Improvements:
1. Added 15 comprehensive User model unit tests
2. Created TECHNICAL_DEBT.md to track test gaps and known issues
3. Updated constitution with Bug Fix Protocol (v1.1.0)
User Model Tests (tests/unit/test_user_model.py):
- Test user creation and properties
- Test is_active property (Flask-Login integration)
- Test password hashing and verification
- Test serialization (to_dict/from_dict)
- Test CRUD operations (create, load, update, delete)
- Test error conditions (duplicate username, invalid role)
Technical Debt Documentation (docs/TECHNICAL_DEBT.md):
- Missing authentication route tests
- CSRF testing disabled by design
- Dashboard routes not implemented (planned)
- ClamAV integration not fully tested
- All 3 MVP bugs documented with lessons learned
Constitution Amendment (v1.0.0 → v1.1.0):
- Added Bug Fix Protocol requiring:
- Write failing test before fix
- Document in TECHNICAL_DEBT.md
- Commit test and fix together
- Lessons learned capture
Test Coverage Improvement:
- Before: 10 tests (8 contract + 2 integration)
- After: 26 tests (8 contract + 2 integration + 15 unit + 1 skipped)
- User model: 0% → 100% coverage
Rationale: Bugs found during manual testing revealed insufficient
test coverage. This addresses the gap and establishes process to
prevent future coverage deficiencies.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
After successful login, the app tried to redirect to admin.dashboard
or dashboard.list routes that don't exist yet (Phase 5 & 6).
Changes:
- Login now redirects to index page for all users
- Logout redirects to index page instead of submission.form
- Base template navigation shows "Coming in Phase X" messages
instead of broken links to unimplemented routes
- Added TODO comments for future dashboard implementation
This allows login/logout to work properly in MVP (Phase 3) while
dashboard features are pending implementation.
Bug: werkzeug.routing.exceptions.BuildError: Could not build url
for endpoint 'admin.dashboard'
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Create init_admin.py script to properly initialize the admin user
with correct password hash for "admin123".
Usage:
python init_admin.py
This script:
- Creates admin user if it doesn't exist
- Uses proper bcrypt password hashing
- Stores user data in data/users.yaml (gitignored)
- Provides clear feedback about user creation
Credentials created:
- Username: admin
- Password: admin123
- Role: administrator
Note: data/users.yaml is gitignored (correct for user data), so
admin user must be initialized on each installation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Flask-Login's UserMixin provides is_active as a read-only property.
Attempting to set it as an instance attribute caused a conflict.
Solution:
- Store active status in private attribute _is_active
- Override is_active property to return custom value
- Update to_dict() to use _is_active
This allows proper Flask-Login integration while maintaining
custom active status tracking.
Bug found during login testing: AttributeError when calling
User.get_by_username() which triggered from_dict() → __init__().
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add CSRF token hidden input fields to:
- Submission form (submission/form.html)
- Login form (auth/login.html)
Also fix broken link in login page that referenced submission.form
without required product_slug parameter. Changed to link to index page.
Bug found during manual testing when submitting feedback resulted in
"Bad Request - The CSRF token is missing" error.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed terminology from "API" to "Routes" to better reflect server-rendered HTML approach:
- Renamed submission_api.md → submission_routes.md
- Renamed dashboard_api.md → dashboard_routes.md
- Renamed admin_api.md → admin_routes.md
- Updated headers to clarify "Response Type: Server-rendered HTML (no JavaScript required)"
- Updated references in plan.md and quickstart.md
This clarifies that the application uses traditional web routes with form submissions
and HTML responses, not REST API endpoints with JSON.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete Phase 0 (Research) and Phase 1 (Design) of implementation planning workflow:
- plan.md: Technical context, constitution check, and project structure
- research.md: Technology decisions for AI integration, file storage, authentication, security
- data-model.md: Domain entities with validation rules and state transitions
- contracts/: API specifications for submission, dashboard, and admin endpoints
- quickstart.md: Developer setup guide with test-first workflow
- CLAUDE.md: Updated agent context with tech stack
All constitutional requirements validated. Ready for task generation phase.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
gurixandClaude