feat: enforce strict CORS and SlowAPI rate limiting

app/api/routes/analysis.py

@@ -1,7 +1,7 @@
 """
 Routes analyses K2 Think
 """
-from fastapi import APIRouter, Depends, HTTPException, status, BackgroundTasks, Body
+from fastapi import APIRouter, Depends, HTTPException, status, BackgroundTasks, Body, Request
 from fastapi.responses import Response, FileResponse
 from sqlalchemy.orm import Session
 from app.dependencies import get_db, get_current_user
@@ -24,6 +24,7 @@ from app.services.export_service import ExportService
 from app.services.arxiv_service import ArXivService
 from app.services.openalex_service import OpenAlexService
 from app.core.logging import logger
+from app.main import limiter
 
 router = APIRouter()
 
@@ -55,9 +56,11 @@ async def get_user_analysis_history(
 
 
 @router.post("/{project_id}", response_model=dict, status_code=status.HTTP_202_ACCEPTED)
+@limiter.limit("2/minute")
 async def start_project_analysis(
+    request: Request,
     project_id: str,
-    request: AnalysisRequest,
+    analysis_request: AnalysisRequest,
     background_tasks: BackgroundTasks,
     current_user = Depends(get_current_user),
     db: Session = Depends(get_db)
@@ -81,8 +84,8 @@ async def start_project_analysis(
         if not current_user.id.hex.startswith("0000"):
             user_repo.deduct_credits(current_user, 50)
             
-        request.user_id = str(current_user.id)
-        request.user_profile = current_user.research_profile
+        analysis_request.user_id = str(current_user.id)
+        analysis_request.user_profile = current_user.research_profile
         target_project_id = project_id
         
         # If project_id is the "nil" UUID from frontend, use/create a real project for history
@@ -94,14 +97,14 @@ async def start_project_analysis(
 
         analysis = service.create_analysis_run(
             project_id=target_project_id,
-            model_used=request.model or "k2-think-pro"
+            model_used=analysis_request.model or "k2-think-pro"
         )
 
         # START THE ACTUAL PROCESSING
         background_tasks.add_task(
             service.process_analysis,
             str(analysis.id),
-            request
+            analysis_request
         )
         
         return {

app/api/routes/users.py

@@ -1,7 +1,7 @@
 """
 Routes utilisateur
 """
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status, Request
 from sqlalchemy.orm import Session
 from app.dependencies import get_db
 from app.services.user_service import UserService
@@ -13,6 +13,7 @@ from datetime import timedelta
 from app.core.settings import settings
 from app.core.logging import logger
 import uuid
+from app.main import limiter
 
 router = APIRouter()
 
@@ -36,7 +37,8 @@ async def create_user(user: UserCreate, db: Session = Depends(get_db)):
         )
 
 @router.post("/register", response_model=dict, status_code=status.HTTP_201_CREATED)
-async def register(user: UserCreate, db: Session = Depends(get_db)):
+@limiter.limit("3/minute")
+async def register(request: Request, user: UserCreate, db: Session = Depends(get_db)):
     """Enregistre un nouvel utilisateur avec mot de passe"""
     logger.info(f"Registering new user: {user.email}")
     try:
@@ -72,7 +74,8 @@ async def register(user: UserCreate, db: Session = Depends(get_db)):
 
 
 @router.post("/login", response_model=dict)
-async def login(user_login: UserLogin, db: Session = Depends(get_db)):
+@limiter.limit("5/minute")
+async def login(request: Request, user_login: UserLogin, db: Session = Depends(get_db)):
     """Connecte un utilisateur par email/password et retourne un JWT"""
     logger.info(f"Login attempt for: {user_login.email}")
     try:

app/core/settings.py

@@ -39,7 +39,12 @@ class Settings(BaseSettings):
     FRONTEND_URL: str = "https://ai-scientific-coinvestigator-ui.vercel.app"
 
     # CORS — array or comma-separated list of allowed origins
-    ALLOWED_ORIGINS: List[str] = ["http://localhost:3000", "https://ai-scientific-coinvestigator-ui.vercel.app"]
+    ALLOWED_ORIGINS: List[str] = [
+        "http://localhost:3000",
+        "https://ai-scientific-coinvestigator-ui.vercel.app",
+        "https://www.scoinvestigator.com",
+        "https://scoinvestigator.com"
+    ]
     
     @field_validator("ALLOWED_ORIGINS", mode="before")
     @classmethod

app/main.py

@@ -133,6 +133,14 @@ from fastapi.middleware.cors import CORSMiddleware
 from starlette.middleware.sessions import SessionMiddleware
 from starlette.responses import Response
 
+from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi.util import get_remote_address
+from slowapi.errors import RateLimitExceeded
+from slowapi.middleware import SlowAPIMiddleware
+
+# Initialize Rate Limiter based on client IP address
+limiter = Limiter(key_func=get_remote_address)
+
 # Create FastAPI app
 app = FastAPI(
     title=settings.API_TITLE,
@@ -141,6 +149,11 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
+# Attach the Limiter to the app
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+app.add_middleware(SlowAPIMiddleware)
+
 # --- PROXY FIX MIDDLEWARE (Required for Hugging Face / OAuth) ---
 @app.middleware("http")
 async def fix_proxy_headers(request: Request, call_next):

requirements.txt

@@ -7,6 +7,7 @@ uvicorn[standard]==0.24.0
 python-multipart==0.0.6
 pydantic==2.5.0
 pydantic-settings==2.1.0
+slowapi==0.1.9
 
 # Database
 sqlalchemy==2.0.23