fix: 收紧演示模式与刷新预限流

apps/api/src/auth/auth.service.ts

@@ -221,6 +221,15 @@ export class AuthService {
     retryAttempt = 0,
   ): Promise<TokenPair> {
     if (!this.validRefreshShape(token)) throw this.invalid();
+    if (retryAttempt === 0)
+      await this.limitAll([
+        {
+          kind: "refresh-attempt-ip",
+          parts: [phoneHmac(ip)],
+          max: envInt("REFRESH_ATTEMPT_IP_LIMIT", 30),
+          ttl: envInt("REFRESH_ATTEMPT_IP_WINDOW_SECONDS", 60),
+        },
+      ]);
     const hash = refreshHmac(token);
     const observed = await this.prisma.refreshToken.findUnique({
       where: { tokenHash: hash },
@@ -241,12 +250,6 @@ export class AuthService {
           max: envInt("REFRESH_RATE_LIMIT", 60),
           ttl: 60,
         },
-        {
-          kind: "refresh-ip",
-          parts: [phoneHmac(ip)],
-          max: envInt("REFRESH_RATE_LIMIT", 60),
-          ttl: 60,
-        },
       ]);
       await this.cleanupExpiredRefreshTokens(observed.sessionId);
     }