05/09 Update: security enhanced

app/routes/vault.py

@@ -1,5 +1,5 @@
 from flask import Blueprint, request, jsonify, g
-from app import db, limiter
+from app import db, limiter, client_ip
 from app.models.vault_item import VaultItem, ItemType
 from app.models.audit_log import AuditLog
 from app.services.auth_service import require_jwt
@@ -9,11 +9,6 @@ vault_bp = Blueprint('vault', __name__)
 VALID_TYPES = {t.value for t in ItemType}
 
 
-def _client_ip():
-    from flask import request as _req
-    return _req.headers.get('X-Forwarded-For', _req.remote_addr or '').split(',')[0].strip()
-
-
 @vault_bp.route('', methods=['GET'])
 @limiter.limit('120 per minute')
 @require_jwt
@@ -64,7 +59,7 @@ def create_item():
             resource_type='vault_item',
             resource_id=item.id,
             detail=f'Created {item_type} item: "{name}"',
-            ip_address=_client_ip(),
+            ip_address=client_ip(),
         )
         db.session.commit()
     except Exception as e:
@@ -122,7 +117,7 @@ def update_item(item_id):
             resource_type='vault_item',
             resource_id=item.id,
             detail=f'Updated item: "{item.name}"',
-            ip_address=_client_ip(),
+            ip_address=client_ip(),
         )
         db.session.commit()
     except Exception as e:
@@ -149,7 +144,7 @@ def delete_item(item_id):
         resource_type='vault_item',
         resource_id=item_id,
         detail=f'Deleted item: "{item_name}"',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
     return jsonify({'message': 'Item deleted'}), 200
@@ -177,7 +172,7 @@ def export_items():
         resource_type='vault_item',
         resource_id=None,
         detail=f'Exported {len(items)} vault item(s)',
-        ip_address=_client_ip(),
+        ip_address=client_ip(),
     )
     db.session.commit()
     return jsonify([item.to_dict() for item in items]), 200
@@ -232,7 +227,7 @@ def import_items():
             resource_type='vault_item',
             resource_id=None,
             detail=f'Imported {imported} item(s), skipped {skipped} malformed row(s)',
-            ip_address=_client_ip(),
+            ip_address=client_ip(),
         )
         db.session.commit()
     return jsonify({'imported': imported, 'skipped': skipped}), 200