new web ract

api/main.py

@@ -4,6 +4,11 @@ from contextlib import asynccontextmanager
 from fastapi import FastAPI, Depends, HTTPException, status
 from fastapi.security import HTTPBasic, HTTPBasicCredentials
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
+from fastapi.openapi.docs import get_swagger_ui_html, get_redoc_html
+from slowapi import _rate_limit_exceeded_handler
+from slowapi.errors import RateLimitExceeded
+from rate_limiter import limiter
 
 from bd.database import wait_for_db, engine, Base
 from route.public import router as public_router
@@ -11,12 +16,14 @@ from route.admin_auth import router as auth_router, ensure_default_admin
 from route.admin_articles import router as articles_router
 from route.admin_categories import router as categories_router
 from route.admin_media import router as media_router
+from route.admin_vk import router as vk_router
+import scheduler
 
 DOCS_USER = os.getenv("DOCS_USERNAME", "admin")
 DOCS_PASS = os.getenv("DOCS_PASSWORD", "admin")
 _basic = HTTPBasic()
 
-
+# Rate limiter — ключ по IP-адресу
 def _verify_docs(creds: HTTPBasicCredentials = Depends(_basic)):
     ok_u = secrets.compare_digest(creds.username.encode(), DOCS_USER.encode())
     ok_p = secrets.compare_digest(creds.password.encode(), DOCS_PASS.encode())
@@ -31,7 +38,9 @@ async def lifespan(app: FastAPI):
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
     await ensure_default_admin()
+    scheduler.start()
     yield
+    scheduler.shutdown()
 
 
 app = FastAPI(
@@ -43,17 +52,18 @@ app = FastAPI(
     openapi_url=None,
 )
 
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
+# CORS: разрешаем только наш домен (меняй на продакшн-домен)
+_ALLOWED_ORIGINS = [o.strip() for o in os.getenv("ALLOWED_ORIGINS", "http://localhost,http://localhost:80").split(",") if o.strip()]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_origins=_ALLOWED_ORIGINS,
+    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
+    allow_headers=["Authorization", "Content-Type"],
 )
 
-# Docs protected by HTTP Basic Auth
-from fastapi.openapi.docs import get_swagger_ui_html, get_redoc_html
-from fastapi.responses import JSONResponse
-
 
 @app.get("/docs", include_in_schema=False)
 async def docs(username: str = Depends(_verify_docs)):
@@ -75,11 +85,12 @@ async def health():
     return {"ok": True}
 
 
-app.include_router(public_router, prefix="/news", tags=["public"])
-app.include_router(auth_router, prefix="/admin", tags=["admin-auth"])
-app.include_router(articles_router, prefix="/admin/articles", tags=["admin-articles"])
-app.include_router(categories_router, prefix="/admin/categories", tags=["admin-categories"])
-app.include_router(media_router, prefix="/admin/media", tags=["admin-media"])
+app.include_router(public_router,    prefix="/news",            tags=["public"])
+app.include_router(auth_router,      prefix="/admin",           tags=["admin-auth"])
+app.include_router(articles_router,  prefix="/admin/articles",  tags=["admin-articles"])
+app.include_router(categories_router,prefix="/admin/categories",tags=["admin-categories"])
+app.include_router(media_router,     prefix="/admin/media",     tags=["admin-media"])
+app.include_router(vk_router,        prefix="/admin/vk",        tags=["admin-vk"])
 
 
 if __name__ == "__main__":