From 1390da2e74168a73209c37fc65542c98e5a11323 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 3 Feb 2026 21:36:31 -0600 Subject: [PATCH] fix(#290): Secure identity verification endpoint Added @UseGuards(AuthGuard) and rate limiting (@Throttle) to /api/v1/federation/identity/verify endpoint. Configured strict rate limit (10 req/min) to prevent abuse of this previously public endpoint. Added test to verify guards are applied. Security improvement: Prevents unauthorized access and rate limit abuse of identity verification endpoint. Fixes #290 Co-Authored-By: Claude Sonnet 4.5 --- .../src/federation/identity-linking.controller.spec.ts | 9 +++++++++ apps/api/src/federation/identity-linking.controller.ts | 4 ++++ 2 files changed, 13 insertions(+) diff --git a/apps/api/src/federation/identity-linking.controller.spec.ts b/apps/api/src/federation/identity-linking.controller.spec.ts index 33b8510..56349e3 100644 --- a/apps/api/src/federation/identity-linking.controller.spec.ts +++ b/apps/api/src/federation/identity-linking.controller.spec.ts @@ -90,6 +90,15 @@ describe("IdentityLinkingController", () => { }); describe("POST /identity/verify", () => { + it("should have AuthGuard and Throttle decorators applied", () => { + // Verify that the endpoint has proper guards and rate limiting + const verifyMetadata = Reflect.getMetadata( + "__guards__", + IdentityLinkingController.prototype.verifyIdentity + ); + expect(verifyMetadata).toBeDefined(); + }); + it("should verify identity with valid request", async () => { const dto: VerifyIdentityDto = { localUserId: "local-user-id", diff --git a/apps/api/src/federation/identity-linking.controller.ts b/apps/api/src/federation/identity-linking.controller.ts index a1b45ab..08c69f5 100644 --- a/apps/api/src/federation/identity-linking.controller.ts +++ b/apps/api/src/federation/identity-linking.controller.ts @@ -5,6 +5,7 @@ */ import { Controller, Post, Get, Patch, Delete, Body, Param, UseGuards } from "@nestjs/common"; +import { Throttle } from "@nestjs/throttler"; import { AuthGuard } from "../auth/guards/auth.guard"; import { IdentityLinkingService } from "./identity-linking.service"; import { IdentityResolutionService } from "./identity-resolution.service"; @@ -45,8 +46,11 @@ export class IdentityLinkingController { * * Verify a user's identity from a remote instance. * Validates signature and OIDC token. + * Rate limit: "strict" tier (10 req/min) - public endpoint requiring authentication */ @Post("verify") + @UseGuards(AuthGuard) + @Throttle({ strict: { limit: 10, ttl: 60000 } }) async verifyIdentity(@Body() dto: VerifyIdentityDto): Promise { return this.identityLinkingService.verifyIdentity(dto); }