# Flask JWT认证示例
from flask import Flask, jsonify, request
from flask_jwt_extended import JWTManager, jwt_required, create_access_token

app = Flask(__name__)
app.config['JWT_SECRET_KEY'] = 'super-secret'  # 生产环境应使用更安全的密钥
jwt = JWTManager(app)

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username', None)
    password = request.json.get('password', None)
    if username != 'test' or password != 'test':
        return jsonify({"msg": "Bad username or password"}), 401
    
    access_token = create_access_token(identity=username)
    return jsonify(access_token=access_token)

@app.route('/protected', methods=['GET'])
@jwt_required()
def protected():
    return jsonify({'message': '这是受保护的API端点'})

# Flask速率限制示例
from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(
    app,
    key_func=get_remote_address,
    default_limits=["200 per day", "50 per hour"]
)

@app.route("/limited-api")
@limiter.limit("10 per minute")
def limited_api():
    return "这个API每分钟只能调用10次"

// 良好错误响应示例
{
  "error": {
    "code": "invalid_parameter",
    "message": "email参数格式不正确",
    "details": {
      "parameter": "email",
      "expected_format": "user@example.com"
    }
  }
}