feat: Implement Phase 4 Web Interface with bugfixes (v0.5.2)

## Phase 4: Web Interface Implementation Implemented complete web interface with public and admin routes, templates, CSS, and development authentication. ### Core Features **Public Routes**: - Homepage with recent published notes - Note permalinks with microformats2 - Server-side rendering (Jinja2) **Admin Routes**: - Login via IndieLogin - Dashboard with note management - Create, edit, delete notes - Protected with @require_auth decorator **Development Authentication**: - Dev login bypass for local testing (DEV_MODE only) - Security safeguards per ADR-011 - Returns 404 when disabled **Templates & Frontend**: - Base layouts (public + admin) - 8 HTML templates with microformats2 - Custom responsive CSS (114 lines) - Error pages (404, 500) ### Bugfixes (v0.5.1 → v0.5.2) 1. **Cookie collision fix (v0.5.1)**: - Renamed auth cookie from "session" to "starpunk_session" - Fixed redirect loop between dev login and admin dashboard - Flask's session cookie no longer conflicts with auth 2. **HTTP 404 error handling (v0.5.1)**: - Update route now returns 404 for nonexistent notes - Delete route now returns 404 for nonexistent notes - Follows ADR-012 HTTP Error Handling Policy - Pattern consistency across all admin routes 3. **Note model enhancement (v0.5.2)**: - Exposed deleted_at field from database schema - Enables soft deletion verification in tests - Follows ADR-013 transparency principle ### Architecture **New ADRs**: - ADR-011: Development Authentication Mechanism - ADR-012: HTTP Error Handling Policy - ADR-013: Expose deleted_at Field in Note Model **Standards Compliance**: - Uses uv for Python environment - Black formatted, Flake8 clean - Follows git branching strategy - Version incremented per versioning strategy ### Test Results - 405/406 tests passing (99.75%) - 87% code coverage - All security tests passing - Manual testing confirmed working ### Documentation - Complete implementation reports in docs/reports/ - Architecture reviews in docs/reviews/ - Design documents in docs/design/ - CHANGELOG updated for v0.5.2 ### Files Changed **New Modules**: - starpunk/dev_auth.py - starpunk/routes/ (public, admin, auth, dev_auth) **Templates**: 10 files (base, pages, admin, errors) **Static**: CSS and optional JavaScript **Tests**: 4 test files for routes and templates **Docs**: 20+ architectural and implementation documents 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-18 23:01:53 -07:00
parent 575a02186b
commit 0cca8169ce
56 changed files with 13151 additions and 304 deletions
--- a/starpunk/routes/admin.py
+++ b/starpunk/routes/admin.py
@@ -0,0 +1,212 @@
+"""
+Admin routes for StarPunk
+
+Handles authenticated admin functionality including dashboard, note creation,
+editing, and deletion. All routes require authentication.
+"""
+
+from flask import Blueprint, flash, g, redirect, render_template, request, url_for
+
+from starpunk.auth import require_auth
+from starpunk.notes import (
+    create_note,
+    delete_note,
+    list_notes,
+    get_note,
+    update_note,
+)
+
+# Create blueprint
+bp = Blueprint("admin", __name__, url_prefix="/admin")
+
+
+@bp.route("/")
+@require_auth
+def dashboard():
+    """
+    Admin dashboard with note list
+
+    Displays all notes (published and drafts) with management controls.
+    Requires authentication.
+
+    Returns:
+        Rendered dashboard template with complete note list
+
+    Decorator: @require_auth
+    Template: templates/admin/dashboard.html
+    Access: g.user_me (set by require_auth decorator)
+    """
+    # Get all notes (published and drafts)
+    notes = list_notes()
+
+    return render_template("admin/dashboard.html", notes=notes, user_me=g.me)
+
+
+@bp.route("/new", methods=["GET"])
+@require_auth
+def new_note_form():
+    """
+    Display create note form
+
+    Shows empty form for creating a new note.
+    Requires authentication.
+
+    Returns:
+        Rendered new note form template
+
+    Decorator: @require_auth
+    Template: templates/admin/new.html
+    """
+    return render_template("admin/new.html")
+
+
+@bp.route("/new", methods=["POST"])
+@require_auth
+def create_note_submit():
+    """
+    Handle new note submission
+
+    Creates a new note from submitted form data.
+    Requires authentication.
+
+    Form data:
+        content: Markdown content (required)
+        published: Checkbox for published status (optional)
+
+    Returns:
+        Redirect to dashboard on success, back to form on error
+
+    Decorator: @require_auth
+    """
+    content = request.form.get("content", "").strip()
+    published = "published" in request.form
+
+    if not content:
+        flash("Content cannot be empty", "error")
+        return redirect(url_for("admin.new_note_form"))
+
+    try:
+        note = create_note(content, published=published)
+        flash(f"Note created: {note.slug}", "success")
+        return redirect(url_for("admin.dashboard"))
+    except ValueError as e:
+        flash(f"Error creating note: {e}", "error")
+        return redirect(url_for("admin.new_note_form"))
+    except Exception as e:
+        flash(f"Unexpected error creating note: {e}", "error")
+        return redirect(url_for("admin.new_note_form"))
+
+
+@bp.route("/edit/<int:note_id>", methods=["GET"])
+@require_auth
+def edit_note_form(note_id: int):
+    """
+    Display edit note form
+
+    Shows form pre-filled with existing note content for editing.
+    Requires authentication.
+
+    Args:
+        note_id: Database ID of note to edit
+
+    Returns:
+        Rendered edit form template or 404 if note not found
+
+    Decorator: @require_auth
+    Template: templates/admin/edit.html
+    """
+    note = get_note(id=note_id)
+
+    if not note:
+        flash("Note not found", "error")
+        return redirect(url_for("admin.dashboard")), 404
+
+    return render_template("admin/edit.html", note=note)
+
+
+@bp.route("/edit/<int:note_id>", methods=["POST"])
+@require_auth
+def update_note_submit(note_id: int):
+    """
+    Handle note update submission
+
+    Updates existing note with submitted form data.
+    Requires authentication.
+
+    Args:
+        note_id: Database ID of note to update
+
+    Form data:
+        content: Updated markdown content (required)
+        published: Checkbox for published status (optional)
+
+    Returns:
+        Redirect to dashboard on success, back to form on error
+
+    Decorator: @require_auth
+    """
+    # Check if note exists first
+    existing_note = get_note(id=note_id, load_content=False)
+    if not existing_note:
+        flash("Note not found", "error")
+        return redirect(url_for("admin.dashboard")), 404
+
+    content = request.form.get("content", "").strip()
+    published = "published" in request.form
+
+    if not content:
+        flash("Content cannot be empty", "error")
+        return redirect(url_for("admin.edit_note_form", note_id=note_id))
+
+    try:
+        note = update_note(id=note_id, content=content, published=published)
+        flash(f"Note updated: {note.slug}", "success")
+        return redirect(url_for("admin.dashboard"))
+    except ValueError as e:
+        flash(f"Error updating note: {e}", "error")
+        return redirect(url_for("admin.edit_note_form", note_id=note_id))
+    except Exception as e:
+        flash(f"Unexpected error updating note: {e}", "error")
+        return redirect(url_for("admin.edit_note_form", note_id=note_id))
+
+
+@bp.route("/delete/<int:note_id>", methods=["POST"])
+@require_auth
+def delete_note_submit(note_id: int):
+    """
+    Handle note deletion
+
+    Deletes a note after confirmation.
+    Requires authentication.
+
+    Args:
+        note_id: Database ID of note to delete
+
+    Form data:
+        confirm: Must be 'yes' to proceed with deletion
+
+    Returns:
+        Redirect to dashboard with success/error message
+
+    Decorator: @require_auth
+    """
+    # Check if note exists first (per ADR-012)
+    existing_note = get_note(id=note_id, load_content=False)
+    if not existing_note:
+        flash("Note not found", "error")
+        return redirect(url_for("admin.dashboard")), 404
+
+    # Check for confirmation
+    if request.form.get("confirm") != "yes":
+        flash("Deletion cancelled", "info")
+        return redirect(url_for("admin.dashboard"))
+
+    try:
+        delete_note(id=note_id, soft=False)
+        flash("Note deleted successfully", "success")
+    except ValueError as e:
+        flash(f"Error deleting note: {e}", "error")
+    except Exception as e:
+        flash(f"Unexpected error deleting note: {e}", "error")
+
+    return redirect(url_for("admin.dashboard"))