Create init_admin.py script to properly initialize the admin user
with correct password hash for "admin123".
Usage:
python init_admin.py
This script:
- Creates admin user if it doesn't exist
- Uses proper bcrypt password hashing
- Stores user data in data/users.yaml (gitignored)
- Provides clear feedback about user creation
Credentials created:
- Username: admin
- Password: admin123
- Role: administrator
Note: data/users.yaml is gitignored (correct for user data), so
admin user must be initialized on each installation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Flask-Login's UserMixin provides is_active as a read-only property.
Attempting to set it as an instance attribute caused a conflict.
Solution:
- Store active status in private attribute _is_active
- Override is_active property to return custom value
- Update to_dict() to use _is_active
This allows proper Flask-Login integration while maintaining
custom active status tracking.
Bug found during login testing: AttributeError when calling
User.get_by_username() which triggered from_dict() → __init__().
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add CSRF token hidden input fields to:
- Submission form (submission/form.html)
- Login form (auth/login.html)
Also fix broken link in login page that referenced submission.form
without required product_slug parameter. Changed to link to index page.
Bug found during manual testing when submitting feedback resulted in
"Bad Request - The CSRF token is missing" error.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed terminology from "API" to "Routes" to better reflect server-rendered HTML approach:
- Renamed submission_api.md → submission_routes.md
- Renamed dashboard_api.md → dashboard_routes.md
- Renamed admin_api.md → admin_routes.md
- Updated headers to clarify "Response Type: Server-rendered HTML (no JavaScript required)"
- Updated references in plan.md and quickstart.md
This clarifies that the application uses traditional web routes with form submissions
and HTML responses, not REST API endpoints with JSON.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete Phase 0 (Research) and Phase 1 (Design) of implementation planning workflow:
- plan.md: Technical context, constitution check, and project structure
- research.md: Technology decisions for AI integration, file storage, authentication, security
- data-model.md: Domain entities with validation rules and state transitions
- contracts/: API specifications for submission, dashboard, and admin endpoints
- quickstart.md: Developer setup guide with test-first workflow
- CLAUDE.md: Updated agent context with tech stack
All constitutional requirements validated. Ready for task generation phase.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
gurixandClaude