gurixandClaude
5675784502
This commit implements all remaining polish tasks (T193-T210) to make the application production-ready. ## Logging & Monitoring (T193, T194, T208, T209) - Add structured JSON logging for production environments - Add human-readable logging for development - Implement comprehensive error logging across all routes: * submission.py: product access, validation, success/failure * auth.py: login attempts, successes, failures, logouts * dashboard.py: access and errors - Add /health endpoint for monitoring (checks data dir, API key) - Add environment variable validation on startup ## Security Hardening (T196-T199, T207) - Add HSTS headers in production (1 year, includeSubDomains) - Add security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection - Verify CSRF protection on all POST routes (Flask-WTF) - Verify session cookie security flags (HttpOnly, Secure, SameSite) - Verify XSS prevention (Jinja2 auto-escaping) - Verify no hardcoded secrets (only in test files) ## Documentation (T195, T203, T210) - Add comprehensive README.md with: * Features, quick start, project structure * Usage guides (end users, product owners, admins) * Configuration, testing, deployment instructions - Add detailed docs/deployment.md with: * Production deployment steps * ClamAV, Nginx, SSL/TLS setup * Security hardening, monitoring, backup strategies - Add requirements-dev.txt for development dependencies ## Performance Testing (T200, T201) - Add test_performance.py with 4 comprehensive tests: * 100 concurrent submissions (SC-012) * Dashboard load <3s for 1000 items (SC-008) * Large file upload handling * Rate limiting verification - Add performance marker to pytest.ini ## Testing - All 49 tests passing, 1 skipped - Fixed error handling to preserve HTTP status codes Phase 7 complete. Application is production-ready with comprehensive logging, security, monitoring, and documentation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
51 lines
1.7 KiB
Python
51 lines
1.7 KiB
Python
"""Authentication routes"""
|
|
from flask import Blueprint, render_template, request, redirect, url_for, flash, current_app
|
|
from flask_login import login_user, logout_user, login_required, current_user
|
|
from app.models.user import User
|
|
|
|
|
|
bp = Blueprint('auth', __name__)
|
|
|
|
|
|
@bp.route('/login', methods=['GET', 'POST'])
|
|
def login():
|
|
"""User login page
|
|
|
|
GET: Display login form
|
|
POST: Process login credentials
|
|
"""
|
|
if request.method == 'POST':
|
|
username = request.form.get('username', '').strip()
|
|
password = request.form.get('password', '')
|
|
|
|
if not username or not password:
|
|
current_app.logger.warning('Login attempt with missing credentials')
|
|
flash('Please provide both username and password', 'error')
|
|
return render_template('auth/login.html')
|
|
|
|
user = User.get_by_username(username)
|
|
|
|
if user and user.is_active and user.check_password(password):
|
|
login_user(user)
|
|
current_app.logger.info(f'User logged in successfully: {username} (role: {user.role})')
|
|
flash(f'Welcome back, {user.username}!', 'success')
|
|
|
|
# Redirect to dashboard for product owners and administrators
|
|
return redirect(url_for('dashboard.list'))
|
|
else:
|
|
current_app.logger.warning(f'Failed login attempt for username: {username}')
|
|
flash('Invalid username or password', 'error')
|
|
|
|
return render_template('auth/login.html')
|
|
|
|
|
|
@bp.route('/logout')
|
|
@login_required
|
|
def logout():
|
|
"""User logout"""
|
|
username = current_user.username
|
|
logout_user()
|
|
current_app.logger.info(f'User logged out: {username}')
|
|
flash('You have been logged out', 'info')
|
|
return redirect(url_for('index'))
|