default
7d6040af41
- Batch device CRUD: POST /api/devices/batch (create 500), PUT /api/devices/batch (update 500), POST /api/devices/batch-delete (delete 100) with WHERE IN bulk queries - Batch command: POST /api/commands/batch with model_validator mutual exclusion - API key auth (X-API-Key header, secrets.compare_digest timing-safe) - Rate limiting via SlowAPIMiddleware (60/min default, 30/min writes) - Real client IP extraction (X-Forwarded-For / CF-Connecting-IP) - Global exception handler (no stack trace leaks, passes HTTPException through) - CORS with auto-disable credentials on wildcard origins - Schema validation: IMEI pattern, lat/lon ranges, Literal enums, MAC/UUID patterns - Heartbeats router, per-ID endpoints for locations/attendance/bluetooth - Input dedup in batch create, result ordering preserved - Baidu reverse geocoding, Gaode map tiles with WGS84→GCJ02 conversion - Device detail panel with feature toggles and command controls - Side panel for location/beacon pages with auto-select active device via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run>
23 lines
706 B
Python
23 lines
706 B
Python
"""
|
|
Shared extension instances (rate limiter, etc.) to avoid circular imports.
|
|
"""
|
|
|
|
from starlette.requests import Request
|
|
from slowapi import Limiter
|
|
|
|
from app.config import settings
|
|
|
|
|
|
def _get_real_client_ip(request: Request) -> str:
|
|
"""Extract real client IP from X-Forwarded-For (behind Cloudflare/nginx) or fallback."""
|
|
forwarded = request.headers.get("X-Forwarded-For")
|
|
if forwarded:
|
|
return forwarded.split(",")[0].strip()
|
|
cf_ip = request.headers.get("CF-Connecting-IP")
|
|
if cf_ip:
|
|
return cf_ip.strip()
|
|
return request.client.host if request.client else "127.0.0.1"
|
|
|
|
|
|
limiter = Limiter(key_func=_get_real_client_ip, default_limits=[settings.RATE_LIMIT_DEFAULT])
|