Complete Phase 7: Polish & Cross-Cutting Concerns
This commit implements all remaining polish tasks (T193-T210) to make the application production-ready. ## Logging & Monitoring (T193, T194, T208, T209) - Add structured JSON logging for production environments - Add human-readable logging for development - Implement comprehensive error logging across all routes: * submission.py: product access, validation, success/failure * auth.py: login attempts, successes, failures, logouts * dashboard.py: access and errors - Add /health endpoint for monitoring (checks data dir, API key) - Add environment variable validation on startup ## Security Hardening (T196-T199, T207) - Add HSTS headers in production (1 year, includeSubDomains) - Add security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection - Verify CSRF protection on all POST routes (Flask-WTF) - Verify session cookie security flags (HttpOnly, Secure, SameSite) - Verify XSS prevention (Jinja2 auto-escaping) - Verify no hardcoded secrets (only in test files) ## Documentation (T195, T203, T210) - Add comprehensive README.md with: * Features, quick start, project structure * Usage guides (end users, product owners, admins) * Configuration, testing, deployment instructions - Add detailed docs/deployment.md with: * Production deployment steps * ClamAV, Nginx, SSL/TLS setup * Security hardening, monitoring, backup strategies - Add requirements-dev.txt for development dependencies ## Performance Testing (T200, T201) - Add test_performance.py with 4 comprehensive tests: * 100 concurrent submissions (SC-012) * Dashboard load <3s for 1000 items (SC-008) * Large file upload handling * Rate limiting verification - Add performance marker to pytest.ini ## Testing - All 49 tests passing, 1 skipped - Fixed error handling to preserve HTTP status codes Phase 7 complete. Application is production-ready with comprehensive logging, security, monitoring, and documentation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Claude
+174
-1
@@ -1,12 +1,127 @@
|
||||
"""Flask application factory"""
|
||||
import os
|
||||
from flask import Flask
|
||||
import logging
|
||||
import json
|
||||
from datetime import datetime
|
||||
from flask import Flask, request
|
||||
from flask_login import LoginManager
|
||||
from flask_limiter import Limiter
|
||||
from flask_limiter.util import get_remote_address
|
||||
from flask_wtf.csrf import CSRFProtect
|
||||
|
||||
|
||||
class JSONFormatter(logging.Formatter):
|
||||
"""Custom JSON formatter for structured logging"""
|
||||
|
||||
def format(self, record):
|
||||
log_data = {
|
||||
'timestamp': datetime.utcnow().isoformat() + 'Z',
|
||||
'level': record.levelname,
|
||||
'logger': record.name,
|
||||
'message': record.getMessage(),
|
||||
'module': record.module,
|
||||
'function': record.funcName,
|
||||
'line': record.lineno,
|
||||
}
|
||||
|
||||
# Add exception info if present
|
||||
if record.exc_info:
|
||||
log_data['exception'] = self.formatException(record.exc_info)
|
||||
|
||||
# Add extra fields if present
|
||||
if hasattr(record, 'extra_data'):
|
||||
log_data.update(record.extra_data)
|
||||
|
||||
return json.dumps(log_data)
|
||||
|
||||
|
||||
def configure_logging(app):
|
||||
"""Configure structured logging for the application
|
||||
|
||||
Args:
|
||||
app: Flask application instance
|
||||
"""
|
||||
# Remove default Flask handlers
|
||||
app.logger.handlers.clear()
|
||||
|
||||
# Create console handler
|
||||
console_handler = logging.StreamHandler()
|
||||
|
||||
if app.config.get('DEBUG'):
|
||||
# Human-readable format for development
|
||||
console_handler.setFormatter(logging.Formatter(
|
||||
'[%(asctime)s] %(levelname)s in %(module)s: %(message)s'
|
||||
))
|
||||
else:
|
||||
# JSON format for production
|
||||
console_handler.setFormatter(JSONFormatter())
|
||||
|
||||
console_handler.setLevel(logging.INFO)
|
||||
app.logger.addHandler(console_handler)
|
||||
app.logger.setLevel(logging.INFO)
|
||||
|
||||
# Log all requests
|
||||
@app.before_request
|
||||
def log_request():
|
||||
app.logger.info(
|
||||
f'Request: {request.method} {request.path}',
|
||||
extra={'extra_data': {
|
||||
'method': request.method,
|
||||
'path': request.path,
|
||||
'remote_addr': request.remote_addr,
|
||||
'user_agent': str(request.user_agent)
|
||||
}}
|
||||
)
|
||||
|
||||
# Log all responses and apply security headers
|
||||
@app.after_request
|
||||
def log_response(response):
|
||||
app.logger.info(
|
||||
f'Response: {response.status_code} for {request.method} {request.path}',
|
||||
extra={'extra_data': {
|
||||
'status_code': response.status_code,
|
||||
'method': request.method,
|
||||
'path': request.path
|
||||
}}
|
||||
)
|
||||
|
||||
# Apply security headers in production (T196)
|
||||
if not app.config.get('DEBUG'):
|
||||
if app.config.get('STRICT_TRANSPORT_SECURITY'):
|
||||
response.headers['Strict-Transport-Security'] = app.config['STRICT_TRANSPORT_SECURITY']
|
||||
if app.config.get('X_CONTENT_TYPE_OPTIONS'):
|
||||
response.headers['X-Content-Type-Options'] = app.config['X_CONTENT_TYPE_OPTIONS']
|
||||
if app.config.get('X_FRAME_OPTIONS'):
|
||||
response.headers['X-Frame-Options'] = app.config['X_FRAME_OPTIONS']
|
||||
if app.config.get('X_XSS_PROTECTION'):
|
||||
response.headers['X-XSS-Protection'] = app.config['X_XSS_PROTECTION']
|
||||
|
||||
return response
|
||||
|
||||
|
||||
def validate_environment(app):
|
||||
"""Validate required environment variables on startup
|
||||
|
||||
Args:
|
||||
app: Flask application instance
|
||||
|
||||
Raises:
|
||||
ValueError: If required environment variables are missing
|
||||
"""
|
||||
required_vars = []
|
||||
|
||||
if not app.config.get('DEBUG'): # Production requirements
|
||||
if not app.config.get('SECRET_KEY'):
|
||||
required_vars.append('SECRET_KEY')
|
||||
if not app.config.get('ANTHROPIC_API_KEY'):
|
||||
required_vars.append('ANTHROPIC_API_KEY')
|
||||
|
||||
if required_vars:
|
||||
raise ValueError(f"Missing required environment variables: {', '.join(required_vars)}")
|
||||
|
||||
app.logger.info("Environment validation passed")
|
||||
|
||||
|
||||
def create_app(config_name='development'):
|
||||
"""Create and configure the Flask application
|
||||
|
||||
@@ -29,6 +144,16 @@ def create_app(config_name='development'):
|
||||
from config.development import DevelopmentConfig
|
||||
app.config.from_object(DevelopmentConfig)
|
||||
|
||||
# Configure structured logging (T194)
|
||||
configure_logging(app)
|
||||
|
||||
# Validate environment variables (T209)
|
||||
try:
|
||||
validate_environment(app)
|
||||
except ValueError as e:
|
||||
app.logger.error(f"Environment validation failed: {e}")
|
||||
raise
|
||||
|
||||
# Ensure data directory exists
|
||||
os.makedirs(app.config['DATA_DIR'], exist_ok=True)
|
||||
|
||||
@@ -70,17 +195,65 @@ def create_app(config_name='development'):
|
||||
from flask import render_template
|
||||
return render_template('index.html')
|
||||
|
||||
# Health check endpoint (T208)
|
||||
@app.route('/health')
|
||||
def health_check():
|
||||
"""Health check endpoint for monitoring
|
||||
|
||||
Returns:
|
||||
JSON response with application status
|
||||
"""
|
||||
from flask import jsonify
|
||||
health_status = {
|
||||
'status': 'healthy',
|
||||
'timestamp': datetime.utcnow().isoformat() + 'Z',
|
||||
'environment': 'production' if not app.config.get('DEBUG') else 'development'
|
||||
}
|
||||
|
||||
# Check critical dependencies
|
||||
try:
|
||||
# Check data directory is writable
|
||||
data_dir = app.config.get('DATA_DIR')
|
||||
if not os.path.exists(data_dir):
|
||||
health_status['status'] = 'unhealthy'
|
||||
health_status['error'] = f'Data directory {data_dir} does not exist'
|
||||
return jsonify(health_status), 503
|
||||
|
||||
# Check AI API key is configured
|
||||
if not app.config.get('ANTHROPIC_API_KEY'):
|
||||
health_status['status'] = 'degraded'
|
||||
health_status['warning'] = 'AI analysis unavailable: ANTHROPIC_API_KEY not configured'
|
||||
|
||||
return jsonify(health_status), 200
|
||||
|
||||
except Exception as e:
|
||||
health_status['status'] = 'unhealthy'
|
||||
health_status['error'] = str(e)
|
||||
app.logger.error(f'Health check failed: {e}')
|
||||
return jsonify(health_status), 503
|
||||
|
||||
# Register error handlers
|
||||
@app.errorhandler(403)
|
||||
def forbidden(e):
|
||||
"""Handle 403 Forbidden errors"""
|
||||
from flask import render_template
|
||||
app.logger.warning(f'403 Forbidden: {request.path} - {e.description}')
|
||||
return render_template('error_403.html'), 403
|
||||
|
||||
@app.errorhandler(404)
|
||||
def not_found(e):
|
||||
"""Handle 404 Not Found errors"""
|
||||
from flask import render_template
|
||||
app.logger.warning(f'404 Not Found: {request.path} - {e.description}')
|
||||
return render_template('error_404.html'), 404
|
||||
|
||||
@app.errorhandler(500)
|
||||
def internal_error(e):
|
||||
"""Handle 500 Internal Server errors"""
|
||||
from flask import render_template
|
||||
app.logger.error(f'500 Internal Server Error: {request.path}', exc_info=True)
|
||||
return render_template('error_500.html' if os.path.exists(
|
||||
os.path.join(app.template_folder, 'error_500.html')
|
||||
) else 'error_404.html'), 500
|
||||
|
||||
return app
|
||||
|
||||
Reference in New Issue
Block a user