feat: prepare six-lesson trial backend with reliable rewards and operations

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/auth.controller.ts

@@ -1,5 +1,8 @@
-import { Body, Controller, HttpCode, Inject, Post, forwardRef } from '@nestjs/common'
+import { Body, Controller, HttpCode, Inject, Post, Req, forwardRef } from '@nestjs/common'
+import type { FastifyRequest } from 'fastify'
 import { Public } from '../common/decorators/public.decorator'
+import { getClientIp } from '../common/http/client-ip'
+import { assertAuthRateLimit } from '../common/rate-limit/auth-rate-limit'
 import { strictBodyPipe } from '../common/pipes/strict-body.pipe'
 import { AuthService } from './auth.service'
 import { LoginDto } from './dto/login.dto'
@@ -12,14 +15,16 @@ export class AuthController {
   @Public()
   @HttpCode(200)
   @Post('register')
-  register(@Body(strictBodyPipe(RegisterDto)) dto: RegisterDto) {
+  register(@Req() req: FastifyRequest, @Body(strictBodyPipe(RegisterDto)) dto: RegisterDto) {
+    assertAuthRateLimit(getClientIp(req))
     return this.auth.register(dto.username, dto.password, dto.name)
   }
 
   @Public()
   @HttpCode(200)
   @Post('login')
-  login(@Body(strictBodyPipe(LoginDto)) dto: LoginDto) {
+  login(@Req() req: FastifyRequest, @Body(strictBodyPipe(LoginDto)) dto: LoginDto) {
+    assertAuthRateLimit(getClientIp(req))
     return this.auth.login(dto.username, dto.password)
   }
 }