Merge branch 'dev' into reschedule

apps/edr-passenger-api/src/app.module.ts

@@ -3,6 +3,7 @@ import { APP_FILTER } from "@nestjs/core";
 import { ConfigModule, ConfigService } from "@nestjs/config";
 import { ScheduleModule } from "@nestjs/schedule";
 import { EventEmitterModule } from "@nestjs/event-emitter";
+import { ThrottlerModule } from "@nestjs/throttler";
 import { TypeOrmModule, TypeOrmModuleOptions } from "@nestjs/typeorm";
 import { IamBaselineSeeder, IamSeedModule } from "@edr/iam-seed";
 import { IamModule as TriaIamModule } from "@tria-plc/iamapi-common/iam.module";
@@ -83,6 +84,17 @@ import { RescheduleModule } from './modules/reschedule/reschedule.module';
     }),
     ScheduleModule.forRoot(),
     EventEmitterModule.forRoot(),
+    // Named tiers only — no APP_GUARD is registered, so nothing is throttled until a
+    // controller opts in with @UseGuards(ThrottlerGuard). AuthController is currently the
+    // only one that does, because the staged sign-in exposes an account-existence lookup.
+    ThrottlerModule.forRoot([
+      // 20/min, not the 5/min the commented-out decorators suggested: the staged sign-in
+      // legitimately costs 3-5 calls (lookup → request code → resend → complete → a retry
+      // after a typo), and the throttler keys on IP, so users sharing a NAT or mobile CGNAT
+      // address share the budget. 5 would lock real passengers out.
+      { name: "auth", limit: 20, ttl: 60_000 },
+      { name: "strict", limit: 20, ttl: 60_000 },
+    ]),
     TypeOrmModule.forRootAsync({
       inject: [ConfigService],
       useFactory: (config: ConfigService): TypeOrmModuleOptions =>
@@ -98,8 +110,11 @@ import { RescheduleModule } from './modules/reschedule/reschedule.module';
           `Your EDR Passenger phone verification code is ${otp}. It will expire in 5 minutes.`,
         [EOtpType.RESET_PASSWORD]: ({ route }) =>
           `Reset your EDR Passenger password using this link: ${route}`,
-        [EOtpType.SET_PASSWORD]: ({ route }) =>
-          `Set your EDR Passenger password using this link: ${route}`,
+        // Carries the bare code as well as the link: the staged sign-in asks for the code
+        // inline, while the link is still what a `/set-password` deep link from an older SMS
+        // relies on. `OtpMessageContext` supplies both.
+        [EOtpType.SET_PASSWORD]: ({ otp, route }) =>
+          `Your EDR Passenger code is ${otp}. Or set your password here: ${route}`,
       },
     }),
     // Replaces the package's DataSeeder. Shared with edr-freight-api, which