Add user agent blocklist, use X-Real-IP header for IP detection

backend/routes/moderation.py

@@ -7,6 +7,13 @@ from dependencies import get_current_user
 from models import User
 from security.audit import log_security
 from security.profanity import add_to_blocklist, get_blocklist, remove_from_blocklist
+from security.user_agent_blocklist import (
+    add_to_blocklist as add_ua_to_blocklist,
+    get_blocklist as get_ua_blocklist,
+    get_static_blocklist as get_ua_static_blocklist,
+    get_external_blocklist as get_ua_external_blocklist,
+    remove_from_blocklist as remove_ua_from_blocklist,
+)
 
 
 class BlocklistUpdateRequest(BaseModel):
@@ -58,3 +65,45 @@ def delete_from_blocklist(
     )
     return {"removed": removed, "words": updated}
 
+
+@router.get("/user-agent-blocklist")
+def list_user_agent_blocklist(current_user: User = Depends(get_current_user)):
+    _ensure_owner(current_user)
+    return {
+        "patterns": get_ua_blocklist(),
+        "static": get_ua_static_blocklist(),
+        "external": get_ua_external_blocklist(),
+    }
+
+
+@router.post("/user-agent-blocklist")
+def append_user_agent_blocklist(
+    request: BlocklistUpdateRequest,
+    current_user: User = Depends(get_current_user)
+):
+    _ensure_owner(current_user)
+    added, updated = add_ua_to_blocklist(request.words)
+    log_security(
+        "user_agent_blocklist_add",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        added=added,
+    )
+    return {"added": added, "patterns": updated}
+
+
+@router.delete("/user-agent-blocklist")
+def delete_from_user_agent_blocklist(
+    request: BlocklistUpdateRequest,
+    current_user: User = Depends(get_current_user)
+):
+    _ensure_owner(current_user)
+    removed, updated = remove_ua_from_blocklist(request.words)
+    log_security(
+        "user_agent_blocklist_remove",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        removed=removed,
+    )
+    return {"removed": removed, "patterns": updated}
+