Not so
fast.

export function callerKey(req: Request, action: string): string {
  const user = req.user as { id: string } | undefined; // set by your auth guard
  if (user) return `rl:${action}:user:${user.id}`;    // after login: the badge
  return `rl:${action}:ip:${req.ip}`;                  // before login: the gate
}

const app = await NestFactory.create<NestExpressApplication>(AppModule);
app.set('trust proxy', 1); // one load balancer in front of us
await app.listen(3000);

@Module({
  imports: [
    ThrottlerModule.forRoot([
      { name: 'short', ttl: 1_000, limit: 3 },   // 3 calls per second
      { name: 'long', ttl: 60_000, limit: 100 }, // 100 calls per minute
    ]),
  ],
  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
})
export class AppModule {}

@Controller('auth')
export class AuthController {
  @Post('otp')
  @Throttle({ short: { limit: 1, ttl: 1_000 }, long: { limit: 3, ttl: 600_000 } })
  sendOtp(@Body() dto: SendOtpDto) {
    return this.otp.send(dto.phone);
  }

  @Get('health')
  @SkipThrottle() // load balancers ping this every few seconds
  health() {
    return 'ok';
  }
}

@Injectable()
export class CallerThrottlerGuard extends ThrottlerGuard {
  protected async getTracker(req: Record<string, any>): Promise<string> {
    return req.user?.id ? `user:${req.user.id}` : `ip:${req.ip}`;
  }
}

ThrottlerModule.forRootAsync({
  inject: [ConfigService],
  useFactory: (config: ConfigService) => ({
    throttlers: [{ ttl: 60_000, limit: 100 }],
    storage: new ThrottlerStorageRedisService(new Redis(config.get('REDIS_URL'))),
  }),
}),

export async function hitLimit(redis: Redis, key: string, limit: number, windowSec: number) {
  const res = await redis.multi().incr(key).expire(key, windowSec, 'NX').exec();
  const count = Number(res?.[0]?.[1]);
  if (count <= limit) return { allowed: true, retryAfter: 0 };
  return { allowed: false, retryAfter: await redis.ttl(key) };
}

// true only for the first caller inside the time given
export async function claimOnce(redis: Redis, key: string, seconds: number) {
  return (await redis.set(key, '1', 'EX', seconds, 'NX')) === 'OK';
}

export function tooMany(retryAfter: number, message = 'Too many requests') {
  return new HttpException({ message, retryAfter }, HttpStatus.TOO_MANY_REQUESTS);
}

async send(phone: string, ip: string) {
  if (!(await claimOnce(this.redis, `otp:cool:${phone}`, 60))) throw tooMany(60);

  const byPhone = await hitLimit(this.redis, `otp:phone:${phone}`, 3, 600);
  if (!byPhone.allowed) throw tooMany(byPhone.retryAfter);

  const byIp = await hitLimit(this.redis, `otp:ip:${ip}`, 20, 3600);
  if (!byIp.allowed) throw tooMany(byIp.retryAfter);

  const code = randomInt(100_000, 1_000_000).toString();
  // store a hash of the code, never the code itself
  await this.redis.set(`otp:code:${phone}`, sha256(code), 'EX', 300);
  await this.sms.send(phone, `Your login code is ${code}`);
}

async verify(phone: string, code: string) {
  const tries = await hitLimit(this.redis, `otp:try:${phone}`, 5, 300);
  if (!tries.allowed) {
    await this.redis.del(`otp:code:${phone}`); // burn the code
    throw tooMany(0, 'Too many wrong codes. Ask for a new one.');
  }
  if ((await this.redis.get(`otp:code:${phone}`)) !== sha256(code)) {
    throw new UnauthorizedException('Wrong code');
  }
  await this.redis.del(`otp:code:${phone}`, `otp:try:${phone}`); // success clears both
}

export const emailWorker = new Worker('email', (job) => mailer.send(job.data), {
  connection,
  limiter: { max: 10, duration: 1_000 }, // the provider accepts 10 emails per second
});

async requestReset(email: string) {
  const r = await hitLimit(this.redis, `rl:reset:${email}`, 3, 3600); // user rule
  if (!r.allowed) throw tooMany(r.retryAfter);

  await this.emailQueue.add('reset', { to: email }, {
    attempts: 5,
    backoff: { type: 'exponential', delay: 2_000 }, // provider busy? retry later
  });
}

async pay(userId: string, dto: PayDto) {
  const key = `rl:pay:user:${userId}`;
  const r = await hitLimit(this.redis, key, 3, 60);
  if (!r.allowed) throw tooMany(r.retryAfter);

  try {
    return await this.gateway.charge(dto);
  } catch (err) {
    // a timeout or 5xx is not the user's fault, so give the attempt back
    if (isServerSideFailure(err)) await this.redis.decr(key);
    throw err;
  }
}

async login(email: string, password: string) {
  const key = `rl:login:fail:${email}`;
  if (Number(await this.redis.get(key)) >= 5) throw tooMany(await this.redis.ttl(key));

  const user = await this.users.checkPassword(email, password);
  if (!user) {
    await hitLimit(this.redis, key, 5, 900); // one more mistake, window of 15 minutes
    throw new UnauthorizedException('Wrong email or password');
  }
  await this.redis.del(key); // a correct login wipes the slate
  return this.tokens.issue(user);
}

@Post('payments')
async create(
  @Req() req: Request,
  @Body() dto: PayDto,
  @Headers('idempotency-key') idemKey: string,
) {
  const firstTime = await claimOnce(this.redis, `idem:${idemKey}`, 86_400);
  // a retry: no new count, no new charge
  if (!firstTime) return this.payments.findByIdemKey(idemKey);
  return this.payments.pay(req.user.id, { ...dto, idemKey });
}

async transfer(userId: string, dto: TransferDto) {
  return this.db.transaction(async (tx) => {
    const used = await tx.query(
      `UPDATE wallets SET free_transfers = free_transfers - 1
        WHERE user_id = $1 AND free_transfers > 0`, [userId]);
    if (used.rowCount === 0) throw new HttpException('No free transfers left', 402);

    // if this insert fails, the decrement above rolls back with it
    return tx.query(
      `INSERT INTO transfers (user_id, amount, to_account) VALUES ($1, $2, $3)`,
      [userId, dto.amount, dto.toAccount],
    );
  });
}

@Injectable()
export class QuotaResetJob {
  constructor(private readonly db: Db, private readonly redis: Redis) {}

  @Cron('0 0 1 * *', { timeZone: 'Asia/Kolkata' }) // midnight on the 1st, Indian time
  async resetMonthlyExports() {
    const gotLock = await claimOnce(this.redis, 'lock:quota-reset', 300);
    if (!gotLock) return; // another instance is already doing it
    await this.db.query(`UPDATE plans SET exports_used = 0`);
  }
}

-- count one export; start from 1 again if a new month has begun
UPDATE plans
   SET exports_used = CASE WHEN period_start < date_trunc('month', now())
                           THEN 1 ELSE exports_used + 1 END,
       period_start = date_trunc('month', now())
 WHERE user_id = $1
   AND (period_start < date_trunc('month', now()) OR exports_used < export_limit)
RETURNING exports_used; -- no row back: limit reached

await queue.upsertJobScheduler('reset-daily-sms', {
  pattern: '0 0 * * *', // every midnight
  tz: 'Asia/Kolkata',
});