v4.2: Update api/main.py

api/main.py

@@ -58,8 +58,9 @@ HF_API_TOKEN = os.environ.get("HF_API_TOKEN", "")
 SAULLM_ENDPOINT = os.environ.get("SAULLM_ENDPOINT", "")
 MAX_TEXT_LENGTH = int(os.environ.get("MAX_TEXT_LENGTH", "200000"))
 
-# ─── FIX v4.1: Sliding window rate limiter with proper IP extraction ───
+# ─── FIX v4.2: Improved sliding window rate limiter with periodic cleanup ───
 _rate_limits: dict[str, list[float]] = {}
+_rate_limits_last_cleanup: float = 0.0
 RATE_LIMIT_REQUESTS = 30
 RATE_LIMIT_WINDOW = 60  # seconds
 
@@ -71,8 +72,17 @@ def _get_client_ip(request: Request) -> str:
     return request.client.host if request.client else "unknown"
 
 def _check_rate_limit(client_ip: str) -> bool:
-    """Sliding window rate limiter."""
+    """Sliding window rate limiter with periodic stale-IP cleanup."""
+    global _rate_limits_last_cleanup
     now = time.time()
+
+    # FIX v4.2: Periodic cleanup every 60s regardless of dict size
+    if now - _rate_limits_last_cleanup > 60:
+        stale = [ip for ip, ts in _rate_limits.items() if not ts or now - ts[-1] > RATE_LIMIT_WINDOW * 2]
+        for ip in stale:
+            del _rate_limits[ip]
+        _rate_limits_last_cleanup = now
+
     if client_ip not in _rate_limits:
         _rate_limits[client_ip] = []
 
@@ -85,13 +95,6 @@ def _check_rate_limit(client_ip: str) -> bool:
         return False
 
     _rate_limits[client_ip].append(now)
-
-    # Periodic cleanup of stale IPs (every 100 requests)
-    if len(_rate_limits) > 1000:
-        stale = [ip for ip, ts in _rate_limits.items() if not ts or now - ts[-1] > RATE_LIMIT_WINDOW * 2]
-        for ip in stale:
-            del _rate_limits[ip]
-
     return True
 
 # ─── Supabase helper ───
@@ -193,11 +196,15 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(title="ClauseGuard API", version="4.1.0", lifespan=lifespan)
 
+# FIX v4.2: CORS origins configurable via env var; localhost only in dev
+_extra_origins = os.environ.get("CORS_EXTRA_ORIGINS", "").split(",")
 ALLOWED_ORIGINS = [
     "https://clauseguardweb.netlify.app",
-    "http://localhost:3000",
-    "http://localhost:3001",
 ]
+# Only add localhost origins if explicitly enabled via env
+if os.environ.get("CORS_ALLOW_LOCALHOST", "").lower() == "true":
+    ALLOWED_ORIGINS.extend(["http://localhost:3000", "http://localhost:3001"])
+ALLOWED_ORIGINS.extend([o.strip() for o in _extra_origins if o.strip()])
 app.add_middleware(
     CORSMiddleware,
     allow_origins=ALLOWED_ORIGINS,