Update app.py

app.py

@@ -43,7 +43,7 @@ _request_log_cache = {
     "ts": 0.0,
     "data": None,  # Cached parsed log data
 }
-REQUEST_LOG_CACHE_TTL_SEC = 30.0  # Cache log for 30 seconds
+REQUEST_LOG_CACHE_TTL_SEC = 15.0  # Cache log for 15 seconds
 
 # -------------------------
 # Helpers
@@ -147,8 +147,9 @@ def _log_request(
 
     _request_log_buffer.append(log_entry)
 
-    # Flush buffer to Hub every 10 requests or if suspicious activity detected
-    if len(_request_log_buffer) >= 10 or suspicious_flags:
+    # Flush buffer to Hub every 5 requests or if suspicious activity detected
+    # Lower threshold to ensure better tracking in load-balanced environments
+    if len(_request_log_buffer) >= 5 or suspicious_flags:
         _flush_request_log()
 
 def _flush_request_log():
@@ -231,10 +232,22 @@ def _get_recent_requests_from_log(ip_address: str) -> list:
 def _check_suspicious_activity(ip_address: str, order_number: str) -> list:
     """Check for suspicious patterns and return list of flags"""
     flags = []
+    now_dt = datetime.now(timezone.utc)
 
     # Get recent requests from the persistent log
     recent_request_ages = _get_recent_requests_from_log(ip_address)
 
+    # Also check the buffer for requests not yet written to the log
+    for entry in _request_log_buffer:
+        if entry['ip_address'] == ip_address:
+            try:
+                timestamp = datetime.fromisoformat(entry['timestamp'])
+                age_seconds = (now_dt - timestamp).total_seconds()
+                if age_seconds < 3600:
+                    recent_request_ages.append(age_seconds)
+            except (ValueError, KeyError):
+                continue
+
     # Count current request
     total_requests = len(recent_request_ages) + 1