[B2/B3/B4a] Remove any-casts, add export download rate limit (#832)

* feat: analytics date range validation, avatar filename regex guard, e2e tests

* feat: inject ConfigService into password.utils, move getPasswordHistoryLimit into AuthService, add tests

* feat: export file 24h expiry with admin revoke, audit logging, reactivate error handling

* fix: remove (user as any) casts across controllers, add rate limit on export download

* fix: update test file to use ConfigService mock instead of process.env

* fix: pass ipAddress/userAgent to preflightChecks, cap date ranges instead of throw

---------

Co-authored-by: nottherealalanturing <nottherealalanturing@users.noreply.github.com>
Co-authored-by: zakkiyyat <zakkiyyat@users.noreply.github.com>
Co-authored-by: devdeen213 <devdeen213@users.noreply.github.com>
Co-authored-by: inteee <inteee@users.noreply.github.com>
Co-authored-by: rmsb-art <ramatshuaibu@gmail.com>
Co-authored-by: nanaf6203-bit <nanaf6203@gmail.com>

Author: 6 people

src/favorites/favorites.controller.ts

@@ -1,5 +1,3 @@
-// @ts-nocheck
-
 import {
   Controller,
   Delete,

src/transactions/transaction-notes.service.ts

@@ -1,5 +1,3 @@
-// @ts-nocheck
-
 import { ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
 import { PrismaService } from '../database/prisma.service';
 import { CreateNoteDto } from './dto/transaction-note.dto';
@@ -12,7 +10,7 @@ export class TransactionNotesService {
     const tx = await this.prisma.transaction.findUnique({ where: { id: transactionId } });
     if (!tx) throw new NotFoundException('Transaction not found');
 
-    return (this.prisma as any).transactionNote.create({
+    return this.prisma.transactionNote.create({
       data: {
         transactionId,
         authorId,
@@ -31,15 +29,12 @@ export class TransactionNotesService {
 
     const where: any = { transactionId };
     if (!isPrivileged && !isParty) {
-      // Non-party/non-admin can only see public notes authored by themselves
       where.isPublic = true;
     } else if (!isPrivileged) {
-      // Transaction parties see public notes and their own private notes
       where.OR = [{ isPublic: true }, { authorId: viewerId }];
     }
-    // Admins/agents see all notes
 
-    return (this.prisma as any).transactionNote.findMany({
+    return this.prisma.transactionNote.findMany({
       where,
       orderBy: { createdAt: 'asc' },
       include: {
@@ -49,14 +44,14 @@ export class TransactionNotesService {
   }
 
   async remove(noteId: string, requesterId: string, requesterRole: string) {
-    const note = await (this.prisma as any).transactionNote.findUnique({ where: { id: noteId } });
+    const note = await this.prisma.transactionNote.findUnique({ where: { id: noteId } });
     if (!note) throw new NotFoundException('Note not found');
 
     const isPrivileged = requesterRole === 'ADMIN';
     if (note.authorId !== requesterId && !isPrivileged) {
       throw new ForbiddenException('Only the author or admin can delete this note');
     }
 
-    return (this.prisma as any).transactionNote.delete({ where: { id: noteId } });
+    return this.prisma.transactionNote.delete({ where: { id: noteId } });
   }
 }

src/transactions/transactions.controller.ts

@@ -1,5 +1,3 @@
-// @ts-nocheck
-
 import {
   Controller,
   Delete,

src/users/users.controller.ts

@@ -1,5 +1,3 @@
-// @ts-nocheck
-
 import {
   Body,
   Controller,
@@ -44,6 +42,10 @@ const UNAUTHORIZED_ACTION_MESSAGE = 'You are not authorized to perform this acti
 
 @Controller('users')
 export class UsersController {
+  private readonly downloadRateLimitMap = new Map<string, { count: number; resetAt: number }>();
+  private static readonly DOWNLOAD_LIMIT = 10;
+  private static readonly DOWNLOAD_WINDOW_MS = 60 * 60 * 1000;
+
   constructor(
     private readonly usersService: UsersService,
     private readonly activityLogService: ActivityLogService,
@@ -167,6 +169,23 @@ export class UsersController {
     @Res() res: Response,
     @CurrentUser() user: AuthUserPayload,
   ) {
+    const now = Date.now();
+    const entry = this.downloadRateLimitMap.get(user.sub);
+    if (entry && now < entry.resetAt) {
+      if (entry.count >= UsersController.DOWNLOAD_LIMIT) {
+        throw new HttpException(
+          'Too many export downloads. Please try again later.',
+          HttpStatus.TOO_MANY_REQUESTS,
+        );
+      }
+      entry.count++;
+    } else {
+      this.downloadRateLimitMap.set(user.sub, {
+        count: 1,
+        resetAt: now + UsersController.DOWNLOAD_WINDOW_MS,
+      });
+    }
+
     const filepath = path.join(process.cwd(), 'exports', filename);
 
     if (!fs.existsSync(filepath)) {