Updated functionalities 2

app/__init__.py

@@ -4,6 +4,8 @@ from flask_login import LoginManager
 from flask_migrate import Migrate
 from flask_mail import Mail
 from flask_wtf.csrf import CSRFProtect
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
 from config import config
 import os
 import logging
@@ -14,6 +16,11 @@ login_manager = LoginManager()
 migrate       = Migrate()
 mail          = Mail()
 csrf          = CSRFProtect()    # initialized here; .init_app() called in create_app()
+limiter       = Limiter(
+    key_func       = get_remote_address,
+    default_limits = [],          # no global limit — applied per-route only
+    storage_uri    = 'memory://', # in-process; swap for 'redis://...' in multi-worker setups
+)
 
 
 def create_app(config_name='default'):
@@ -25,6 +32,7 @@ def create_app(config_name='default'):
     migrate.init_app(app, db)
     mail.init_app(app)
     csrf.init_app(app)    # enables CSRF protection for all web routes
+    limiter.init_app(app) # rate limiting — applied per-route via @limiter.limit()
 
     login_manager.login_view         = 'auth.login'
     login_manager.login_message      = 'Please log in to access this page.'