""" Shared extension instances (rate limiter, etc.) to avoid circular imports. """ from starlette.requests import Request from slowapi import Limiter from app.config import settings def _get_real_client_ip(request: Request) -> str: """Extract real client IP from X-Forwarded-For (behind Cloudflare/nginx) or fallback.""" forwarded = request.headers.get("X-Forwarded-For") if forwarded: return forwarded.split(",")[0].strip() cf_ip = request.headers.get("CF-Connecting-IP") if cf_ip: return cf_ip.strip() return request.client.host if request.client else "127.0.0.1" limiter = Limiter(key_func=_get_real_client_ip, default_limits=[settings.RATE_LIMIT_DEFAULT])