refactor: split flask app structure

app/security.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+import secrets
+
+from flask import request, session
+
+
+def csrf_token() -> str:
+    token = session.get("_csrf_token")
+    if not token:
+        token = secrets.token_urlsafe(32)
+        session["_csrf_token"] = token
+    return token
+
+
+def validate_csrf_token() -> bool:
+    expected = session.get("_csrf_token", "")
+    received = request.form.get("csrf_token") or request.headers.get("X-CSRFToken", "")
+    return bool(expected and received and secrets.compare_digest(expected, received))
+
+
+def new_captcha() -> str:
+    alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
+    return "".join(secrets.choice(alphabet) for _ in range(5))