Implement Phase 5: Product Owner Dashboard (User Story 3)
Add complete dashboard functionality for product owners and administrators to view, filter, search, and manage feedback submissions following Test-First Discipline. Tests (T093-T105): - Add 12 contract tests for dashboard routes (authentication, listing, filtering, search, detail view, status updates, attachment downloads, access control) - Add 2 integration tests for complete dashboard workflow and access control enforcement - All tests written first and verified to fail before implementation Services (T111-T118): - Enhance FeedbackStorageService with load_feedback_list() for pagination, filtering, searching, and sorting - Add load_feedback_detail() to load complete feedback with attachments and analysis - Add update_feedback_status_by_id() for status management - Add get_attachment_path() with path traversal prevention Routes (T119-T134): - Implement GET /dashboard with filters, search, and pagination (50 items/page) - Implement GET /feedback/<id> detail view with role-based access control - Implement POST /feedback/<id>/status for status updates - Implement GET /feedback/<id>/attachment/<filename> for secure file downloads - Add access control helpers (administrators see all products, owners see only assigned) Templates (T135-T136): - Create dashboard/list.html with filter form, search, and pagination - Create dashboard/detail.html with status update form and attachment links - Create error_403.html for access denied - Create error_404.html for not found Integration & Bug Fixes: - Update auth routes to remove /auth prefix and redirect to dashboard after login - Update Feedback.VALID_STATUSES to include dashboard statuses (in_progress, resolved, closed) - Register error handlers for 403 and 404 in app factory - Fix test fixtures to use correct users.yaml format and User.hash_password() Test Results: 39 passed, 1 skipped (all Phase 5 tests passing) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Claude
+3
-8
@@ -4,7 +4,7 @@ from flask_login import login_user, logout_user, login_required
|
||||
from app.models.user import User
|
||||
|
||||
|
||||
bp = Blueprint('auth', __name__, url_prefix='/auth')
|
||||
bp = Blueprint('auth', __name__)
|
||||
|
||||
|
||||
@bp.route('/login', methods=['GET', 'POST'])
|
||||
@@ -28,13 +28,8 @@ def login():
|
||||
login_user(user)
|
||||
flash(f'Welcome back, {user.username}!', 'success')
|
||||
|
||||
# TODO: Redirect based on role when dashboards are implemented
|
||||
# For now, redirect to index page
|
||||
# if user.role == 'administrator':
|
||||
# return redirect(url_for('admin.dashboard'))
|
||||
# elif user.role == 'product_owner':
|
||||
# return redirect(url_for('dashboard.list'))
|
||||
return redirect(url_for('index'))
|
||||
# Redirect to dashboard for product owners and administrators
|
||||
return redirect(url_for('dashboard.list'))
|
||||
else:
|
||||
flash('Invalid username or password', 'error')
|
||||
|
||||
|
||||
+242
-4
@@ -1,9 +1,247 @@
|
||||
"""Dashboard routes - product owner feedback management"""
|
||||
from flask import Blueprint
|
||||
from flask_login import login_required
|
||||
from flask import Blueprint, render_template, request, redirect, url_for, flash, send_file, abort
|
||||
from flask_login import login_required, current_user
|
||||
from app.services.feedback_storage import FeedbackStorageService
|
||||
from app.models.product import Product
|
||||
import os
|
||||
import mimetypes
|
||||
|
||||
|
||||
bp = Blueprint('dashboard', __name__, url_prefix='/dashboard')
|
||||
bp = Blueprint('dashboard', __name__)
|
||||
|
||||
|
||||
# Routes will be implemented in Phase 5 (User Story 3)
|
||||
def get_user_product_ids():
|
||||
"""Get list of product IDs accessible to current user
|
||||
|
||||
Returns:
|
||||
list: Product IDs or None for administrators (access to all)
|
||||
"""
|
||||
if not current_user.is_authenticated:
|
||||
return []
|
||||
|
||||
# Administrators have access to all products
|
||||
if current_user.role == 'administrator':
|
||||
return None # None means all products
|
||||
|
||||
# Product owners see only assigned products
|
||||
return current_user.product_ids
|
||||
|
||||
|
||||
def check_product_access(product_id):
|
||||
"""Check if current user has access to product
|
||||
|
||||
Args:
|
||||
product_id: Product ID to check
|
||||
|
||||
Returns:
|
||||
bool: True if user has access, False otherwise
|
||||
"""
|
||||
if not current_user.is_authenticated:
|
||||
return False
|
||||
|
||||
# Administrators have access to all products
|
||||
if current_user.role == 'administrator':
|
||||
return True
|
||||
|
||||
# Product owners see only assigned products
|
||||
return product_id in current_user.product_ids
|
||||
|
||||
|
||||
@bp.route('/dashboard')
|
||||
@login_required
|
||||
def list():
|
||||
"""Dashboard - list feedback with filters and search
|
||||
|
||||
Query parameters:
|
||||
page: Page number (default 1)
|
||||
category: Filter by category
|
||||
status: Filter by status
|
||||
language: Filter by language
|
||||
search: Search query
|
||||
"""
|
||||
# Get query parameters
|
||||
page = request.args.get('page', 1, type=int)
|
||||
category = request.args.get('category')
|
||||
status = request.args.get('status')
|
||||
language = request.args.get('language')
|
||||
search_query = request.args.get('search')
|
||||
|
||||
# Build filters
|
||||
filters = {}
|
||||
if category:
|
||||
filters['category'] = category
|
||||
if status:
|
||||
filters['status'] = status
|
||||
if language:
|
||||
filters['language'] = language
|
||||
|
||||
# Get product IDs for current user
|
||||
product_ids = get_user_product_ids()
|
||||
|
||||
# Load feedback list
|
||||
result = FeedbackStorageService.load_feedback_list(
|
||||
product_ids=product_ids,
|
||||
page=page,
|
||||
per_page=50,
|
||||
filters=filters if filters else None,
|
||||
search_query=search_query
|
||||
)
|
||||
|
||||
# Load product names for display
|
||||
all_products = Product.get_all()
|
||||
product_names = {p.product_id: p.name for p in all_products}
|
||||
|
||||
return render_template(
|
||||
'dashboard/list.html',
|
||||
feedback_list=result['items'],
|
||||
page=result['page'],
|
||||
pages=result['pages'],
|
||||
total=result['total'],
|
||||
product_names=product_names,
|
||||
filters={
|
||||
'category': category,
|
||||
'status': status,
|
||||
'language': language,
|
||||
'search': search_query
|
||||
}
|
||||
)
|
||||
|
||||
|
||||
@bp.route('/feedback/<feedback_id>')
|
||||
@login_required
|
||||
def detail(feedback_id):
|
||||
"""Feedback detail view
|
||||
|
||||
Args:
|
||||
feedback_id: Feedback ID to view
|
||||
|
||||
Returns:
|
||||
Rendered template or 403/404 error
|
||||
"""
|
||||
# First check if feedback exists globally (to distinguish 403 from 404)
|
||||
all_products = Product.get_all()
|
||||
feedback_data = None
|
||||
actual_product_id = None
|
||||
|
||||
for product in all_products:
|
||||
feedback_data = FeedbackStorageService.load_feedback_detail(product.product_id, feedback_id)
|
||||
if feedback_data:
|
||||
actual_product_id = product.product_id
|
||||
break
|
||||
|
||||
# If not found globally, return 404
|
||||
if not feedback_data:
|
||||
abort(404)
|
||||
|
||||
# Check if user has access to this product
|
||||
if not check_product_access(actual_product_id):
|
||||
abort(403)
|
||||
|
||||
# Load product info
|
||||
product = Product.get_by_id(actual_product_id)
|
||||
|
||||
return render_template(
|
||||
'dashboard/detail.html',
|
||||
feedback=feedback_data,
|
||||
product=product
|
||||
)
|
||||
|
||||
|
||||
@bp.route('/feedback/<feedback_id>/status', methods=['POST'])
|
||||
@login_required
|
||||
def update_status(feedback_id):
|
||||
"""Update feedback status
|
||||
|
||||
Args:
|
||||
feedback_id: Feedback ID to update
|
||||
|
||||
Returns:
|
||||
Redirect to detail page or error
|
||||
"""
|
||||
new_status = request.form.get('status')
|
||||
|
||||
if not new_status:
|
||||
flash('Status is required', 'error')
|
||||
return redirect(url_for('dashboard.detail', feedback_id=feedback_id))
|
||||
|
||||
# Find feedback globally first
|
||||
all_products = Product.get_all()
|
||||
actual_product_id = None
|
||||
|
||||
for product in all_products:
|
||||
feedback_data = FeedbackStorageService.load_feedback_detail(product.product_id, feedback_id)
|
||||
if feedback_data:
|
||||
actual_product_id = product.product_id
|
||||
break
|
||||
|
||||
# If not found globally, return 404
|
||||
if not actual_product_id:
|
||||
abort(404)
|
||||
|
||||
# Check if user has access to this product
|
||||
if not check_product_access(actual_product_id):
|
||||
abort(403)
|
||||
|
||||
# Update status
|
||||
success = FeedbackStorageService.update_feedback_status_by_id(
|
||||
actual_product_id, feedback_id, new_status
|
||||
)
|
||||
|
||||
if success:
|
||||
flash(f'Status updated to {new_status}', 'success')
|
||||
else:
|
||||
flash('Failed to update status', 'error')
|
||||
|
||||
return redirect(url_for('dashboard.detail', feedback_id=feedback_id))
|
||||
|
||||
|
||||
@bp.route('/feedback/<feedback_id>/attachment/<filename>')
|
||||
@login_required
|
||||
def download_attachment(feedback_id, filename):
|
||||
"""Download attachment file
|
||||
|
||||
Args:
|
||||
feedback_id: Feedback ID
|
||||
filename: Attachment filename
|
||||
|
||||
Returns:
|
||||
File download or error
|
||||
"""
|
||||
# Find feedback globally first
|
||||
all_products = Product.get_all()
|
||||
actual_product_id = None
|
||||
|
||||
for product in all_products:
|
||||
feedback_data = FeedbackStorageService.load_feedback_detail(product.product_id, feedback_id)
|
||||
if feedback_data:
|
||||
actual_product_id = product.product_id
|
||||
break
|
||||
|
||||
# If not found globally, return 404
|
||||
if not actual_product_id:
|
||||
abort(404)
|
||||
|
||||
# Check if user has access to this product
|
||||
if not check_product_access(actual_product_id):
|
||||
abort(403)
|
||||
|
||||
# Get attachment path
|
||||
attachment_path = FeedbackStorageService.get_attachment_path(
|
||||
actual_product_id, feedback_id, filename
|
||||
)
|
||||
|
||||
if not attachment_path:
|
||||
abort(404)
|
||||
|
||||
# Detect MIME type
|
||||
mime_type, _ = mimetypes.guess_type(filename)
|
||||
if not mime_type:
|
||||
mime_type = 'application/octet-stream'
|
||||
|
||||
# Send file
|
||||
return send_file(
|
||||
attachment_path,
|
||||
mimetype=mime_type,
|
||||
as_attachment=True,
|
||||
download_name=filename
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user