02b81f0113
Security (fail-secure for production): - Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless PPM_ALLOW_NO_AUTH=1 (local dev only) - Add login rate limiting (5 failures / 60s per client), enforced inside SessionManager.login so it cannot be bypassed at the endpoint layer - compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy - Add .dockerignore to keep runtime data/out of the image Features: - Task timeline gantt on home page (week/month zoom, horizontal scroll, infinite-arrow for open-ended dates, CSS Grid layout) - Duration metrics gain a second/minute/hour unit for input & display (canonical storage stays integer seconds) - Per-metric progress bars on home page (no more merged average) - Backfill historical records via date picker in the today-record card - Admin panel: stats overview, JSON import/restore, full task list mgmt Fixes: - Nullable task startDate; summarize handles missing start date - Task dialog cancel/close no longer submits the form - Import validates whole backup first, rejects path traversal, rebuilds archives, and replaces stale files Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
94 lines
5.0 KiB
Python
94 lines
5.0 KiB
Python
from datetime import date
|
|
|
|
|
|
def payload(name="API 任务"):
|
|
return {"name": name, "startDate": "2026-08-01", "priority": 3, "metrics": [{"name": "完成", "kind": "checkin", "period": "day"}]}
|
|
|
|
|
|
def test_api_crud_order_layout_and_daily(client):
|
|
response = client.get("/api/health"); assert response.status_code == 200
|
|
assert client.get("/api/layouts/home").json()["page"] == "home"
|
|
first = client.post("/api/tasks", json=payload("第一项")); assert first.status_code == 201
|
|
second = client.post("/api/tasks", json=payload("第二项")).json()
|
|
task = first.json(); metric_id = task["metrics"][0]["metricId"]
|
|
listed = client.get("/api/tasks").json(); assert len(listed["items"]) == 2
|
|
reordered = client.put("/api/tasks/reorder/all", json={"taskIds": [second["taskId"], task["taskId"]], "expectedVersion": listed["version"]})
|
|
assert reordered.status_code == 200
|
|
saved = client.put(f"/api/tasks/{task['taskId']}/daily/2026-08-20", json={"values": [{"metricId": metric_id, "value": 1}], "note": "完成"})
|
|
assert saved.status_code == 200
|
|
assert client.get(f"/api/tasks/{task['taskId']}/history?start=2026-08-20&end=2026-08-20").json()["records"]
|
|
|
|
|
|
def test_summary_endpoints(client):
|
|
task = client.post("/api/tasks", json=payload("周期任务")).json()
|
|
metric_id = task["metrics"][0]["metricId"]
|
|
client.put(f"/api/tasks/{task['taskId']}/daily/2026-08-20", json={"expectedVersion": 0, "values": [{"metricId": metric_id, "value": 1}]})
|
|
|
|
scoped = client.get(f"/api/tasks/{task['taskId']}/summary?date=2026-08-20").json()
|
|
assert scoped["tasks"][task["taskId"]]["metrics"][0]["value"] == 1
|
|
assert scoped["tasks"][task["taskId"]]["today"]["recorded"] is True
|
|
|
|
assert client.get("/api/summary?date=2026-08-21").json()["tasks"][task["taskId"]]["metrics"][0]["value"] == 0
|
|
|
|
|
|
def test_first_daily_write_is_accepted(client):
|
|
task = client.post("/api/tasks", json=payload("首次记录")).json()
|
|
metric_id = task["metrics"][0]["metricId"]
|
|
current = client.get(f"/api/tasks/{task['taskId']}/daily/2026-08-20").json()
|
|
saved = client.put(
|
|
f"/api/tasks/{task['taskId']}/daily/2026-08-20",
|
|
json={"expectedVersion": current["version"], "values": [{"metricId": metric_id, "value": 1}]},
|
|
)
|
|
assert saved.status_code == 200, saved.text
|
|
|
|
|
|
def test_invalid_input_and_auth(auth_client):
|
|
assert auth_client.get("/api/tasks").status_code == 401
|
|
login = auth_client.post("/api/auth/login", json={"password": "secret"}); assert login.status_code == 200
|
|
assert auth_client.get("/api/tasks").status_code == 200
|
|
csrf = login.json()["csrfToken"]
|
|
bad = auth_client.post("/api/tasks", json={"name": "", "startDate": "2026-08-01", "metrics": []}, headers={"X-CSRF-Token": csrf})
|
|
assert bad.status_code == 422
|
|
forbidden = auth_client.post("/api/tasks", json=payload())
|
|
assert forbidden.status_code == 403
|
|
|
|
|
|
def test_duration_unit_and_backfill(client):
|
|
task = client.post("/api/tasks", json={
|
|
"name": "时长任务", "startDate": "2026-08-01",
|
|
"metrics": [{"name": "专注", "kind": "duration", "period": "day", "durationUnit": "minute", "target": 120}],
|
|
}).json()
|
|
assert task["metrics"][0]["durationUnit"] == "minute"
|
|
metric_id = task["metrics"][0]["metricId"]
|
|
saved = client.put(f"/api/tasks/{task['taskId']}/daily/2026-08-10", json={"expectedVersion": 0, "values": [{"metricId": metric_id, "value": 3600}]})
|
|
assert saved.status_code == 200
|
|
summary = client.get(f"/api/tasks/{task['taskId']}/summary?date=2026-08-10").json()
|
|
metric = summary["tasks"][task["taskId"]]["metrics"][0]
|
|
assert metric["value"] == 3600, "时长仍以整数秒存储"
|
|
assert metric.get("durationUnit") == "minute"
|
|
|
|
|
|
def test_invalid_duration_unit_rejected(client):
|
|
bad = client.post("/api/tasks", json={"name": "非法单位", "startDate": "2026-08-01", "metrics": [{"name": "x", "kind": "duration", "period": "day", "durationUnit": "year"}]})
|
|
assert bad.status_code == 422
|
|
|
|
|
|
def test_task_without_dates(client):
|
|
task = client.post("/api/tasks", json={"name": "无日期任务", "metrics": [{"name": "完成", "kind": "checkin", "period": "day"}]}).json()
|
|
assert task["startDate"] is None and task["endDate"] is None
|
|
# 无开始日期的 lifetime 统计不应报错
|
|
assert client.get(f"/api/tasks/{task['taskId']}/summary").status_code == 200
|
|
|
|
|
|
def test_admin_stats_and_import(client):
|
|
task = client.post("/api/tasks", json=payload("导入任务")).json()
|
|
metric_id = task["metrics"][0]["metricId"]
|
|
client.put(f"/api/tasks/{task['taskId']}/daily/2026-08-20", json={"expectedVersion": 0, "values": [{"metricId": metric_id, "value": 1}]})
|
|
stats = client.get("/api/admin/stats").json()
|
|
assert stats["taskCount"] == 1 and stats["dailyFactCount"] == 1
|
|
exported = client.get("/api/export").json()
|
|
imported = client.post("/api/admin/import", json=exported)
|
|
assert imported.status_code == 200 and imported.json()["imported"] == 1
|
|
assert client.get("/api/admin/stats").json()["taskCount"] == 1
|
|
|