Fix tenant quota guard syntax and abuse score service

src/rate-limiting/guards/tenant-quota.guard.ts

@@ -0,0 +1,36 @@
+import { Injectable, CanActivate, ExecutionContext, HttpException } from '@nestjs/common';
+
+@Injectable()
+export class TenantQuotaGuard implements CanActivate {
+  private readonly tiers: Record<string, number> = {
+    FREE: 100,
+    PRO: 1000,
+    ENTERPRISE: -1,
+  };
+  private counters = new Map<string, { count: number; resetAt: number }>();
+
+  canActivate(context: ExecutionContext): boolean {
+    const req = context.switchToHttp().getRequest();
+    const tenantId = req.headers['x-tenant-id'] as string;
+    if (!tenantId) return true;
+
+    const tier = (req as any).tenantTier || 'FREE';
+    const limit = this.tiers[tier] || this.tiers.FREE;
+    if (limit === -1) return true;
+
+    const now = Date.now();
+    const key = tenantId;
+    const entry = this.counters.get(key);
+
+    if (!entry || now > entry.resetAt) {
+      this.counters.set(key, { count: 1, resetAt: now + 60000 });
+      return true;
+    }
+
+    entry.count++;
+    if (entry.count > limit) {
+      throw new HttpException('Tenant rate limit exceeded', 429);
+    }
+    return true;
+  }
+}

src/security/abuse/abuse-score.service.ts

@@ -0,0 +1,21 @@
+import { Injectable } from '@nestjs/common';
+
+@Injectable()
+export class AbuseScoreService {
+  private scores = new Map<string, { score: number; expiresAt: number }>();
+
+  async getCompositeScore(userId: string, ip: string): Promise<number> {
+    const key = `${userId}:${ip}`;
+    const entry = this.scores.get(key);
+    if (!entry || Date.now() > entry.expiresAt) return 0;
+    return entry.score;
+  }
+
+  addSignal(userId: string, ip: string, weight: number): void {
+    const key = `${userId}:${ip}`;
+    const entry = this.scores.get(key);
+    const now = Date.now();
+    const newScore = (entry && now <= entry.expiresAt ? entry.score : 0) + weight;
+    this.scores.set(key, { score: newScore, expiresAt: now + 60000 });
+  }
+}