| 35 | @Post('login') |
| 36 | @HttpCode(HttpStatus.OK) |
| 37 | async login(@Request() req, @Response() res, @Body() loginDto: LoginDto) { |
| 38 | const ipAddress = req.ip || req.connection.remoteAddress; |
| 39 | const userAgent = req.get('User-Agent'); |
| 40 | |
| 41 | const result = await this.authService.login(req.user, ipAddress, userAgent); |
| 42 | |
| 43 | // Set httpOnly cookies |
| 44 | res.cookie('access_token', result.access_token, { |
| 45 | httpOnly: true, |
| 46 | secure: process.env.NODE_ENV === 'production', |
| 47 | sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax', |
| 48 | maxAge: 15 * 60 * 1000, // 15 minutes |
| 49 | }); |
| 50 | |
| 51 | res.cookie('refresh_token', result.refresh_token, { |
| 52 | httpOnly: true, |
| 53 | secure: process.env.NODE_ENV === 'production', |
| 54 | sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax', |
| 55 | maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days |
| 56 | }); |
| 57 | |
| 58 | return res.json({ user: result.user }); |
| 59 | } |
| 60 | |
| 61 | @UseGuards(ThrottlerGuard) |
| 62 | @Throttle({ signup: { limit: 20, ttl: 3600000 } }) // 20 signups per hour |