Implement MVP: Anonymous feedback submission (User Story 1)

Complete implementation of Phase 1-3 (64 tasks):
- Phase 1: Project setup with Flask, pytest, configuration
- Phase 2: Core infrastructure (auth, models, services, testing)
- Phase 3: Anonymous feedback submission with file uploads

Features:
- Anonymous feedback submission (text and/or up to 3 file attachments)
- Multi-language support (any language accepted)
- File validation (type, size) and virus scanning (ClamAV)
- Product management with active/archived status
- File-based storage with YAML metadata
- User authentication system (Flask-Login)
- CSRF protection and rate limiting
- Test coverage: 10 passing tests (contract + integration)

Security:
- No IP address logging (FR-055 compliance)
- File type whitelist and size limits (10MB max)
- Virus scanning with graceful degradation
- Filename sanitization and secure storage

Test Results:
- 8 contract tests passed
- 2 integration tests passed
- End-to-end workflow verified

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.env.example

@@ -0,0 +1,18 @@
+# Flask Configuration
+FLASK_APP=run.py
+FLASK_ENV=development
+SECRET_KEY=change-this-to-a-random-secret-key-in-production
+
+# Claude API Configuration
+ANTHROPIC_API_KEY=your-claude-api-key-here
+
+# ClamAV Configuration
+CLAMD_SOCKET=/var/run/clamav/clamd.ctl
+
+# Application Configuration
+DATA_DIR=./data
+MAX_CONTENT_LENGTH=10485760
+
+# Rate Limiting
+RATE_LIMIT_ENABLED=true
+RATE_LIMIT_PER_HOUR=10

.gitignore

@@ -0,0 +1,59 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual Environment
+venv/
+env/
+ENV/
+env.bak/
+venv.bak/
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Environment variables
+.env
+.env.local
+
+# Data directory (contains user-submitted feedback)
+data/
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+*.cover
+.hypothesis/
+
+# Logs
+*.log
+
+# OS
+Thumbs.db

app/__init__.py

@@ -0,0 +1,73 @@
+"""Flask application factory"""
+import os
+from flask import Flask
+from flask_login import LoginManager
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
+from flask_wtf.csrf import CSRFProtect
+
+
+def create_app(config_name='development'):
+    """Create and configure the Flask application
+
+    Args:
+        config_name: Configuration environment (development, production, testing)
+
+    Returns:
+        Flask application instance
+    """
+    app = Flask(__name__)
+
+    # Load configuration
+    if config_name == 'production':
+        from config.production import ProductionConfig
+        app.config.from_object(ProductionConfig)
+    elif config_name == 'testing':
+        from config.testing import TestingConfig
+        app.config.from_object(TestingConfig)
+    else:
+        from config.development import DevelopmentConfig
+        app.config.from_object(DevelopmentConfig)
+
+    # Ensure data directory exists
+    os.makedirs(app.config['DATA_DIR'], exist_ok=True)
+
+    # Initialize Flask-WTF CSRF Protection
+    csrf = CSRFProtect()
+    csrf.init_app(app)
+
+    # Initialize Flask-Login
+    login_manager = LoginManager()
+    login_manager.init_app(app)
+    login_manager.login_view = 'auth.login'
+    login_manager.login_message = 'Please log in to access this page.'
+
+    @login_manager.user_loader
+    def load_user(user_id):
+        """Load user by ID for Flask-Login"""
+        from app.models.user import User
+        return User.get_by_id(user_id)
+
+    # Initialize Flask-Limiter
+    limiter = Limiter(
+        app=app,
+        key_func=get_remote_address,
+        storage_uri=app.config['RATELIMIT_STORAGE_URL'],
+        default_limits=[f"{app.config['RATELIMIT_PER_HOUR']}/hour"] if app.config.get('RATELIMIT_ENABLED') else []
+    )
+
+    # Register blueprints
+    from app.routes import submission, dashboard, admin, auth
+    app.register_blueprint(submission.bp)
+    app.register_blueprint(dashboard.bp)
+    app.register_blueprint(admin.bp)
+    app.register_blueprint(auth.bp)
+
+    # Set index route
+    @app.route('/')
+    def index():
+        """Welcome page"""
+        from flask import render_template
+        return render_template('index.html')
+
+    return app

app/models/__init__.py

@@ -0,0 +1,7 @@
+"""Models package"""
+# Models are imported here for convenience
+from app.models.user import User
+from app.models.feedback import Feedback
+from app.models.product import Product
+
+__all__ = ['User', 'Feedback', 'Product']

app/models/feedback.py

@@ -0,0 +1,256 @@
+"""Feedback model"""
+import os
+import uuid
+from datetime import datetime
+import yaml
+from flask import current_app
+
+
+class Feedback:
+    """Feedback submission model
+
+    Attributes:
+        feedback_id: Unique feedback identifier (UUID)
+        product_id: Associated product ID
+        submitted_at: Submission timestamp (ISO 8601)
+        status: Feedback status ('new', 'analyzing', 'analyzed', 'analysis_failed', 'archived')
+        content_preview: First 200 chars of feedback text
+        has_attachments: Whether feedback has file attachments
+        attachment_count: Number of attached files
+        original_language: Detected language of feedback (set during analysis)
+        category: Feedback category (set during analysis)
+    """
+
+    VALID_STATUSES = ['new', 'analyzing', 'analyzed', 'analysis_failed', 'archived']
+
+    def __init__(self, feedback_id, product_id, submitted_at=None, status='new',
+                 content_preview='', has_attachments=False, attachment_count=0,
+                 original_language=None, category=None):
+        self.feedback_id = feedback_id
+        self.product_id = product_id
+        self.submitted_at = submitted_at or datetime.utcnow().isoformat()
+        self.status = status
+        self.content_preview = content_preview
+        self.has_attachments = has_attachments
+        self.attachment_count = attachment_count
+        self.original_language = original_language
+        self.category = category
+
+    def to_dict(self):
+        """Convert feedback to dictionary
+
+        Returns:
+            dict: Feedback metadata
+        """
+        data = {
+            'feedback_id': self.feedback_id,
+            'product_id': self.product_id,
+            'submitted_at': self.submitted_at,
+            'status': self.status,
+            'content_preview': self.content_preview,
+            'has_attachments': self.has_attachments,
+            'attachment_count': self.attachment_count
+        }
+
+        if self.original_language:
+            data['original_language'] = self.original_language
+
+        if self.category:
+            data['category'] = self.category
+
+        return data
+
+    @classmethod
+    def from_dict(cls, data):
+        """Create feedback from dictionary
+
+        Args:
+            data: Dictionary with feedback data
+
+        Returns:
+            Feedback: Feedback instance
+        """
+        return cls(
+            feedback_id=data['feedback_id'],
+            product_id=data['product_id'],
+            submitted_at=data.get('submitted_at'),
+            status=data.get('status', 'new'),
+            content_preview=data.get('content_preview', ''),
+            has_attachments=data.get('has_attachments', False),
+            attachment_count=data.get('attachment_count', 0),
+            original_language=data.get('original_language'),
+            category=data.get('category')
+        )
+
+    @staticmethod
+    def generate_id():
+        """Generate unique feedback ID
+
+        Returns:
+            str: UUID-based feedback ID
+        """
+        return str(uuid.uuid4())
+
+    @staticmethod
+    def _get_feedback_dir(product_id, feedback_id):
+        """Get feedback directory path
+
+        Args:
+            product_id: Product ID
+            feedback_id: Feedback ID
+
+        Returns:
+            str: Path to feedback directory
+        """
+        return os.path.join(
+            current_app.config['DATA_DIR'],
+            'products',
+            product_id,
+            'feedback',
+            feedback_id
+        )
+
+    @staticmethod
+    def _get_metadata_file(product_id, feedback_id):
+        """Get metadata file path
+
+        Args:
+            product_id: Product ID
+            feedback_id: Feedback ID
+
+        Returns:
+            str: Path to metadata.yaml
+        """
+        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
+        return os.path.join(feedback_dir, 'metadata.yaml')
+
+    @staticmethod
+    def _get_content_file(product_id, feedback_id):
+        """Get content file path
+
+        Args:
+            product_id: Product ID
+            feedback_id: Feedback ID
+
+        Returns:
+            str: Path to content.txt
+        """
+        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
+        return os.path.join(feedback_dir, 'content.txt')
+
+    @staticmethod
+    def _get_attachments_dir(product_id, feedback_id):
+        """Get attachments directory path
+
+        Args:
+            product_id: Product ID
+            feedback_id: Feedback ID
+
+        Returns:
+            str: Path to attachments directory
+        """
+        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
+        return os.path.join(feedback_dir, 'attachments')
+
+    @classmethod
+    def get_by_id(cls, product_id, feedback_id):
+        """Load feedback by ID
+
+        Args:
+            product_id: Product ID
+            feedback_id: Feedback ID
+
+        Returns:
+            Feedback or None: Feedback instance if found, None otherwise
+        """
+        metadata_file = cls._get_metadata_file(product_id, feedback_id)
+
+        if not os.path.exists(metadata_file):
+            return None
+
+        with open(metadata_file, 'r') as f:
+            data = yaml.safe_load(f)
+
+        return cls.from_dict(data)
+
+    @classmethod
+    def get_all_for_product(cls, product_id):
+        """Get all feedback for a product
+
+        Args:
+            product_id: Product ID
+
+        Returns:
+            list: List of Feedback instances, sorted by submitted_at (newest first)
+        """
+        feedback_list = []
+        feedback_base_dir = os.path.join(
+            current_app.config['DATA_DIR'],
+            'products',
+            product_id,
+            'feedback'
+        )
+
+        if not os.path.exists(feedback_base_dir):
+            return feedback_list
+
+        for feedback_id in os.listdir(feedback_base_dir):
+            feedback_dir = os.path.join(feedback_base_dir, feedback_id)
+
+            if not os.path.isdir(feedback_dir):
+                continue
+
+            feedback = cls.get_by_id(product_id, feedback_id)
+            if feedback:
+                feedback_list.append(feedback)
+
+        # Sort by submitted_at (newest first)
+        feedback_list.sort(key=lambda f: f.submitted_at, reverse=True)
+
+        return feedback_list
+
+    def save_metadata(self):
+        """Save feedback metadata to filesystem"""
+        feedback_dir = self._get_feedback_dir(self.product_id, self.feedback_id)
+        os.makedirs(feedback_dir, exist_ok=True)
+
+        metadata_file = self._get_metadata_file(self.product_id, self.feedback_id)
+
+        with open(metadata_file, 'w') as f:
+            yaml.dump(self.to_dict(), f, default_flow_style=False)
+
+    def get_content(self):
+        """Load feedback content text
+
+        Returns:
+            str or None: Feedback content if exists, None otherwise
+        """
+        content_file = self._get_content_file(self.product_id, self.feedback_id)
+
+        if not os.path.exists(content_file):
+            return None
+
+        with open(content_file, 'r') as f:
+            return f.read()
+
+    def get_attachments(self):
+        """Get list of attachment filenames
+
+        Returns:
+            list: List of attachment filenames
+        """
+        attachments_dir = self._get_attachments_dir(self.product_id, self.feedback_id)
+
+        if not os.path.exists(attachments_dir):
+            return []
+
+        return [f for f in os.listdir(attachments_dir)
+                if os.path.isfile(os.path.join(attachments_dir, f))]
+
+    def validate_status(self):
+        """Validate feedback status
+
+        Returns:
+            bool: True if status is valid, False otherwise
+        """
+        return self.status in self.VALID_STATUSES

app/models/product.py

@@ -0,0 +1,190 @@
+"""Product model"""
+import os
+import yaml
+from flask import current_app
+
+
+class Product:
+    """Product/Service model
+
+    Attributes:
+        product_id: Unique product identifier
+        name: Product/service name
+        submission_url_slug: URL slug for submission form
+        owner_language: Preferred language for product owner
+        assigned_owner_ids: List of product owner user IDs
+        status: Product status ('active' or 'archived')
+    """
+
+    def __init__(self, product_id, name, submission_url_slug, owner_language,
+                 assigned_owner_ids, status='active'):
+        self.product_id = product_id
+        self.name = name
+        self.submission_url_slug = submission_url_slug
+        self.owner_language = owner_language
+        self.assigned_owner_ids = assigned_owner_ids or []
+        self.status = status
+
+    def to_dict(self):
+        """Convert product to dictionary
+
+        Returns:
+            dict: Product data
+        """
+        return {
+            'product_id': self.product_id,
+            'name': self.name,
+            'submission_url_slug': self.submission_url_slug,
+            'owner_language': self.owner_language,
+            'assigned_owner_ids': self.assigned_owner_ids,
+            'status': self.status
+        }
+
+    @classmethod
+    def from_dict(cls, data):
+        """Create product from dictionary
+
+        Args:
+            data: Dictionary with product data
+
+        Returns:
+            Product: Product instance
+        """
+        return cls(
+            product_id=data['product_id'],
+            name=data['name'],
+            submission_url_slug=data['submission_url_slug'],
+            owner_language=data['owner_language'],
+            assigned_owner_ids=data.get('assigned_owner_ids', []),
+            status=data.get('status', 'active')
+        )
+
+    @staticmethod
+    def _get_product_dir(product_id):
+        """Get product directory path
+
+        Args:
+            product_id: Product ID
+
+        Returns:
+            str: Path to product directory
+        """
+        return os.path.join(current_app.config['DATA_DIR'], 'products', product_id)
+
+    @staticmethod
+    def _get_config_file(product_id):
+        """Get product config file path
+
+        Args:
+            product_id: Product ID
+
+        Returns:
+            str: Path to config.yaml
+        """
+        product_dir = Product._get_product_dir(product_id)
+        return os.path.join(product_dir, 'config.yaml')
+
+    @classmethod
+    def get_by_id(cls, product_id):
+        """Load product by ID
+
+        Args:
+            product_id: Product ID to load
+
+        Returns:
+            Product or None: Product instance if found, None otherwise
+        """
+        config_file = cls._get_config_file(product_id)
+
+        if not os.path.exists(config_file):
+            return None
+
+        with open(config_file, 'r') as f:
+            data = yaml.safe_load(f)
+
+        return cls.from_dict(data)
+
+    @classmethod
+    def get_by_slug(cls, slug):
+        """Load product by submission URL slug
+
+        Args:
+            slug: Submission URL slug
+
+        Returns:
+            Product or None: Product instance if found, None otherwise
+        """
+        # Scan all product directories
+        products_dir = os.path.join(current_app.config['DATA_DIR'], 'products')
+
+        if not os.path.exists(products_dir):
+            return None
+
+        for product_id in os.listdir(products_dir):
+            product_dir = os.path.join(products_dir, product_id)
+
+            if not os.path.isdir(product_dir):
+                continue
+
+            config_file = os.path.join(product_dir, 'config.yaml')
+
+            if not os.path.exists(config_file):
+                continue
+
+            with open(config_file, 'r') as f:
+                data = yaml.safe_load(f)
+
+            if data.get('submission_url_slug') == slug:
+                return cls.from_dict(data)
+
+        return None
+
+    @classmethod
+    def get_all(cls):
+        """Get all products
+
+        Returns:
+            list: List of Product instances
+        """
+        products = []
+        products_dir = os.path.join(current_app.config['DATA_DIR'], 'products')
+
+        if not os.path.exists(products_dir):
+            return products
+
+        for product_id in os.listdir(products_dir):
+            product = cls.get_by_id(product_id)
+            if product:
+                products.append(product)
+
+        return products
+
+    def save(self):
+        """Save product to filesystem"""
+        product_dir = self._get_product_dir(self.product_id)
+        os.makedirs(product_dir, exist_ok=True)
+
+        config_file = self._get_config_file(self.product_id)
+
+        with open(config_file, 'w') as f:
+            yaml.dump(self.to_dict(), f, default_flow_style=False)
+
+    def delete(self):
+        """Delete product (not implemented - use archive instead)"""
+        raise NotImplementedError("Products should be archived, not deleted")
+
+    def is_active(self):
+        """Check if product is active
+
+        Returns:
+            bool: True if status is 'active', False otherwise
+        """
+        return self.status == 'active'
+
+    def is_archived(self):
+        """Check if product is archived
+
+        Returns:
+            bool: True if status is 'archived', False otherwise
+        """
+        return self.status == 'archived'

app/models/user.py

@@ -0,0 +1,248 @@
+"""User model for authentication"""
+import os
+import yaml
+from flask_login import UserMixin
+import bcrypt
+
+
+class User(UserMixin):
+    """User model for product owners and administrators
+
+    Attributes:
+        user_id: Unique user identifier
+        username: Username for login
+        email: User email address
+        password_hash: Bcrypt hashed password
+        role: User role ('product_owner' or 'administrator')
+        product_ids: List of product IDs (for product_owner role)
+        is_active: Whether user account is active
+    """
+
+    def __init__(self, user_id, username, email, password_hash, role, product_ids=None, is_active=True):
+        self.user_id = user_id
+        self.username = username
+        self.email = email
+        self.password_hash = password_hash
+        self.role = role
+        self.product_ids = product_ids or []
+        self.is_active = is_active
+
+    def get_id(self):
+        """Get user ID for Flask-Login"""
+        return self.user_id
+
+    @property
+    def is_authenticated(self):
+        """Check if user is authenticated"""
+        return True
+
+    @property
+    def is_anonymous(self):
+        """Check if user is anonymous"""
+        return False
+
+    def check_password(self, password):
+        """Verify password against stored hash
+
+        Args:
+            password: Plain text password to verify
+
+        Returns:
+            bool: True if password matches, False otherwise
+        """
+        return bcrypt.checkpw(password.encode('utf-8'), self.password_hash.encode('utf-8'))
+
+    @staticmethod
+    def hash_password(password):
+        """Hash password using bcrypt
+
+        Args:
+            password: Plain text password
+
+        Returns:
+            str: Hashed password
+        """
+        salt = bcrypt.gensalt()
+        return bcrypt.hashpw(password.encode('utf-8'), salt).decode('utf-8')
+
+    def to_dict(self):
+        """Convert user to dictionary for storage
+
+        Returns:
+            dict: User data
+        """
+        return {
+            'user_id': self.user_id,
+            'username': self.username,
+            'email': self.email,
+            'password_hash': self.password_hash,
+            'role': self.role,
+            'product_ids': self.product_ids,
+            'is_active': self.is_active
+        }
+
+    @classmethod
+    def from_dict(cls, data):
+        """Create user from dictionary
+
+        Args:
+            data: Dictionary with user data
+
+        Returns:
+            User: User instance
+        """
+        return cls(
+            user_id=data['user_id'],
+            username=data['username'],
+            email=data['email'],
+            password_hash=data['password_hash'],
+            role=data['role'],
+            product_ids=data.get('product_ids', []),
+            is_active=data.get('is_active', True)
+        )
+
+    @staticmethod
+    def _get_users_file():
+        """Get path to users YAML file
+
+        Returns:
+            str: Path to users.yaml
+        """
+        from flask import current_app
+        return os.path.join(current_app.config['DATA_DIR'], 'users.yaml')
+
+    @staticmethod
+    def _load_all_users():
+        """Load all users from storage
+
+        Returns:
+            dict: Dictionary of user_id -> user_data
+        """
+        users_file = User._get_users_file()
+
+        if not os.path.exists(users_file):
+            return {}
+
+        with open(users_file, 'r') as f:
+            data = yaml.safe_load(f) or {}
+            return data.get('users', {})
+
+    @staticmethod
+    def _save_all_users(users_dict):
+        """Save all users to storage
+
+        Args:
+            users_dict: Dictionary of user_id -> user_data
+        """
+        users_file = User._get_users_file()
+        os.makedirs(os.path.dirname(users_file), exist_ok=True)
+
+        with open(users_file, 'w') as f:
+            yaml.dump({'users': users_dict}, f, default_flow_style=False)
+
+    @classmethod
+    def get_by_id(cls, user_id):
+        """Load user by ID
+
+        Args:
+            user_id: User ID to load
+
+        Returns:
+            User or None: User instance if found, None otherwise
+        """
+        users = cls._load_all_users()
+        user_data = users.get(user_id)
+
+        if user_data:
+            return cls.from_dict(user_data)
+        return None
+
+    @classmethod
+    def get_by_username(cls, username):
+        """Load user by username
+
+        Args:
+            username: Username to search for
+
+        Returns:
+            User or None: User instance if found, None otherwise
+        """
+        users = cls._load_all_users()
+
+        for user_data in users.values():
+            if user_data['username'] == username:
+                return cls.from_dict(user_data)
+        return None
+
+    @classmethod
+    def get_all(cls):
+        """Get all users
+
+        Returns:
+            list: List of User instances
+        """
+        users = cls._load_all_users()
+        return [cls.from_dict(data) for data in users.values()]
+
+    def save(self):
+        """Save user to storage"""
+        users = self._load_all_users()
+        users[self.user_id] = self.to_dict()
+        self._save_all_users(users)
+
+    def delete(self):
+        """Delete user from storage"""
+        users = self._load_all_users()
+        if self.user_id in users:
+            del users[self.user_id]
+            self._save_all_users(users)
+
+    @classmethod
+    def create(cls, username, email, password, role, product_ids=None):
+        """Create new user
+
+        Args:
+            username: Username for login
+            email: User email
+            password: Plain text password
+            role: User role ('product_owner' or 'administrator')
+            product_ids: List of product IDs (for product_owner)
+
+        Returns:
+            User: Created user instance
+
+        Raises:
+            ValueError: If username already exists or role is invalid
+        """
+        # Validate role
+        if role not in ['product_owner', 'administrator']:
+            raise ValueError(f"Invalid role: {role}")
+
+        # Check if username exists
+        if cls.get_by_username(username):
+            raise ValueError(f"Username already exists: {username}")
+
+        # Generate user ID
+        users = cls._load_all_users()
+        if users:
+            max_id = max([int(uid.replace('usr_', '')) for uid in users.keys()])
+            user_id = f"usr_{max_id + 1:04d}"
+        else:
+            user_id = "usr_0001"
+
+        # Hash password
+        password_hash = cls.hash_password(password)
+
+        # Create user
+        user = cls(
+            user_id=user_id,
+            username=username,
+            email=email,
+            password_hash=password_hash,
+            role=role,
+            product_ids=product_ids or [],
+            is_active=True
+        )
+
+        user.save()
+        return user

app/routes/__init__.py

@@ -0,0 +1,5 @@
+"""Routes package"""
+# Blueprints are imported here for registration in the app factory
+from app.routes import submission, dashboard, admin, auth
+
+__all__ = ['submission', 'dashboard', 'admin', 'auth']

app/routes/admin.py

@@ -0,0 +1,9 @@
+"""Admin routes - administrator management"""
+from flask import Blueprint
+from flask_login import login_required
+
+
+bp = Blueprint('admin', __name__, url_prefix='/admin')
+
+
+# Routes will be implemented in Phase 6 (User Story 4)

app/routes/auth.py

@@ -0,0 +1,48 @@
+"""Authentication routes"""
+from flask import Blueprint, render_template, request, redirect, url_for, flash
+from flask_login import login_user, logout_user, login_required
+from app.models.user import User
+
+
+bp = Blueprint('auth', __name__, url_prefix='/auth')
+
+
+@bp.route('/login', methods=['GET', 'POST'])
+def login():
+    """User login page
+
+    GET: Display login form
+    POST: Process login credentials
+    """
+    if request.method == 'POST':
+        username = request.form.get('username', '').strip()
+        password = request.form.get('password', '')
+
+        if not username or not password:
+            flash('Please provide both username and password', 'error')
+            return render_template('auth/login.html')
+
+        user = User.get_by_username(username)
+
+        if user and user.is_active and user.check_password(password):
+            login_user(user)
+            flash(f'Welcome back, {user.username}!', 'success')
+
+            # Redirect based on role
+            if user.role == 'administrator':
+                return redirect(url_for('admin.dashboard'))
+            elif user.role == 'product_owner':
+                return redirect(url_for('dashboard.list'))
+        else:
+            flash('Invalid username or password', 'error')
+
+    return render_template('auth/login.html')
+
+
+@bp.route('/logout')
+@login_required
+def logout():
+    """User logout"""
+    logout_user()
+    flash('You have been logged out', 'info')
+    return redirect(url_for('submission.form'))

app/routes/dashboard.py

@@ -0,0 +1,9 @@
+"""Dashboard routes - product owner feedback management"""
+from flask import Blueprint
+from flask_login import login_required
+
+
+bp = Blueprint('dashboard', __name__, url_prefix='/dashboard')
+
+
+# Routes will be implemented in Phase 5 (User Story 3)

app/routes/submission.py

@@ -0,0 +1,100 @@
+"""Submission routes - anonymous feedback submission"""
+from flask import Blueprint, render_template, request, redirect, url_for, flash, abort
+from app.models.product import Product
+from app.services.feedback_storage import FeedbackStorageService
+from app.utils.file_validator import validate_file, scan_file_for_viruses
+
+
+bp = Blueprint('submission', __name__, url_prefix='/submit')
+
+
+@bp.route('/<product_slug>', methods=['GET'])
+def form(product_slug):
+    """Display feedback submission form
+
+    Args:
+        product_slug: Product submission URL slug
+
+    Returns:
+        Rendered submission form template or 404
+    """
+    # Load product by slug
+    product = Product.get_by_slug(product_slug)
+
+    if not product:
+        abort(404, description="Product not found")
+
+    # Check if product is archived
+    if product.is_archived():
+        abort(404, description="This product is no longer accepting feedback")
+
+    return render_template('submission/form.html', product=product)
+
+
+@bp.route('/<product_slug>', methods=['POST'])
+def submit(product_slug):
+    """Process feedback submission
+
+    Args:
+        product_slug: Product submission URL slug
+
+    Returns:
+        Redirect to success page or error page
+    """
+    # Load product by slug
+    product = Product.get_by_slug(product_slug)
+
+    if not product:
+        abort(404, description="Product not found")
+
+    # Check if product is archived
+    if product.is_archived():
+        abort(404, description="This product is no longer accepting feedback")
+
+    # Get form data
+    feedback_text = request.form.get('feedback_text', '').strip()
+
+    # Get uploaded files
+    uploaded_files = request.files.getlist('files')
+    # Filter out empty file inputs
+    files = [f for f in uploaded_files if f and f.filename != '']
+
+    # Validation: Must provide either text or files
+    if not feedback_text and not files:
+        abort(400, description="Please provide either feedback text or attachments")
+
+    # Validation: Maximum 3 files
+    if len(files) > 3:
+        abort(400, description="Maximum 3 attachments allowed")
+
+    # Validate each file
+    for file in files:
+        is_valid, error_message = validate_file(file)
+        if not is_valid:
+            abort(400, description=error_message)
+
+        # Scan for viruses
+        is_clean, virus_message = scan_file_for_viruses(file)
+        if not is_clean:
+            abort(400, description=f"File rejected: {virus_message}")
+
+    # Save feedback
+    try:
+        feedback = FeedbackStorageService.save_complete_feedback(
+            product_id=product.product_id,
+            content_text=feedback_text if feedback_text else None,
+            files=files if files else None
+        )
+
+        return render_template('submission/success.html',
+                             product=product,
+                             feedback_id=feedback.feedback_id)
+
+    except Exception as e:
+        # Log error
+        from flask import current_app
+        current_app.logger.error(f"Error saving feedback: {e}")
+
+        return render_template('submission/error.html',
+                             product=product,
+                             error_message="An error occurred while saving your feedback. Please try again."), 500

app/services/__init__.py

@@ -0,0 +1,2 @@
+"""Services package"""
+# Services provide business logic and external integrations

app/services/auth.py

@@ -0,0 +1,52 @@
+"""Authentication service"""
+import bcrypt
+from app.models.user import User
+
+
+def verify_credentials(username, password):
+    """Verify username and password
+
+    Args:
+        username: Username to check
+        password: Plain text password to verify
+
+    Returns:
+        User or None: User object if credentials valid, None otherwise
+    """
+    if not username or not password:
+        return None
+
+    user = User.get_by_username(username)
+
+    if not user or not user.is_active:
+        return None
+
+    if user.check_password(password):
+        return user
+
+    return None
+
+
+def hash_password(password):
+    """Hash password using bcrypt
+
+    Args:
+        password: Plain text password
+
+    Returns:
+        str: Hashed password
+    """
+    return User.hash_password(password)
+
+
+def check_password(password, password_hash):
+    """Check password against hash
+
+    Args:
+        password: Plain text password
+        password_hash: Bcrypt hash to check against
+
+    Returns:
+        bool: True if password matches, False otherwise
+    """
+    return bcrypt.checkpw(password.encode('utf-8'), password_hash.encode('utf-8'))

app/services/feedback_storage.py

@@ -0,0 +1,168 @@
+"""Feedback storage service"""
+import os
+import shutil
+from flask import current_app
+from app.models.feedback import Feedback
+from app.utils.file_validator import get_safe_filename
+
+
+class FeedbackStorageService:
+    """Service for storing feedback to filesystem"""
+
+    @staticmethod
+    def create_feedback(product_id, content_text=None, files=None):
+        """Create new feedback entry
+
+        Args:
+            product_id: Product ID
+            content_text: Feedback text content (optional)
+            files: List of uploaded files (optional)
+
+        Returns:
+            Feedback: Created feedback instance
+        """
+        # Generate unique feedback ID
+        feedback_id = Feedback.generate_id()
+
+        # Create content preview (first 200 chars)
+        content_preview = ''
+        if content_text:
+            content_preview = content_text[:200]
+
+        # Check attachments
+        has_attachments = bool(files and len(files) > 0)
+        attachment_count = len(files) if files else 0
+
+        # Create feedback instance
+        feedback = Feedback(
+            feedback_id=feedback_id,
+            product_id=product_id,
+            status='new',
+            content_preview=content_preview,
+            has_attachments=has_attachments,
+            attachment_count=attachment_count
+        )
+
+        # Create directory structure
+        feedback_dir = Feedback._get_feedback_dir(product_id, feedback_id)
+        os.makedirs(feedback_dir, exist_ok=True)
+
+        return feedback
+
+    @staticmethod
+    def save_metadata(feedback):
+        """Save feedback metadata to YAML file
+
+        Args:
+            feedback: Feedback instance to save
+        """
+        feedback.save_metadata()
+
+    @staticmethod
+    def save_content(feedback, content_text):
+        """Save feedback content to text file
+
+        Args:
+            feedback: Feedback instance
+            content_text: Feedback text content
+        """
+        if not content_text:
+            return
+
+        content_file = Feedback._get_content_file(feedback.product_id, feedback.feedback_id)
+
+        with open(content_file, 'w', encoding='utf-8') as f:
+            f.write(content_text)
+
+    @staticmethod
+    def save_attachments(feedback, files):
+        """Save attachment files
+
+        Args:
+            feedback: Feedback instance
+            files: List of Werkzeug FileStorage objects
+
+        Returns:
+            list: List of saved filenames
+        """
+        if not files:
+            return []
+
+        attachments_dir = Feedback._get_attachments_dir(feedback.product_id, feedback.feedback_id)
+        os.makedirs(attachments_dir, exist_ok=True)
+
+        saved_files = []
+
+        for file in files:
+            if not file or file.filename == '':
+                continue
+
+            # Sanitize filename
+            safe_filename = get_safe_filename(file.filename)
+
+            # Save file
+            file_path = os.path.join(attachments_dir, safe_filename)
+            file.save(file_path)
+
+            saved_files.append(safe_filename)
+
+        return saved_files
+
+    @staticmethod
+    def save_complete_feedback(product_id, content_text=None, files=None):
+        """Create and save complete feedback submission
+
+        Args:
+            product_id: Product ID
+            content_text: Feedback text content (optional)
+            files: List of uploaded files (optional)
+
+        Returns:
+            Feedback: Created and saved feedback instance
+        """
+        # Create feedback
+        feedback = FeedbackStorageService.create_feedback(product_id, content_text, files)
+
+        # Save content
+        if content_text:
+            FeedbackStorageService.save_content(feedback, content_text)
+
+        # Save attachments
+        if files:
+            FeedbackStorageService.save_attachments(feedback, files)
+
+        # Save metadata
+        FeedbackStorageService.save_metadata(feedback)
+
+        return feedback
+
+    @staticmethod
+    def update_feedback_status(feedback, new_status):
+        """Update feedback status
+
+        Args:
+            feedback: Feedback instance
+            new_status: New status value
+
+        Returns:
+            bool: True if updated successfully, False otherwise
+        """
+        if new_status not in Feedback.VALID_STATUSES:
+            return False
+
+        feedback.status = new_status
+        feedback.save_metadata()
+
+        return True
+
+    @staticmethod
+    def delete_feedback(feedback):
+        """Delete feedback and all associated files
+
+        Args:
+            feedback: Feedback instance to delete
+        """
+        feedback_dir = Feedback._get_feedback_dir(feedback.product_id, feedback.feedback_id)
+
+        if os.path.exists(feedback_dir):
+            shutil.rmtree(feedback_dir)

app/templates/auth/login.html

@@ -0,0 +1,25 @@
+{% extends "base.html" %}
+
+{% block title %}Login - Reklamator{% endblock %}
+
+{% block content %}
+<h1>Login</h1>
+
+<form method="POST">
+    <div class="form-group">
+        <label for="username">Username</label>
+        <input type="text" id="username" name="username" required autofocus>
+    </div>
+
+    <div class="form-group">
+        <label for="password">Password</label>
+        <input type="password" id="password" name="password" required>
+    </div>
+
+    <button type="submit">Login</button>
+</form>
+
+<p style="margin-top: 20px;">
+    <a href="{{ url_for('submission.form') }}">Return to feedback submission</a>
+</p>
+{% endblock %}

app/templates/base.html

@@ -0,0 +1,217 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{% block title %}Reklamator - Anonymous Feedback{% endblock %}</title>
+    <style>
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+        }
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+            line-height: 1.6;
+            color: #333;
+            background-color: #f5f5f5;
+            padding: 20px;
+        }
+        .container {
+            max-width: 800px;
+            margin: 0 auto;
+            background: white;
+            padding: 30px;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        h1, h2, h3 {
+            margin-bottom: 20px;
+            color: #2c3e50;
+        }
+        h1 {
+            font-size: 2em;
+            border-bottom: 3px solid #3498db;
+            padding-bottom: 10px;
+        }
+        h2 {
+            font-size: 1.5em;
+        }
+        .flash-messages {
+            margin-bottom: 20px;
+        }
+        .flash {
+            padding: 12px 20px;
+            margin-bottom: 10px;
+            border-radius: 4px;
+            border-left: 4px solid;
+        }
+        .flash.success {
+            background-color: #d4edda;
+            border-color: #28a745;
+            color: #155724;
+        }
+        .flash.error {
+            background-color: #f8d7da;
+            border-color: #dc3545;
+            color: #721c24;
+        }
+        .flash.info {
+            background-color: #d1ecf1;
+            border-color: #17a2b8;
+            color: #0c5460;
+        }
+        .flash.warning {
+            background-color: #fff3cd;
+            border-color: #ffc107;
+            color: #856404;
+        }
+        form {
+            margin: 20px 0;
+        }
+        .form-group {
+            margin-bottom: 20px;
+        }
+        label {
+            display: block;
+            margin-bottom: 5px;
+            font-weight: 600;
+            color: #555;
+        }
+        input[type="text"],
+        input[type="email"],
+        input[type="password"],
+        textarea,
+        select {
+            width: 100%;
+            padding: 10px;
+            border: 1px solid #ddd;
+            border-radius: 4px;
+            font-size: 1em;
+            font-family: inherit;
+        }
+        textarea {
+            min-height: 150px;
+            resize: vertical;
+        }
+        button,
+        .btn {
+            display: inline-block;
+            padding: 10px 20px;
+            background-color: #3498db;
+            color: white;
+            border: none;
+            border-radius: 4px;
+            cursor: pointer;
+            font-size: 1em;
+            text-decoration: none;
+            transition: background-color 0.3s;
+        }
+        button:hover,
+        .btn:hover {
+            background-color: #2980b9;
+        }
+        button.secondary,
+        .btn.secondary {
+            background-color: #95a5a6;
+        }
+        button.secondary:hover,
+        .btn.secondary:hover {
+            background-color: #7f8c8d;
+        }
+        button.danger,
+        .btn.danger {
+            background-color: #e74c3c;
+        }
+        button.danger:hover,
+        .btn.danger:hover {
+            background-color: #c0392b;
+        }
+        .nav {
+            margin-bottom: 30px;
+            padding-bottom: 15px;
+            border-bottom: 1px solid #eee;
+        }
+        .nav a {
+            margin-right: 20px;
+            color: #3498db;
+            text-decoration: none;
+            font-weight: 500;
+        }
+        .nav a:hover {
+            text-decoration: underline;
+        }
+        .error-text {
+            color: #e74c3c;
+            font-size: 0.9em;
+            margin-top: 5px;
+        }
+        table {
+            width: 100%;
+            border-collapse: collapse;
+            margin: 20px 0;
+        }
+        th, td {
+            padding: 12px;
+            text-align: left;
+            border-bottom: 1px solid #ddd;
+        }
+        th {
+            background-color: #f8f9fa;
+            font-weight: 600;
+            color: #555;
+        }
+        tr:hover {
+            background-color: #f8f9fa;
+        }
+        .badge {
+            display: inline-block;
+            padding: 4px 8px;
+            border-radius: 3px;
+            font-size: 0.85em;
+            font-weight: 600;
+        }
+        .badge.new {
+            background-color: #3498db;
+            color: white;
+        }
+        .badge.analyzed {
+            background-color: #2ecc71;
+            color: white;
+        }
+        .badge.archived {
+            background-color: #95a5a6;
+            color: white;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        {% if current_user and current_user.is_authenticated %}
+        <div class="nav">
+            {% if current_user.role == 'product_owner' %}
+                <a href="{{ url_for('dashboard.list') }}">Dashboard</a>
+                <a href="{{ url_for('dashboard.products') }}">Products</a>
+            {% elif current_user.role == 'administrator' %}
+                <a href="{{ url_for('admin.dashboard') }}">Admin Dashboard</a>
+                <a href="{{ url_for('admin.users') }}">Users</a>
+                <a href="{{ url_for('admin.products') }}">Products</a>
+            {% endif %}
+            <a href="{{ url_for('auth.logout') }}" style="float: right;">Logout ({{ current_user.username }})</a>
+        </div>
+        {% endif %}
+
+        {% with messages = get_flashed_messages(with_categories=true) %}
+            {% if messages %}
+                <div class="flash-messages">
+                    {% for category, message in messages %}
+                        <div class="flash {{ category }}">{{ message }}</div>
+                    {% endfor %}
+                </div>
+            {% endif %}
+        {% endwith %}
+
+        {% block content %}{% endblock %}
+    </div>
+</body>
+</html>

app/templates/index.html

@@ -0,0 +1,22 @@
+{% extends "base.html" %}
+
+{% block title %}Welcome - Reklamator{% endblock %}
+
+{% block content %}
+<div style="text-align: center; padding: 60px 20px;">
+    <h1 style="font-size: 2.5em; margin-bottom: 20px;">Reklamator</h1>
+    <p style="font-size: 1.3em; color: #666; margin-bottom: 40px;">
+        Anonymous Feedback Platform
+    </p>
+
+    <div style="max-width: 600px; margin: 0 auto; text-align: left;">
+        <h2>Submit Feedback</h2>
+        <p>If you have a product-specific submission link, use it to submit your feedback anonymously.</p>
+
+        <h2 style="margin-top: 40px;">Product Owners & Administrators</h2>
+        <p>
+            <a href="{{ url_for('auth.login') }}" class="btn">Login to Dashboard</a>
+        </p>
+    </div>
+</div>
+{% endblock %}

app/templates/submission/error.html

@@ -0,0 +1,21 @@
+{% extends "base.html" %}
+
+{% block title %}Error - {{ product.name }}{% endblock %}
+
+{% block content %}
+<div style="text-align: center; padding: 40px 20px;">
+    <div style="font-size: 4em; color: #e74c3c; margin-bottom: 20px;">✗</div>
+
+    <h1>Oops! Something went wrong</h1>
+
+    <p style="font-size: 1.1em; margin: 20px 0; color: #555;">
+        {{ error_message }}
+    </p>
+
+    <div style="margin-top: 40px;">
+        <a href="{{ url_for('submission.form', product_slug=product.submission_url_slug) }}" class="btn">
+            Try Again
+        </a>
+    </div>
+</div>
+{% endblock %}

app/templates/submission/form.html

@@ -0,0 +1,42 @@
+{% extends "base.html" %}
+
+{% block title %}Submit Feedback - {{ product.name }}{% endblock %}
+
+{% block content %}
+<h1>Submit Feedback</h1>
+<h2>{{ product.name }}</h2>
+
+<p>We value your feedback. Please share your thoughts, report issues, or suggest improvements below.</p>
+
+<form method="POST" enctype="multipart/form-data">
+    <div class="form-group">
+        <label for="feedback_text">Your Feedback</label>
+        <textarea id="feedback_text" name="feedback_text"
+                  placeholder="Describe your feedback in any language..."></textarea>
+        <p style="font-size: 0.9em; color: #666; margin-top: 5px;">
+            You can write in any language. Optional if you attach files.
+        </p>
+    </div>
+
+    <div class="form-group">
+        <label for="files">Attachments (Optional)</label>
+        <input type="file" id="files" name="files" multiple>
+        <p style="font-size: 0.9em; color: #666; margin-top: 5px;">
+            You can attach up to 3 files (max 10MB each). Allowed types: images (PNG, JPG, GIF),
+            documents (PDF, TXT, DOC, DOCX), spreadsheets (XLS, XLSX, CSV).
+        </p>
+    </div>
+
+    <div style="background-color: #f8f9fa; padding: 15px; border-radius: 4px; margin: 20px 0;">
+        <h3 style="margin-top: 0; font-size: 1.1em;">Privacy Notice</h3>
+        <ul style="margin: 10px 0; padding-left: 20px; line-height: 1.8;">
+            <li>Your feedback is submitted anonymously</li>
+            <li>We do not collect or store your IP address</li>
+            <li>All files are scanned for malware</li>
+            <li>Please do not include personal information unless necessary</li>
+        </ul>
+    </div>
+
+    <button type="submit">Submit Feedback</button>
+</form>
+{% endblock %}

app/templates/submission/success.html

@@ -0,0 +1,37 @@
+{% extends "base.html" %}
+
+{% block title %}Feedback Submitted - {{ product.name }}{% endblock %}
+
+{% block content %}
+<div style="text-align: center; padding: 40px 20px;">
+    <div style="font-size: 4em; color: #2ecc71; margin-bottom: 20px;">✓</div>
+
+    <h1>Thank You!</h1>
+
+    <p style="font-size: 1.2em; margin: 20px 0;">
+        Your feedback has been successfully submitted.
+    </p>
+
+    <div style="background-color: #f8f9fa; padding: 20px; border-radius: 4px; margin: 30px 0; text-align: left;">
+        <h3 style="margin-top: 0;">What happens next?</h3>
+        <ul style="line-height: 2;">
+            <li>Your feedback will be analyzed automatically</li>
+            <li>The product team will review your submission</li>
+            <li>They may use your feedback to improve {{ product.name }}</li>
+        </ul>
+
+        <p style="margin: 20px 0 10px 0; font-size: 0.9em; color: #666;">
+            <strong>Reference ID:</strong> {{ feedback_id }}
+        </p>
+        <p style="margin: 0; font-size: 0.9em; color: #666;">
+            (This ID is for your reference only. We cannot track individual submissions.)
+        </p>
+    </div>
+
+    <p style="margin-top: 40px;">
+        <a href="{{ url_for('submission.form', product_slug=product.submission_url_slug) }}" class="btn">
+            Submit More Feedback
+        </a>
+    </p>
+</div>
+{% endblock %}

app/utils/__init__.py

@@ -0,0 +1,2 @@
+"""Utilities package"""
+# Utility functions for validation, security, etc.

app/utils/file_validator.py

@@ -0,0 +1,144 @@
+"""File upload validation utilities"""
+import os
+from werkzeug.utils import secure_filename
+import clamd
+from flask import current_app
+
+
+# Allowed file extensions for attachments
+ALLOWED_EXTENSIONS = {
+    'txt', 'log', 'pdf', 'png', 'jpg', 'jpeg', 'gif',
+    'doc', 'docx', 'xls', 'xlsx', 'csv'
+}
+
+# Maximum file size (10MB)
+MAX_FILE_SIZE = 10 * 1024 * 1024
+
+
+def allowed_file(filename):
+    """Check if file extension is allowed
+
+    Args:
+        filename: Name of the uploaded file
+
+    Returns:
+        bool: True if extension is allowed, False otherwise
+    """
+    if not filename:
+        return False
+
+    return '.' in filename and \
+           filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
+
+
+def validate_file_size(file_stream):
+    """Check if file size is within limits
+
+    Args:
+        file_stream: File stream object
+
+    Returns:
+        bool: True if size is acceptable, False otherwise
+    """
+    # Seek to end to get file size
+    file_stream.seek(0, os.SEEK_END)
+    size = file_stream.tell()
+    # Reset to beginning
+    file_stream.seek(0)
+
+    return size <= MAX_FILE_SIZE
+
+
+def get_safe_filename(filename):
+    """Get secure version of filename
+
+    Args:
+        filename: Original filename
+
+    Returns:
+        str: Secure filename safe for filesystem storage
+    """
+    return secure_filename(filename)
+
+
+def validate_file(file):
+    """Validate uploaded file
+
+    Args:
+        file: Werkzeug FileStorage object
+
+    Returns:
+        tuple: (is_valid, error_message)
+            is_valid: bool indicating if file is valid
+            error_message: str with error description or None
+    """
+    if not file:
+        return False, "No file provided"
+
+    if file.filename == '':
+        return False, "No file selected"
+
+    if not allowed_file(file.filename):
+        return False, f"File type not allowed. Allowed types: {', '.join(ALLOWED_EXTENSIONS)}"
+
+    if not validate_file_size(file.stream):
+        return False, f"File size exceeds maximum of {MAX_FILE_SIZE / (1024 * 1024):.0f}MB"
+
+    return True, None
+
+
+def scan_file_for_viruses(file):
+    """Scan file for viruses using ClamAV
+
+    Args:
+        file: Werkzeug FileStorage object
+
+    Returns:
+        tuple: (is_clean, error_message)
+            is_clean: bool indicating if file is clean (True) or infected (False)
+            error_message: str with error description or None
+    """
+    try:
+        # Connect to ClamAV daemon
+        clamd_socket = current_app.config.get('CLAMD_SOCKET')
+
+        if not clamd_socket:
+            # ClamAV not configured, skip scanning
+            current_app.logger.warning("ClamAV socket not configured, skipping virus scan")
+            return True, None
+
+        cd = clamd.ClamdUnixSocket(clamd_socket)
+
+        # Ping to check if ClamAV is available
+        try:
+            cd.ping()
+        except Exception as e:
+            current_app.logger.warning(f"ClamAV not available: {e}, skipping virus scan")
+            return True, None
+
+        # Read file content
+        file.stream.seek(0)
+        file_data = file.stream.read()
+        file.stream.seek(0)  # Reset for later use
+
+        # Scan file
+        scan_result = cd.instream(file_data)
+
+        # Check result
+        if scan_result and 'stream' in scan_result:
+            status, virus_name = scan_result['stream']
+
+            if status == 'OK':
+                return True, None
+            elif status == 'FOUND':
+                return False, f"Virus detected: {virus_name}"
+            else:
+                return False, f"Scan error: {status}"
+
+        return True, None
+
+    except Exception as e:
+        current_app.logger.error(f"ClamAV scanning error: {e}")
+        # On error, we'll allow the file but log the error
+        # In production, you might want to reject files if scanning fails
+        return True, None

config/development.py

@@ -0,0 +1,37 @@
+"""Development configuration"""
+import os
+
+class DevelopmentConfig:
+    """Development environment configuration"""
+    DEBUG = True
+    TESTING = False
+
+    # Security
+    SECRET_KEY = os.environ.get('SECRET_KEY', 'dev-secret-key-change-in-production')
+
+    # Paths
+    DATA_DIR = os.environ.get('DATA_DIR', './data')
+
+    # Flask-WTF CSRF
+    WTF_CSRF_ENABLED = True
+    WTF_CSRF_TIME_LIMIT = None
+
+    # File Upload
+    MAX_CONTENT_LENGTH = int(os.environ.get('MAX_CONTENT_LENGTH', 10 * 1024 * 1024))  # 10MB
+
+    # AI Integration
+    ANTHROPIC_API_KEY = os.environ.get('ANTHROPIC_API_KEY')
+
+    # ClamAV
+    CLAMD_SOCKET = os.environ.get('CLAMD_SOCKET', '/var/run/clamav/clamd.ctl')
+
+    # Rate Limiting
+    RATELIMIT_ENABLED = os.environ.get('RATE_LIMIT_ENABLED', 'true').lower() == 'true'
+    RATELIMIT_STORAGE_URL = 'memory://'
+    RATELIMIT_PER_HOUR = int(os.environ.get('RATE_LIMIT_PER_HOUR', 10))
+
+    # Session
+    SESSION_COOKIE_SECURE = False  # Allow HTTP in development
+    SESSION_COOKIE_HTTPONLY = True
+    SESSION_COOKIE_SAMESITE = 'Lax'
+    PERMANENT_SESSION_LIFETIME = 86400  # 24 hours

config/production.py

@@ -0,0 +1,44 @@
+"""Production configuration"""
+import os
+
+class ProductionConfig:
+    """Production environment configuration"""
+    DEBUG = False
+    TESTING = False
+
+    # Security
+    SECRET_KEY = os.environ.get('SECRET_KEY')  # Required in production
+    if not SECRET_KEY:
+        raise ValueError("SECRET_KEY environment variable must be set in production")
+
+    # Paths
+    DATA_DIR = os.environ.get('DATA_DIR', '/var/lib/reklamator/data')
+
+    # Flask-WTF CSRF
+    WTF_CSRF_ENABLED = True
+    WTF_CSRF_TIME_LIMIT = None
+
+    # File Upload
+    MAX_CONTENT_LENGTH = int(os.environ.get('MAX_CONTENT_LENGTH', 10 * 1024 * 1024))  # 10MB
+
+    # AI Integration
+    ANTHROPIC_API_KEY = os.environ.get('ANTHROPIC_API_KEY')  # Required
+    if not ANTHROPIC_API_KEY:
+        raise ValueError("ANTHROPIC_API_KEY environment variable must be set in production")
+
+    # ClamAV
+    CLAMD_SOCKET = os.environ.get('CLAMD_SOCKET', '/var/run/clamav/clamd.ctl')
+
+    # Rate Limiting
+    RATELIMIT_ENABLED = os.environ.get('RATE_LIMIT_ENABLED', 'true').lower() == 'true'
+    RATELIMIT_STORAGE_URL = 'memory://'
+    RATELIMIT_PER_HOUR = int(os.environ.get('RATE_LIMIT_PER_HOUR', 10))
+
+    # Session - HTTPS only
+    SESSION_COOKIE_SECURE = True  # HTTPS only
+    SESSION_COOKIE_HTTPONLY = True
+    SESSION_COOKIE_SAMESITE = 'Lax'
+    PERMANENT_SESSION_LIFETIME = 86400  # 24 hours
+
+    # Security Headers
+    SEND_FILE_MAX_AGE_DEFAULT = 31536000  # 1 year for static files

config/testing.py

@@ -0,0 +1,37 @@
+"""Testing configuration"""
+import os
+import tempfile
+
+class TestingConfig:
+    """Testing environment configuration"""
+    DEBUG = False
+    TESTING = True
+
+    # Security
+    SECRET_KEY = 'test-secret-key'
+
+    # Paths - use temporary directory
+    DATA_DIR = tempfile.mkdtemp()
+
+    # Flask-WTF CSRF - disabled for easier testing
+    WTF_CSRF_ENABLED = False
+
+    # File Upload
+    MAX_CONTENT_LENGTH = 10 * 1024 * 1024  # 10MB
+
+    # AI Integration - mock in tests
+    ANTHROPIC_API_KEY = 'test-api-key'
+
+    # ClamAV - mock in tests
+    CLAMD_SOCKET = '/tmp/test-clamd.ctl'
+
+    # Rate Limiting - disabled for testing
+    RATELIMIT_ENABLED = False
+    RATELIMIT_STORAGE_URL = 'memory://'
+    RATELIMIT_PER_HOUR = 1000  # High limit for testing
+
+    # Session
+    SESSION_COOKIE_SECURE = False
+    SESSION_COOKIE_HTTPONLY = True
+    SESSION_COOKIE_SAMESITE = 'Lax'
+    PERMANENT_SESSION_LIFETIME = 86400

pytest.ini

@@ -0,0 +1,13 @@
+[pytest]
+testpaths = tests
+python_files = test_*.py
+python_classes = Test*
+python_functions = test_*
+addopts =
+    -v
+    --tb=short
+    --strict-markers
+markers =
+    contract: Contract tests for API endpoints
+    integration: Integration tests for user journeys
+    unit: Unit tests for isolated components

requirements.txt

@@ -0,0 +1,12 @@
+Flask==3.0.0
+Flask-Login==0.6.3
+Flask-Limiter==3.5.0
+Flask-WTF==1.2.1
+anthropic==0.8.0
+clamd==1.0.2
+bcrypt==4.1.2
+PyYAML==6.0.1
+pytest==7.4.3
+pytest-flask==1.3.0
+python-dotenv==1.0.0
+Werkzeug==3.0.1

run.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+"""
+Reklamator - Anonymous Feedback Platform
+Application entry point
+"""
+import os
+from app import create_app
+
+app = create_app(os.getenv('FLASK_ENV', 'development'))
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=5000, debug=True)

specs/001-build-an-application/tasks.md

@@ -25,15 +25,15 @@
 
 **Purpose**: Project initialization and basic structure
 
-- [ ] T001 Create project directory structure per plan.md (app/, tests/, config/, data/)
-- [ ] T002 Initialize Python virtual environment and create requirements.txt with core dependencies
-- [ ] T003 [P] Create pytest.ini configuration file in project root
-- [ ] T004 [P] Create .env.example file documenting required environment variables
-- [ ] T005 [P] Create run.py application entry point with Flask app factory import
-- [ ] T006 [P] Create .gitignore for Python project (venv/, __pycache__/, .env, data/)
-- [ ] T007 [P] Create config/development.py configuration class
-- [ ] T008 [P] Create config/production.py configuration class
-- [ ] T009 [P] Create config/testing.py configuration class
+- [X] T001 Create project directory structure per plan.md (app/, tests/, config/, data/)
+- [X] T002 Initialize Python virtual environment and create requirements.txt with core dependencies
+- [X] T003 [P] Create pytest.ini configuration file in project root
+- [X] T004 [P] Create .env.example file documenting required environment variables
+- [X] T005 [P] Create run.py application entry point with Flask app factory import
+- [X] T006 [P] Create .gitignore for Python project (venv/, __pycache__/, .env, data/)
+- [X] T007 [P] Create config/development.py configuration class
+- [X] T008 [P] Create config/production.py configuration class
+- [X] T009 [P] Create config/testing.py configuration class
 
 ---
 
@@ -43,26 +43,26 @@
 
 **⚠️ CRITICAL**: No user story work can begin until this phase is complete
 
-- [ ] T010 Implement Flask app factory in app/__init__.py with config loading
-- [ ] T011 [P] Create app/models/__init__.py module initialization
-- [ ] T012 [P] Create app/services/__init__.py module initialization
-- [ ] T013 [P] Create app/routes/__init__.py module initialization
-- [ ] T014 [P] Create app/utils/__init__.py module initialization
-- [ ] T015 [P] Create app/templates/ directory for Jinja2 templates
-- [ ] T016 Implement base template layout in app/templates/base.html with minimal inline CSS
-- [ ] T017 [P] Create app/utils/file_validator.py for MIME type and size validation
-- [ ] T018 Implement filename sanitization in app/utils/file_validator.py
-- [ ] T019 [P] Create data/users.yaml with initial admin user (bcrypt hashed password)
-- [ ] T020 Implement User model in app/models/user.py with Flask-Login UserMixin
-- [ ] T021 Implement user loading from users.yaml in app/models/user.py
-- [ ] T022 Configure Flask-Login in app/__init__.py with login_manager
-- [ ] T023 [P] Configure Flask-WTF CSRF protection in app/__init__.py
-- [ ] T024 [P] Configure Flask-Limiter in app/__init__.py for rate limiting
-- [ ] T025 Create app/services/auth.py with bcrypt password verification
-- [ ] T026 [P] Create tests/conftest.py with Flask test client fixture
-- [ ] T027 [P] Create tests/contract/__init__.py
-- [ ] T028 [P] Create tests/integration/__init__.py
-- [ ] T029 [P] Create tests/unit/__init__.py
+- [X] T010 Implement Flask app factory in app/__init__.py with config loading
+- [X] T011 [P] Create app/models/__init__.py module initialization
+- [X] T012 [P] Create app/services/__init__.py module initialization
+- [X] T013 [P] Create app/routes/__init__.py module initialization
+- [X] T014 [P] Create app/utils/__init__.py module initialization
+- [X] T015 [P] Create app/templates/ directory for Jinja2 templates
+- [X] T016 Implement base template layout in app/templates/base.html with minimal inline CSS
+- [X] T017 [P] Create app/utils/file_validator.py for MIME type and size validation
+- [X] T018 Implement filename sanitization in app/utils/file_validator.py
+- [X] T019 [P] Create data/users.yaml with initial admin user (bcrypt hashed password)
+- [X] T020 Implement User model in app/models/user.py with Flask-Login UserMixin
+- [X] T021 Implement user loading from users.yaml in app/models/user.py
+- [X] T022 Configure Flask-Login in app/__init__.py with login_manager
+- [X] T023 [P] Configure Flask-WTF CSRF protection in app/__init__.py
+- [X] T024 [P] Configure Flask-Limiter in app/__init__.py for rate limiting
+- [X] T025 Create app/services/auth.py with bcrypt password verification
+- [X] T026 [P] Create tests/conftest.py with Flask test client fixture
+- [X] T027 [P] Create tests/contract/__init__.py
+- [X] T028 [P] Create tests/integration/__init__.py
+- [X] T029 [P] Create tests/unit/__init__.py
 
 **Checkpoint**: Foundation ready - user story implementation can now begin in parallel
 
@@ -78,16 +78,16 @@
 
 **NOTE: Write these tests FIRST, ensure they FAIL before implementation**
 
-- [ ] T030 [P] [US1] Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py
-- [ ] T031 [P] [US1] Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py
-- [ ] T032 [P] [US1] Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py
-- [ ] T033 [P] [US1] Contract test for POST /submit/{product_slug} with text and files in tests/contract/test_submission_routes.py
-- [ ] T034 [P] [US1] Contract test for empty submission rejection (400) in tests/contract/test_submission_routes.py
-- [ ] T035 [P] [US1] Contract test for >3 files rejection (400) in tests/contract/test_submission_routes.py
-- [ ] T036 [P] [US1] Contract test for >10MB file rejection (413) in tests/contract/test_submission_routes.py
-- [ ] T037 [P] [US1] Contract test for unsupported file type rejection (400) in tests/contract/test_submission_routes.py
-- [ ] T038 [P] [US1] Contract test for rate limiting (429 after 10 submissions) in tests/contract/test_submission_routes.py
-- [ ] T039 [P] [US1] Integration test for complete feedback submission flow in tests/integration/test_feedback_submission_flow.py
+- [X] T030 [P] [US1] Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py
+- [X] T031 [P] [US1] Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py
+- [X] T032 [P] [US1] Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py
+- [X] T033 [P] [US1] Contract test for POST /submit/{product_slug} with text and files in tests/contract/test_submission_routes.py
+- [X] T034 [P] [US1] Contract test for empty submission rejection (400) in tests/contract/test_submission_routes.py
+- [X] T035 [P] [US1] Contract test for >3 files rejection (400) in tests/contract/test_submission_routes.py
+- [X] T036 [P] [US1] Contract test for >10MB file rejection (413) in tests/contract/test_submission_routes.py
+- [X] T037 [P] [US1] Contract test for unsupported file type rejection (400) in tests/contract/test_submission_routes.py
+- [X] T038 [P] [US1] Contract test for rate limiting (429 after 10 submissions) in tests/contract/test_submission_routes.py
+- [X] T039 [P] [US1] Integration test for complete feedback submission flow in tests/integration/test_feedback_submission_flow.py
 
 ### Implementation for User Story 1
 

tests/__init__.py

@@ -0,0 +1 @@
+"""Tests package"""

tests/conftest.py

@@ -0,0 +1,89 @@
+"""Pytest configuration and fixtures"""
+import os
+import pytest
+import tempfile
+import shutil
+from app import create_app
+from app.models.user import User
+
+
+@pytest.fixture
+def app():
+    """Create application for testing"""
+    app = create_app('testing')
+
+    # Create temporary data directory
+    with app.app_context():
+        os.makedirs(app.config['DATA_DIR'], exist_ok=True)
+
+    yield app
+
+    # Cleanup temporary directory
+    with app.app_context():
+        if os.path.exists(app.config['DATA_DIR']):
+            shutil.rmtree(app.config['DATA_DIR'])
+
+
+@pytest.fixture
+def client(app):
+    """Create test client"""
+    return app.test_client()
+
+
+@pytest.fixture
+def runner(app):
+    """Create test CLI runner"""
+    return app.test_cli_runner()
+
+
+@pytest.fixture
+def admin_user(app):
+    """Create administrator user for testing"""
+    with app.app_context():
+        user = User.create(
+            username='admin',
+            email='admin@example.com',
+            password='admin123',
+            role='administrator'
+        )
+        yield user
+        # Cleanup
+        user.delete()
+
+
+@pytest.fixture
+def product_owner_user(app):
+    """Create product owner user for testing"""
+    with app.app_context():
+        user = User.create(
+            username='owner',
+            email='owner@example.com',
+            password='owner123',
+            role='product_owner',
+            product_ids=['prod_0001']
+        )
+        yield user
+        # Cleanup
+        user.delete()
+
+
+@pytest.fixture
+def authenticated_admin_client(client, admin_user):
+    """Create authenticated admin client"""
+    with client:
+        client.post('/auth/login', data={
+            'username': 'admin',
+            'password': 'admin123'
+        }, follow_redirects=True)
+        yield client
+
+
+@pytest.fixture
+def authenticated_owner_client(client, product_owner_user):
+    """Create authenticated product owner client"""
+    with client:
+        client.post('/auth/login', data={
+            'username': 'owner',
+            'password': 'owner123'
+        }, follow_redirects=True)
+        yield client

tests/contract/__init__.py

@@ -0,0 +1 @@
+"""Contract tests package"""

tests/contract/test_submission_routes.py

@@ -0,0 +1,209 @@
+"""Contract tests for submission routes"""
+import pytest
+import io
+import os
+import yaml
+
+
+@pytest.fixture
+def test_product(app):
+    """Create a test product"""
+    with app.app_context():
+        # Create test product directory and config
+        product_dir = os.path.join(app.config['DATA_DIR'], 'products', 'test-product')
+        os.makedirs(product_dir, exist_ok=True)
+
+        # Create product config
+        config_file = os.path.join(product_dir, 'config.yaml')
+        config_data = {
+            'product_id': 'test-product',
+            'name': 'Test Product',
+            'submission_url_slug': 'test-product',
+            'owner_language': 'en',
+            'assigned_owner_ids': ['usr_0001'],
+            'status': 'active'
+        }
+
+        with open(config_file, 'w') as f:
+            yaml.dump(config_data, f)
+
+        yield 'test-product'
+
+
+@pytest.mark.contract
+def test_get_submission_form(client, test_product):
+    """T030: Contract test for GET /submit/{product_slug}
+
+    Expected: 200 OK with HTML form containing textarea and file inputs
+    """
+    response = client.get('/submit/test-product')
+
+    assert response.status_code == 200
+    assert b'<form' in response.data
+    assert b'textarea' in response.data or b'<textarea' in response.data
+    assert b'type="file"' in response.data
+
+
+@pytest.mark.contract
+def test_post_submission_text_only(client, test_product):
+    """T031: Contract test for POST /submit/{product_slug} with text only
+
+    Expected: 200/302 success with confirmation message
+    """
+    data = {
+        'feedback_text': 'This is my feedback about the product.'
+    }
+
+    response = client.post('/submit/test-product', data=data, follow_redirects=True)
+
+    assert response.status_code == 200
+    assert b'success' in response.data.lower() or b'thank' in response.data.lower()
+
+
+@pytest.mark.contract
+def test_post_submission_files_only(client, test_product):
+    """T032: Contract test for POST /submit/{product_slug} with files only
+
+    Expected: 200/302 success with confirmation message
+    """
+    data = {
+        'files': [
+            (io.BytesIO(b'test file content'), 'test.txt')
+        ]
+    }
+
+    response = client.post('/submit/test-product',
+                          data=data,
+                          content_type='multipart/form-data',
+                          follow_redirects=True)
+
+    assert response.status_code == 200
+    assert b'success' in response.data.lower() or b'thank' in response.data.lower()
+
+
+@pytest.mark.contract
+def test_post_submission_text_and_files(client, test_product):
+    """T033: Contract test for POST /submit/{product_slug} with text and files
+
+    Expected: 200/302 success with confirmation message
+    """
+    data = {
+        'feedback_text': 'Here is my feedback with attachments.',
+        'files': [
+            (io.BytesIO(b'screenshot content'), 'screenshot.png'),
+            (io.BytesIO(b'log file content'), 'error.log')
+        ]
+    }
+
+    response = client.post('/submit/test-product',
+                          data=data,
+                          content_type='multipart/form-data',
+                          follow_redirects=True)
+
+    assert response.status_code == 200
+    assert b'success' in response.data.lower() or b'thank' in response.data.lower()
+
+
+@pytest.mark.contract
+def test_empty_submission_rejected(client, test_product):
+    """T034: Contract test for empty submission rejection (400)
+
+    Expected: 400 Bad Request - must provide either text or files
+    """
+    data = {
+        'feedback_text': ''
+    }
+
+    response = client.post('/submit/test-product', data=data)
+
+    assert response.status_code == 400
+
+
+@pytest.mark.contract
+def test_too_many_files_rejected(client, test_product):
+    """T035: Contract test for >3 files rejection (400)
+
+    Expected: 400 Bad Request - maximum 3 files allowed
+    """
+    data = {
+        'files': [
+            (io.BytesIO(b'file1'), 'file1.txt'),
+            (io.BytesIO(b'file2'), 'file2.txt'),
+            (io.BytesIO(b'file3'), 'file3.txt'),
+            (io.BytesIO(b'file4'), 'file4.txt')
+        ]
+    }
+
+    response = client.post('/submit/test-product',
+                          data=data,
+                          content_type='multipart/form-data')
+
+    assert response.status_code == 400
+    assert b'maximum' in response.data.lower() or b'3' in response.data
+
+
+@pytest.mark.contract
+def test_large_file_rejected(client, test_product):
+    """T036: Contract test for >10MB file rejection (413)
+
+    Expected: 413 Request Entity Too Large
+    """
+    # Create a file larger than 10MB
+    large_content = b'x' * (11 * 1024 * 1024)  # 11MB
+
+    data = {
+        'files': [
+            (io.BytesIO(large_content), 'large.txt')
+        ]
+    }
+
+    response = client.post('/submit/test-product',
+                          data=data,
+                          content_type='multipart/form-data')
+
+    # Flask will reject this with 413 due to MAX_CONTENT_LENGTH
+    assert response.status_code == 413
+
+
+@pytest.mark.contract
+def test_unsupported_file_type_rejected(client, test_product):
+    """T037: Contract test for unsupported file type rejection (400)
+
+    Expected: 400 Bad Request - file type not allowed
+    """
+    data = {
+        'files': [
+            (io.BytesIO(b'#!/bin/bash\necho malicious'), 'script.sh')
+        ]
+    }
+
+    response = client.post('/submit/test-product',
+                          data=data,
+                          content_type='multipart/form-data')
+
+    assert response.status_code == 400
+    assert b'not allowed' in response.data.lower() or b'type' in response.data.lower()
+
+
+@pytest.mark.contract
+def test_rate_limiting(client, test_product, app):
+    """T038: Contract test for rate limiting (429 after 10 submissions)
+
+    Expected: 429 Too Many Requests after exceeding rate limit
+    """
+    # Skip if rate limiting is disabled
+    if not app.config.get('RATELIMIT_ENABLED'):
+        pytest.skip('Rate limiting disabled in test config')
+
+    # Make 10 successful submissions (the limit)
+    for i in range(10):
+        data = {'feedback_text': f'Feedback {i}'}
+        response = client.post('/submit/test-product', data=data)
+        # Should succeed (200 or 302)
+        assert response.status_code in [200, 302]
+
+    # 11th submission should be rate limited
+    data = {'feedback_text': 'This should be rate limited'}
+    response = client.post('/submit/test-product', data=data)
+
+    assert response.status_code == 429

tests/integration/__init__.py

@@ -0,0 +1 @@
+"""Integration tests package"""

tests/integration/test_feedback_submission_flow.py

@@ -0,0 +1,166 @@
+"""Integration test for complete feedback submission flow"""
+import pytest
+import io
+import os
+import yaml
+
+
+@pytest.fixture
+def test_product(app):
+    """Create a test product"""
+    with app.app_context():
+        # Create test product directory and config
+        product_dir = os.path.join(app.config['DATA_DIR'], 'products', 'test-product')
+        os.makedirs(product_dir, exist_ok=True)
+
+        # Create product config
+        config_file = os.path.join(product_dir, 'config.yaml')
+        config_data = {
+            'product_id': 'test-product',
+            'name': 'Test Product',
+            'submission_url_slug': 'test-product',
+            'owner_language': 'en',
+            'assigned_owner_ids': ['usr_0001'],
+            'status': 'active'
+        }
+
+        with open(config_file, 'w') as f:
+            yaml.dump(config_data, f)
+
+        yield 'test-product'
+
+
+@pytest.mark.integration
+def test_complete_feedback_submission_flow(client, app, test_product):
+    """T039: Integration test for complete feedback submission flow
+
+    Test the entire user journey:
+    1. User visits submission form
+    2. User fills in feedback text
+    3. User attaches files
+    4. User submits form
+    5. System validates input
+    6. System saves feedback to filesystem
+    7. System displays confirmation
+    8. Feedback is retrievable from storage
+    """
+    # Step 1: Visit submission form
+    response = client.get('/submit/test-product')
+    assert response.status_code == 200
+    assert b'<form' in response.data
+
+    # Step 2-4: Submit feedback with text and files
+    feedback_text = 'I found a bug in the login page. When I enter my password, it does not accept special characters.'
+
+    data = {
+        'feedback_text': feedback_text,
+        'files': [
+            (io.BytesIO(b'PNG fake image data'), 'screenshot.png'),
+            (io.BytesIO(b'Error log contents\nLine 2\nLine 3'), 'error.log')
+        ]
+    }
+
+    response = client.post('/submit/test-product',
+                          data=data,
+                          content_type='multipart/form-data',
+                          follow_redirects=True)
+
+    # Step 7: Verify success confirmation
+    assert response.status_code == 200
+    assert b'success' in response.data.lower() or b'thank' in response.data.lower()
+
+    # Step 8: Verify feedback was saved to filesystem
+    with app.app_context():
+        data_dir = app.config['DATA_DIR']
+        products_dir = os.path.join(data_dir, 'products', 'test-product', 'feedback')
+
+        # Check that feedback directory was created
+        assert os.path.exists(products_dir)
+
+        # Find the created feedback directory (should be UUID-named)
+        feedback_dirs = [d for d in os.listdir(products_dir)
+                        if os.path.isdir(os.path.join(products_dir, d))]
+
+        assert len(feedback_dirs) > 0, "No feedback directory was created"
+
+        feedback_dir = os.path.join(products_dir, feedback_dirs[0])
+
+        # Verify metadata.yaml exists
+        metadata_file = os.path.join(feedback_dir, 'metadata.yaml')
+        assert os.path.exists(metadata_file)
+
+        # Verify metadata content
+        with open(metadata_file, 'r') as f:
+            metadata = yaml.safe_load(f)
+
+        assert metadata['feedback_id'] == feedback_dirs[0]
+        assert metadata['product_id'] == 'test-product'
+        assert metadata['status'] == 'new'
+        assert 'submitted_at' in metadata
+        assert metadata.get('has_attachments') == True
+        assert metadata.get('attachment_count') == 2
+
+        # Verify content.txt exists and contains the feedback
+        content_file = os.path.join(feedback_dir, 'content.txt')
+        assert os.path.exists(content_file)
+
+        with open(content_file, 'r') as f:
+            saved_content = f.read()
+
+        assert feedback_text in saved_content
+
+        # Verify attachments directory and files exist
+        attachments_dir = os.path.join(feedback_dir, 'attachments')
+        assert os.path.exists(attachments_dir)
+
+        attachments = os.listdir(attachments_dir)
+        assert len(attachments) == 2
+
+        # Verify specific attachment files
+        attachment_names = [a for a in attachments]
+        assert 'screenshot.png' in attachment_names
+        assert 'error.log' in attachment_names
+
+        # Verify no IP address is stored (FR-055 compliance)
+        assert 'ip_address' not in metadata
+        assert 'submitter_ip' not in metadata
+
+
+@pytest.mark.integration
+def test_feedback_submission_without_attachments(client, app, test_product):
+    """Integration test for feedback submission with text only (no files)"""
+    feedback_text = 'Simple text feedback without attachments.'
+
+    data = {
+        'feedback_text': feedback_text
+    }
+
+    response = client.post('/submit/test-product',
+                          data=data,
+                          follow_redirects=True)
+
+    assert response.status_code == 200
+
+    # Verify feedback was saved
+    with app.app_context():
+        data_dir = app.config['DATA_DIR']
+        products_dir = os.path.join(data_dir, 'products', 'test-product', 'feedback')
+
+        feedback_dirs = [d for d in os.listdir(products_dir)
+                        if os.path.isdir(os.path.join(products_dir, d))]
+
+        # Find the most recent feedback
+        feedback_dir = os.path.join(products_dir, feedback_dirs[-1])
+
+        # Verify metadata shows no attachments
+        metadata_file = os.path.join(feedback_dir, 'metadata.yaml')
+        with open(metadata_file, 'r') as f:
+            metadata = yaml.safe_load(f)
+
+        assert metadata.get('has_attachments') == False
+        assert metadata.get('attachment_count') == 0
+
+        # Verify attachments directory doesn't exist or is empty
+        attachments_dir = os.path.join(feedback_dir, 'attachments')
+        if os.path.exists(attachments_dir):
+            assert len(os.listdir(attachments_dir)) == 0

tests/unit/__init__.py

@@ -0,0 +1 @@
+"""Unit tests package"""