phil/StarPunk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Implement Phase 4 Web Interface with bugfixes (v0.5.2)

Browse Source 
## Phase 4: Web Interface Implementation

Implemented complete web interface with public and admin routes,
templates, CSS, and development authentication.

### Core Features

**Public Routes**:
- Homepage with recent published notes
- Note permalinks with microformats2
- Server-side rendering (Jinja2)

**Admin Routes**:
- Login via IndieLogin
- Dashboard with note management
- Create, edit, delete notes
- Protected with @require_auth decorator

**Development Authentication**:
- Dev login bypass for local testing (DEV_MODE only)
- Security safeguards per ADR-011
- Returns 404 when disabled

**Templates & Frontend**:
- Base layouts (public + admin)
- 8 HTML templates with microformats2
- Custom responsive CSS (114 lines)
- Error pages (404, 500)

### Bugfixes (v0.5.1 → v0.5.2)

1. **Cookie collision fix (v0.5.1)**:
   - Renamed auth cookie from "session" to "starpunk_session"
   - Fixed redirect loop between dev login and admin dashboard
   - Flask's session cookie no longer conflicts with auth

2. **HTTP 404 error handling (v0.5.1)**:
   - Update route now returns 404 for nonexistent notes
   - Delete route now returns 404 for nonexistent notes
   - Follows ADR-012 HTTP Error Handling Policy
   - Pattern consistency across all admin routes

3. **Note model enhancement (v0.5.2)**:
   - Exposed deleted_at field from database schema
   - Enables soft deletion verification in tests
   - Follows ADR-013 transparency principle

### Architecture

**New ADRs**:
- ADR-011: Development Authentication Mechanism
- ADR-012: HTTP Error Handling Policy
- ADR-013: Expose deleted_at Field in Note Model

**Standards Compliance**:
- Uses uv for Python environment
- Black formatted, Flake8 clean
- Follows git branching strategy
- Version incremented per versioning strategy

### Test Results

- 405/406 tests passing (99.75%)
- 87% code coverage
- All security tests passing
- Manual testing confirmed working

### Documentation

- Complete implementation reports in docs/reports/
- Architecture reviews in docs/reviews/
- Design documents in docs/design/
- CHANGELOG updated for v0.5.2

### Files Changed

**New Modules**:
- starpunk/dev_auth.py
- starpunk/routes/ (public, admin, auth, dev_auth)

**Templates**: 10 files (base, pages, admin, errors)
**Static**: CSS and optional JavaScript
**Tests**: 4 test files for routes and templates
**Docs**: 20+ architectural and implementation documents

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Phil Skentelbery
2025-11-18 23:01:53 -07:00
parent 575a02186b
commit 0cca8169ce
56 changed files with 13151 additions and 304 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
tests/test_notes.py
View File

@@ -25,7 +25,7 @@ from starpunk.notes import (
NoteNotFoundError,
InvalidNoteDataError,
NoteSyncError,
_get_existing_slugs
_get_existing_slugs,
)
from starpunk.database import get_db
@@ -147,7 +147,7 @@ class TestCreateNote:
"""Test that file is created on disk"""
with app.app_context():
note = create_note("Test content")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
assert note_path.exists()
@@ -158,10 +158,12 @@ class TestCreateNote:
with app.app_context():
note = create_note("Test content")
db = get_db(app)
row = db.execute("SELECT * FROM notes WHERE slug = ?", (note.slug,)).fetchone()
row = db.execute(
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row is not None
assert row['slug'] == note.slug
assert row["slug"] == note.slug
def test_create_content_hash_calculated(self, app, client):
"""Test that content hash is calculated"""
@@ -176,7 +178,7 @@ class TestCreateNote:
with pytest.raises(InvalidNoteDataError) as exc:
create_note("")
assert 'content' in str(exc.value).lower()
assert "content" in str(exc.value).lower()
def test_create_whitespace_content_fails(self, app, client):
"""Test whitespace-only content raises error"""
@@ -340,7 +342,7 @@ class TestListNotes:
note2 = create_note("Second", created_at=datetime(2024, 1, 2))
# Newest first (default)
notes = list_notes(order_by='created_at', order_dir='DESC')
notes = list_notes(order_by="created_at", order_dir="DESC")
assert notes[0].slug == note2.slug
assert notes[1].slug == note1.slug
@@ -351,7 +353,7 @@ class TestListNotes:
note2 = create_note("Second", created_at=datetime(2024, 1, 2))
# Oldest first
notes = list_notes(order_by='created_at', order_dir='ASC')
notes = list_notes(order_by="created_at", order_dir="ASC")
assert notes[0].slug == note1.slug
assert notes[1].slug == note2.slug
@@ -364,22 +366,22 @@ class TestListNotes:
# Update first note (will have newer updated_at)
update_note(slug=note1.slug, content="Updated first")
notes = list_notes(order_by='updated_at', order_dir='DESC')
notes = list_notes(order_by="updated_at", order_dir="DESC")
assert notes[0].slug == note1.slug
def test_list_invalid_order_field(self, app, client):
"""Test invalid order_by field raises error"""
with app.app_context():
with pytest.raises(ValueError) as exc:
list_notes(order_by='malicious; DROP TABLE notes;')
list_notes(order_by="malicious; DROP TABLE notes;")
assert 'Invalid order_by' in str(exc.value)
assert "Invalid order_by" in str(exc.value)
def test_list_invalid_order_direction(self, app, client):
"""Test invalid order direction raises error"""
with app.app_context():
with pytest.raises(ValueError) as exc:
list_notes(order_dir='INVALID')
list_notes(order_dir="INVALID")
assert "Must be 'ASC' or 'DESC'" in str(exc.value)
@@ -389,7 +391,7 @@ class TestListNotes:
with pytest.raises(ValueError) as exc:
list_notes(limit=2000)
assert 'exceeds maximum' in str(exc.value)
assert "exceeds maximum" in str(exc.value)
def test_list_negative_limit(self, app, client):
"""Test negative limit raises error"""
@@ -451,9 +453,7 @@ class TestUpdateNote:
with app.app_context():
note = create_note("Draft", published=False)
updated = update_note(
slug=note.slug,
content="Published content",
published=True
slug=note.slug, content="Published content", published=True
)
assert updated.content == "Published content"
@@ -515,7 +515,7 @@ class TestUpdateNote:
"""Test file is updated on disk"""
with app.app_context():
note = create_note("Original")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
update_note(slug=note.slug, content="Updated")
@@ -559,17 +559,16 @@ class TestDeleteNote:
# But record still in database with deleted_at set
db = get_db(app)
row = db.execute(
"SELECT * FROM notes WHERE slug = ?",
(note.slug,)
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row is not None
assert row['deleted_at'] is not None
assert row["deleted_at"] is not None
def test_hard_delete(self, app, client):
"""Test hard deletion"""
with app.app_context():
note = create_note("To be deleted")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
delete_note(slug=note.slug, soft=False)
@@ -577,8 +576,7 @@ class TestDeleteNote:
# Note not in database
db = get_db(app)
row = db.execute(
"SELECT * FROM notes WHERE slug = ?",
(note.slug,)
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row is None
@@ -630,7 +628,9 @@ class TestDeleteNote:
# Now completely gone
db = get_db(app)
row = db.execute("SELECT * FROM notes WHERE slug = ?", (note.slug,)).fetchone()
row = db.execute(
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row is None
def test_delete_both_slug_and_id_fails(self, app, client):
@@ -649,7 +649,7 @@ class TestDeleteNote:
"""Test soft delete moves file to trash directory"""
with app.app_context():
note = create_note("Test")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
delete_note(slug=note.slug, soft=True)
@@ -674,21 +674,23 @@ class TestFileDatabaseSync:
"""Test file and database are created together"""
with app.app_context():
note = create_note("Test content")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
# Both file and database record should exist
assert note_path.exists()
db = get_db(app)
row = db.execute("SELECT * FROM notes WHERE slug = ?", (note.slug,)).fetchone()
row = db.execute(
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row is not None
def test_update_file_and_db_in_sync(self, app, client):
"""Test file and database are updated together"""
with app.app_context():
note = create_note("Original")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
update_note(slug=note.slug, content="Updated")
@@ -698,14 +700,16 @@ class TestFileDatabaseSync:
# Database updated
db = get_db(app)
row = db.execute("SELECT * FROM notes WHERE slug = ?", (note.slug,)).fetchone()
assert row['updated_at'] > row['created_at']
row = db.execute(
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row["updated_at"] > row["created_at"]
def test_delete_file_and_db_in_sync(self, app, client):
"""Test file and database are deleted together (hard delete)"""
with app.app_context():
note = create_note("Test")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
delete_note(slug=note.slug, soft=False)
@@ -715,7 +719,9 @@ class TestFileDatabaseSync:
# Database deleted
db = get_db(app)
row = db.execute("SELECT * FROM notes WHERE slug = ?", (note.slug,)).fetchone()
row = db.execute(
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row is None
@@ -786,7 +792,7 @@ class TestErrorHandling:
"""Test that missing file is logged but doesn't crash"""
with app.app_context():
note = create_note("Test content")
data_dir = Path(app.config['DATA_PATH'])
data_dir = Path(app.config["DATA_PATH"])
note_path = data_dir / note.file_path
# Delete the file but leave database record
@@ -893,7 +899,9 @@ class TestIntegration:
# Completely gone
db = get_db(app)
row = db.execute("SELECT * FROM notes WHERE slug = ?", (note.slug,)).fetchone()
row = db.execute(
"SELECT * FROM notes WHERE slug = ?", (note.slug,)
).fetchone()
assert row is None
def test_create_list_paginate(self, app, client):