[Petrelid]

What

Closes #992: CONTRIBUTING and ARCHITECTURE

• CONTRIBUTING.md: npm run type-check is now npm run typecheck.
• ARCHITECTURE.md: all three RateLimitGuard mentions (the diagram, the request lifecycle and the security table) now say ThrottlerGuard. They note that it uses Redis storage when REDIS_URL is set and memory otherwise, matching buildThrottlerOptions in src/app.module.ts.

Closes #993: SPECIFICATION route map

• I checked every row against the @Throttle decorators in the controllers. The route map now matches the code, including buyer-contact going from 5 to 10.
• /stress-test/active/{id} is now /stress-test/active/:testId.
• I added a short note above the table explaining routes with no @Throttle (they get the default of 60/min), what — means (exempt), and which limits can be changed through environment variables.
• I found 23 wrong limits, not the 24 the issue states. You may want to recount before the PR claims a number.

Closes #994: CHANGELOG

• I added seven entries under [Unreleased] → Changed, six marked Breaking:
  • FRONTEND_URL and EVIDENCE_STORAGE_BASE_URL required in production
  • SENDGRID_FROM_EMAIL required with a SendGrid key
  • the six SENDGRID_TEMPLATE_* ids
  • TWILIO_FROM_NUMBER required with a Twilio SID
  • Redis rate-limit storage (not marked Breaking)
  • per-route limits now enforced
  • the stellar-sdk 17 upgrade, which needs Node 22.12 or later
• The wording comes from the validation rules in src/config/config.schema.ts.

Closes #996: 429 and 500 responses

• sep10.controller.ts: added 429 and 500 once at the class level, next to the class-level @Throttle, so all four /auth routes get them.
• app.controller.ts: added 429 and 500 to GET / and GET /version.
• stellar-webhook.controller.ts: added 500 only. The issue says this route is rate limited, but it has @SkipThrottle() (from The Stellar webhook is rate limited #923), so a 429 can't happen there. Adding one would make the docs wrong again.

Testing

• To run anything I had to install the dependencies (npm ci) and generate the Prisma client, using the test DATABASE_URL because none was set.
• Lint passes on the three changed controllers.
• The tests for those three controllers pass: 37 of 37.
• npm run typecheck reports 8 errors, in update-vendor-profile.dto.ts and admin-stats.service.ts. The clean dev branch has the same 8.
• 8 unit test suites fail, and they fail the same way on clean dev. They appear to need Postgres, which isn't running on this machine.
• The four Markdown files already failed prettier --check before my edits, so I didn't reformat them.

[drips-wave]

@Petrelid Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits