add upload rate limiter per IP to backend.

Nest throttler with nullcart-style default profile and upload override via throttleProfiles.

backend/src/config/index.ts

@@ -41,6 +41,14 @@ export const getAppConfig = (): AppConfig => {
         corsOrigins: rawOrigins
             .split(',')
             .map(o => o.trim())
-            .filter(Boolean)
+            .filter(Boolean),
+        throttle: {
+            ttlMs: envInt('THROTTLE_TTL_MS'),
+            limit: envInt('THROTTLE_LIMIT')
+        },
+        uploadThrottle: {
+            ttlMs: envInt('THROTTLE_UPLOAD_TTL_MS'),
+            limit: envInt('THROTTLE_UPLOAD_LIMIT')
+        }
     };
 };

backend/src/config/throttleProfiles.ts

@@ -0,0 +1,9 @@
+import { getAppConfig } from './index';
+
+const {
+    uploadThrottle: { limit, ttlMs }
+} = getAppConfig();
+
+export const throttleProfiles = {
+    upload: { default: { limit, ttl: ttlMs } }
+} as const;

backend/src/config/validate.ts

@@ -75,6 +75,18 @@ class EnvironmentVariables {
     @Max(3650)
     NEVER_MODE_INACTIVITY_DAYS: number;
 
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1000)
+    @Max(3_600_000)
+    THROTTLE_TTL_MS: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(1_000_000)
+    THROTTLE_LIMIT: number;
+
     @IsNotEmpty()
     @IsNumber()
     @Min(1000)
@@ -86,30 +98,6 @@ class EnvironmentVariables {
     @Min(1)
     @Max(10_000)
     THROTTLE_UPLOAD_LIMIT: number;
-
-    @IsNotEmpty()
-    @IsNumber()
-    @Min(1000)
-    @Max(3_600_000)
-    THROTTLE_HOTLINK_PER_IP_TTL_MS: number;
-
-    @IsNotEmpty()
-    @IsNumber()
-    @Min(1)
-    @Max(1_000_000)
-    THROTTLE_HOTLINK_PER_IP_LIMIT: number;
-
-    @IsNotEmpty()
-    @IsNumber()
-    @Min(1000)
-    @Max(3_600_000)
-    THROTTLE_HOTLINK_PER_ID_TTL_MS: number;
-
-    @IsNotEmpty()
-    @IsNumber()
-    @Min(1)
-    @Max(1_000_000)
-    THROTTLE_HOTLINK_PER_ID_LIMIT: number;
 }
 
 export const validate = (config: Record<string, unknown>) => {