05/09 Update: security enhanced

app/routes/sharing.py

@@ -1,5 +1,5 @@
 from flask import Blueprint, request, jsonify, g
-from app import db, limiter
+from app import db, limiter, client_ip
 from app.models.user import User
 from app.models.shared_item import SharedItem
 from app.models.audit_log import AuditLog
@@ -8,9 +8,6 @@ from app.services.auth_service import require_jwt
 sharing_bp = Blueprint('sharing', __name__)
 
 
-def _client_ip():
-    return request.headers.get('X-Forwarded-For', request.remote_addr or '').split(',')[0].strip()
-
 
 # ── Sharing keypair management ────────────────────────────────────────────────
 
@@ -55,7 +52,7 @@ def store_my_keys():
         resource_type='sharing_keys',
         resource_id=g.current_user_id,
         detail='ECDH sharing keypair stored/updated',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
 
@@ -72,10 +69,10 @@ def get_public_key():
         return jsonify({'error': 'email query param is required'}), 400
 
     user = User.query.filter_by(email=email).first()
-    if not user:
-        return jsonify({'error': 'User not found'}), 404
-    if not user.sharing_public_key:
-        return jsonify({'error': 'User has not set up sharing keys yet'}), 404
+    # Return the same 404 regardless of whether the email is registered,
+    # to prevent user enumeration by authenticated clients.
+    if not user or not user.sharing_public_key:
+        return jsonify({'error': 'User or sharing key not found'}), 404
 
     return jsonify({
         'user_id': user.id,
@@ -161,7 +158,7 @@ def create_share():
         resource_type='shared_item',
         resource_id=share.id,
         detail=f'Shared item "{item_name}" ({item_type}) with {recipient_email}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
 
@@ -187,7 +184,7 @@ def delete_share(share_id):
         resource_type='shared_item',
         resource_id=share_id,
         detail=f'Revoked share of "{item_name}" with {recipient_email}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
     return jsonify({'message': 'Share removed'}), 200
@@ -251,7 +248,7 @@ def accept_share(share_id):
         resource_type='shared_item',
         resource_id=share.id,
         detail=f'Accepted shared item "{share.item_name}" from {owner_email}',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()