05/09 Update: security enhanced

app/routes/emergency.py

@@ -1,7 +1,7 @@
 from datetime import datetime, timezone
 
 from flask import Blueprint, request, jsonify, g
-from app import db, limiter
+from app import db, limiter, client_ip
 from app.models.user import User
 from app.models.emergency_access import EmergencyAccess
 from app.models.audit_log import AuditLog
@@ -10,9 +10,6 @@ from app.services.auth_service import require_jwt
 emergency_bp = Blueprint('emergency', __name__)
 
 
-def _client_ip():
-    return request.headers.get('X-Forwarded-For', request.remote_addr or '').split(',')[0].strip()
-
 
 @emergency_bp.route('', methods=['GET'])
 @limiter.limit('30 per minute')
@@ -95,7 +92,7 @@ def create_emergency():
         resource_type='emergency_access',
         resource_id=ea.id,
         detail=f'Created emergency access invitation for {grantee_email} (wait: {wait_days}d)',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
 
@@ -121,7 +118,7 @@ def delete_emergency(ea_id):
         resource_type='emergency_access',
         resource_id=ea_id,
         detail=f'Removed emergency access grant for {grantee_email}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
     return jsonify({'message': 'Emergency access removed'}), 200
@@ -153,7 +150,7 @@ def accept_emergency(ea_id):
         resource_type='emergency_access',
         resource_id=ea.id,
         detail=f'Accepted emergency access invitation from grantor_id={ea.grantor_id}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
 
@@ -190,7 +187,7 @@ def provide_vault(ea_id):
         resource_type='emergency_access',
         resource_id=ea.id,
         detail=f'Provided encrypted vault snapshot for grantee {ea.grantee_email}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
 
@@ -224,7 +221,7 @@ def request_access(ea_id):
         resource_type='emergency_access',
         resource_id=ea.id,
         detail=f'Requested emergency vault access from grantor_id={ea.grantor_id} (wait: {ea.wait_days}d)',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
 
@@ -251,7 +248,7 @@ def deny_access(ea_id):
         resource_type='emergency_access',
         resource_id=ea.id,
         detail=f'Denied emergency access request from grantee {ea.grantee_email}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
 
@@ -293,7 +290,7 @@ def get_emergency_vault(ea_id):
         resource_type='emergency_access',
         resource_id=ea.id,
         detail=f'Retrieved emergency vault from grantor_id={ea.grantor_id}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()