diff --git a/app/__init__.py b/app/__init__.py
index 41b90a0..dbf65b8 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -182,18 +182,12 @@ def create_app(config_name='development'):
)
# Register blueprints
- from app.routes import submission, dashboard, admin, auth
+ from app.routes import submission, dashboard, admin, auth, landing
app.register_blueprint(submission.bp)
app.register_blueprint(dashboard.bp)
app.register_blueprint(admin.bp)
app.register_blueprint(auth.bp)
-
- # Set index route
- @app.route('/')
- def index():
- """Welcome page"""
- from flask import render_template
- return render_template('index.html')
+ app.register_blueprint(landing.landing_bp) # Landing page (product selection)
# Health check endpoint (T208)
@app.route('/health')
diff --git a/app/models/product.py b/app/models/product.py
index 038da4b..7fe4bc1 100644
--- a/app/models/product.py
+++ b/app/models/product.py
@@ -159,6 +159,22 @@ class Product:
return products
+ @classmethod
+ def load_active(cls):
+ """Load all active products, sorted alphabetically by name then product_id
+
+ Returns:
+ list[Product]: Active products with valid submission_url_slug, sorted by:
+ 1. name (case-insensitive alphabetical)
+ 2. product_id (alphabetical) as tiebreaker
+
+ Products with missing/invalid submission_url_slug are excluded.
+ """
+ all_products = cls.get_all()
+ active = [p for p in all_products
+ if p.status == 'active' and p.submission_url_slug]
+ return sorted(active, key=lambda p: (p.name.lower(), p.product_id))
+
def save(self):
"""Save product to filesystem"""
product_dir = self._get_product_dir(self.product_id)
diff --git a/app/routes/landing.py b/app/routes/landing.py
new file mode 100644
index 0000000..dba197b
--- /dev/null
+++ b/app/routes/landing.py
@@ -0,0 +1,29 @@
+"""Landing page route - product selection"""
+from flask import Blueprint, render_template, current_app
+from app.models.product import Product
+
+landing_bp = Blueprint('landing', __name__)
+
+
+@landing_bp.route('/')
+def index():
+ """Landing page showing all active products for feedback submission
+
+ Returns:
+ Rendered HTML template with:
+ - List of active products (if any)
+ - Empty state message (if no active products)
+ """
+ try:
+ products = Product.load_active()
+ current_app.logger.info(
+ f'Landing page accessed: {len(products)} active products available'
+ )
+ return render_template('landing/index.html', products=products)
+ except Exception as e:
+ current_app.logger.error(
+ f'Error loading landing page: {e}',
+ exc_info=True
+ )
+ # Graceful degradation - show empty product list
+ return render_template('landing/index.html', products=[])
diff --git a/app/templates/landing/index.html b/app/templates/landing/index.html
new file mode 100644
index 0000000..5b34c1a
--- /dev/null
+++ b/app/templates/landing/index.html
@@ -0,0 +1,37 @@
+{% extends "base.html" %}
+
+{% block title %}Select Product - Reklamator{% endblock %}
+
+{% block content %}
+Submit Feedback
+
+{% if products %}
+ Select a product to share your feedback, report issues, or suggest improvements.
+
+
+ {% for product in products %}
+
+
+ {{ product.name }}
+
+
+ {% if product.description %}
+
{{ product.description }}
+ {% endif %}
+
+
+ Submit Feedback
+
+
+ {% endfor %}
+
+
+ No products are currently accepting feedback. Please check back later.
+
+
Malicious description'
+ }, f)
+
+ yield
+
+
+@pytest.mark.contract
+def test_get_landing_page_with_products(client, test_products):
+ """T002: GET / with active products returns 200 with product list HTML"""
+ response = client.get('/')
+
+ assert response.status_code == 200
+ assert b'' not in html, "Script tag not escaped in product name"
+ assert 'alert("xss")' not in html or '<script>' in html, "XSS vulnerability in product name"
+
+ # Image onerror should be escaped
+ assert '