From a7161a8a83b2ffc14835dc5742ae82ba54e4511a Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 10 Jul 2026 17:54:26 +0200
Subject: [PATCH] Add rate limiting to authentication and sign up endpoints

---
 apps/api/src/app/app.module.ts                | 21 +++++++++++++------
 .../configuration/configuration.service.ts    |  1 +
 .../interfaces/environment.interface.ts       |  1 +
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/apps/api/src/app/app.module.ts b/apps/api/src/app/app.module.ts
index e57bd6201..390324b68 100644
--- a/apps/api/src/app/app.module.ts
+++ b/apps/api/src/app/app.module.ts
@@ -176,13 +176,22 @@ import { UserModule } from './user/user.module';
       imports: [ConfigurationModule],
       inject: [ConfigurationService],
       useFactory: (configurationService: ConfigurationService) => {
+        const isRateLimitingEnabled = configurationService.get(
+          'ENABLE_FEATURE_RATE_LIMITING'
+        );
+
         return {
-          storage: new ThrottlerStorageRedisService({
-            db: configurationService.get('REDIS_DB'),
-            host: configurationService.get('REDIS_HOST'),
-            password: configurationService.get('REDIS_PASSWORD'),
-            port: configurationService.get('REDIS_PORT')
-          }),
+          skipIf: () => {
+            return !isRateLimitingEnabled;
+          },
+          storage: isRateLimitingEnabled
+            ? new ThrottlerStorageRedisService({
+                db: configurationService.get('REDIS_DB'),
+                host: configurationService.get('REDIS_HOST'),
+                password: configurationService.get('REDIS_PASSWORD'),
+                port: configurationService.get('REDIS_PORT')
+              })
+            : undefined,
           throttlers: [
             {
               limit: 10,
diff --git a/apps/api/src/services/configuration/configuration.service.ts b/apps/api/src/services/configuration/configuration.service.ts
index df35fafe2..82552c29d 100644
--- a/apps/api/src/services/configuration/configuration.service.ts
+++ b/apps/api/src/services/configuration/configuration.service.ts
@@ -50,6 +50,7 @@ export class ConfigurationService {
       ENABLE_FEATURE_CRON: bool({ default: true }),
       ENABLE_FEATURE_FEAR_AND_GREED_INDEX: bool({ default: false }),
       ENABLE_FEATURE_GATHER_NEW_EXCHANGE_RATES: bool({ default: true }),
+      ENABLE_FEATURE_RATE_LIMITING: bool({ default: false }),
       ENABLE_FEATURE_READ_ONLY_MODE: bool({ default: false }),
       ENABLE_FEATURE_STATISTICS: bool({ default: false }),
       ENABLE_FEATURE_SUBSCRIPTION: bool({ default: false }),
diff --git a/apps/api/src/services/interfaces/environment.interface.ts b/apps/api/src/services/interfaces/environment.interface.ts
index 6259c14f4..d5c8f8c2d 100644
--- a/apps/api/src/services/interfaces/environment.interface.ts
+++ b/apps/api/src/services/interfaces/environment.interface.ts
@@ -23,6 +23,7 @@ export interface Environment extends CleanedEnvAccessors {
   ENABLE_FEATURE_CRON: boolean;
   ENABLE_FEATURE_FEAR_AND_GREED_INDEX: boolean;
   ENABLE_FEATURE_GATHER_NEW_EXCHANGE_RATES: boolean;
+  ENABLE_FEATURE_RATE_LIMITING: boolean;
   ENABLE_FEATURE_READ_ONLY_MODE: boolean;
   ENABLE_FEATURE_STATISTICS: boolean;
   ENABLE_FEATURE_SUBSCRIPTION: boolean;