gurixandClaude
b301def134
Complete implementation of Phase 1-3 (64 tasks): - Phase 1: Project setup with Flask, pytest, configuration - Phase 2: Core infrastructure (auth, models, services, testing) - Phase 3: Anonymous feedback submission with file uploads Features: - Anonymous feedback submission (text and/or up to 3 file attachments) - Multi-language support (any language accepted) - File validation (type, size) and virus scanning (ClamAV) - Product management with active/archived status - File-based storage with YAML metadata - User authentication system (Flask-Login) - CSRF protection and rate limiting - Test coverage: 10 passing tests (contract + integration) Security: - No IP address logging (FR-055 compliance) - File type whitelist and size limits (10MB max) - Virus scanning with graceful degradation - Filename sanitization and secure storage Test Results: - 8 contract tests passed - 2 integration tests passed - End-to-end workflow verified 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
49 lines
1.5 KiB
Python
49 lines
1.5 KiB
Python
"""Authentication routes"""
|
|
from flask import Blueprint, render_template, request, redirect, url_for, flash
|
|
from flask_login import login_user, logout_user, login_required
|
|
from app.models.user import User
|
|
|
|
|
|
bp = Blueprint('auth', __name__, url_prefix='/auth')
|
|
|
|
|
|
@bp.route('/login', methods=['GET', 'POST'])
|
|
def login():
|
|
"""User login page
|
|
|
|
GET: Display login form
|
|
POST: Process login credentials
|
|
"""
|
|
if request.method == 'POST':
|
|
username = request.form.get('username', '').strip()
|
|
password = request.form.get('password', '')
|
|
|
|
if not username or not password:
|
|
flash('Please provide both username and password', 'error')
|
|
return render_template('auth/login.html')
|
|
|
|
user = User.get_by_username(username)
|
|
|
|
if user and user.is_active and user.check_password(password):
|
|
login_user(user)
|
|
flash(f'Welcome back, {user.username}!', 'success')
|
|
|
|
# Redirect based on role
|
|
if user.role == 'administrator':
|
|
return redirect(url_for('admin.dashboard'))
|
|
elif user.role == 'product_owner':
|
|
return redirect(url_for('dashboard.list'))
|
|
else:
|
|
flash('Invalid username or password', 'error')
|
|
|
|
return render_template('auth/login.html')
|
|
|
|
|
|
@bp.route('/logout')
|
|
@login_required
|
|
def logout():
|
|
"""User logout"""
|
|
logout_user()
|
|
flash('You have been logged out', 'info')
|
|
return redirect(url_for('submission.form'))
|