05/02/2026 updated code for security 6

app/routes/folders.py

@@ -1,5 +1,5 @@
 from flask import Blueprint, request, jsonify, g
-from app import db
+from app import db, limiter
 from app.models.folder import Folder
 from app.models.audit_log import AuditLog
 from app.services.auth_service import require_jwt
@@ -13,6 +13,7 @@ def _client_ip():
 
 
 @folders_bp.route('', methods=['GET'])
+@limiter.limit('120 per minute')
 @require_jwt
 def list_folders():
     folders = Folder.query.filter_by(user_id=g.current_user_id).order_by(Folder.name.asc()).all()
@@ -20,6 +21,7 @@ def list_folders():
 
 
 @folders_bp.route('', methods=['POST'])
+@limiter.limit('30 per minute')
 @require_jwt
 def create_folder():
     data = request.get_json(silent=True) or {}
@@ -43,6 +45,7 @@ def create_folder():
 
 
 @folders_bp.route('/<int:folder_id>', methods=['PUT'])
+@limiter.limit('30 per minute')
 @require_jwt
 def update_folder(folder_id):
     folder = Folder.query.filter_by(id=folder_id, user_id=g.current_user_id).first()
@@ -68,6 +71,7 @@ def update_folder(folder_id):
 
 
 @folders_bp.route('/<int:folder_id>', methods=['DELETE'])
+@limiter.limit('30 per minute')
 @require_jwt
 def delete_folder(folder_id):
     folder = Folder.query.filter_by(id=folder_id, user_id=g.current_user_id).first()
@@ -86,4 +90,4 @@ def delete_folder(folder_id):
         ip_address=_client_ip(),
     )
     db.session.commit()
-    return jsonify({'message': 'Folder deleted'}), 200
+    return jsonify({'message': 'Folder deleted'}), 200