Add comprehensive JSDoc and inline comments documenting the known race
condition in the in-memory fallback path of ThrottlerValkeyStorageService.
The non-atomic read-modify-write in incrementMemory() is intentionally
left without a mutex because:
- It is only the fallback path when Valkey is unavailable
- The primary Valkey path uses atomic INCR and is race-free
- Adding locking to a rarely-used degraded path adds complexity
with minimal benefit
Also adds Logger.warn calls when falling back to in-memory mode
at runtime (Redis command failures).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Log at ERROR level when falling back to in-memory storage
- Track and expose degraded mode status for health checks
- Add isUsingFallback() method to check fallback state
- Add getHealthStatus() method for health check endpoints
- Add comprehensive tests for fallback behavior and health status
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Regenerated Prisma client to include version field from #196
- Updated ThrottlerValkeyStorageService to match @nestjs/throttler v6.5 interface
- increment() now returns ThrottlerStorageRecord with totalHits, timeToExpire, isBlocked
- Added blockDuration and throttlerName parameters to match interface
- Added null checks for job variable after length checks in coordinator-integration.service.ts
- Fixed template literal type error in ConcurrentUpdateException
- Removed unnecessary await in throttler-storage.service.ts
- Fixes pipeline 79 typecheck failure
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Implements comprehensive rate limiting on all webhook and coordinator endpoints
to prevent DoS attacks. Follows TDD protocol with 14 passing tests.
Implementation:
- Added @nestjs/throttler package for rate limiting
- Created ThrottlerApiKeyGuard for per-API-key rate limiting
- Created ThrottlerValkeyStorageService for distributed rate limiting via Redis
- Configured rate limits on stitcher endpoints (60 req/min)
- Configured rate limits on coordinator endpoints (100 req/min)
- Higher limits for health endpoints (300 req/min for monitoring)
- Added environment variables for rate limit configuration
- Rate limiting logs violations for security monitoring
Rate Limits:
- Stitcher webhooks: 60 requests/minute per API key
- Coordinator endpoints: 100 requests/minute per API key
- Health endpoints: 300 requests/minute (higher for monitoring)
Storage:
- Uses Valkey (Redis) for distributed rate limiting across API instances
- Falls back to in-memory storage if Redis unavailable
Testing:
- 14 comprehensive rate limiting tests (all passing)
- Tests verify: rate limit enforcement, Retry-After headers, per-API-key isolation
- TDD approach: RED (failing tests) → GREEN (implementation) → REFACTOR
Additional improvements:
- Type safety improvements in websocket gateway
- Array type notation standardization in coordinator service
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
