extensions.py

from flask_sqlalchemy import SQLAlchemy
from flask_login import LoginManager
from flask_wtf.csrf import CSRFProtect
from flask_caching import Cache
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

# Shared SQLAlchemy instance for the app
# Import this as: from extensions import db
# NOTE: SQLite support removed (Roadmap #11) - PostgreSQL only

db = SQLAlchemy()

# Flask-Login manager for authentication
# Import this as: from extensions import login_manager
login_manager = LoginManager()
login_manager.login_view = 'auth.login'  # Updated after blueprint refactoring
login_manager.login_message = 'Please log in to access this page.'
login_manager.login_message_category = 'info'

# CSRF protection for all forms
# Import this as: from extensions import csrf
csrf = CSRFProtect()

# Flask-Caching for query optimization
# Import this as: from extensions import cache
cache = Cache()

# Flask-Limiter for rate limiting
# Import this as: from extensions import limiter
# DEVELOPMENT MODE: Limits set very high to avoid blocking during testing
# TODO: Before production deployment, reduce to:
#   default_limits=["10000 per day", "1000 per hour"]
#   auth routes: 5-10 per 15 minutes
#   guest routes: 50-200 per hour
limiter = Limiter(
    key_func=get_remote_address,
    default_limits=["100000 per day", "10000 per hour"],  # Very high for development
    storage_uri="memory://"  # Use Redis for production: "redis://localhost:6379"
)