02b81f0113
Security (fail-secure for production): - Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless PPM_ALLOW_NO_AUTH=1 (local dev only) - Add login rate limiting (5 failures / 60s per client), enforced inside SessionManager.login so it cannot be bypassed at the endpoint layer - compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy - Add .dockerignore to keep runtime data/out of the image Features: - Task timeline gantt on home page (week/month zoom, horizontal scroll, infinite-arrow for open-ended dates, CSS Grid layout) - Duration metrics gain a second/minute/hour unit for input & display (canonical storage stays integer seconds) - Per-metric progress bars on home page (no more merged average) - Backfill historical records via date picker in the today-record card - Admin panel: stats overview, JSON import/restore, full task list mgmt Fixes: - Nullable task startDate; summarize handles missing start date - Task dialog cancel/close no longer submits the form - Import validates whole backup first, rejects path traversal, rebuilds archives, and replaces stale files Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
28 lines
832 B
Python
28 lines
832 B
Python
import os
|
|
from pathlib import Path
|
|
|
|
# 测试环境：允许无密码启动，避免模块级 create_app() 因 fail-secure 抛错。
|
|
os.environ.setdefault("PPM_ALLOW_NO_AUTH", "1")
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.auth import SessionManager, make_password_hash
|
|
from app.main import create_app
|
|
|
|
|
|
@pytest.fixture()
|
|
def client(tmp_path: Path):
|
|
app = create_app(tmp_path / "data", Path(__file__).parents[1] / "config" / "layouts", SessionManager(None))
|
|
with TestClient(app) as test_client:
|
|
yield test_client
|
|
|
|
|
|
@pytest.fixture()
|
|
def auth_client(tmp_path: Path):
|
|
manager = SessionManager(make_password_hash("secret"))
|
|
app = create_app(tmp_path / "data", Path(__file__).parents[1] / "config" / "layouts", manager)
|
|
with TestClient(app) as test_client:
|
|
yield test_client
|
|
|