app/config.py

"""Central application settings."""

import os

APP_NAME = "Asset Extractor API"
APP_VERSION = "2.0.0"

# --- Asset extractor (POST /assets) ---
# Page fetch limits.
ASSETS_FETCH_TIMEOUT = float(os.getenv("ASSETS_FETCH_TIMEOUT", "15"))
ASSETS_MAX_BYTES = int(os.getenv("ASSETS_MAX_BYTES", str(5 * 1024 * 1024)))  # 5 MB
ASSETS_MAX_REDIRECTS = int(os.getenv("ASSETS_MAX_REDIRECTS", "5"))
ASSETS_USER_AGENT = os.getenv(
    "ASSETS_USER_AGENT",
    "Mozilla/5.0 (compatible; AssetExtractor/2.0; +https://lljz66-api.hf.space)",
)
# Reject fetching these private/link-local networks (SSRF guard).
ASSETS_BLOCKED_HOSTS = {
    "localhost",
    "127.0.0.1",
    "::1",
    "0.0.0.0",
    "169.254.169.254",  # cloud metadata
}