05/02/2026 updated code for security 6

app/routes/sharing.py

@@ -1,5 +1,5 @@
 from flask import Blueprint, request, jsonify, g
-from app import db
+from app import db, limiter
 from app.models.user import User
 from app.models.shared_item import SharedItem
 from app.models.audit_log import AuditLog
@@ -15,6 +15,7 @@ def _client_ip():
 # ── Sharing keypair management ────────────────────────────────────────────────
 
 @sharing_bp.route('/keys', methods=['GET'])
+@limiter.limit('60 per minute')
 @require_jwt
 def get_my_keys():
     """Return current user's encrypted sharing private key (to decrypt client-side)."""
@@ -30,6 +31,7 @@ def get_my_keys():
 
 
 @sharing_bp.route('/keys', methods=['POST'])
+@limiter.limit('10 per minute')
 @require_jwt
 def store_my_keys():
     """Store ECDH keypair. Public key plaintext; private key encrypted with vault key."""
@@ -61,6 +63,7 @@ def store_my_keys():
 
 
 @sharing_bp.route('/public-key', methods=['GET'])
+@limiter.limit('30 per minute')
 @require_jwt
 def get_public_key():
     """Look up another user's ECDH public key by email (needed to create a share)."""
@@ -84,6 +87,7 @@ def get_public_key():
 # ── Outgoing shares ───────────────────────────────────────────────────────────
 
 @sharing_bp.route('', methods=['GET'])
+@limiter.limit('60 per minute')
 @require_jwt
 def list_outgoing():
     """List all items the current user has shared with others."""
@@ -103,6 +107,7 @@ def list_outgoing():
 
 
 @sharing_bp.route('', methods=['POST'])
+@limiter.limit('30 per minute')
 @require_jwt
 def create_share():
     """
@@ -164,6 +169,7 @@ def create_share():
 
 
 @sharing_bp.route('/<int:share_id>', methods=['DELETE'])
+@limiter.limit('30 per minute')
 @require_jwt
 def delete_share(share_id):
     share = SharedItem.query.filter_by(id=share_id, owner_id=g.current_user_id).first()
@@ -190,6 +196,7 @@ def delete_share(share_id):
 # ── Inbox (received shares) ───────────────────────────────────────────────────
 
 @sharing_bp.route('/inbox', methods=['GET'])
+@limiter.limit('60 per minute')
 @require_jwt
 def inbox():
     """List all items shared with the current user."""
@@ -216,6 +223,7 @@ def inbox():
 
 
 @sharing_bp.route('/inbox/<int:share_id>/accept', methods=['POST'])
+@limiter.limit('30 per minute')
 @require_jwt
 def accept_share(share_id):
     """Mark a received share as accepted (links recipient_id if not already set)."""