django-aegis 0.0.1__tar.gz

django_aegis-0.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 loowtide
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_aegis-0.0.1/PKG-INFO

@@ -0,0 +1,184 @@
+Metadata-Version: 2.4
+Name: django-aegis
+Version: 0.0.1
+Summary: IP based blocker with rate limiting
+Keywords: aegis,blocker,ip,rate limiting,api
+Author: loowtide
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: django>=6.0.5
+Requires-Dist: django-stubs>=6.0.4
+Requires-Dist: pytest-django>=4.12.0
+Requires-Dist: python-dotenv>=1.2.2
+Requires-Python: >=3.13
+Project-URL: Homepage, https://github.com/loowtide/aegis
+Description-Content-Type: text/markdown
+
+![Aegis](docs/aegis.svg)
+# Aegis
+
+Django middleware that blocks requests from IPs listed in a database-backed blocklist and optional cache-backed rate limiting. Returns styled 403/429 responses with a `Retry-After` header and tracks every blocked attempt.
+
+## Features
+
+- **IP Blocking** — database-backed blocklist with per-entry expiry (or permanent when `expires_at=None`)
+- **Rate Limiting** — cache-backed sliding-window rate limiter
+- **Auto-Blocking** — rate limit offenders can be automatically added to the blocklist
+- Atomic tally and `last_seen` tracking on each hit
+- Standards-compliant `Retry-After` header
+- Human-readable retry duration in rendered templates
+- Skip paths config (e.g., exempt admin/static from rate limiting)
+
+## Installation
+
+Add the middlewares to `MIDDLEWARE` in `settings.py`. `BlockedIPMiddleware` should come first so blocked requests short-circuit before auth, sessions, and views:
+
+```python
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "aegis.middleware.BlockedIPMiddleware",
+    "aegis.middleware.RateLimitMiddleware",
+    # ...
+]
+```
+
+Rate limiting requires a Django cache backend. Add one if you don't have one already:
+
+```python
+CACHES = {
+    "default": {
+        "BACKEND": "django.core.cache.backends.locmem.LocMemCache",
+    }
+}
+```
+
+Ensure `aegis` is in `INSTALLED_APPS`, then run migrations:
+
+```bash
+python manage.py migrate aegis
+```
+
+## Requirements
+
+| Component                        | Purpose                                                              |
+| -------------------------------- | -------------------------------------------------------------------- |
+| `aegis.models.BlockedIP`         | Model with fields: `ip`, `expires_at`, `last_seen`, `tally`          |
+| `aegis.utils.get_client_ip`      | Extracts the real client IP from the request                         |
+| `aegis.middleware.BlockedIPMiddleware` | Returns 403 for blocked IPs                                    |
+| `aegis.middleware.RateLimitMiddleware` | Returns 429 for rate-limited IPs, with optional auto-block     |
+| `aegis.rate_limit`               | Cache-backed rate limit engine                                      |
+| `aegis/templates/aegis/403.html` | Template for blocked requests; receives `retry_after_human`          |
+| `aegis/templates/aegis/429.html` | Template for rate-limited requests; receives `retry_after_human`     |
+
+## How It Works
+
+On every request, each middleware runs in order:
+
+### BlockedIPMiddleware
+
+1. Resolves the client IP via `get_client_ip(request)`.
+2. Looks up an active `BlockedIP` record (`expires_at > now` or `expires_at IS NULL` for permanent blocks).
+3. If none exists, the request proceeds normally.
+4. If one exists:
+   - Atomically increments `tally` and updates `last_seen` using `F()`.
+   - Computes seconds remaining until `expires_at` (or `None` for permanent blocks).
+   - Renders `aegis/403.html` with a humanized duration (or `"the foreseeable future"` for permanent blocks).
+   - Returns `403 Forbidden` with a `Retry-After` header (omitted for permanent blocks).
+
+### RateLimitMiddleware
+
+1. Checks if the request path should be rate limited (respects `AEGIS_RATE_LIMIT_SKIP_PATHS`).
+2. Resolves the client IP.
+3. Increments a cache-based counter for the current time window.
+4. If the count exceeds `AEGIS_RATE_LIMIT_REQUESTS`:
+   - Increments a violation counter.
+   - Optionally auto-blocks the IP via `BlockedIP` if violations reach `AEGIS_RATE_LIMIT_AUTO_BLOCK_THRESHOLD`.
+   - Returns `429 Too Many Requests` with a `Retry-After` header.
+5. If within limits, allows the request (at most one violation counted per time window).
+
+## Response Format
+
+### 403 Forbidden
+
+- **Status:** `403 Forbidden`
+- **Header:** `Retry-After: <seconds>` — minimum `1` (omitted for permanent blocks)
+- **Body:** Rendered HTML from `aegis/403.html`
+
+### 429 Too Many Requests
+
+- **Status:** `429 Too Many Requests`
+- **Header:** `Retry-After: <seconds>`
+- **Body:** Rendered HTML from `aegis/429.html`
+
+## Humanized Durations
+
+The `_humanize` helper converts seconds into the largest unit that fits, with correct pluralization:
+
+| Range   | Output         |
+| ------- | -------------- |
+| `< 60s` | `"42 seconds"` |
+| `< 60m` | `"7 minutes"`  |
+| `< 24h` | `"3 hours"`    |
+| `≥ 24h` | `"2 days"`     |
+
+## Configuration
+
+All settings are optional with sensible defaults.
+
+### Rate Limiting
+
+| Setting                               | Default  | Description                                   |
+| ------------------------------------- | -------- | --------------------------------------------- |
+| `AEGIS_RATE_LIMIT_ENABLED`            | `True`   | Toggle rate limiting on/off                   |
+| `AEGIS_RATE_LIMIT_REQUESTS`           | `100`    | Max requests per window                       |
+| `AEGIS_RATE_LIMIT_WINDOW`             | `60`     | Time window in seconds                        |
+| `AEGIS_RATE_LIMIT_AUTO_BLOCK`         | `True`   | Auto-block IPs that exceed violation threshold |
+| `AEGIS_RATE_LIMIT_AUTO_BLOCK_THRESHOLD` | `5`    | Consecutive limited windows before auto-block |
+| `AEGIS_RATE_LIMIT_BLOCK_DURATION`     | `3600`   | Block duration in seconds (default 1 hour)    |
+| `AEGIS_RATE_LIMIT_SKIP_PATHS`         | `[]`     | Path prefixes to exclude from rate limiting   |
+
+## Adding a Block
+
+Create a `BlockedIP` row anywhere in your code — a signal, management command, admin action, or rate-limit handler:
+
+```python
+from datetime import timedelta
+from django.utils import timezone
+from aegis.models import BlockedIP
+
+BlockedIP.objects.create(
+    ip="203.0.113.45",
+    expires_at=timezone.now() + timedelta(hours=1),
+)
+```
+
+For a permanent block, omit `expires_at` (set it to `None`):
+
+```python
+BlockedIP.objects.create(ip="203.0.113.45", reason="permanent ban")
+```
+
+The block takes effect on the offender's next request — no restart or cache invalidation needed.
+
+## Running Tests
+
+```bash
+pytest
+```
+
+Tests are in `aegis/tests/` and cover:
+
+| File                    | What it tests                                        |
+| ----------------------- | ---------------------------------------------------- |
+| `test_models.py`        | `BlockedIP.is_active` for permanent, future, expired |
+| `test_utils.py`         | `get_client_ip` with direct and proxied requests     |
+| `test_middleware.py`    | 403 responses, pass-through, tally tracking          |
+| `test_rate_limit.py`    | Rate limit counting, window slots, violations (one per window), 429 responses, auto-block, skip paths, permanent blocks |

django_aegis-0.0.1/README.md

@@ -0,0 +1,160 @@
+![Aegis](docs/aegis.svg)
+# Aegis
+
+Django middleware that blocks requests from IPs listed in a database-backed blocklist and optional cache-backed rate limiting. Returns styled 403/429 responses with a `Retry-After` header and tracks every blocked attempt.
+
+## Features
+
+- **IP Blocking** — database-backed blocklist with per-entry expiry (or permanent when `expires_at=None`)
+- **Rate Limiting** — cache-backed sliding-window rate limiter
+- **Auto-Blocking** — rate limit offenders can be automatically added to the blocklist
+- Atomic tally and `last_seen` tracking on each hit
+- Standards-compliant `Retry-After` header
+- Human-readable retry duration in rendered templates
+- Skip paths config (e.g., exempt admin/static from rate limiting)
+
+## Installation
+
+Add the middlewares to `MIDDLEWARE` in `settings.py`. `BlockedIPMiddleware` should come first so blocked requests short-circuit before auth, sessions, and views:
+
+```python
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "aegis.middleware.BlockedIPMiddleware",
+    "aegis.middleware.RateLimitMiddleware",
+    # ...
+]
+```
+
+Rate limiting requires a Django cache backend. Add one if you don't have one already:
+
+```python
+CACHES = {
+    "default": {
+        "BACKEND": "django.core.cache.backends.locmem.LocMemCache",
+    }
+}
+```
+
+Ensure `aegis` is in `INSTALLED_APPS`, then run migrations:
+
+```bash
+python manage.py migrate aegis
+```
+
+## Requirements
+
+| Component                        | Purpose                                                              |
+| -------------------------------- | -------------------------------------------------------------------- |
+| `aegis.models.BlockedIP`         | Model with fields: `ip`, `expires_at`, `last_seen`, `tally`          |
+| `aegis.utils.get_client_ip`      | Extracts the real client IP from the request                         |
+| `aegis.middleware.BlockedIPMiddleware` | Returns 403 for blocked IPs                                    |
+| `aegis.middleware.RateLimitMiddleware` | Returns 429 for rate-limited IPs, with optional auto-block     |
+| `aegis.rate_limit`               | Cache-backed rate limit engine                                      |
+| `aegis/templates/aegis/403.html` | Template for blocked requests; receives `retry_after_human`          |
+| `aegis/templates/aegis/429.html` | Template for rate-limited requests; receives `retry_after_human`     |
+
+## How It Works
+
+On every request, each middleware runs in order:
+
+### BlockedIPMiddleware
+
+1. Resolves the client IP via `get_client_ip(request)`.
+2. Looks up an active `BlockedIP` record (`expires_at > now` or `expires_at IS NULL` for permanent blocks).
+3. If none exists, the request proceeds normally.
+4. If one exists:
+   - Atomically increments `tally` and updates `last_seen` using `F()`.
+   - Computes seconds remaining until `expires_at` (or `None` for permanent blocks).
+   - Renders `aegis/403.html` with a humanized duration (or `"the foreseeable future"` for permanent blocks).
+   - Returns `403 Forbidden` with a `Retry-After` header (omitted for permanent blocks).
+
+### RateLimitMiddleware
+
+1. Checks if the request path should be rate limited (respects `AEGIS_RATE_LIMIT_SKIP_PATHS`).
+2. Resolves the client IP.
+3. Increments a cache-based counter for the current time window.
+4. If the count exceeds `AEGIS_RATE_LIMIT_REQUESTS`:
+   - Increments a violation counter.
+   - Optionally auto-blocks the IP via `BlockedIP` if violations reach `AEGIS_RATE_LIMIT_AUTO_BLOCK_THRESHOLD`.
+   - Returns `429 Too Many Requests` with a `Retry-After` header.
+5. If within limits, allows the request (at most one violation counted per time window).
+
+## Response Format
+
+### 403 Forbidden
+
+- **Status:** `403 Forbidden`
+- **Header:** `Retry-After: <seconds>` — minimum `1` (omitted for permanent blocks)
+- **Body:** Rendered HTML from `aegis/403.html`
+
+### 429 Too Many Requests
+
+- **Status:** `429 Too Many Requests`
+- **Header:** `Retry-After: <seconds>`
+- **Body:** Rendered HTML from `aegis/429.html`
+
+## Humanized Durations
+
+The `_humanize` helper converts seconds into the largest unit that fits, with correct pluralization:
+
+| Range   | Output         |
+| ------- | -------------- |
+| `< 60s` | `"42 seconds"` |
+| `< 60m` | `"7 minutes"`  |
+| `< 24h` | `"3 hours"`    |
+| `≥ 24h` | `"2 days"`     |
+
+## Configuration
+
+All settings are optional with sensible defaults.
+
+### Rate Limiting
+
+| Setting                               | Default  | Description                                   |
+| ------------------------------------- | -------- | --------------------------------------------- |
+| `AEGIS_RATE_LIMIT_ENABLED`            | `True`   | Toggle rate limiting on/off                   |
+| `AEGIS_RATE_LIMIT_REQUESTS`           | `100`    | Max requests per window                       |
+| `AEGIS_RATE_LIMIT_WINDOW`             | `60`     | Time window in seconds                        |
+| `AEGIS_RATE_LIMIT_AUTO_BLOCK`         | `True`   | Auto-block IPs that exceed violation threshold |
+| `AEGIS_RATE_LIMIT_AUTO_BLOCK_THRESHOLD` | `5`    | Consecutive limited windows before auto-block |
+| `AEGIS_RATE_LIMIT_BLOCK_DURATION`     | `3600`   | Block duration in seconds (default 1 hour)    |
+| `AEGIS_RATE_LIMIT_SKIP_PATHS`         | `[]`     | Path prefixes to exclude from rate limiting   |
+
+## Adding a Block
+
+Create a `BlockedIP` row anywhere in your code — a signal, management command, admin action, or rate-limit handler:
+
+```python
+from datetime import timedelta
+from django.utils import timezone
+from aegis.models import BlockedIP
+
+BlockedIP.objects.create(
+    ip="203.0.113.45",
+    expires_at=timezone.now() + timedelta(hours=1),
+)
+```
+
+For a permanent block, omit `expires_at` (set it to `None`):
+
+```python
+BlockedIP.objects.create(ip="203.0.113.45", reason="permanent ban")
+```
+
+The block takes effect on the offender's next request — no restart or cache invalidation needed.
+
+## Running Tests
+
+```bash
+pytest
+```
+
+Tests are in `aegis/tests/` and cover:
+
+| File                    | What it tests                                        |
+| ----------------------- | ---------------------------------------------------- |
+| `test_models.py`        | `BlockedIP.is_active` for permanent, future, expired |
+| `test_utils.py`         | `get_client_ip` with direct and proxied requests     |
+| `test_middleware.py`    | 403 responses, pass-through, tally tracking          |
+| `test_rate_limit.py`    | Rate limit counting, window slots, violations (one per window), 429 responses, auto-block, skip paths, permanent blocks |

django_aegis-0.0.1/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["uv_build>=0.9.21,<=0.12.0"]
+build-backend = "uv_build"
+
+[project]
+name = "django-aegis"
+version = "0.0.1"
+description = "IP based blocker with rate limiting"
+readme = "README.md"
+authors = [{ name = "loowtide" }]
+license = "MIT"
+license-files = ["LICEN[CS]E*"]
+requires-python = ">=3.13"
+dependencies = [
+  "django>=6.0.5",
+  "django-stubs>=6.0.4",
+  "pytest-django>=4.12.0",
+  "python-dotenv>=1.2.2",
+]
+keywords = ["aegis", "blocker", "ip", "rate limiting", "api"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "Topic :: Software Development :: Libraries",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+]
+
+
+[project.urls]
+Homepage = "https://github.com/loowtide/aegis"
+
+[tool.uv.build-backend]
+module-name = "aegis"
+
+[tool.mypy]
+plugins = ["mypy_django_plugin.main"]
+strict = true
+
+[tool.django-stubs]
+django_settings_module = "config.settings"
+
+[dependency-groups]
+dev = ["mypy>=2.1.0", "django-stubs[compatible-mypy]>=5.1.0"]

django_aegis-0.0.1/src/aegis/admin.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+from django.contrib import admin
+from django.db.models.query import QuerySet
+from django.http import HttpRequest
+from django.utils import timezone
+
+from aegis.models import BlockedIP
+
+
+class ActiveStatusFilter(admin.SimpleListFilter):
+    title = "status"
+    parameter_name = "status"
+
+    def lookups(
+        self, request: HttpRequest, model_admin: admin.ModelAdmin[BlockedIP]
+    ) -> list[tuple[str, str]]:
+        return [
+            ("active", "Active"),
+            ("expired", "Expired"),
+            ("permanent", "Permanent"),
+        ]
+
+    def queryset(
+        self, request: HttpRequest, queryset: QuerySet[BlockedIP]
+    ) -> QuerySet[BlockedIP]:
+        now = timezone.now()
+        if self.value() == "active":
+            return queryset.filter(expires_at__gt=now)
+        if self.value() == "expired":
+            return queryset.filter(expires_at__lte=now)
+        if self.value() == "permanent":
+            return queryset.filter(expires_at__isnull=True)
+        return queryset
+
+
+@admin.register(BlockedIP)
+class BlockedIPAdmin(admin.ModelAdmin):  # type: ignore[type-arg]
+    list_display = ["ip", "reason", "blocked_at", "expires_at", "last_seen"]
+    search_fields = [
+        "ip",
+    ]
+    list_filter = [ActiveStatusFilter, "blocked_at"]
+    ordering = ["-blocked_at"]

django_aegis-0.0.1/src/aegis/apps.py

@@ -0,0 +1,5 @@
+from django.apps import AppConfig
+
+
+class AegisConfig(AppConfig):
+    name = "aegis"

django_aegis-0.0.1/src/aegis/middleware.py

@@ -0,0 +1,107 @@
+from collections.abc import Callable
+
+from django.conf import settings
+from django.db.models import F, Q
+from django.http import HttpRequest, HttpResponse
+from django.template.loader import render_to_string
+from django.utils import timezone
+
+from aegis.models import BlockedIP
+from aegis.rate_limit import (
+    auto_block,
+    increment_violations,
+    is_rate_limited,
+    reset_if_clean_window,
+    #    reset_if_clean_window,
+)
+from aegis.utils import get_client_ip
+
+
+def _humanize(seconds: int) -> str:
+    if seconds < 60:
+        return f"{seconds} second{'s' if seconds != 1 else ''}"
+    if seconds < 3600:
+        m = seconds // 60
+        return f"{m} minute{'s' if m != 1 else ''}"
+    if seconds < 86400:
+        h = seconds // 3600
+        return f"{h} hour{'s' if h != 1 else ''}"
+    d = seconds // 86400
+    return f"{d} day{'s' if d != 1 else ''}"
+
+
+class BlockedIPMiddleware:
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]) -> None:
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        ip = get_client_ip(request)
+        if not ip:
+            return self.get_response(request)
+        now = timezone.now()
+        entry = BlockedIP.objects.filter(
+            Q(expires_at__isnull=True) | Q(expires_at__gt=now), ip=ip
+        ).first()
+        if entry:
+            BlockedIP.objects.filter(pk=entry.pk).update(
+                last_seen=now, tally=F("tally") + 1
+            )
+            if entry.expires_at is None:
+                retry_after = None
+            else:
+                retry_after = max(1, int((entry.expires_at - now).total_seconds()))
+            html = render_to_string(
+                "aegis/403.html",
+                {
+                    "retry_after_human": _humanize(retry_after)
+                    if retry_after
+                    else "the foreseeable future"
+                },
+                request=request,
+            )
+            response = HttpResponse(html, status=403)
+            if retry_after is not None:
+                response["Retry-After"] = str(retry_after)
+            return response
+        return self.get_response(request)
+
+
+class RateLimitMiddleware:
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]) -> None:
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        if not self._should_rate_limit(request):
+            return self.get_response(request)
+        ip = get_client_ip(request)
+        if not ip:
+            return self.get_response(request)
+        window = getattr(settings, "AEGIS_RATE_LIMIT_WINDOW", 60)
+        max_requests = getattr(settings, "AEGIS_RATE_LIMIT_REQUESTS", 100)
+        auto_block_enabled = getattr(settings, "AEGIS_RATE_LIMIT_AUTO_BLOCK", True)
+        threshold = getattr(settings, "AEGIS_RATE_LIMIT_AUTO_BLOCK_THRESHOLD", 5)
+        block_duration = getattr(settings, "AEGIS_RATE_LIMIT_BLOCK_DURATION", 3600)
+        limited, _ = is_rate_limited(ip, max_requests, window)
+        if limited:
+            violations = increment_violations(ip, window, threshold)
+            if auto_block_enabled and violations >= threshold:
+                auto_block(ip, block_duration)
+            retry_after = window
+            html = render_to_string(
+                "aegis/429.html",
+                {"retry_after_human": _humanize(retry_after)},
+                request=request,
+            )
+            response = HttpResponse(html, status=429)
+            response["Retry-After"] = str(retry_after)
+            return response
+        else:
+            reset_if_clean_window(ip, window, threshold)
+        return self.get_response(request)
+
+    def _should_rate_limit(self, request: HttpRequest) -> bool:
+        if not getattr(settings, "AEGIS_RATE_LIMIT_ENABLED", True):
+            return False
+        skip_paths = getattr(settings, "AEGIS_RATE_LIMIT_SKIP_PATHS", [])
+        path = request.path_info
+        return not any(path.startswith(p) for p in skip_paths)

django_aegis-0.0.1/src/aegis/migrations/0001_initial.py

@@ -0,0 +1,44 @@
+# Generated by Django 6.0.5 on 2026-05-23 12:48
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = []
+
+    operations = [
+        migrations.CreateModel(
+            name="BlockedIP",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                (
+                    "ip",
+                    models.GenericIPAddressField(
+                        db_index=True, unique=True, verbose_name="IP address"
+                    ),
+                ),
+                ("reason", models.TextField()),
+                ("blocked_at", models.DateTimeField(auto_now_add=True)),
+                (
+                    "expires_at",
+                    models.DateTimeField(blank=True, db_index=True, null=True),
+                ),
+                ("tally", models.PositiveIntegerField(default=0)),
+                ("last_seen", models.DateTimeField(blank=True, null=True)),
+            ],
+            options={
+                "verbose_name": "Blocked IP",
+                "ordering": ["-blocked_at"],
+            },
+        ),
+    ]

django_aegis-0.0.1/src/aegis/models.py

@@ -0,0 +1,24 @@
+from django.db import models
+from django.utils import timezone
+
+
+class BlockedIP(models.Model):
+    ip = models.GenericIPAddressField(unique=True, verbose_name="IP address")
+    reason = models.TextField()
+    blocked_at = models.DateTimeField(auto_now_add=True)
+    expires_at = models.DateTimeField(null=True, blank=True, db_index=True)
+    tally = models.PositiveIntegerField(default=0)
+    last_seen = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        verbose_name = "Blocked IP"
+        ordering = ["-blocked_at"]
+
+    def __str__(self) -> str:
+        return f"{self.ip}"
+
+    @property
+    def is_active(self) -> bool:
+        if self.expires_at is None:
+            return True  # permanent block
+        return timezone.now() < self.expires_at

django_aegis-0.0.1/src/aegis/rate_limit.py

@@ -0,0 +1,111 @@
+from datetime import timedelta
+
+from django.core.cache import cache
+from django.utils import timezone
+
+from aegis.models import BlockedIP
+
+
+def _window_slot(window: int) -> int:
+    now = int(timezone.now().timestamp())
+    return now - (now % window)
+
+
+def _rate_limit_key(ip: str, window: int) -> str:
+    slot = _window_slot(window)
+    return f"aegis:{ip}:{slot}"
+
+
+def _violation_key(ip: str) -> str:
+    return f"aegis:{ip}:violations"
+
+
+def _clean_streak_key(ip: str) -> str:
+    return f"aegis:{ip}:clean_streak"
+
+
+def _last_seen_window_key(ip: str) -> str:
+    return f"aegis:{ip}:last_seen_window"
+
+
+def is_rate_limited(
+    ip: str, max_requests: int = 100, window: int = 60
+) -> tuple[bool, int]:
+    key = _rate_limit_key(ip, window)
+    if cache.add(key, 1, timeout=window * 2):
+        return False, 1
+    try:
+        count = cache.incr(key)
+    except ValueError:
+        cache.add(key, 1, timeout=window * 2)
+        count = 1
+    return count > max_requests, count
+
+
+def get_violations(ip: str) -> int:
+    return cache.get(_violation_key(ip)) or 0
+
+
+def increment_violations(ip: str, window: int, threshold: int) -> int:
+    key = _violation_key(ip)
+    timeout = window * threshold * 2
+    slot = _window_slot(window)
+    last_key = _last_seen_window_key(ip)
+    if cache.get(last_key) == slot:
+        return get_violations(ip)
+    if cache.add(key, 1, timeout=timeout):
+        v = 1
+    else:
+        try:
+            v = cache.incr(key)
+        except ValueError:
+            cache.add(key, 1, timeout=timeout)
+            v = 1
+    cache.touch(key, timeout)
+    cache.set(_clean_streak_key(ip), 0, timeout=timeout)
+    cache.set(last_key, slot, timeout=timeout)
+    return v
+
+
+def reset_if_clean_window(ip: str, window: int, threshold: int) -> int:
+    key = _violation_key(ip)
+    streak = _clean_streak_key(ip)
+    last_key = _last_seen_window_key(ip)
+    timeout = window * threshold * 2
+    slot = _window_slot(window)
+    if cache.get(last_key) == slot:
+        return get_violations(ip)
+
+    cache.set(last_key, slot, timeout=timeout)
+    if get_violations(ip) == 0:
+        return 0
+    if cache.add(streak, 1, timeout=timeout):
+        streak_cnt = 1
+    else:
+        try:
+            streak_cnt = cache.incr(streak)
+        except ValueError:
+            cache.add(streak, 1, timeout=timeout)
+            streak_cnt = 1
+    cache.touch(streak, timeout)
+
+    if streak_cnt >= threshold:
+        cache.set(key, 0, timeout=timeout)
+        cache.set(streak, 0, timeout=timeout)
+        return 0
+
+    return get_violations(ip)
+
+
+def auto_block(ip: str, duration: int, extend_active: bool = False) -> BlockedIP:
+    reason = "Rate limit violation threshold exceeded"
+    expires_at = timezone.now() + timedelta(seconds=duration)
+    blocked, _ = BlockedIP.objects.get_or_create(
+        ip=ip,
+        defaults={"reason": reason, "expires_at": expires_at},
+    )
+    if not blocked.expires_at or blocked.expires_at < timezone.now() or extend_active:
+        blocked.expires_at = expires_at
+        blocked.reason = reason
+        blocked.save(update_fields=["expires_at", "reason"])
+    return blocked

django_aegis-0.0.1/src/aegis/templates/aegis/403.html

@@ -0,0 +1,56 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Just a moment</title>
+        <style>
+            * {
+                box-sizing: border-box;
+            }
+            body {
+                font-family:
+                    -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
+                    sans-serif;
+                background: #fafaf9;
+                color: #1c1917;
+                display: flex;
+                align-items: center;
+                justify-content: center;
+                min-height: 100vh;
+                margin: 0;
+                padding: 1.5rem;
+                line-height: 1.6;
+            }
+            main {
+                max-width: 420px;
+                text-align: center;
+            }
+            h1 {
+                font-size: 1.5rem;
+                font-weight: 600;
+                margin: 0 0 1rem;
+            }
+            p {
+                color: #57534e;
+                margin: 0.5rem 0;
+            }
+            .retry {
+                margin-top: 1.5rem;
+                color: #78716c;
+                font-size: 0.9rem;
+            }
+        </style>
+    </head>
+    <body>
+        <main>
+            <h1>Just a moment</h1>
+            <p>
+                We've paused requests from your connection for a little while.
+            </p>
+            {% if retry_after_human %}
+            <p class="retry">You can try again in {{ retry_after_human }}.</p>
+            {% endif %}
+        </main>
+    </body>
+</html>

django_aegis-0.0.1/src/aegis/templates/aegis/429.html

@@ -0,0 +1,54 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>Too Many Requests</title>
+        <style>
+            * {
+                box-sizing: border-box;
+            }
+            body {
+                font-family:
+                    -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
+                    sans-serif;
+                background: #fafaf9;
+                color: #1c1917;
+                display: flex;
+                align-items: center;
+                justify-content: center;
+                min-height: 100vh;
+                margin: 0;
+                padding: 1.5rem;
+                line-height: 1.6;
+            }
+            main {
+                max-width: 420px;
+                text-align: center;
+            }
+            h1 {
+                font-size: 1.5rem;
+                font-weight: 600;
+                margin: 0 0 1rem;
+            }
+            p {
+                color: #57534e;
+                margin: 0.5rem 0;
+            }
+            .retry {
+                margin-top: 1.5rem;
+                color: #78716c;
+                font-size: 0.9rem;
+            }
+        </style>
+    </head>
+    <body>
+        <main>
+            <h1>Too Many Requests</h1>
+            <p>You've made too many requests. Please slow down.</p>
+            {% if retry_after_human %}
+            <p class="retry">You can try again in {{ retry_after_human }}.</p>
+            {% endif %}
+        </main>
+    </body>
+</html>

django_aegis-0.0.1/src/aegis/tests/.ruff_cache/.gitignore

@@ -0,0 +1,2 @@
+# Automatically created by ruff.
+*

django_aegis-0.0.1/src/aegis/tests/.ruff_cache/CACHEDIR.TAG

@@ -0,0 +1 @@
+Signature: 8a477f597d28d172789f06886806bc55

django_aegis-0.0.1/src/aegis/tests/test_middleware.py

@@ -0,0 +1,46 @@
+from datetime import timedelta
+
+import pytest
+from django.test import Client
+from django.utils import timezone
+
+from aegis.models import BlockedIP
+
+
+@pytest.mark.django_db
+class TestMiddleware:
+    def test_middleware_returns_403_for_blocked_ip(self) -> None:
+        """Middleware returns 403 for blocked ip."""
+
+        future = timezone.now() + timedelta(hours=1)
+        BlockedIP.objects.create(ip="127.0.0.1", reason="test", expires_at=future)
+        client = Client(REMOTE_ADDR="127.0.0.1")
+        response = client.get("/admin/")
+        assert response.status_code == 403
+
+    def test_middlware_passes_through_non_block(self) -> None:
+        """Middleware let pass the non blocked ips."""
+
+        client = Client(REMOTE_ADDR="127.0.0.1")
+        response = client.get("/admin/")
+        assert response.status_code == 302
+
+    def test_middleware_passes_through_expired_ips(self) -> None:
+        """Middleware also let expired ips to pass through."""
+
+        past = timezone.now() - timedelta(hours=1)
+        BlockedIP.objects.create(ip="127.0.0.1", expires_at=past)
+        client = Client(REMOTE_ADDR="127.0.0.1")
+        response = client.get("/admin/")
+        assert response.status_code == 302
+
+    def test_middleware_tally_increment(self) -> None:
+        """Tally increments on blocked ips"""
+
+        future = timezone.now() + timedelta(hours=1)
+        blocked = BlockedIP.objects.create(ip="127.0.0.1", expires_at=future)
+        client = Client(REMOTE_ADDR="127.0.0.1")
+        for i in range(4):
+            client.get("/admin/")
+        blocked.refresh_from_db()
+        assert blocked.tally == 4

django_aegis-0.0.1/src/aegis/tests/test_models.py

@@ -0,0 +1,32 @@
+from datetime import timedelta
+
+import pytest
+from django.utils import timezone
+
+from aegis.models import BlockedIP
+
+
+@pytest.mark.django_db
+class TestBlockedIP:
+    def test_is_active_when_expires_at_is_none(self) -> None:
+        """Permanent Blocks are always active."""
+
+        blocked = BlockedIP.objects.create(
+            ip="127.0.0.3",
+            reason="spam",
+        )
+        assert blocked.is_active
+
+    def test_is_active_when_expires_at_in_future(self) -> None:
+        """BLocks with future expiry are still active."""
+
+        future = timezone.now() + timedelta(hours=1)
+        blocked = BlockedIP.objects.create(ip="127.0.0.2", expires_at=future)
+        assert blocked.is_active
+
+    def test_is_active_expires_at_in_past(self) -> None:
+        """Blocks past their expiry are not active(expired)."""
+
+        past = timezone.now() - timedelta(hours=1)
+        blocked = BlockedIP.objects.create(ip="127.0.0.3", expires_at=past)
+        assert not blocked.is_active

django_aegis-0.0.1/src/aegis/tests/test_rate_limit.py

@@ -0,0 +1,194 @@
+from datetime import timedelta
+from unittest.mock import patch
+
+from django.conf import settings
+from django.core.cache import cache
+from django.test import Client, TestCase, override_settings
+from django.utils import timezone
+
+from aegis.models import BlockedIP
+from aegis.rate_limit import (
+    _clean_streak_key,
+    _violation_key,
+    _window_slot,
+    increment_violations,
+    is_rate_limited,
+    reset_if_clean_window,
+)
+
+
+@override_settings(AEGIS_RATE_LIMIT_REQUESTS=100)
+class TestRateLimit(TestCase):
+    def setUp(self) -> None:
+        cache.clear()
+
+    def test_under_limit_passes(self) -> None:
+        limited, count = is_rate_limited("127.0.0.14", 100, 60)
+        assert not limited
+        assert count == 1
+
+    def test_over_limit_detected(self) -> None:
+        ip = "127.0.0.3"
+        window = 60
+        max_req = 3
+        for _ in range(max_req):
+            is_rate_limited(ip, max_req, window)
+        limited, count = is_rate_limited(ip, max_req, window)
+        assert limited
+        assert count == 4
+
+    def test_window_slot_changes(self) -> None:
+        slot_a = _window_slot(60)
+        with patch("aegis.rate_limit.timezone") as mock_tz:
+            mock_tz.now.return_value = timezone.now() + timedelta(seconds=120)
+            mock_tz.timedelta = timedelta
+            slot_b = _window_slot(60)
+        assert slot_b > slot_a
+
+    def test_violations_persist_without_clean_windows(self) -> None:
+        ip = "127.0.0.99"
+        window = 60
+        threshold = 5
+        base = _window_slot(window)
+        with patch("aegis.rate_limit._window_slot") as mock_slot:
+            mock_slot.return_value = base
+            assert increment_violations(ip, window, threshold) == 1
+            mock_slot.return_value = base + 2 * window
+            assert increment_violations(ip, window, threshold) == 2
+            mock_slot.return_value = base + 5 * window
+            assert increment_violations(ip, window, threshold) == 3
+
+    def test_one_violation_per_window(self) -> None:
+        ip = "127.0.0.98"
+        window = 60
+        threshold = 5
+        with patch("aegis.rate_limit._window_slot") as mock_slot:
+            mock_slot.return_value = _window_slot(window)
+            assert increment_violations(ip, window, threshold) == 1
+            assert increment_violations(ip, window, threshold) == 1
+
+
+@override_settings(AEGIS_RATE_LIMIT_REQUESTS=100)
+class TestAutoBlock(TestCase):
+    def test_under_limit_no_block(self) -> None:
+        client = Client(REMOTE_ADDR="127.0.0.10")
+        for _ in range(50):
+            resp = client.get("/some-page/")
+            assert resp.status_code in (200, 404)
+        assert BlockedIP.objects.filter(ip="127.0.0.10").count() == 0
+
+    def test_rate_limit_returns_429(self) -> None:
+        ip = "127.0.0.11"
+        client = Client(REMOTE_ADDR=ip)
+        resp = None
+        for _ in range(101):
+            resp = client.get("/some-page/")
+        assert resp is not None
+        assert resp.status_code == 429
+        assert "Retry-After" in resp
+
+    def test_skip_paths_bypass_rate_limit(self) -> None:
+        client = Client(REMOTE_ADDR="127.0.0.12")
+        with patch.object(settings, "AEGIS_RATE_LIMIT_SKIP_PATHS", ["/skip-me/"]):
+            resp = client.get("/skip-me/")
+            assert resp.status_code != 429
+
+    def test_auto_block_creates_blockedip(self) -> None:
+        ip = "127.0.0.13"
+        window = 60
+        threshold = 3
+        duration = 300
+
+        from aegis.rate_limit import auto_block
+
+        for _ in range(threshold):
+            increment_violations(ip, window, threshold)
+
+        auto_block(ip, duration)
+        entry = BlockedIP.objects.filter(ip=ip).first()
+        assert entry is not None
+        assert entry.reason == "Rate limit violation threshold exceeded"
+        assert entry.expires_at is not None
+        assert entry.expires_at > timezone.now()
+
+    def test_existing_blocked_ips_get_403_via_middleware(self) -> None:
+        ip = "127.0.0.14"
+        BlockedIP.objects.create(
+            ip=ip,
+            reason="auto-blocked",
+            expires_at=timezone.now() + timedelta(hours=1),
+        )
+        client = Client(REMOTE_ADDR=ip)
+        resp = client.get("/some-page/")
+        assert resp.status_code == 403
+
+    def test_permanent_block_returns_403(self) -> None:
+        ip = "127.0.0.4"
+        BlockedIP.objects.create(ip=ip, reason="permanent", expires_at=None)
+        client = Client(REMOTE_ADDR=ip)
+        resp = client.get("/some-page")
+        assert resp.status_code == 403
+
+
+class TestCleanWindowReset(TestCase):
+    def setUp(self) -> None:
+        cache.clear()
+
+    def test_reset_after_n_consecutive_clean_windows(self) -> None:
+        ip = "127.0.0.50"
+        window = 60
+        threshold = 3
+        base = _window_slot(window)
+        with patch("aegis.rate_limit._window_slot") as mock_slot:
+            mock_slot.return_value = base
+            increment_violations(ip, window, threshold)
+            mock_slot.return_value = base + window
+            increment_violations(ip, window, threshold)
+            assert cache.get(_violation_key(ip)) == 2
+
+            mock_slot.return_value = base + 2 * window
+            reset_if_clean_window(ip, window, threshold)
+            mock_slot.return_value = base + 3 * window
+            reset_if_clean_window(ip, window, threshold)
+            mock_slot.return_value = base + 4 * window
+            result = reset_if_clean_window(ip, window, threshold)
+            assert result == 0
+            assert cache.get(_violation_key(ip)) in (0, None)
+
+    def test_violation_breaks_clean_streak(self) -> None:
+        ip = "127.0.0.51"
+        window = 60
+        threshold = 3
+        base = _window_slot(window)
+        with patch("aegis.rate_limit._window_slot") as mock_slot:
+            mock_slot.return_value = base
+            increment_violations(ip, window, threshold)
+            mock_slot.return_value = base + window
+            reset_if_clean_window(ip, window, threshold)
+            mock_slot.return_value = base + 2 * window
+            reset_if_clean_window(ip, window, threshold)
+            mock_slot.return_value = base + 3 * window
+            increment_violations(ip, window, threshold)
+            assert cache.get(_clean_streak_key(ip)) == 0
+
+    def test_no_op_on_ip_with_no_violation_history(self) -> None:
+        ip = "127.0.0.60"
+        window = 60
+        threshold = 3
+        result = reset_if_clean_window(ip, window, threshold)
+        assert result == 0
+        assert cache.get(_clean_streak_key(ip)) is None
+
+    def test_duplicate_clean_calls_same_window_are_noop(self) -> None:
+        ip = "127.0.0.61"
+        window = 60
+        threshold = 3
+        base = _window_slot(window)
+        with patch("aegis.rate_limit._window_slot") as mock_slot:
+            mock_slot.return_value = base
+            increment_violations(ip, window, threshold)
+            mock_slot.return_value = base + window
+            r1 = reset_if_clean_window(ip, window, threshold)
+            r2 = reset_if_clean_window(ip, window, threshold)
+            assert r1 == r2
+            assert cache.get(_clean_streak_key(ip)) == 1

django_aegis-0.0.1/src/aegis/tests/test_utils.py

@@ -0,0 +1,86 @@
+import pytest
+from django.test import RequestFactory, override_settings
+
+from aegis.utils import _is_trusted, get_client_ip
+
+
+@pytest.mark.django_db
+class TestUtils:
+    def test_get_client_ip_for_direct_conn(self) -> None:
+        """get ip address for direct connection."""
+
+        factory = RequestFactory()
+        request = factory.get("/", REMOTE_ADDR="127.0.0.2")
+        assert get_client_ip(request) == "127.0.0.2"
+
+    def test_get_client_ip_from_x_forwarded_for_trusted(self) -> None:
+        factory = RequestFactory()
+        request = factory.get(
+            "/", REMOTE_ADDR="127.0.0.1", HTTP_X_FORWARDED_FOR="223.20.1.0"
+        )
+        assert get_client_ip(request) == "223.20.1.0"
+
+    def test_get_client_ip_from_x_forwarded_for_untrusted(self) -> None:
+        factory = RequestFactory()
+        request = factory.get(
+            "/", REMOTE_ADDR="127.0.0.2", HTTP_X_FORWARDED_FOR="10.0.0.2"
+        )
+        assert get_client_ip(request) == "127.0.0.2"
+
+
+@pytest.mark.django_db
+class TestIsTrustedIPv4Only:
+    def test_trusts_loopback_by_default(self) -> None:
+        assert _is_trusted("127.0.0.1") is True
+
+    def test_trusts_ip_in_configured_cidr(self) -> None:
+        with override_settings(AEGIS_TRUSTED_PROXY_NETWORKS=["10.0.0.0/8"]):
+            from aegis import utils
+
+            utils.TRUSTED_PROXY_NETWORKS = utils._load_trusted_networks()
+            assert _is_trusted("10.1.2.3") is True
+            assert _is_trusted("11.1.2.3") is False
+        from aegis import utils
+
+        utils.TRUSTED_PROXY_NETWORKS = utils._load_trusted_networks()
+
+    def test_rejects_ipv6_even_if_supplied(self) -> None:
+        assert _is_trusted("::1") is False
+
+    def test_rejects_garbage(self) -> None:
+        assert _is_trusted("not-an-ip") is False
+        assert _is_trusted("") is False
+
+
+@pytest.mark.django_db
+class TestGetClientIpSpoofing:
+    def test_attacker_prepended_entries_are_ignored(self) -> None:
+        factory = RequestFactory()
+        request = factory.get(
+            "/", REMOTE_ADDR="127.0.0.1", HTTP_X_FORWARDED_FOR="9.9.9.9, 198.51.100.7"
+        )
+        assert get_client_ip(request) == "198.51.100.7"
+
+    def test_depth_two_requires_two_hops(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        from aegis import utils
+
+        monkeypatch.setattr(utils, "TRUSTED_PROXY_DEPTH", 2)
+        factory = RequestFactory()
+        request = factory.get(
+            "/",
+            REMOTE_ADDR="127.0.0.1",
+            HTTP_X_FORWARDED_FOR="9.9.9.9, 10.0.0.5, 198.51.100.7",
+        )
+        assert get_client_ip(request) == "10.0.0.5"
+
+    def test_short_header_falls_back_to_remote_addr(self) -> None:
+        from aegis import utils
+
+        factory = RequestFactory()
+        request = factory.get(
+            "/", REMOTE_ADDR="127.0.0.1", HTTP_X_FORWARDED_FOR="198.51.100.7"
+        )
+        with override_settings(AEGIS_TRUSTED_PROXY_DEPTH=3):
+            utils.TRUSTED_PROXY_DEPTH = 3
+            assert get_client_ip(request) == "127.0.0.1"
+        utils.TRUSTED_PROXY_DEPTH = 1

django_aegis-0.0.1/src/aegis/utils.py

@@ -0,0 +1,80 @@
+import ipaddress
+import logging
+from datetime import datetime
+from typing import Any
+
+from django.conf import settings
+from django.db.models import Q
+from django.http import HttpRequest
+from django.utils import timezone
+
+from aegis.models import BlockedIP
+
+logger = logging.getLogger(__name__)
+
+
+def _load_trusted_networks() -> list[ipaddress.IPv4Network | ipaddress.IPv6Network]:
+    raw = getattr(settings, "AEGIS_TRUSTED_PROXY_NETWORKS", ["127.0.0.1"])
+    networks = []
+    for entry in raw:
+        try:
+            networks.append(ipaddress.ip_network(entry, strict=False))
+        except ValueError:
+            logger.warning("aegis: ignoring invalid trusted proxy network %r", entry)
+    return networks
+
+
+TRUSTED_PROXY_NETWORKS = _load_trusted_networks()
+TRUSTED_PROXY_DEPTH = getattr(settings, "AEGIS_TRUSTED_PROXY_DEPTH")
+
+
+def _is_trusted(ip: str) -> bool:
+    try:
+        addr = ipaddress.ip_address(ip)
+    except ValueError:
+        return False
+    return any(
+        addr in net
+        for net in TRUSTED_PROXY_NETWORKS
+        if isinstance(net, ipaddress.IPv4Network)
+    )
+
+
+def get_client_ip(request: HttpRequest) -> Any:
+    remote_addr = request.META.get("REMOTE_ADDR")
+    if not remote_addr or not _is_trusted(remote_addr):
+        return remote_addr
+    xff = request.META.get("HTTP_X_FORWARDED_FOR")
+    if not xff:
+        return remote_addr
+
+    hops = [h.strip() for h in xff.split(",") if h.strip()]
+    if not hops:
+        return remote_addr
+
+    if TRUSTED_PROXY_DEPTH < 1:
+        logger.warning("aegis: AEGIS_PROXY_DEPTH <1 ,XFF ignored")
+        return remote_addr
+
+    if len(hops) < TRUSTED_PROXY_DEPTH:
+        logger.warning(
+            "aegis: XFF has  %d hop(s), expected at least %d, falling to REMOTE_ADDR",
+            len(hops),
+            TRUSTED_PROXY_DEPTH,
+        )
+        return remote_addr
+
+    client_ip = hops[-TRUSTED_PROXY_DEPTH]
+    try:
+        ipaddress.ip_address(client_ip)
+    except ValueError:
+        logger.warning("aegis: XFF client entry %r is not valid IP", client_ip)
+        return remote_addr
+    return client_ip
+
+
+def should_block(ip: str, now: datetime | None = None) -> BlockedIP | None:
+    now = now or timezone.now()
+    return BlockedIP.objects.filter(
+        Q(expires_at__isnull=True) | Q(expires_at__gt=now), ip=ip
+    ).first()