Implement comprehensive API rate limiting with configurable tiers and Redis persistence

[nanaf6203-bit]

Problem

The RateLimitGuard and RateLimitService have gaps: user tiers default to free with no way to configure different limits, JWT payload doesn't include a tier field, IP-based rate limiting uses in-memory storage only (no Redis), GraphQL endpoints not rate-limited.

Why It Matters

Without effective rate limiting, API endpoints are vulnerable to abuse and DoS attacks.

Expected Outcome

Configurable, persistent, tier-based rate limiting that survives restarts.

Acceptance Criteria

• User tiers (free, pro, enterprise) with configurable limits
• Tier field added to JWT payload and AuthUserPayload type
• Redis-backed rate limit counters
• Rate limit headers consistently set
• GraphQL rate limiting (complexity-based)

Files Affected

src/auth/rate-limit.service.ts, src/auth/rate-limit.config.ts, src/auth/guards/rate-limit.guard.ts, src/auth/types/auth-user.type.ts

Difficulty

Medium

Estimated Effort

Medium (1 week)

Labels

rate-limiting, security, enhancement

[IamHarrie-Labs]

@IamHarrie-Labs has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hey Fren!

I'd love to take on this issue. I've reviewed the requirements and have a clear approach for the implementation. I can complete the changes, add the necessary tests, and ensure everything meets the acceptance criteria.

I estimate I can have a PR ready within about 2 hours of being assigned.
Kindly assign this to me. Thanks!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @IamHarrie-Labs to this issue.

[rilwanubala]

@rilwanubala has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

hi how are you doing please allow me to work this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @rilwanubala to this issue.

[vincentchimene]

@vincentchimene has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi! I’d like to contribute to #894 – Implement comprehensive API rate limiting with configurable tiers and Redis persistence. I have experience building backend services with a focus on API security, authentication flows, and scalable infrastructure.

I can enhance the existing rate-limiting system by introducing configurable user tiers (free, pro, enterprise), extending JWT and auth payloads to include tier information, and migrating rate-limit counters from in-memory storage to Redis for persistence across instances and restarts. I’ll also ensure consistent rate-limit headers, integrate protection for GraphQL endpoints using complexity-based controls, and add tests covering tier rules, persistence, and enforcement behavior.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @vincentchimene to this issue.

[abdoolyaro]

@abdoolyaro has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I’d like to take this issue. I can implement configurable tier-based rate limiting (free, pro, enterprise), add tier information to the JWT payload and auth types, migrate rate limit counters to Redis for persistence, apply consistent rate limit headers across the API (including GraphQL), and add tests to verify the new behavior.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @abdoolyaro to this issue.

[drips-wave]

Congratulations, @abdoolyaro! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @abdoolyaro: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊