fix: standardize rate limiter TTL to milliseconds and parameterize migration SQL

[LautaroPetaccio]

Summary

Rate limiter TTL unit mismatch: DEPLOYMENTS_DEFAULT_RATE_LIMIT_TTL was stored in seconds (divided by 1000 in Environment.ts) while all other TTL configs (entitiesConfigTtl, entitiesConfigUnchangedTtl) were stored in milliseconds. The fallback in components.ts used ms('1m') (60000 ms), creating a unit mismatch with the configured value (60 seconds).

The fix removes the /1000 conversion in Environment.ts so the config is stored in milliseconds like all other TTL fields, and adds a toSeconds() call in deployRateLimiterComponent.ts where the defaultTtl fallback is used, so NodeCache receives the correct seconds value.

Migration SQL injection: migrations/Helper.ts used string interpolation for all SQL queries ('${entityType}', ${row.id}, etc.). While the inputs are developer-controlled migration data (not user input), this is unsafe practice. Replaced all interpolation with parameterized queries using $1, $2 placeholders. Changed deleteFailedDeployments from sync pgm.sql() to async pgm.db.query() with params, and updated the two callers to add await.

Test plan

• Added unit tests verifying the rate limiter correctly handles millisecond defaultTtl
• Run: cd content && npx jest test/unit/ports/deployRateLimiterComponent.spec.ts --no-coverage
• Verify migrations still run correctly

[decentraland-bot]

Code Review — PR #1896: Rate Limiter TTL Standardization & Migration SQL Parameterization

Verdict: ✅ APPROVE

Important fixes for both correctness and security.

Key Findings

What's fixed (all correct):

1. Rate limiter TTL unit mismatch: DEPLOYMENTS_DEFAULT_RATE_LIMIT_TTL was divided by 1000 (stored in seconds) while all other TTL configs were in milliseconds. The fallback in components.ts used ms('1m') (60000 ms), creating inconsistency. Fix removes the /1000 and adds toSeconds() at the consumption site. All paths now consistently produce seconds for NodeCache. Verified correct.

2. SQL injection in migrations/Helper.ts: All string interpolation ('${entityType}', ${row.id}) replaced with parameterized queries using $1, $2 placeholders. deleteFailedDeployments changed from sync pgm.sql() to async pgm.db.query() with params. Both callers updated with await. Correct and important for security hygiene.

P3 — Minor observations (not blocking):

• The parameterized queries use $1, $2 for values (entity_id, entity_type, etc.) which is correct for DML. All the SQL in Helper.ts is DML (DELETE, INSERT, SELECT), not DDL, so standard parameterization works correctly.
• Consider adding a unit suffix to the TTL variable name (e.g., defaultTtlMs) to prevent future regressions.

Tests: New deployRateLimiterComponent.spec.ts with 4 tests verifying correct TTL behavior with millisecond values. Good coverage of the fix.

CI: Tests still in progress (test-content running), validations + test-lambdas passing ✅

Requested by Lautaro Petaccio via Slack