From 212b15890ef5407ac3f4883be7517151d4307af9 Mon Sep 17 00:00:00 2001
From: Mir Arif Hasan <arif.ishan05@gmail.com>
Date: Mon, 5 Jan 2026 14:02:56 +0600
Subject: [PATCH] chore: apply ThrottlerBehindProxyGuard across controllers
 (#5746)

---
 packages/hoppscotch-backend/src/app.controller.ts    |  4 +++-
 .../src/health/health.controller.ts                  |  4 +++-
 .../src/infra-config/onboarding.controller.ts        | 12 +++++++++++-
 .../src/published-docs/published-docs.controller.ts  |  3 +++
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/packages/hoppscotch-backend/src/app.controller.ts b/packages/hoppscotch-backend/src/app.controller.ts
index 8ce570ea..298e9551 100644
--- a/packages/hoppscotch-backend/src/app.controller.ts
+++ b/packages/hoppscotch-backend/src/app.controller.ts
@@ -1,6 +1,8 @@
-import { Controller, Get } from '@nestjs/common';
+import { Controller, Get, UseGuards } from '@nestjs/common';
+import { ThrottlerBehindProxyGuard } from './guards/throttler-behind-proxy.guard';
 
 @Controller('ping')
+@UseGuards(ThrottlerBehindProxyGuard)
 export class AppController {
   @Get()
   ping(): string {
diff --git a/packages/hoppscotch-backend/src/health/health.controller.ts b/packages/hoppscotch-backend/src/health/health.controller.ts
index 0f632611..3c704f87 100644
--- a/packages/hoppscotch-backend/src/health/health.controller.ts
+++ b/packages/hoppscotch-backend/src/health/health.controller.ts
@@ -1,12 +1,14 @@
-import { Controller, Get } from '@nestjs/common';
+import { Controller, Get, UseGuards } from '@nestjs/common';
 import {
   HealthCheck,
   HealthCheckService,
   PrismaHealthIndicator,
 } from '@nestjs/terminus';
+import { ThrottlerBehindProxyGuard } from 'src/guards/throttler-behind-proxy.guard';
 import { PrismaService } from 'src/prisma/prisma.service';
 
 @Controller('health')
+@UseGuards(ThrottlerBehindProxyGuard)
 export class HealthController {
   constructor(
     private health: HealthCheckService,
diff --git a/packages/hoppscotch-backend/src/infra-config/onboarding.controller.ts b/packages/hoppscotch-backend/src/infra-config/onboarding.controller.ts
index b931ba5f..1741e77d 100644
--- a/packages/hoppscotch-backend/src/infra-config/onboarding.controller.ts
+++ b/packages/hoppscotch-backend/src/infra-config/onboarding.controller.ts
@@ -1,4 +1,12 @@
-import { Body, Controller, Get, HttpStatus, Post, Query } from '@nestjs/common';
+import {
+  Body,
+  Controller,
+  Get,
+  HttpStatus,
+  Post,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
 import { InfraConfigService } from './infra-config.service';
 import { RESTError } from 'src/types/RESTError';
 import { throwHTTPErr } from 'src/utils';
@@ -11,8 +19,10 @@ import {
 } from './dto/onboarding.dto';
 import { ApiCreatedResponse, ApiOkResponse } from '@nestjs/swagger';
 import { plainToInstance } from 'class-transformer';
+import { ThrottlerBehindProxyGuard } from 'src/guards/throttler-behind-proxy.guard';
 
 @Controller({ path: 'onboarding', version: '1' })
+@UseGuards(ThrottlerBehindProxyGuard)
 export class OnboardingController {
   constructor(private infraConfigService: InfraConfigService) {}
 
diff --git a/packages/hoppscotch-backend/src/published-docs/published-docs.controller.ts b/packages/hoppscotch-backend/src/published-docs/published-docs.controller.ts
index d3e6d529..c61e80c0 100644
--- a/packages/hoppscotch-backend/src/published-docs/published-docs.controller.ts
+++ b/packages/hoppscotch-backend/src/published-docs/published-docs.controller.ts
@@ -5,6 +5,7 @@ import {
   Query,
   HttpCode,
   HttpStatus,
+  UseGuards,
 } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiResponse } from '@nestjs/swagger';
 import { PublishedDocsService } from './published-docs.service';
@@ -12,9 +13,11 @@ import { GetPublishedDocsQueryDto } from './published-docs.dto';
 import * as E from 'fp-ts/Either';
 import { throwHTTPErr } from 'src/utils';
 import { PublishedDocs } from './published-docs.model';
+import { ThrottlerBehindProxyGuard } from 'src/guards/throttler-behind-proxy.guard';
 
 @ApiTags('Published Docs')
 @Controller({ version: '1', path: 'published-docs' })
+@UseGuards(ThrottlerBehindProxyGuard)
 export class PublishedDocsController {
   constructor(private readonly publishedDocsService: PublishedDocsService) {}