From db9d2f08c46b6bc5b45bfbedebf65710e59f80ea Mon Sep 17 00:00:00 2001
From: Yggdrasil <yggdrasilworld@users.noreply.github.com>
Date: Wed, 14 Oct 2026 02:57:36 -0400
Subject: [PATCH] fix(api): tighten the public-read routes past the default
 throttler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GET /bounties/:id, /milestones, /milestones/:id, /maintenance-pools and
/maintenance-pools/:id rode the lenient global 'default' throttler (120/min)
while returning whole tables — scrapable. Add explicit @Throttle limits.

Resolves #592
---
 src/bounties/bounties.controller.ts                 | 1 +
 src/maintenance-pool/maintenance-pool.controller.ts | 4 ++++
 src/milestones/milestones.controller.ts             | 1 +
 3 files changed, 6 insertions(+)

diff --git a/src/bounties/bounties.controller.ts b/src/bounties/bounties.controller.ts
index 38ad22e1..7bffa64f 100644
--- a/src/bounties/bounties.controller.ts
+++ b/src/bounties/bounties.controller.ts
@@ -89,6 +89,7 @@ export class BountiesController {
 
   @ApiOperation({ summary: 'Get a bounty by id' })
   @ApiStandardErrorResponses()
+  @Throttle({ long: { limit: 1000, ttl: 3600000 } })
   @Get(':id')
   findOne(@Param('id', new ParseUUIDPipe()) id: string) {
     return this.bountiesService.findOne(id);
diff --git a/src/maintenance-pool/maintenance-pool.controller.ts b/src/maintenance-pool/maintenance-pool.controller.ts
index 0b370c4c..a38b48bd 100644
--- a/src/maintenance-pool/maintenance-pool.controller.ts
+++ b/src/maintenance-pool/maintenance-pool.controller.ts
@@ -81,6 +81,9 @@ export class MaintenancePoolController {
   }
 
   @ApiOperation({ summary: 'List maintenance pools' })
+  // Public read returning the whole table — tighten past the global default
+  // so it can't be scraped at the lenient rate (#592).
+  @Throttle({ long: { limit: 300, ttl: 3600000 } })
   @Get()
   list() {
     return this.poolService.list();
@@ -88,6 +91,7 @@ export class MaintenancePoolController {
 
   @ApiOperation({ summary: 'Get a maintenance pool by id' })
   @ApiStandardErrorResponses()
+  @Throttle({ long: { limit: 1000, ttl: 3600000 } })
   @Get(':id')
   findOne(@Param('id', new ParseUUIDPipe()) id: string) {
     return this.poolService.findOne(id);
diff --git a/src/milestones/milestones.controller.ts b/src/milestones/milestones.controller.ts
index 0aaf9d99..851f7648 100644
--- a/src/milestones/milestones.controller.ts
+++ b/src/milestones/milestones.controller.ts
@@ -76,6 +76,7 @@ export class MilestonesController {
   }
 
   @ApiOperation({ summary: 'Get a milestone by id' })
+  @Throttle({ long: { limit: 1000, ttl: 3600000 } })
   @Get(':id')
   findOne(@Param('id', new ParseUUIDPipe()) id: string) {
     return this.milestonesService.findOne(id);