CsrfGuard is already applied globally via APP_GUARD in AppModule. The explicit @UseGuards(CsrfGuard) on FederationController caused a DI error because CsrfService is not provided in FederationModule. Co-Authored-By: Claude Opus 4.6 <[email protected]>