05/02/2026 updated code for security 6

app/routes/emergency.py

@@ -1,7 +1,7 @@
 from datetime import datetime, timezone
 
 from flask import Blueprint, request, jsonify, g
-from app import db
+from app import db, limiter
 from app.models.user import User
 from app.models.emergency_access import EmergencyAccess
 from app.models.audit_log import AuditLog
@@ -15,6 +15,7 @@ def _client_ip():
 
 
 @emergency_bp.route('', methods=['GET'])
+@limiter.limit('30 per minute')
 @require_jwt
 def list_emergency():
     """Return emergency access records both as grantor and as grantee."""
@@ -45,6 +46,7 @@ def _ea_as_grantee(ea: EmergencyAccess) -> dict:
 
 
 @emergency_bp.route('', methods=['POST'])
+@limiter.limit('10 per minute')
 @require_jwt
 def create_emergency():
     """Grantor creates an emergency access invitation for a trusted contact."""
@@ -101,6 +103,7 @@ def create_emergency():
 
 
 @emergency_bp.route('/<int:ea_id>', methods=['DELETE'])
+@limiter.limit('10 per minute')
 @require_jwt
 def delete_emergency(ea_id):
     """Grantor removes an emergency access grant."""
@@ -125,6 +128,7 @@ def delete_emergency(ea_id):
 
 
 @emergency_bp.route('/<int:ea_id>/accept', methods=['POST'])
+@limiter.limit('10 per minute')
 @require_jwt
 def accept_emergency(ea_id):
     """Grantee accepts an emergency access invitation."""
@@ -157,6 +161,7 @@ def accept_emergency(ea_id):
 
 
 @emergency_bp.route('/<int:ea_id>/provide', methods=['POST'])
+@limiter.limit('10 per minute')
 @require_jwt
 def provide_vault(ea_id):
     """
@@ -194,6 +199,7 @@ def provide_vault(ea_id):
 
 
 @emergency_bp.route('/<int:ea_id>/request', methods=['POST'])
+@limiter.limit('10 per minute')
 @require_jwt
 def request_access(ea_id):
     """Grantee initiates an access request, starting the wait-period clock."""
@@ -226,6 +232,7 @@ def request_access(ea_id):
 
 
 @emergency_bp.route('/<int:ea_id>/deny', methods=['POST'])
+@limiter.limit('10 per minute')
 @require_jwt
 def deny_access(ea_id):
     """Grantor denies a pending access request (resets to ready)."""
@@ -253,6 +260,7 @@ def deny_access(ea_id):
 
 
 @emergency_bp.route('/<int:ea_id>/vault', methods=['GET'])
+@limiter.limit('10 per minute')
 @require_jwt
 def get_emergency_vault(ea_id):
     """
@@ -293,5 +301,4 @@ def get_emergency_vault(ea_id):
     return jsonify({
         'enc_vault': ea.enc_vault,
         'grantor_public_key': grantor.sharing_public_key if grantor else None,
-    }), 200
-
+    }), 200