Python FastAPI ile JWT Kimlik Doğrulama ve IP Tabanlı Rate Limiter

import time
from fastapi import Request, HTTPException, Security, Depends
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
import jwt

SECRET_KEY = "super-gizli-anahtar-buraya"
ALGORITHM = "HS256"
security = HTTPBearer()

# Basit In-Memory Rate Limiter Yapısı
REQUEST_LIMIT = 60  # Dakikada maks 60 istek
TIME_WINDOW = 60    # 60 saniye
ip_requests = {}

def rate_limiter(request: Request):
    client_ip = request.client.host
    current_time = time.time()
    
    if client_ip not in ip_requests:
        ip_requests[client_ip] = []
        
    # 60 saniyeden eski istekleri temizle
    ip_requests[client_ip] = [t for t in ip_requests[client_ip] if current_time - t < TIME_WINDOW]
    
    if len(ip_requests[client_ip]) >= REQUEST_LIMIT:
        raise HTTPException(status_code=429, detail="Çok fazla istek gönderildi. Lütfen bekleyin.")
    
    ip_requests[client_ip].append(current_time)

def verify_jwt_token(credentials: HTTPAuthorizationCredentials = Security(security)):
    token = credentials.credentials
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        return payload  # Kullanıcı verilerini döndürür
    except jwt.ExpiredSignatureError:
        raise HTTPException(status_code=401, detail="Token süresi doldu")
    except jwt.InvalidTokenError:
        raise HTTPException(status_code=401, detail="Geçersiz Token")

# Örnek Korunan Route Kullanımı:
# @app.get("/protected-route", dependencies=[Depends(rate_limiter)])
# def protected_data(user_info: dict = Depends(verify_jwt_token)):
#     return {"data": "Gizli veri", "user": user_info}