feat: implement tiered rate limiting with admin bypass

Update rate limiting to be more lenient for authenticated users and bypass limits entirely for admin users:

- Unauthenticated users: 100 requests/minute (original limit)
- Authenticated users: 500 requests/minute (5x increase)
- Admin users: No rate limits (completely bypassed via allowList)

This allows the admin to interact with the library without restrictions whilst still protecting against abuse from unauthenticated users. Authenticated users get a much more generous limit for better user experience.

Uses @fastify/rate-limit's allowList and dynamic max options to implement the tiered system.

CLAUDE.md

@@ -0,0 +1,299 @@
+# Library Project - Claude Instructions
+
+This is a personal media library tracking application built with an Nx monorepo structure. It tracks games, books, music, art, shows, and manga with user profiles, comments, achievements, and social features.
+
+## Git Commit Guidelines
+
+**CRITICAL**: When working on this project:
+- **Always commit as Hikari** using: `--author="Hikari <hikari@nhcarrigan.com>" --no-gpg-sign`
+- **Always ask permission before creating commits** - Never commit without explicit user approval
+- **Never modify git config** - Always use CLI flags for author information
+
+## User Permissions
+
+This is **Naomi's personal library**:
+- **Admin (Naomi only)** - Can create, update, and delete all media items (games, books, music, art, shows, manga)
+- **Regular users** - Can only:
+  - Like items
+  - Comment on items (with markdown support)
+  - Submit suggestions for new items (requires admin approval)
+  - Customise their own profile
+
+All CRUD operations on media items are **admin-only**. Regular users interact through the social features (likes, comments, suggestions).
+
+## Project Structure
+
+This is an **Nx monorepo** containing:
+- **`api/`** - Fastify backend API with Prisma ORM
+- **`apps/frontend/`** - Angular frontend application
+- **`shared-types/`** - Shared TypeScript types between frontend and backend
+- **`libs/`** - Shared libraries
+
+## Technology Stack
+
+### Backend (api/)
+- **Runtime**: Node.js v24
+- **Framework**: Fastify 5.x with plugins:
+  - `@fastify/autoload` - Auto-loads routes and plugins
+  - `@fastify/jwt` - JWT authentication
+  - `@fastify/oauth2` - Discord OAuth integration
+  - `@fastify/helmet` - Security headers
+  - `@fastify/cors` - CORS configuration
+  - `@fastify/csrf-protection` - CSRF protection
+  - `@fastify/rate-limit` - Rate limiting
+  - `@fastify/cookie` - Cookie handling
+  - `@fastify/static` - Static file serving
+- **Database**: MongoDB with Prisma ORM
+- **Logging**: `@nhcarrigan/logger` (custom logger package)
+- **Markdown**: `marked` for parsing, `dompurify` + `jsdom` for sanitisation
+
+### Frontend (apps/frontend/)
+- **Framework**: Angular 21.x
+- **Icons**: FontAwesome (solid + brands)
+- **Styling**: Angular's built-in styling system
+
+### Development Tools
+- **Package Manager**: pnpm v10
+- **Monorepo**: Nx 22.x
+- **Linting**: ESLint 9 (flat config) with `@nhcarrigan/eslint-config`
+- **Testing**: Jest 30.x
+- **Build**: esbuild (backend), Angular CLI (frontend)
+- **Secrets**: 1Password CLI (`op run`)
+
+## Database Schema
+
+The Prisma schema (`api/prisma/schema.prisma`) defines these models:
+- **Game** - Video game tracking with platform, status, rating, cover image, tags, series
+- **Book** - Book tracking with author, ISBN, status, rating, cover image, tags, series
+- **Music** - Music tracking (album/single/EP) with artist, status, rating, cover art, tags
+- **Art** - Art collection with artist, description, image, tags
+- **Show** - TV/anime/film tracking with type, status, rating, cover image, tags
+- **Manga** - Manga tracking with author, status, rating, cover image, tags
+- **User** - User profiles with Discord auth, slug, bio, badges, achievements, social links
+- **Comment** - Comments on any media type with markdown support
+- **AuditLog** - Security and action logging
+- **Suggestion** - User-submitted content suggestions
+- **Like** - User likes on media items
+- **RefreshToken** - JWT refresh token storage
+- **ProfileReport** - User profile reporting system
+- **CommentReport** - Comment reporting system
+- **UserAchievement** - Achievement tracking with progress
+
+All models use MongoDB ObjectIds and include timestamps (`createdAt`, `updatedAt`).
+
+## Authentication Flow
+
+The application uses **Discord OAuth** for authentication:
+1. User clicks "Login with Discord"
+2. OAuth flow redirects to Discord for authorisation
+3. Discord redirects back with authorisation code
+4. Backend exchanges code for Discord user info
+5. Backend creates/updates User record
+6. Backend issues JWT access token (15m expiry) and refresh token (7d expiry)
+7. Frontend stores tokens in cookies
+8. Access token in `Authorization` header for API requests
+9. Refresh token used to obtain new access tokens
+
+See `api/AUTH_FLOW.md` for detailed authentication implementation.
+
+## Image Upload Handling
+
+The application supports **two methods** for cover images:
+1. **Regular URLs** - Standard image URLs (max 2048 characters)
+2. **Base64 Data URLs** - Inline base64-encoded images (max 5MB decoded size)
+
+### Base64 Upload Constraints
+- **Fastify body limit**: 10MB (accommodates base64 overhead)
+- **Validation**: Data URLs must match format `data:image/(jpeg|png|gif|webp|svg+xml);base64,[base64data]`
+- **Size calculation**: Base64 data is extracted and decoded size calculated as `base64Data.length * 0.75`
+- **Size limit**: Decoded image must be under 5MB
+
+### Implementation Notes
+- Base64 size check happens AFTER format validation
+- Regular URL length check (2048 chars) does NOT apply to data URLs
+- Validation logic is in `api/src/app/services/*.service.ts` files
+- Base64 validation helpers in `api/src/app/utils/validation.ts`
+
+## Development Workflow
+
+### Local Development
+```bash
+pnpm dev  # Builds all projects and starts API with dev.env secrets
+```
+
+The `dev` script:
+1. Runs `nx run-many --target=build --all` to build all projects
+2. Uses `op run --env-file=dev.env` to inject secrets from 1Password
+3. Starts the API with `NODE_ENV=production node dist/api/main.js`
+4. API serves the frontend as static files from `dist/apps/frontend/browser`
+
+### Separate Frontend/Backend Development
+```bash
+pnpm start:frontend:dev  # nx serve frontend (port 4200)
+pnpm start:api:dev       # nx serve api (port 3000, watch mode)
+```
+
+### Building for Production
+```bash
+pnpm build  # Generates Prisma client, then builds all projects
+```
+
+### Database Management
+```bash
+pnpm db:gen   # Generate Prisma client
+pnpm db:push  # Push schema changes to MongoDB (uses prod.env secrets)
+```
+
+### Linting & Testing
+```bash
+pnpm lint  # Lints all projects with ESLint
+pnpm test  # Runs all tests with Jest
+```
+
+## CI/CD Pipeline
+
+The project uses **Gitea Actions** (`.gitea/workflows/ci.yml`):
+
+1. **Dependency Pin Check** - Ensures all dependencies are pinned (no `^` or `~`)
+2. **Install Dependencies** - `pnpm install`
+3. **Lint** - `pnpm run lint`
+4. **Build** - `pnpm run build`
+5. **Test** - `pnpm run test`
+
+CI runs on:
+- Pushes to `main` branch
+- Pull requests to `main` branch
+
+## Configuration Standards
+
+### TypeScript
+- Uses `@nhcarrigan/typescript-config` as base
+- Separate configs for app code (`tsconfig.app.json`) and tests (`tsconfig.spec.json`)
+- Output directory: `dist/` for builds
+
+### ESLint
+- Uses `@nhcarrigan/eslint-config` (ESLint 9 flat config)
+- **No Prettier** - all style rules handled by ESLint
+- Configured in `eslint.config.mjs`
+- Angular-specific rules enabled for frontend
+
+### Testing
+- Jest 30.x with `ts-jest` for TypeScript support
+- Separate jest configs per project (e.g., `api/jest.config.cts`)
+- Cypress for e2e testing (frontend-e2e project)
+
+## Secrets Management
+
+### Environment Files
+- **`dev.env`** - Development secrets (1Password vault references)
+- **`prod.env`** - Production secrets (1Password vault references)
+
+These files contain **ONLY** 1Password references (e.g., `op://vault/item/field`), NOT actual secrets. They are safe to commit.
+
+### Non-Secret Configuration
+Configuration that isn't sensitive (URLs, intervals, feature flags) should be in code (e.g., constants files), NOT in `.env` files.
+
+### Running with Secrets
+Always use 1Password CLI:
+```bash
+op run --env-file=dev.env -- <command>
+op run --env-file=prod.env -- <command>
+```
+
+## Security Features
+
+The application implements multiple security layers:
+- **Helmet** - Security headers (CSP, HSTS, etc.)
+- **CORS** - Configured origin restrictions
+- **CSRF Protection** - Token-based CSRF validation
+- **Rate Limiting** - Request rate limits per IP
+- **JWT** - Short-lived access tokens with refresh token rotation
+- **Audit Logging** - All security events logged to AuditLog model
+- **Content Sanitisation** - Markdown comments sanitised with DOMPurify
+- **Input Validation** - All inputs validated before database operations
+
+## API Routes Structure
+
+Routes are auto-loaded via `@fastify/autoload` from `api/src/app/routes/`:
+- Each route file exports Fastify route handlers
+- Routes follow REST conventions (GET, POST, PUT, DELETE)
+- All routes require JWT authentication (except auth endpoints)
+- Route handlers call service functions for business logic
+
+Example structure:
+- `api/src/app/routes/games/index.ts` - Game CRUD endpoints
+- `api/src/app/services/game.service.ts` - Game business logic
+
+## Code Style Conventions
+
+### General
+- Use **clear, descriptive variable/function names**
+- Prefer **self-documenting code** over comments
+- Only use comments to explain **reasoning** when intent isn't clear
+- Use **British English** spelling (colour, organise, whilst)
+
+### TypeScript
+- Prefer `interface` over `type` for object shapes
+- Use `const` assertions where appropriate
+- Enable strict mode (inherited from `@nhcarrigan/typescript-config`)
+
+### Error Handling
+- Service functions throw `Error` instances with descriptive messages
+- Route handlers wrap service calls in try-catch blocks
+- Return 400 for validation errors with error message
+- Return 500 for unexpected errors (message hidden in production)
+- All errors logged to AuditLog for security events
+
+### Validation
+- Validation utilities in `api/src/app/utils/validation.ts`
+- Constants for max lengths in `shared-types/src/lib/constants.ts`
+- Validate early in service functions before database operations
+
+## Common Gotchas
+
+### Base64 Image Uploads
+- **Body limit must be 10MB** (`api/src/main.ts`) to accommodate base64 overhead
+- Validate data URL format BEFORE size check
+- Extract base64 portion (after comma) for size calculation
+- Don't apply regular URL length validation to data URLs
+
+### Prisma Client Generation
+- Must run `pnpm db:gen` before building if schema changed
+- The build script automatically runs this
+- Prisma client is generated to `api/generated/`
+
+### Nx Cache
+- Nx caches build outputs for faster rebuilds
+- Clear cache with `nx reset` if experiencing issues
+- Cache stored in `.nx/cache/`
+
+### MongoDB ObjectIds
+- All IDs are MongoDB ObjectIds (not UUIDs or auto-increment integers)
+- Use `@db.ObjectId` in Prisma schema
+- Use `String` type in TypeScript for ObjectIds
+
+## Deployment
+
+The application is deployed in production mode:
+```bash
+pnpm build              # Build all projects
+pnpm start              # Start with prod.env secrets
+```
+
+Production start command:
+```bash
+NODE_ENV=production op run --env-file=prod.env -- node dist/api/main.js
+```
+
+The API serves the built frontend as static files, so only the API process needs to run in production.
+
+## Important Notes
+
+- This is a **personal project** for Naomi's media tracking
+- Uses **Discord OAuth** for authentication (no other auth methods)
+- **MongoDB** is the only supported database (Prisma schema is MongoDB-specific)
+- All **timestamps** are stored as UTC in the database
+- **Achievements system** tracks user activity and unlocks (see UserAchievement model)
+- **Comments support markdown** with sanitisation
+- **User profiles** support custom slugs, bios, and social links
+- **Reporting system** for profiles and comments with moderation workflow

api/src/app/plugins/rate-limit.ts

@@ -12,8 +12,27 @@ import { AuditAction, AuditCategory } from "@library/shared-types";
 
 const rateLimitPlugin: FastifyPluginAsync = async (app) => {
   await app.register(fastifyRateLimit, {
-    max: 100,
+    max: async (request) => {
+      // Try to get user from JWT
+      try {
+        await request.jwtVerify();
+        // Authenticated users get higher limits
+        return 500;
+      } catch {
+        // Unauthenticated users get lower limits
+        return 100;
+      }
+    },
     timeWindow: "1 minute",
+    allowList: async (request) => {
+      // Bypass rate limiting entirely for admin users
+      try {
+        await request.jwtVerify();
+        return request.user?.isAdmin === true;
+      } catch {
+        return false;
+      }
+    },
     errorResponseBuilder: (request) => {
       // Log rate limit exceeded event
       AuditService.log({

api/src/app/routes/games/index.ts

@@ -41,13 +41,14 @@ const gamesRoutes: FastifyPluginAsync = async (app) => {
   );
 
   // Create game (protected admin route)
-  app.post<{ Body: CreateGameDto; Reply: Game }>(
+  app.post<{ Body: CreateGameDto; Reply: Game | { error: string } }>(
     "/",
     {
       preValidation: [app.authenticate, adminGuard],
       preHandler: [app.csrfProtection],
     },
-    async (request) => {
+    async (request, reply) => {
+      try {
         const game = await gameService.createGame(request.body);
         await AuditService.logFromRequest(request, {
           action: AuditAction.entryCreate,
@@ -57,6 +58,12 @@ const gamesRoutes: FastifyPluginAsync = async (app) => {
           details: `Created game: ${game.title}`,
         });
         return game;
+      } catch (error) {
+        if (error instanceof Error) {
+          return reply.code(400).send({ error: error.message });
+        }
+        throw error;
+      }
     }
   );
 
@@ -64,14 +71,15 @@ const gamesRoutes: FastifyPluginAsync = async (app) => {
   app.put<{
     Params: { id: string };
     Body: UpdateGameDto;
-    Reply: Game | null;
+    Reply: Game | null | { error: string };
   }>(
     "/:id",
     {
       preValidation: [app.authenticate, adminGuard],
       preHandler: [app.csrfProtection],
     },
-    async (request) => {
+    async (request, reply) => {
+      try {
         const { id } = request.params;
         const game = await gameService.updateGame(id, request.body);
         if (game) {
@@ -84,6 +92,12 @@ const gamesRoutes: FastifyPluginAsync = async (app) => {
           });
         }
         return game;
+      } catch (error) {
+        if (error instanceof Error) {
+          return reply.code(400).send({ error: error.message });
+        }
+        throw error;
+      }
     }
   );
 

api/src/app/services/book.service.ts

@@ -10,6 +10,7 @@ import {
   validateUrl,
   validateRating,
   validateStringLength,
+  validateDataUrl,
   MAX_LENGTHS,
 } from "../utils/validation";
 
@@ -44,10 +45,24 @@ export class BookService {
       throw new Error("Rating must be an integer between 0 and 10.");
     }
 
-    // Validate cover image URL
-    if (data.coverImage && !validateUrl(data.coverImage)) {
+    if (data.coverImage) {
+      if (data.coverImage.startsWith("data:")) {
+        const sizeInBytes = data.coverImage.length * 0.75;
+        if (sizeInBytes > MAX_LENGTHS.DATA_URL) {
+          throw new Error("Cover image must be under 5MB.");
+        }
+        if (!validateDataUrl(data.coverImage)) {
+          throw new Error("Invalid image data URL.");
+        }
+      } else {
+        if (!validateStringLength(data.coverImage, MAX_LENGTHS.URL)) {
+          throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
+        }
+        if (!validateUrl(data.coverImage)) {
           throw new Error("Invalid cover image URL. Only http and https URLs are allowed.");
         }
+      }
+    }
 
     // Validate tags
     if (data.tags) {

api/src/app/services/game.service.ts

@@ -10,6 +10,7 @@ import {
   validateUrl,
   validateRating,
   validateStringLength,
+  validateDataUrl,
   MAX_LENGTHS,
 } from "../utils/validation";
 
@@ -32,9 +33,6 @@ export class GameService {
     if (!validateStringLength(data.notes, MAX_LENGTHS.NOTES)) {
       throw new Error(`Notes must be ${MAX_LENGTHS.NOTES} characters or less.`);
     }
-    if (!validateStringLength(data.coverImage, MAX_LENGTHS.URL)) {
-      throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
-    }
 
     // Validate rating
     if (!validateRating(data.rating)) {
@@ -42,9 +40,30 @@ export class GameService {
     }
 
     // Validate cover image URL
-    if (data.coverImage && !validateUrl(data.coverImage)) {
+    if (data.coverImage) {
+      if (data.coverImage.startsWith("data:")) {
+        // Extract just the base64 data (after the comma)
+        const base64Data = data.coverImage.split(",")[1];
+        if (!base64Data) {
+          throw new Error("Invalid image data URL format.");
+        }
+        // Calculate decoded size: base64 is ~4/3 larger than original, so multiply by 0.75
+        const decodedSizeInBytes = base64Data.length * 0.75;
+        if (decodedSizeInBytes > MAX_LENGTHS.DATA_URL) {
+          throw new Error("Cover image must be under 5MB.");
+        }
+        if (!validateDataUrl(data.coverImage)) {
+          throw new Error("Invalid image data URL.");
+        }
+      } else {
+        if (!validateStringLength(data.coverImage, MAX_LENGTHS.URL)) {
+          throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
+        }
+        if (!validateUrl(data.coverImage)) {
           throw new Error("Invalid cover image URL. Only http and https URLs are allowed.");
         }
+      }
+    }
 
     // Validate tags
     if (data.tags) {

api/src/app/services/manga.service.ts

@@ -10,6 +10,7 @@ import {
   validateUrl,
   validateRating,
   validateStringLength,
+  validateDataUrl,
   MAX_LENGTHS,
 } from "../utils/validation";
 
@@ -42,9 +43,24 @@ export class MangaService {
     }
 
     // Validate cover image URL
-    if (data.coverImage && !validateUrl(data.coverImage)) {
+    if (data.coverImage) {
+      if (data.coverImage.startsWith("data:")) {
+        const sizeInBytes = data.coverImage.length * 0.75;
+        if (sizeInBytes > MAX_LENGTHS.DATA_URL) {
+          throw new Error("Cover image must be under 5MB.");
+        }
+        if (!validateDataUrl(data.coverImage)) {
+          throw new Error("Invalid image data URL.");
+        }
+      } else {
+        if (!validateStringLength(data.coverImage, MAX_LENGTHS.URL)) {
+          throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
+        }
+        if (!validateUrl(data.coverImage)) {
           throw new Error("Invalid cover image URL. Only http and https URLs are allowed.");
         }
+      }
+    }
 
     // Validate tags
     if (data.tags) {

api/src/app/services/music.service.ts

@@ -10,6 +10,7 @@ import {
   validateUrl,
   validateRating,
   validateStringLength,
+  validateDataUrl,
   MAX_LENGTHS,
 } from "../utils/validation";
 
@@ -42,8 +43,23 @@ export class MusicService {
     }
 
     // Validate cover art URL
-    if (data.coverArt && !validateUrl(data.coverArt)) {
-      throw new Error("Invalid cover art URL. Only http and https URLs are allowed.");
+    if (data.coverArt) {
+      if (data.coverArt.startsWith("data:")) {
+        const sizeInBytes = data.coverArt.length * 0.75;
+        if (sizeInBytes > MAX_LENGTHS.DATA_URL) {
+          throw new Error("Cover image must be under 5MB.");
+        }
+        if (!validateDataUrl(data.coverArt)) {
+          throw new Error("Invalid image data URL.");
+        }
+      } else {
+        if (!validateStringLength(data.coverArt, MAX_LENGTHS.URL)) {
+          throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
+        }
+        if (!validateUrl(data.coverArt)) {
+          throw new Error("Invalid cover image URL. Only http and https URLs are allowed.");
+        }
+      }
     }
 
     // Validate tags

api/src/app/services/show.service.ts

@@ -10,6 +10,7 @@ import {
   validateUrl,
   validateRating,
   validateStringLength,
+  validateDataUrl,
   MAX_LENGTHS,
 } from "../utils/validation";
 
@@ -39,9 +40,24 @@ export class ShowService {
     }
 
     // Validate cover image URL
-    if (data.coverImage && !validateUrl(data.coverImage)) {
+    if (data.coverImage) {
+      if (data.coverImage.startsWith("data:")) {
+        const sizeInBytes = data.coverImage.length * 0.75;
+        if (sizeInBytes > MAX_LENGTHS.DATA_URL) {
+          throw new Error("Cover image must be under 5MB.");
+        }
+        if (!validateDataUrl(data.coverImage)) {
+          throw new Error("Invalid image data URL.");
+        }
+      } else {
+        if (!validateStringLength(data.coverImage, MAX_LENGTHS.URL)) {
+          throw new Error(`Cover image URL must be ${MAX_LENGTHS.URL} characters or less.`);
+        }
+        if (!validateUrl(data.coverImage)) {
           throw new Error("Invalid cover image URL. Only http and https URLs are allowed.");
         }
+      }
+    }
 
     // Validate tags
     if (data.tags) {

api/src/app/utils/validation.ts

@@ -4,6 +4,14 @@
  * @author Naomi Carrigan
  */
 
+/**
+ * Validates that a URL is a proper base64 data string.
+ * Allows whitespace in the base64 data which may occur during transmission.
+ */
+export function validateDataUrl(url: string): boolean {
+  return /^data:image\/(jpeg|png|gif|webp|svg\+xml);base64,[A-Za-z0-9+/=\s]+$/.test(url);
+}
+
 /**
  * Validates that a URL is safe and points to an allowed protocol.
  * Prevents javascript:, data:, vbscript:, and file: URLs.
@@ -83,4 +91,5 @@ export const MAX_LENGTHS = {
   NOTES: 5000,
   TAGS: 50, // per tag
   ISBN: 50,
+  DATA_URL: 5 * 1024 * 1024, // 5MB in bytes (not chars)
 } as const;

api/src/main.ts

@@ -40,7 +40,7 @@ process.on('SIGINT', () => {
 // Instantiate Fastify with some config
 const server = Fastify({
   logger: true,
-  bodyLimit: 1048576, // 1MB max body size
+  bodyLimit: 10485760, // 10MB max body size (to accommodate base64-encoded images)
 });
 
 // Register your application as a normal plugin.