05/06/2026 Initial commit

app/extensions.py

@@ -0,0 +1,36 @@
+"""
+extensions.py — Shared Flask extension instances.
+Imported by both app factories to avoid circular imports.
+"""
+
+from flask_sqlalchemy import SQLAlchemy
+from flask_migrate import Migrate
+from flask_login import LoginManager
+from flask_jwt_extended import JWTManager
+from flask_wtf.csrf import CSRFProtect
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
+from flask_mail import Mail
+from flask_apscheduler import APScheduler
+from flask_bcrypt import Bcrypt
+
+db = SQLAlchemy()
+migrate = Migrate()
+csrf = CSRFProtect()
+mail = Mail()
+scheduler = APScheduler()
+bcrypt = Bcrypt()
+
+# Two separate LoginManager instances — one per app factory.
+admin_login_manager = LoginManager()
+tenant_login_manager = LoginManager()
+
+# Two separate JWTManager instances — one per app factory.
+admin_jwt = JWTManager()
+tenant_jwt = JWTManager()
+
+# Rate limiter — shared, keyed by remote address.
+limiter = Limiter(key_func=get_remote_address)
+
+jwt = admin_jwt  # shared alias used by both app factories
+