feat(auth): add support for internal service-to-service request handling in throttler

backend/src/app.module.ts

@@ -4,6 +4,7 @@ import { ScheduleModule } from '@nestjs/schedule';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { AICoreModule } from './ai-core/ai-core.module.js';
 import { AppController } from './app.controller.js';
+import { IRequestWithCognitoInfo } from './authorization/cognito-decoded.interface.js';
 import { GlobalDatabaseContext } from './common/application/global-database-context.js';
 import { BaseType, UseCaseType } from './common/data-injection.tokens.js';
 import { AIModule } from './entities/ai/ai.module.js';
@@ -65,6 +66,14 @@ import { GetHelloUseCase } from './use-cases-app/get-hello.use.case.js';
 					limit: 200,
 				},
 			],
+			// Skip rate limiting for internal service-to-service calls: they are
+			// gated by SaaSAuthMiddleware (microservice JWT), which flags the request.
+			// All such calls share the satellites' IPs, so a per-IP limit would
+			// throttle them collectively; auth already bounds who can make them.
+			skipIf: (context) => {
+				const req = context.switchToHttp().getRequest<IRequestWithCognitoInfo>();
+				return req.isMicroserviceRequest === true;
+			},
 		}),
 		CedarAuthorizationModule,
 		AICoreModule,

backend/src/authorization/cognito-decoded.interface.ts

@@ -29,4 +29,10 @@ export interface IRequestWithCognitoInfo extends Omit<Request, 'query' | 'params
 	query: Record<string, string | undefined>;
 	params: Record<string, string | undefined>;
 	decoded: Partial<ICognitoDecodedData>;
+	/**
+	 * Set by `SaaSAuthMiddleware` once a request has passed microservice-JWT auth.
+	 * The global throttler's `skipIf` reads this to exempt internal service-to-service
+	 * calls from rate limiting (they all originate from the same satellite IPs).
+	 */
+	isMicroserviceRequest?: boolean;
 }

backend/src/authorization/saas-auth.middleware.ts

@@ -27,6 +27,9 @@ export class SaaSAuthMiddleware implements NestMiddleware {
 			}
 
 			req.decoded = data;
+			// Mark the request as an internal service-to-service call so the global
+			// throttler skips it (see ThrottlerModule `skipIf` in app.module).
+			req.isMicroserviceRequest = true;
 			next();
 		} catch (_e) {
 			throw new UnauthorizedException(Messages.AUTHORIZATION_REJECTED);