips[0] : req.ip;
+    const uid = req.user?.id ?? -1;
+
+    return `${uid}@${ip}`;
+  }
+}

apps/backend/src/main.ts

@@ -17,7 +17,7 @@ import cors from '@fastify/cors';
 import multipart from '@fastify/multipart';
 import { Logger } from 'nestjs-pino';
 import cluster from 'node:cluster';
-import { Environment } from './app/config';
+import { Config, Environment } from './app/config';
 import { AppModule } from './app/app.module';
 import { VALIDATION_PIPE_CONFIG } from './app/dto';
 import { FIRST_WORKER_ENV_VAR } from './clustered';
@@ -30,9 +30,13 @@ async function bootstrap() {
     return this.toString();
   };
 
+  const env: Environment = Config.env;
+
   const app = await NestFactory.create<NestFastifyApplication>(
     AppModule,
-    new FastifyAdapter(),
+    new FastifyAdapter({
+      trustProxy: env === Environment.PRODUCTION
+    }),
     {
       bufferLogs: true, // Buffer logs until Pino is attached
       rawBody: true // So we can use RawBodyRequest
@@ -43,7 +47,6 @@ async function bootstrap() {
   app.useLogger(app.get(Logger));
 
   const configService = app.get(ConfigService);
-  const env: Environment = configService.getOrThrow('env');
 
   // Steam game auth and replay submission from game send raw octet-streams.
   // Steam auth we could limit to 2kb, but replays can be massive. Limiting