05/09 Update: security enhanced

app/routes/folders.py

@@ -1,5 +1,5 @@
 from flask import Blueprint, request, jsonify, g
-from app import db, limiter
+from app import db, limiter, client_ip
 from app.models.folder import Folder
 from app.models.audit_log import AuditLog
 from app.services.auth_service import require_jwt
@@ -7,10 +7,6 @@ from app.services.auth_service import require_jwt
 folders_bp = Blueprint('folders', __name__)
 
 
-def _client_ip():
-    from flask import request as _req
-    return _req.headers.get('X-Forwarded-For', _req.remote_addr or '').split(',')[0].strip()
-
 
 @folders_bp.route('', methods=['GET'])
 @limiter.limit('120 per minute')
@@ -38,7 +34,7 @@ def create_folder():
         resource_type='folder',
         resource_id=folder.id,
         detail=f'Created folder: "{name}"',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
     return jsonify(folder.to_dict()), 201
@@ -64,7 +60,7 @@ def update_folder(folder_id):
         resource_type='folder',
         resource_id=folder.id,
         detail=f'Renamed folder: "{old_name}" → "{name}"',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
     return jsonify(folder.to_dict()), 200
@@ -87,7 +83,7 @@ def delete_folder(folder_id):
         resource_type='folder',
         resource_id=folder_id,
         detail=f'Deleted folder: "{folder_name}"',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
     return jsonify({'message': 'Folder deleted'}), 200