fix: add rate limiting to POST /auth/resend-otp (#26)

[lvhong0420]

Summary

Fixes #26: Add in-memory rate limiting to POST /auth/resend-otp endpoint.

Problem

The
esendOtpController had no rate limiting, allowing attackers to:

• Infinitely loop calls with a valid email address
• Trigger an OTP email on each request
• Abuse the Resend email sending quota

Solution

• Added Map<string, number> cooldown tracker at module level (
  esendCooldowns)
• Each email address is limited to 1 request per 60 seconds
• Returns HTTP 429 with clear message when limit exceeded
• Lightweight in-memory implementation, no Redis dependency needed

Changes

• File: src/controllers/auth.controller.ts
  • Added const resendCooldowns = new Map<string, number>() after imports (line 21)
  • Added cooldown check + update logic inside
    esendOtpController (lines 69-78)

---

If you need more quick fixes like this, feel free to reach out!

[vercel]

@lvhong0420 is attempting to deploy a commit to the voiceyBill's projects Team on Vercel.

A member of the Team first needs to authorize it.