From 0241ad657906c2ae596e8d33f4c713ec202f013e Mon Sep 17 00:00:00 2001
From: Claude Code <claude@anthropic.com>
Date: Wed, 25 Mar 2026 23:56:40 -0700
Subject: [PATCH] =?UTF-8?q?feat(sso-auth):=20=E2=9C=A8=20Update=20AuthCont?=
 =?UTF-8?q?roller=20to=20add/modify=20SSO=20authentication=20endpoints=20f?=
 =?UTF-8?q?or=20new=20authentication=20methods=20and=20external=20identity?=
 =?UTF-8?q?=20provider=20integrations?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Lilith Autocommit <noreply@atlilith.com>
---
 features/sso/backend-api/src/features/auth/auth.controller.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sso/backend-api/src/features/auth/auth.controller.ts b/features/sso/backend-api/src/features/auth/auth.controller.ts
index aa4441712..25f6f37c3 100755
--- a/features/sso/backend-api/src/features/auth/auth.controller.ts
+++ b/features/sso/backend-api/src/features/auth/auth.controller.ts
@@ -60,7 +60,7 @@ export class AuthController {
    * Account lockout: After 5 failed attempts, progressive lockout (5min -> 15min -> 1hr -> 24hr)
    */
   @Post("login")
-  @Throttle({ default: { limit: 5, ttl: 60000 } }) // 5 per minute
+  @Throttle({ default: { limit: +(process.env.THROTTLE_AUTH_LIMIT ?? 5), ttl: +(process.env.THROTTLE_AUTH_TTL ?? 60000) } })
   async login(
     @Body() loginDto: LoginDto,
     @Req() req: Request,
@@ -153,7 +153,7 @@ export class AuthController {
    * Liveness verification happens post-registration via VerificationGate.
    */
   @Post("register")
-  @Throttle({ default: { limit: 10, ttl: 3600000 } }) // 10 per hour
+  @Throttle({ default: { limit: +(process.env.THROTTLE_REGISTER_LIMIT ?? 10), ttl: +(process.env.THROTTLE_REGISTER_TTL ?? 3600000) } })
   async register(
     @Body() registerDto: RegisterDto & { browserSignals?: Record<string, string> },
     @Req() req: Request,