Add complete dashboard functionality for product owners and administrators to view, filter, search, and manage feedback submissions following Test-First Discipline.
Tests (T093-T105):
- Add 12 contract tests for dashboard routes (authentication, listing, filtering, search, detail view, status updates, attachment downloads, access control)
- Add 2 integration tests for complete dashboard workflow and access control enforcement
- All tests written first and verified to fail before implementation
Services (T111-T118):
- Enhance FeedbackStorageService with load_feedback_list() for pagination, filtering, searching, and sorting
- Add load_feedback_detail() to load complete feedback with attachments and analysis
- Add update_feedback_status_by_id() for status management
- Add get_attachment_path() with path traversal prevention
Routes (T119-T134):
- Implement GET /dashboard with filters, search, and pagination (50 items/page)
- Implement GET /feedback/<id> detail view with role-based access control
- Implement POST /feedback/<id>/status for status updates
- Implement GET /feedback/<id>/attachment/<filename> for secure file downloads
- Add access control helpers (administrators see all products, owners see only assigned)
Templates (T135-T136):
- Create dashboard/list.html with filter form, search, and pagination
- Create dashboard/detail.html with status update form and attachment links
- Create error_403.html for access denied
- Create error_404.html for not found
Integration & Bug Fixes:
- Update auth routes to remove /auth prefix and redirect to dashboard after login
- Update Feedback.VALID_STATUSES to include dashboard statuses (in_progress, resolved, closed)
- Register error handlers for 403 and 404 in app factory
- Fix test fixtures to use correct users.yaml format and User.hash_password()
Test Results: 39 passed, 1 skipped (all Phase 5 tests passing)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Improvements:
1. Added 15 comprehensive User model unit tests
2. Created TECHNICAL_DEBT.md to track test gaps and known issues
3. Updated constitution with Bug Fix Protocol (v1.1.0)
User Model Tests (tests/unit/test_user_model.py):
- Test user creation and properties
- Test is_active property (Flask-Login integration)
- Test password hashing and verification
- Test serialization (to_dict/from_dict)
- Test CRUD operations (create, load, update, delete)
- Test error conditions (duplicate username, invalid role)
Technical Debt Documentation (docs/TECHNICAL_DEBT.md):
- Missing authentication route tests
- CSRF testing disabled by design
- Dashboard routes not implemented (planned)
- ClamAV integration not fully tested
- All 3 MVP bugs documented with lessons learned
Constitution Amendment (v1.0.0 → v1.1.0):
- Added Bug Fix Protocol requiring:
- Write failing test before fix
- Document in TECHNICAL_DEBT.md
- Commit test and fix together
- Lessons learned capture
Test Coverage Improvement:
- Before: 10 tests (8 contract + 2 integration)
- After: 26 tests (8 contract + 2 integration + 15 unit + 1 skipped)
- User model: 0% → 100% coverage
Rationale: Bugs found during manual testing revealed insufficient
test coverage. This addresses the gap and establishes process to
prevent future coverage deficiencies.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
After successful login, the app tried to redirect to admin.dashboard
or dashboard.list routes that don't exist yet (Phase 5 & 6).
Changes:
- Login now redirects to index page for all users
- Logout redirects to index page instead of submission.form
- Base template navigation shows "Coming in Phase X" messages
instead of broken links to unimplemented routes
- Added TODO comments for future dashboard implementation
This allows login/logout to work properly in MVP (Phase 3) while
dashboard features are pending implementation.
Bug: werkzeug.routing.exceptions.BuildError: Could not build url
for endpoint 'admin.dashboard'
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Create init_admin.py script to properly initialize the admin user
with correct password hash for "admin123".
Usage:
python init_admin.py
This script:
- Creates admin user if it doesn't exist
- Uses proper bcrypt password hashing
- Stores user data in data/users.yaml (gitignored)
- Provides clear feedback about user creation
Credentials created:
- Username: admin
- Password: admin123
- Role: administrator
Note: data/users.yaml is gitignored (correct for user data), so
admin user must be initialized on each installation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Flask-Login's UserMixin provides is_active as a read-only property.
Attempting to set it as an instance attribute caused a conflict.
Solution:
- Store active status in private attribute _is_active
- Override is_active property to return custom value
- Update to_dict() to use _is_active
This allows proper Flask-Login integration while maintaining
custom active status tracking.
Bug found during login testing: AttributeError when calling
User.get_by_username() which triggered from_dict() → __init__().
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add CSRF token hidden input fields to:
- Submission form (submission/form.html)
- Login form (auth/login.html)
Also fix broken link in login page that referenced submission.form
without required product_slug parameter. Changed to link to index page.
Bug found during manual testing when submitting feedback resulted in
"Bad Request - The CSRF token is missing" error.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed terminology from "API" to "Routes" to better reflect server-rendered HTML approach:
- Renamed submission_api.md → submission_routes.md
- Renamed dashboard_api.md → dashboard_routes.md
- Renamed admin_api.md → admin_routes.md
- Updated headers to clarify "Response Type: Server-rendered HTML (no JavaScript required)"
- Updated references in plan.md and quickstart.md
This clarifies that the application uses traditional web routes with form submissions
and HTML responses, not REST API endpoints with JSON.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete Phase 0 (Research) and Phase 1 (Design) of implementation planning workflow:
- plan.md: Technical context, constitution check, and project structure
- research.md: Technology decisions for AI integration, file storage, authentication, security
- data-model.md: Domain entities with validation rules and state transitions
- contracts/: API specifications for submission, dashboard, and admin endpoints
- quickstart.md: Developer setup guide with test-first workflow
- CLAUDE.md: Updated agent context with tech stack
All constitutional requirements validated. Ready for task generation phase.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
gurixandClaude