diff --git a/.gitignore b/.gitignore index 928b8f7..31ab822 100644 --- a/.gitignore +++ b/.gitignore @@ -8,6 +8,4 @@ .DS_Store Thumbs.db -# Environment -.env -*.env.local + diff --git a/backend/.env b/backend/.env new file mode 100644 index 0000000..a610db5 --- /dev/null +++ b/backend/.env @@ -0,0 +1,22 @@ +# Database +MYSQL_HOST=mysql.theaken.com +MYSQL_PORT=33306 +MYSQL_USER=A060 +MYSQL_PASSWORD=WLeSCi0yhtc7 +MYSQL_DATABASE=db_A060 + +# Redis +REDIS_HOST=localhost +REDIS_PORT=6379 +REDIS_DB=0 + +# JWT +JWT_SECRET_KEY=pjctrl-jwt-secret-key-2024-change-in-production +JWT_ALGORITHM=HS256 +JWT_EXPIRE_MINUTES=15 + +# External Auth API +AUTH_API_URL=https://pj-auth-api.vercel.app + +# System Admin +SYSTEM_ADMIN_EMAIL=ymirliu@panjit.com.tw diff --git a/backend/.gitignore b/backend/.gitignore index 7acb01d..0e32712 100644 --- a/backend/.gitignore +++ b/backend/.gitignore @@ -1,7 +1,3 @@ -# Environment -.env -*.env.local - # Python __pycache__/ *.py[cod] diff --git a/backend/README.md b/backend/README.md new file mode 100644 index 0000000..3da950e --- /dev/null +++ b/backend/README.md @@ -0,0 +1,92 @@ +# PROJECT CONTROL Backend + +FastAPI 後端服務 + +## 系統需求 + +### 必要服務 + +| 服務 | 版本 | 說明 | +|-----|------|-----| +| Python | 3.11+ | 執行環境 | +| MySQL | 8.0+ | 主要資料庫 | +| Redis | 6.0+ | Session 存儲 | + +### Redis Server 安裝 + +Redis Python 套件 (`redis==5.0.1`) 僅為客戶端，需另外安裝 Redis Server： + +**macOS (Homebrew):** +```bash +brew install redis +brew services start redis +``` + +**Ubuntu/Debian:** +```bash +sudo apt update +sudo apt install redis-server +sudo systemctl start redis-server +sudo systemctl enable redis-server +``` + +**Docker:** +```bash +docker run -d --name redis -p 6379:6379 redis:alpine +``` + +**驗證安裝:** +```bash +redis-cli ping +# 應回傳 PONG +``` + +## 環境建置 + +```bash +# 使用 Conda +conda env create -f environment.yml +conda activate pjctrl + +# 或使用 pip +pip install -r requirements.txt +``` + +## 設定 + +複製並編輯環境變數： +```bash +cp .env.example .env +``` + +主要設定項目： +- `MYSQL_*` - 資料庫連線 +- `REDIS_*` - Redis 連線 +- `JWT_SECRET_KEY` - JWT 簽名密鑰 (生產環境必須更換) +- `AUTH_API_URL` - 外部認證 API + +## 執行 + +```bash +# 開發模式 +uvicorn app.main:app --reload --port 8000 + +# 生產模式 +uvicorn app.main:app --host 0.0.0.0 --port 8000 +``` + +## 資料庫遷移 + +```bash +# 升級至最新版本 +alembic upgrade head + +# 回滾一個版本 +alembic downgrade -1 +``` + +## 測試 + +```bash +pytest -v +``` diff --git a/backend/app/api/auth/router.py b/backend/app/api/auth/router.py index 4759758..a64e38a 100644 --- a/backend/app/api/auth/router.py +++ b/backend/app/api/auth/router.py @@ -1,6 +1,7 @@ from fastapi import APIRouter, Depends, HTTPException, status from sqlalchemy.orm import Session +from app.core.config import settings from app.core.database import get_db from app.core.security import create_access_token, create_token_payload from app.core.redis import get_redis @@ -74,10 +75,10 @@ async def login( # Create access token access_token = create_access_token(token_data) - # Store session in Redis + # Store session in Redis (sync with JWT expiry) redis_client.setex( f"session:{user.id}", - 900, # 15 minutes + settings.JWT_EXPIRE_MINUTES * 60, # Convert to seconds access_token, ) diff --git a/backend/app/api/projects/__init__.py b/backend/app/api/projects/__init__.py new file mode 100644 index 0000000..64e0948 --- /dev/null +++ b/backend/app/api/projects/__init__.py @@ -0,0 +1,3 @@ +from app.api.projects.router import router + +__all__ = ["router"] diff --git a/backend/app/api/projects/router.py b/backend/app/api/projects/router.py new file mode 100644 index 0000000..63f4170 --- /dev/null +++ b/backend/app/api/projects/router.py @@ -0,0 +1,273 @@ +import uuid +from typing import List +from fastapi import APIRouter, Depends, HTTPException, status +from sqlalchemy.orm import Session + +from app.core.database import get_db +from app.models import User, Space, Project, TaskStatus +from app.models.task_status import DEFAULT_STATUSES +from app.schemas.project import ProjectCreate, ProjectUpdate, ProjectResponse, ProjectWithDetails +from app.schemas.task_status import TaskStatusResponse +from app.middleware.auth import ( + get_current_user, check_space_access, check_space_edit_access, + check_project_access, check_project_edit_access +) + +router = APIRouter(tags=["projects"]) + + +def create_default_statuses(db: Session, project_id: str): + """Create default task statuses for a new project.""" + for status_data in DEFAULT_STATUSES: + status = TaskStatus( + id=str(uuid.uuid4()), + project_id=project_id, + **status_data + ) + db.add(status) + + +@router.get("/api/spaces/{space_id}/projects", response_model=List[ProjectWithDetails]) +async def list_projects_in_space( + space_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + List all projects in a space that the user can access. + """ + space = db.query(Space).filter(Space.id == space_id, Space.is_active == True).first() + + if not space: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Space not found", + ) + + if not check_space_access(current_user, space): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + projects = db.query(Project).filter(Project.space_id == space_id).all() + + # Filter by project access + accessible_projects = [p for p in projects if check_project_access(current_user, p)] + + result = [] + for project in accessible_projects: + task_count = len(project.tasks) if project.tasks else 0 + result.append(ProjectWithDetails( + id=project.id, + space_id=project.space_id, + title=project.title, + description=project.description, + owner_id=project.owner_id, + budget=project.budget, + start_date=project.start_date, + end_date=project.end_date, + security_level=project.security_level, + status=project.status, + department_id=project.department_id, + created_at=project.created_at, + updated_at=project.updated_at, + owner_name=project.owner.name if project.owner else None, + space_name=project.space.name if project.space else None, + department_name=project.department.name if project.department else None, + task_count=task_count, + )) + + return result + + +@router.post("/api/spaces/{space_id}/projects", response_model=ProjectResponse, status_code=status.HTTP_201_CREATED) +async def create_project( + space_id: str, + project_data: ProjectCreate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Create a new project in a space. + """ + space = db.query(Space).filter(Space.id == space_id, Space.is_active == True).first() + + if not space: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Space not found", + ) + + if not check_space_access(current_user, space): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + project = Project( + id=str(uuid.uuid4()), + space_id=space_id, + title=project_data.title, + description=project_data.description, + owner_id=current_user.id, + budget=project_data.budget, + start_date=project_data.start_date, + end_date=project_data.end_date, + security_level=project_data.security_level.value if project_data.security_level else "department", + department_id=project_data.department_id or current_user.department_id, + ) + + db.add(project) + db.flush() # Get the project ID + + # Create default task statuses + create_default_statuses(db, project.id) + + db.commit() + db.refresh(project) + + return project + + +@router.get("/api/projects/{project_id}", response_model=ProjectWithDetails) +async def get_project( + project_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Get a project by ID. + """ + project = db.query(Project).filter(Project.id == project_id).first() + + if not project: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Project not found", + ) + + if not check_project_access(current_user, project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + task_count = len(project.tasks) if project.tasks else 0 + + return ProjectWithDetails( + id=project.id, + space_id=project.space_id, + title=project.title, + description=project.description, + owner_id=project.owner_id, + budget=project.budget, + start_date=project.start_date, + end_date=project.end_date, + security_level=project.security_level, + status=project.status, + department_id=project.department_id, + created_at=project.created_at, + updated_at=project.updated_at, + owner_name=project.owner.name if project.owner else None, + space_name=project.space.name if project.space else None, + department_name=project.department.name if project.department else None, + task_count=task_count, + ) + + +@router.patch("/api/projects/{project_id}", response_model=ProjectResponse) +async def update_project( + project_id: str, + project_data: ProjectUpdate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Update a project. + """ + project = db.query(Project).filter(Project.id == project_id).first() + + if not project: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Project not found", + ) + + if not check_project_edit_access(current_user, project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Only project owner can update", + ) + + # Update fields + update_data = project_data.model_dump(exclude_unset=True) + for field, value in update_data.items(): + if field == "security_level" and value: + setattr(project, field, value.value) + else: + setattr(project, field, value) + + db.commit() + db.refresh(project) + + return project + + +@router.delete("/api/projects/{project_id}", status_code=status.HTTP_204_NO_CONTENT) +async def delete_project( + project_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Delete a project (hard delete, cascades to tasks). + """ + project = db.query(Project).filter(Project.id == project_id).first() + + if not project: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Project not found", + ) + + if not check_project_edit_access(current_user, project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Only project owner can delete", + ) + + db.delete(project) + db.commit() + + return None + + +@router.get("/api/projects/{project_id}/statuses", response_model=List[TaskStatusResponse]) +async def list_project_statuses( + project_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + List all task statuses for a project. + """ + project = db.query(Project).filter(Project.id == project_id).first() + + if not project: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Project not found", + ) + + if not check_project_access(current_user, project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + statuses = db.query(TaskStatus).filter( + TaskStatus.project_id == project_id + ).order_by(TaskStatus.position).all() + + return statuses diff --git a/backend/app/api/spaces/__init__.py b/backend/app/api/spaces/__init__.py new file mode 100644 index 0000000..7ca13ab --- /dev/null +++ b/backend/app/api/spaces/__init__.py @@ -0,0 +1,3 @@ +from app.api.spaces.router import router + +__all__ = ["router"] diff --git a/backend/app/api/spaces/router.py b/backend/app/api/spaces/router.py new file mode 100644 index 0000000..2588209 --- /dev/null +++ b/backend/app/api/spaces/router.py @@ -0,0 +1,164 @@ +import uuid +from typing import List +from fastapi import APIRouter, Depends, HTTPException, status +from sqlalchemy.orm import Session + +from app.core.database import get_db +from app.models import User, Space +from app.schemas.space import SpaceCreate, SpaceUpdate, SpaceResponse, SpaceWithOwner +from app.middleware.auth import get_current_user, check_space_access, check_space_edit_access + +router = APIRouter(prefix="/api/spaces", tags=["spaces"]) + + +@router.get("", response_model=List[SpaceWithOwner]) +async def list_spaces( + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + List all active spaces the user can access. + """ + spaces = db.query(Space).filter(Space.is_active == True).all() + + # Filter by access (currently all users can see all spaces) + accessible_spaces = [s for s in spaces if check_space_access(current_user, s)] + + result = [] + for space in accessible_spaces: + result.append(SpaceWithOwner( + id=space.id, + name=space.name, + description=space.description, + owner_id=space.owner_id, + is_active=space.is_active, + created_at=space.created_at, + updated_at=space.updated_at, + owner_name=space.owner.name if space.owner else None, + )) + + return result + + +@router.post("", response_model=SpaceResponse, status_code=status.HTTP_201_CREATED) +async def create_space( + space_data: SpaceCreate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Create a new space. + """ + space = Space( + id=str(uuid.uuid4()), + name=space_data.name, + description=space_data.description, + owner_id=current_user.id, + is_active=True, + ) + + db.add(space) + db.commit() + db.refresh(space) + + return space + + +@router.get("/{space_id}", response_model=SpaceWithOwner) +async def get_space( + space_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Get a space by ID. + """ + space = db.query(Space).filter(Space.id == space_id).first() + + if not space: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Space not found", + ) + + if not check_space_access(current_user, space): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + return SpaceWithOwner( + id=space.id, + name=space.name, + description=space.description, + owner_id=space.owner_id, + is_active=space.is_active, + created_at=space.created_at, + updated_at=space.updated_at, + owner_name=space.owner.name if space.owner else None, + ) + + +@router.patch("/{space_id}", response_model=SpaceResponse) +async def update_space( + space_id: str, + space_data: SpaceUpdate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Update a space. + """ + space = db.query(Space).filter(Space.id == space_id).first() + + if not space: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Space not found", + ) + + if not check_space_edit_access(current_user, space): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Only space owner can update", + ) + + # Update fields + update_data = space_data.model_dump(exclude_unset=True) + for field, value in update_data.items(): + setattr(space, field, value) + + db.commit() + db.refresh(space) + + return space + + +@router.delete("/{space_id}", status_code=status.HTTP_204_NO_CONTENT) +async def delete_space( + space_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Soft delete a space (set is_active = False). + """ + space = db.query(Space).filter(Space.id == space_id).first() + + if not space: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Space not found", + ) + + if not check_space_edit_access(current_user, space): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Only space owner can delete", + ) + + # Soft delete + space.is_active = False + db.commit() + + return None diff --git a/backend/app/api/tasks/__init__.py b/backend/app/api/tasks/__init__.py new file mode 100644 index 0000000..d97bb2e --- /dev/null +++ b/backend/app/api/tasks/__init__.py @@ -0,0 +1,3 @@ +from app.api.tasks.router import router + +__all__ = ["router"] diff --git a/backend/app/api/tasks/router.py b/backend/app/api/tasks/router.py new file mode 100644 index 0000000..29b46f4 --- /dev/null +++ b/backend/app/api/tasks/router.py @@ -0,0 +1,420 @@ +import uuid +from typing import List, Optional +from fastapi import APIRouter, Depends, HTTPException, status, Query +from sqlalchemy.orm import Session + +from app.core.database import get_db +from app.models import User, Project, Task, TaskStatus +from app.schemas.task import ( + TaskCreate, TaskUpdate, TaskResponse, TaskWithDetails, TaskListResponse, + TaskStatusUpdate, TaskAssignUpdate +) +from app.middleware.auth import ( + get_current_user, check_project_access, check_task_access, check_task_edit_access +) + +router = APIRouter(tags=["tasks"]) + +# Maximum subtask depth +MAX_SUBTASK_DEPTH = 2 + + +def get_task_depth(db: Session, task: Task) -> int: + """Calculate the depth of a task in the hierarchy.""" + depth = 1 + current = task + while current.parent_task_id: + depth += 1 + current = db.query(Task).filter(Task.id == current.parent_task_id).first() + if not current: + break + return depth + + +def task_to_response(task: Task) -> TaskWithDetails: + """Convert a Task model to TaskWithDetails response.""" + return TaskWithDetails( + id=task.id, + project_id=task.project_id, + parent_task_id=task.parent_task_id, + title=task.title, + description=task.description, + priority=task.priority, + original_estimate=task.original_estimate, + time_spent=task.time_spent, + due_date=task.due_date, + assignee_id=task.assignee_id, + status_id=task.status_id, + blocker_flag=task.blocker_flag, + position=task.position, + created_by=task.created_by, + created_at=task.created_at, + updated_at=task.updated_at, + assignee_name=task.assignee.name if task.assignee else None, + status_name=task.status.name if task.status else None, + status_color=task.status.color if task.status else None, + creator_name=task.creator.name if task.creator else None, + subtask_count=len(task.subtasks) if task.subtasks else 0, + ) + + +@router.get("/api/projects/{project_id}/tasks", response_model=TaskListResponse) +async def list_tasks( + project_id: str, + parent_task_id: Optional[str] = Query(None, description="Filter by parent task"), + status_id: Optional[str] = Query(None, description="Filter by status"), + assignee_id: Optional[str] = Query(None, description="Filter by assignee"), + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + List all tasks in a project. + """ + project = db.query(Project).filter(Project.id == project_id).first() + + if not project: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Project not found", + ) + + if not check_project_access(current_user, project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + query = db.query(Task).filter(Task.project_id == project_id) + + # Apply filters + if parent_task_id is not None: + if parent_task_id == "": + # Root tasks only + query = query.filter(Task.parent_task_id == None) + else: + query = query.filter(Task.parent_task_id == parent_task_id) + else: + # By default, show only root tasks + query = query.filter(Task.parent_task_id == None) + + if status_id: + query = query.filter(Task.status_id == status_id) + + if assignee_id: + query = query.filter(Task.assignee_id == assignee_id) + + tasks = query.order_by(Task.position, Task.created_at).all() + + return TaskListResponse( + tasks=[task_to_response(t) for t in tasks], + total=len(tasks), + ) + + +@router.post("/api/projects/{project_id}/tasks", response_model=TaskResponse, status_code=status.HTTP_201_CREATED) +async def create_task( + project_id: str, + task_data: TaskCreate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Create a new task in a project. + """ + project = db.query(Project).filter(Project.id == project_id).first() + + if not project: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Project not found", + ) + + if not check_project_access(current_user, project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + # Validate parent task and check depth + if task_data.parent_task_id: + parent_task = db.query(Task).filter( + Task.id == task_data.parent_task_id, + Task.project_id == project_id + ).first() + + if not parent_task: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="Parent task not found in this project", + ) + + # Check depth limit + parent_depth = get_task_depth(db, parent_task) + if parent_depth >= MAX_SUBTASK_DEPTH: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail=f"Maximum subtask depth ({MAX_SUBTASK_DEPTH}) exceeded", + ) + + # Validate status_id belongs to this project + if task_data.status_id: + status_obj = db.query(TaskStatus).filter( + TaskStatus.id == task_data.status_id, + TaskStatus.project_id == project_id + ).first() + + if not status_obj: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="Status not found in this project", + ) + else: + # Use first status (To Do) as default + default_status = db.query(TaskStatus).filter( + TaskStatus.project_id == project_id + ).order_by(TaskStatus.position).first() + task_data.status_id = default_status.id if default_status else None + + # Get max position + max_pos_result = db.query(Task).filter( + Task.project_id == project_id, + Task.parent_task_id == task_data.parent_task_id + ).order_by(Task.position.desc()).first() + next_position = (max_pos_result.position + 1) if max_pos_result else 0 + + task = Task( + id=str(uuid.uuid4()), + project_id=project_id, + parent_task_id=task_data.parent_task_id, + title=task_data.title, + description=task_data.description, + priority=task_data.priority.value if task_data.priority else "medium", + original_estimate=task_data.original_estimate, + due_date=task_data.due_date, + assignee_id=task_data.assignee_id, + status_id=task_data.status_id, + position=next_position, + created_by=current_user.id, + ) + + db.add(task) + db.commit() + db.refresh(task) + + return task + + +@router.get("/api/tasks/{task_id}", response_model=TaskWithDetails) +async def get_task( + task_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Get a task by ID. + """ + task = db.query(Task).filter(Task.id == task_id).first() + + if not task: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Task not found", + ) + + if not check_task_access(current_user, task, task.project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + return task_to_response(task) + + +@router.patch("/api/tasks/{task_id}", response_model=TaskResponse) +async def update_task( + task_id: str, + task_data: TaskUpdate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Update a task. + """ + task = db.query(Task).filter(Task.id == task_id).first() + + if not task: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Task not found", + ) + + if not check_task_edit_access(current_user, task, task.project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Permission denied", + ) + + # Update fields + update_data = task_data.model_dump(exclude_unset=True) + for field, value in update_data.items(): + if field == "priority" and value: + setattr(task, field, value.value) + else: + setattr(task, field, value) + + db.commit() + db.refresh(task) + + return task + + +@router.delete("/api/tasks/{task_id}", status_code=status.HTTP_204_NO_CONTENT) +async def delete_task( + task_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Delete a task (cascades to subtasks). + """ + task = db.query(Task).filter(Task.id == task_id).first() + + if not task: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Task not found", + ) + + if not check_task_edit_access(current_user, task, task.project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Permission denied", + ) + + db.delete(task) + db.commit() + + return None + + +@router.patch("/api/tasks/{task_id}/status", response_model=TaskResponse) +async def update_task_status( + task_id: str, + status_data: TaskStatusUpdate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Update task status. + """ + task = db.query(Task).filter(Task.id == task_id).first() + + if not task: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Task not found", + ) + + if not check_task_edit_access(current_user, task, task.project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Permission denied", + ) + + # Validate new status belongs to same project + new_status = db.query(TaskStatus).filter( + TaskStatus.id == status_data.status_id, + TaskStatus.project_id == task.project_id + ).first() + + if not new_status: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="Status not found in this project", + ) + + task.status_id = status_data.status_id + + # Auto-set blocker_flag based on status name + if new_status.name.lower() == "blocked": + task.blocker_flag = True + else: + task.blocker_flag = False + + db.commit() + db.refresh(task) + + return task + + +@router.patch("/api/tasks/{task_id}/assign", response_model=TaskResponse) +async def assign_task( + task_id: str, + assign_data: TaskAssignUpdate, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + Assign or unassign a task. + """ + task = db.query(Task).filter(Task.id == task_id).first() + + if not task: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Task not found", + ) + + if not check_task_edit_access(current_user, task, task.project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Permission denied", + ) + + # Validate assignee exists if provided + if assign_data.assignee_id: + assignee = db.query(User).filter(User.id == assign_data.assignee_id).first() + if not assignee: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="Assignee not found", + ) + + task.assignee_id = assign_data.assignee_id + db.commit() + db.refresh(task) + + return task + + +@router.get("/api/tasks/{task_id}/subtasks", response_model=TaskListResponse) +async def list_subtasks( + task_id: str, + db: Session = Depends(get_db), + current_user: User = Depends(get_current_user), +): + """ + List subtasks of a task. + """ + task = db.query(Task).filter(Task.id == task_id).first() + + if not task: + raise HTTPException( + status_code=status.HTTP_404_NOT_FOUND, + detail="Task not found", + ) + + if not check_task_access(current_user, task, task.project): + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Access denied", + ) + + subtasks = db.query(Task).filter( + Task.parent_task_id == task_id + ).order_by(Task.position, Task.created_at).all() + + return TaskListResponse( + tasks=[task_to_response(t) for t in subtasks], + total=len(subtasks), + ) diff --git a/backend/app/core/config.py b/backend/app/core/config.py index a21a545..4c79e6a 100644 --- a/backend/app/core/config.py +++ b/backend/app/core/config.py @@ -27,7 +27,7 @@ class Settings(BaseSettings): # JWT JWT_SECRET_KEY: str = "your-secret-key-change-in-production" JWT_ALGORITHM: str = "HS256" - JWT_EXPIRE_MINUTES: int = 15 + JWT_EXPIRE_MINUTES: int = 10080 # 7 days # External Auth API AUTH_API_URL: str = "https://pj-auth-api.vercel.app" diff --git a/backend/app/main.py b/backend/app/main.py index f9eba03..bd0c078 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -4,6 +4,9 @@ from fastapi.middleware.cors import CORSMiddleware from app.api.auth import router as auth_router from app.api.users import router as users_router from app.api.departments import router as departments_router +from app.api.spaces import router as spaces_router +from app.api.projects import router as projects_router +from app.api.tasks import router as tasks_router from app.core.config import settings app = FastAPI( @@ -25,6 +28,9 @@ app.add_middleware( app.include_router(auth_router.router, prefix="/api/auth", tags=["Authentication"]) app.include_router(users_router.router, prefix="/api/users", tags=["Users"]) app.include_router(departments_router.router, prefix="/api/departments", tags=["Departments"]) +app.include_router(spaces_router) +app.include_router(projects_router) +app.include_router(tasks_router) @app.get("/health") diff --git a/backend/app/middleware/auth.py b/backend/app/middleware/auth.py index 0017bf3..5452a63 100644 --- a/backend/app/middleware/auth.py +++ b/backend/app/middleware/auth.py @@ -167,3 +167,107 @@ def check_department_access( return True return False + + +def check_space_access(user: User, space) -> bool: + """ + Check if user has access to a space. + + Currently all active users can see all spaces. + Owner has edit/delete permissions. + """ + # System admin has full access + if user.is_system_admin: + return True + + # All active users can view spaces + return True + + +def check_space_edit_access(user: User, space) -> bool: + """ + Check if user can edit/delete a space. + """ + # System admin has full access + if user.is_system_admin: + return True + + # Only owner can edit + return space.owner_id == user.id + + +def check_project_access(user: User, project) -> bool: + """ + Check if user has access to a project based on security level. + + Security Levels: + - public: All logged-in users + - department: Same department users + project owner + - confidential: Only project owner (+ system admin) + """ + # System admin bypasses all restrictions + if user.is_system_admin: + return True + + # Project owner always has access + if project.owner_id == user.id: + return True + + # Check by security level + security_level = project.security_level + + if security_level == "public": + return True + + elif security_level == "department": + # Same department has access + if project.department_id and user.department_id == project.department_id: + return True + return False + + else: # confidential + # Only owner has access (already checked above) + return False + + +def check_project_edit_access(user: User, project) -> bool: + """ + Check if user can edit/delete a project. + """ + # System admin has full access + if user.is_system_admin: + return True + + # Only owner can edit + return project.owner_id == user.id + + +def check_task_access(user: User, task, project) -> bool: + """ + Check if user has access to a task. + Task access is based on project access. + """ + return check_project_access(user, project) + + +def check_task_edit_access(user: User, task, project) -> bool: + """ + Check if user can edit a task. + """ + # System admin has full access + if user.is_system_admin: + return True + + # Project owner can edit all tasks + if project.owner_id == user.id: + return True + + # Task creator can edit their own tasks + if task.created_by == user.id: + return True + + # Assignee can edit their assigned tasks + if task.assignee_id == user.id: + return True + + return False diff --git a/backend/app/models/__init__.py b/backend/app/models/__init__.py index 0d603b6..6c5ca95 100644 --- a/backend/app/models/__init__.py +++ b/backend/app/models/__init__.py @@ -1,5 +1,9 @@ from app.models.user import User from app.models.role import Role from app.models.department import Department +from app.models.space import Space +from app.models.project import Project +from app.models.task_status import TaskStatus +from app.models.task import Task -__all__ = ["User", "Role", "Department"] +__all__ = ["User", "Role", "Department", "Space", "Project", "TaskStatus", "Task"] diff --git a/backend/app/models/department.py b/backend/app/models/department.py index 907921e..c404841 100644 --- a/backend/app/models/department.py +++ b/backend/app/models/department.py @@ -15,3 +15,6 @@ class Department(Base): # Self-referential relationship parent = relationship("Department", remote_side=[id], backref="children") + + # Project relationship + projects = relationship("Project", back_populates="department") diff --git a/backend/app/models/project.py b/backend/app/models/project.py new file mode 100644 index 0000000..ab7e7b7 --- /dev/null +++ b/backend/app/models/project.py @@ -0,0 +1,40 @@ +from sqlalchemy import Column, String, Text, Boolean, DateTime, Date, Numeric, Enum, ForeignKey +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func +from app.core.database import Base +import enum + + +class SecurityLevel(str, enum.Enum): + PUBLIC = "public" + DEPARTMENT = "department" + CONFIDENTIAL = "confidential" + + +class Project(Base): + __tablename__ = "pjctrl_projects" + + id = Column(String(36), primary_key=True) + space_id = Column(String(36), ForeignKey("pjctrl_spaces.id", ondelete="CASCADE"), nullable=False) + title = Column(String(200), nullable=False) + description = Column(Text, nullable=True) + owner_id = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=False) + budget = Column(Numeric(15, 2), nullable=True) + start_date = Column(Date, nullable=True) + end_date = Column(Date, nullable=True) + security_level = Column( + Enum("public", "department", "confidential", name="security_level_enum"), + default="department", + nullable=False + ) + status = Column(String(50), default="active", nullable=False) + department_id = Column(String(36), ForeignKey("pjctrl_departments.id"), nullable=True) + created_at = Column(DateTime, server_default=func.now(), nullable=False) + updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False) + + # Relationships + space = relationship("Space", back_populates="projects") + owner = relationship("User", foreign_keys=[owner_id], back_populates="owned_projects") + department = relationship("Department", back_populates="projects") + task_statuses = relationship("TaskStatus", back_populates="project", cascade="all, delete-orphan") + tasks = relationship("Task", back_populates="project", cascade="all, delete-orphan") diff --git a/backend/app/models/space.py b/backend/app/models/space.py new file mode 100644 index 0000000..d9c1e86 --- /dev/null +++ b/backend/app/models/space.py @@ -0,0 +1,20 @@ +from sqlalchemy import Column, String, Text, Boolean, DateTime, ForeignKey +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func +from app.core.database import Base + + +class Space(Base): + __tablename__ = "pjctrl_spaces" + + id = Column(String(36), primary_key=True) + name = Column(String(200), nullable=False) + description = Column(Text, nullable=True) + owner_id = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=False) + is_active = Column(Boolean, default=True, nullable=False) + created_at = Column(DateTime, server_default=func.now(), nullable=False) + updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False) + + # Relationships + owner = relationship("User", back_populates="owned_spaces") + projects = relationship("Project", back_populates="space", cascade="all, delete-orphan") diff --git a/backend/app/models/task.py b/backend/app/models/task.py new file mode 100644 index 0000000..893636f --- /dev/null +++ b/backend/app/models/task.py @@ -0,0 +1,45 @@ +from sqlalchemy import Column, String, Text, Integer, Boolean, DateTime, Numeric, Enum, ForeignKey +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func +from app.core.database import Base +import enum + + +class Priority(str, enum.Enum): + LOW = "low" + MEDIUM = "medium" + HIGH = "high" + URGENT = "urgent" + + +class Task(Base): + __tablename__ = "pjctrl_tasks" + + id = Column(String(36), primary_key=True) + project_id = Column(String(36), ForeignKey("pjctrl_projects.id", ondelete="CASCADE"), nullable=False) + parent_task_id = Column(String(36), ForeignKey("pjctrl_tasks.id", ondelete="CASCADE"), nullable=True) + title = Column(String(500), nullable=False) + description = Column(Text, nullable=True) + assignee_id = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=True) + status_id = Column(String(36), ForeignKey("pjctrl_task_statuses.id"), nullable=True) + priority = Column( + Enum("low", "medium", "high", "urgent", name="priority_enum"), + default="medium", + nullable=False + ) + original_estimate = Column(Numeric(8, 2), nullable=True) + time_spent = Column(Numeric(8, 2), default=0, nullable=False) + blocker_flag = Column(Boolean, default=False, nullable=False) + due_date = Column(DateTime, nullable=True) + position = Column(Integer, default=0, nullable=False) + created_by = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=False) + created_at = Column(DateTime, server_default=func.now(), nullable=False) + updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False) + + # Relationships + project = relationship("Project", back_populates="tasks") + parent_task = relationship("Task", remote_side=[id], back_populates="subtasks") + subtasks = relationship("Task", back_populates="parent_task", cascade="all, delete-orphan") + assignee = relationship("User", foreign_keys=[assignee_id], back_populates="assigned_tasks") + creator = relationship("User", foreign_keys=[created_by], back_populates="created_tasks") + status = relationship("TaskStatus", back_populates="tasks") diff --git a/backend/app/models/task_status.py b/backend/app/models/task_status.py new file mode 100644 index 0000000..495ffd5 --- /dev/null +++ b/backend/app/models/task_status.py @@ -0,0 +1,33 @@ +from sqlalchemy import Column, String, Integer, Boolean, DateTime, ForeignKey, UniqueConstraint +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func +from app.core.database import Base + + +class TaskStatus(Base): + __tablename__ = "pjctrl_task_statuses" + + id = Column(String(36), primary_key=True) + project_id = Column(String(36), ForeignKey("pjctrl_projects.id", ondelete="CASCADE"), nullable=False) + name = Column(String(50), nullable=False) + color = Column(String(7), default="#808080", nullable=False) + position = Column(Integer, default=0, nullable=False) + is_done = Column(Boolean, default=False, nullable=False) + created_at = Column(DateTime, server_default=func.now(), nullable=False) + + __table_args__ = ( + UniqueConstraint('project_id', 'name', name='uk_status_name'), + ) + + # Relationships + project = relationship("Project", back_populates="task_statuses") + tasks = relationship("Task", back_populates="status") + + +# Default statuses to create for new projects +DEFAULT_STATUSES = [ + {"name": "To Do", "color": "#808080", "position": 0, "is_done": False}, + {"name": "In Progress", "color": "#0066cc", "position": 1, "is_done": False}, + {"name": "Blocked", "color": "#cc0000", "position": 2, "is_done": False}, + {"name": "Done", "color": "#00cc66", "position": 3, "is_done": True}, +] diff --git a/backend/app/models/user.py b/backend/app/models/user.py index b33013a..159192b 100644 --- a/backend/app/models/user.py +++ b/backend/app/models/user.py @@ -23,3 +23,9 @@ class User(Base): # Relationships department = relationship("Department", backref="users") role = relationship("Role", backref="users") + + # Task management relationships + owned_spaces = relationship("Space", back_populates="owner") + owned_projects = relationship("Project", foreign_keys="Project.owner_id", back_populates="owner") + assigned_tasks = relationship("Task", foreign_keys="Task.assignee_id", back_populates="assignee") + created_tasks = relationship("Task", foreign_keys="Task.created_by", back_populates="creator") diff --git a/backend/app/schemas/__init__.py b/backend/app/schemas/__init__.py index ad08efd..4b89096 100644 --- a/backend/app/schemas/__init__.py +++ b/backend/app/schemas/__init__.py @@ -2,6 +2,15 @@ from app.schemas.auth import LoginRequest, LoginResponse, TokenPayload from app.schemas.user import UserCreate, UserUpdate, UserResponse, UserInDB from app.schemas.department import DepartmentCreate, DepartmentUpdate, DepartmentResponse from app.schemas.role import RoleResponse +from app.schemas.space import SpaceCreate, SpaceUpdate, SpaceResponse, SpaceWithOwner +from app.schemas.project import ( + ProjectCreate, ProjectUpdate, ProjectResponse, ProjectWithDetails, SecurityLevel +) +from app.schemas.task_status import TaskStatusCreate, TaskStatusUpdate, TaskStatusResponse +from app.schemas.task import ( + TaskCreate, TaskUpdate, TaskResponse, TaskWithDetails, TaskListResponse, + TaskStatusUpdate as TaskStatusChangeUpdate, TaskAssignUpdate, Priority +) __all__ = [ "LoginRequest", @@ -15,4 +24,24 @@ __all__ = [ "DepartmentUpdate", "DepartmentResponse", "RoleResponse", + "SpaceCreate", + "SpaceUpdate", + "SpaceResponse", + "SpaceWithOwner", + "ProjectCreate", + "ProjectUpdate", + "ProjectResponse", + "ProjectWithDetails", + "SecurityLevel", + "TaskStatusCreate", + "TaskStatusUpdate", + "TaskStatusResponse", + "TaskCreate", + "TaskUpdate", + "TaskResponse", + "TaskWithDetails", + "TaskListResponse", + "TaskStatusChangeUpdate", + "TaskAssignUpdate", + "Priority", ] diff --git a/backend/app/schemas/project.py b/backend/app/schemas/project.py new file mode 100644 index 0000000..685f68a --- /dev/null +++ b/backend/app/schemas/project.py @@ -0,0 +1,55 @@ +from pydantic import BaseModel +from typing import Optional +from datetime import datetime, date +from decimal import Decimal +from enum import Enum + + +class SecurityLevel(str, Enum): + PUBLIC = "public" + DEPARTMENT = "department" + CONFIDENTIAL = "confidential" + + +class ProjectBase(BaseModel): + title: str + description: Optional[str] = None + budget: Optional[Decimal] = None + start_date: Optional[date] = None + end_date: Optional[date] = None + security_level: SecurityLevel = SecurityLevel.DEPARTMENT + + +class ProjectCreate(ProjectBase): + department_id: Optional[str] = None + + +class ProjectUpdate(BaseModel): + title: Optional[str] = None + description: Optional[str] = None + budget: Optional[Decimal] = None + start_date: Optional[date] = None + end_date: Optional[date] = None + security_level: Optional[SecurityLevel] = None + status: Optional[str] = None + department_id: Optional[str] = None + + +class ProjectResponse(ProjectBase): + id: str + space_id: str + owner_id: str + status: str + department_id: Optional[str] = None + created_at: datetime + updated_at: datetime + + class Config: + from_attributes = True + + +class ProjectWithDetails(ProjectResponse): + owner_name: Optional[str] = None + space_name: Optional[str] = None + department_name: Optional[str] = None + task_count: int = 0 diff --git a/backend/app/schemas/space.py b/backend/app/schemas/space.py new file mode 100644 index 0000000..a7033b1 --- /dev/null +++ b/backend/app/schemas/space.py @@ -0,0 +1,32 @@ +from pydantic import BaseModel +from typing import Optional +from datetime import datetime + + +class SpaceBase(BaseModel): + name: str + description: Optional[str] = None + + +class SpaceCreate(SpaceBase): + pass + + +class SpaceUpdate(BaseModel): + name: Optional[str] = None + description: Optional[str] = None + + +class SpaceResponse(SpaceBase): + id: str + owner_id: str + is_active: bool + created_at: datetime + updated_at: datetime + + class Config: + from_attributes = True + + +class SpaceWithOwner(SpaceResponse): + owner_name: Optional[str] = None diff --git a/backend/app/schemas/task.py b/backend/app/schemas/task.py new file mode 100644 index 0000000..f422037 --- /dev/null +++ b/backend/app/schemas/task.py @@ -0,0 +1,74 @@ +from pydantic import BaseModel +from typing import Optional, List +from datetime import datetime +from decimal import Decimal +from enum import Enum + + +class Priority(str, Enum): + LOW = "low" + MEDIUM = "medium" + HIGH = "high" + URGENT = "urgent" + + +class TaskBase(BaseModel): + title: str + description: Optional[str] = None + priority: Priority = Priority.MEDIUM + original_estimate: Optional[Decimal] = None + due_date: Optional[datetime] = None + + +class TaskCreate(TaskBase): + parent_task_id: Optional[str] = None + assignee_id: Optional[str] = None + status_id: Optional[str] = None + + +class TaskUpdate(BaseModel): + title: Optional[str] = None + description: Optional[str] = None + priority: Optional[Priority] = None + original_estimate: Optional[Decimal] = None + time_spent: Optional[Decimal] = None + due_date: Optional[datetime] = None + position: Optional[int] = None + + +class TaskStatusUpdate(BaseModel): + status_id: str + + +class TaskAssignUpdate(BaseModel): + assignee_id: Optional[str] = None + + +class TaskResponse(TaskBase): + id: str + project_id: str + parent_task_id: Optional[str] = None + assignee_id: Optional[str] = None + status_id: Optional[str] = None + time_spent: Decimal + blocker_flag: bool + position: int + created_by: str + created_at: datetime + updated_at: datetime + + class Config: + from_attributes = True + + +class TaskWithDetails(TaskResponse): + assignee_name: Optional[str] = None + status_name: Optional[str] = None + status_color: Optional[str] = None + creator_name: Optional[str] = None + subtask_count: int = 0 + + +class TaskListResponse(BaseModel): + tasks: List[TaskWithDetails] + total: int diff --git a/backend/app/schemas/task_status.py b/backend/app/schemas/task_status.py new file mode 100644 index 0000000..e5a93e5 --- /dev/null +++ b/backend/app/schemas/task_status.py @@ -0,0 +1,30 @@ +from pydantic import BaseModel +from typing import Optional +from datetime import datetime + + +class TaskStatusBase(BaseModel): + name: str + color: str = "#808080" + position: int = 0 + is_done: bool = False + + +class TaskStatusCreate(TaskStatusBase): + pass + + +class TaskStatusUpdate(BaseModel): + name: Optional[str] = None + color: Optional[str] = None + position: Optional[int] = None + is_done: Optional[bool] = None + + +class TaskStatusResponse(TaskStatusBase): + id: str + project_id: str + created_at: datetime + + class Config: + from_attributes = True diff --git a/backend/app/services/auth_client.py b/backend/app/services/auth_client.py index ece7fe7..c50ebeb 100644 --- a/backend/app/services/auth_client.py +++ b/backend/app/services/auth_client.py @@ -35,7 +35,7 @@ async def verify_credentials(email: str, password: str) -> dict: async with httpx.AsyncClient(timeout=10.0) as client: response = await client.post( f"{settings.AUTH_API_URL}/api/auth/login", - json={"email": email, "password": password}, + json={"username": email, "password": password}, ) if response.status_code == 200: diff --git a/backend/environment.yml b/backend/environment.yml index ee020a7..c04d51f 100644 --- a/backend/environment.yml +++ b/backend/environment.yml @@ -2,6 +2,8 @@ name: pjctrl channels: - defaults - conda-forge +# 注意: 此環境需要額外安裝 Redis Server (brew install redis / apt install redis-server) +# 詳見 README.md dependencies: - python=3.11 - pip diff --git a/backend/migrations/versions/002_task_management_tables.py b/backend/migrations/versions/002_task_management_tables.py new file mode 100644 index 0000000..d9a38ce --- /dev/null +++ b/backend/migrations/versions/002_task_management_tables.py @@ -0,0 +1,108 @@ +"""Task management tables + +Revision ID: 002 +Revises: 001 +Create Date: 2024-01-XX + +""" +from alembic import op +import sqlalchemy as sa +from sqlalchemy.dialects import mysql + +# revision identifiers, used by Alembic. +revision = '002' +down_revision = '001' +branch_labels = None +depends_on = None + + +def upgrade() -> None: + # Create pjctrl_spaces table + op.create_table( + 'pjctrl_spaces', + sa.Column('id', sa.String(36), primary_key=True), + sa.Column('name', sa.String(200), nullable=False), + sa.Column('description', sa.Text, nullable=True), + sa.Column('owner_id', sa.String(36), sa.ForeignKey('pjctrl_users.id'), nullable=False), + sa.Column('is_active', sa.Boolean, default=True, nullable=False), + sa.Column('created_at', sa.DateTime, server_default=sa.func.now(), nullable=False), + sa.Column('updated_at', sa.DateTime, server_default=sa.func.now(), onupdate=sa.func.now(), nullable=False), + ) + op.create_index('idx_spaces_owner', 'pjctrl_spaces', ['owner_id']) + op.create_index('idx_spaces_active', 'pjctrl_spaces', ['is_active']) + + # Create pjctrl_projects table + op.create_table( + 'pjctrl_projects', + sa.Column('id', sa.String(36), primary_key=True), + sa.Column('space_id', sa.String(36), sa.ForeignKey('pjctrl_spaces.id', ondelete='CASCADE'), nullable=False), + sa.Column('title', sa.String(200), nullable=False), + sa.Column('description', sa.Text, nullable=True), + sa.Column('owner_id', sa.String(36), sa.ForeignKey('pjctrl_users.id'), nullable=False), + sa.Column('budget', sa.Numeric(15, 2), nullable=True), + sa.Column('start_date', sa.Date, nullable=True), + sa.Column('end_date', sa.Date, nullable=True), + sa.Column('security_level', sa.Enum('public', 'department', 'confidential', name='security_level_enum'), + server_default='department', nullable=False), + sa.Column('status', sa.String(50), server_default='active', nullable=False), + sa.Column('department_id', sa.String(36), sa.ForeignKey('pjctrl_departments.id'), nullable=True), + sa.Column('created_at', sa.DateTime, server_default=sa.func.now(), nullable=False), + sa.Column('updated_at', sa.DateTime, server_default=sa.func.now(), onupdate=sa.func.now(), nullable=False), + ) + op.create_index('idx_projects_space', 'pjctrl_projects', ['space_id']) + op.create_index('idx_projects_owner', 'pjctrl_projects', ['owner_id']) + op.create_index('idx_projects_department', 'pjctrl_projects', ['department_id']) + op.create_index('idx_projects_security', 'pjctrl_projects', ['security_level']) + + # Create pjctrl_task_statuses table + op.create_table( + 'pjctrl_task_statuses', + sa.Column('id', sa.String(36), primary_key=True), + sa.Column('project_id', sa.String(36), sa.ForeignKey('pjctrl_projects.id', ondelete='CASCADE'), nullable=False), + sa.Column('name', sa.String(50), nullable=False), + sa.Column('color', sa.String(7), server_default='#808080', nullable=False), + sa.Column('position', sa.Integer, server_default='0', nullable=False), + sa.Column('is_done', sa.Boolean, server_default='0', nullable=False), + sa.Column('created_at', sa.DateTime, server_default=sa.func.now(), nullable=False), + sa.UniqueConstraint('project_id', 'name', name='uk_status_name'), + ) + op.create_index('idx_statuses_project', 'pjctrl_task_statuses', ['project_id']) + + # Create pjctrl_tasks table + op.create_table( + 'pjctrl_tasks', + sa.Column('id', sa.String(36), primary_key=True), + sa.Column('project_id', sa.String(36), sa.ForeignKey('pjctrl_projects.id', ondelete='CASCADE'), nullable=False), + sa.Column('parent_task_id', sa.String(36), sa.ForeignKey('pjctrl_tasks.id', ondelete='CASCADE'), nullable=True), + sa.Column('title', sa.String(500), nullable=False), + sa.Column('description', sa.Text, nullable=True), + sa.Column('assignee_id', sa.String(36), sa.ForeignKey('pjctrl_users.id'), nullable=True), + sa.Column('status_id', sa.String(36), sa.ForeignKey('pjctrl_task_statuses.id'), nullable=True), + sa.Column('priority', sa.Enum('low', 'medium', 'high', 'urgent', name='priority_enum'), + server_default='medium', nullable=False), + sa.Column('original_estimate', sa.Numeric(8, 2), nullable=True), + sa.Column('time_spent', sa.Numeric(8, 2), server_default='0', nullable=False), + sa.Column('blocker_flag', sa.Boolean, server_default='0', nullable=False), + sa.Column('due_date', sa.DateTime, nullable=True), + sa.Column('position', sa.Integer, server_default='0', nullable=False), + sa.Column('created_by', sa.String(36), sa.ForeignKey('pjctrl_users.id'), nullable=False), + sa.Column('created_at', sa.DateTime, server_default=sa.func.now(), nullable=False), + sa.Column('updated_at', sa.DateTime, server_default=sa.func.now(), onupdate=sa.func.now(), nullable=False), + ) + op.create_index('idx_tasks_project', 'pjctrl_tasks', ['project_id']) + op.create_index('idx_tasks_parent', 'pjctrl_tasks', ['parent_task_id']) + op.create_index('idx_tasks_assignee', 'pjctrl_tasks', ['assignee_id']) + op.create_index('idx_tasks_status', 'pjctrl_tasks', ['status_id']) + op.create_index('idx_tasks_due', 'pjctrl_tasks', ['due_date']) + op.create_index('idx_tasks_blocker', 'pjctrl_tasks', ['blocker_flag']) + + +def downgrade() -> None: + op.drop_table('pjctrl_tasks') + op.drop_table('pjctrl_task_statuses') + op.drop_table('pjctrl_projects') + op.drop_table('pjctrl_spaces') + + # Drop enums + op.execute("DROP TYPE IF EXISTS priority_enum") + op.execute("DROP TYPE IF EXISTS security_level_enum") diff --git a/backend/tests/test_projects.py b/backend/tests/test_projects.py new file mode 100644 index 0000000..2758dd5 --- /dev/null +++ b/backend/tests/test_projects.py @@ -0,0 +1,97 @@ +import pytest +from unittest.mock import MagicMock + +from app.models import Project +from app.middleware.auth import check_project_access, check_project_edit_access + + +def get_mock_user(is_admin=False, department_id="dept-1"): + user = MagicMock() + user.id = "test-user-id" + user.is_system_admin = is_admin + user.department_id = department_id + return user + + +def get_mock_project(owner_id="owner-id", security_level="department", department_id="dept-1"): + project = MagicMock() + project.id = "project-id" + project.owner_id = owner_id + project.security_level = security_level + project.department_id = department_id + return project + + +class TestProjectModel: + """Test Project model.""" + + def test_project_creation(self): + """Test Project model can be instantiated.""" + project = Project( + id="test-id", + space_id="space-id", + title="Test Project", + owner_id="owner-id", + security_level="department", + ) + assert project.title == "Test Project" + assert project.security_level == "department" + + +class TestProjectSecurityLevel: + """Test project access based on security level.""" + + def test_admin_bypasses_all(self): + """Test that admin can access any project.""" + admin = get_mock_user(is_admin=True) + project = get_mock_project(security_level="confidential") + + assert check_project_access(admin, project) == True + assert check_project_edit_access(admin, project) == True + + def test_owner_has_access(self): + """Test that owner can access their project.""" + user = get_mock_user() + project = get_mock_project(owner_id=user.id, security_level="confidential") + + assert check_project_access(user, project) == True + + def test_public_project_accessible_by_all(self): + """Test that public projects are accessible by all users.""" + user = get_mock_user(department_id="other-dept") + project = get_mock_project(security_level="public") + + assert check_project_access(user, project) == True + + def test_department_project_same_dept(self): + """Test that department projects are accessible by same department.""" + user = get_mock_user(department_id="dept-1") + project = get_mock_project(security_level="department", department_id="dept-1") + + assert check_project_access(user, project) == True + + def test_department_project_different_dept(self): + """Test that department projects are not accessible by different department.""" + user = get_mock_user(department_id="dept-2") + project = get_mock_project(security_level="department", department_id="dept-1") + + assert check_project_access(user, project) == False + + def test_confidential_project_non_owner(self): + """Test that confidential projects are not accessible by non-owners.""" + user = get_mock_user(department_id="dept-1") + project = get_mock_project( + owner_id="other-user", + security_level="confidential", + department_id="dept-1" + ) + + assert check_project_access(user, project) == False + + def test_only_owner_can_edit(self): + """Test that only owner can edit project.""" + user = get_mock_user() + project = get_mock_project(owner_id="other-user", security_level="public") + + assert check_project_access(user, project) == True # Can view + assert check_project_edit_access(user, project) == False # Cannot edit diff --git a/backend/tests/test_spaces.py b/backend/tests/test_spaces.py new file mode 100644 index 0000000..b8a3fe5 --- /dev/null +++ b/backend/tests/test_spaces.py @@ -0,0 +1,117 @@ +import pytest +from fastapi.testclient import TestClient +from unittest.mock import MagicMock, patch + +from app.main import app +from app.models import User, Space + +client = TestClient(app) + + +# Mock user for testing +def get_mock_user(): + user = MagicMock(spec=User) + user.id = "test-user-id" + user.email = "test@example.com" + user.name = "Test User" + user.is_active = True + user.is_system_admin = False + user.department_id = "dept-1" + return user + + +def get_mock_admin_user(): + user = get_mock_user() + user.is_system_admin = True + return user + + +class TestSpacesAPI: + """Test Spaces API endpoints.""" + + @patch("app.api.spaces.router.get_current_user") + @patch("app.api.spaces.router.get_db") + def test_list_spaces_empty(self, mock_db, mock_get_user): + """Test listing spaces when none exist.""" + mock_user = get_mock_user() + mock_get_user.return_value = mock_user + + mock_session = MagicMock() + mock_session.query.return_value.filter.return_value.all.return_value = [] + mock_db.return_value = mock_session + + # Skip actual auth for unit test + with patch("app.middleware.auth.get_current_user", return_value=mock_user): + response = client.get( + "/api/spaces", + headers={"Authorization": "Bearer test-token"} + ) + + # This will fail auth in real scenario, but tests the route exists + assert response.status_code in [200, 401] + + @patch("app.api.spaces.router.get_current_user") + def test_create_space_requires_auth(self, mock_get_user): + """Test that creating a space requires authentication.""" + response = client.post( + "/api/spaces", + json={"name": "Test Space", "description": "Test"} + ) + assert response.status_code == 403 # No auth header + + def test_space_routes_exist(self): + """Test that all space routes are registered.""" + routes = [route.path for route in app.routes if hasattr(route, 'path')] + assert "/api/spaces" in routes + assert "/api/spaces/{space_id}" in routes + + +class TestSpaceModel: + """Test Space model.""" + + def test_space_creation(self): + """Test Space model can be instantiated.""" + space = Space( + id="test-id", + name="Test Space", + description="A test space", + owner_id="owner-id", + is_active=True, + ) + assert space.name == "Test Space" + assert space.is_active == True + + +class TestSpacePermissions: + """Test space permission logic.""" + + def test_admin_has_access(self): + """Test that admin users have access to all spaces.""" + from app.middleware.auth import check_space_access, check_space_edit_access + + admin = get_mock_admin_user() + space = MagicMock() + space.owner_id = "other-user" + + assert check_space_access(admin, space) == True + assert check_space_edit_access(admin, space) == True + + def test_owner_can_edit(self): + """Test that space owner can edit.""" + from app.middleware.auth import check_space_edit_access + + user = get_mock_user() + space = MagicMock() + space.owner_id = user.id + + assert check_space_edit_access(user, space) == True + + def test_non_owner_cannot_edit(self): + """Test that non-owner cannot edit.""" + from app.middleware.auth import check_space_edit_access + + user = get_mock_user() + space = MagicMock() + space.owner_id = "other-user-id" + + assert check_space_edit_access(user, space) == False diff --git a/backend/tests/test_tasks.py b/backend/tests/test_tasks.py new file mode 100644 index 0000000..9808bf3 --- /dev/null +++ b/backend/tests/test_tasks.py @@ -0,0 +1,116 @@ +import pytest +from unittest.mock import MagicMock +from fastapi.testclient import TestClient + +from app.main import app +from app.models import Task +from app.middleware.auth import check_task_access, check_task_edit_access + +client = TestClient(app) + + +def get_mock_user(is_admin=False): + user = MagicMock() + user.id = "test-user-id" + user.is_system_admin = is_admin + user.department_id = "dept-1" + return user + + +def get_mock_project(owner_id="owner-id"): + project = MagicMock() + project.id = "project-id" + project.owner_id = owner_id + project.security_level = "public" + project.department_id = "dept-1" + return project + + +def get_mock_task(created_by="creator-id", assignee_id=None): + task = MagicMock() + task.id = "task-id" + task.created_by = created_by + task.assignee_id = assignee_id + return task + + +class TestTaskModel: + """Test Task model.""" + + def test_task_creation(self): + """Test Task model can be instantiated.""" + task = Task( + id="test-id", + project_id="project-id", + title="Test Task", + priority="medium", + created_by="user-id", + ) + assert task.title == "Test Task" + assert task.priority == "medium" + + +class TestTaskRoutes: + """Test task routes exist.""" + + def test_task_routes_exist(self): + """Test that all task routes are registered.""" + routes = [route.path for route in app.routes if hasattr(route, 'path')] + assert "/api/projects/{project_id}/tasks" in routes + assert "/api/tasks/{task_id}" in routes + assert "/api/tasks/{task_id}/status" in routes + assert "/api/tasks/{task_id}/assign" in routes + + +class TestTaskPermissions: + """Test task permission logic.""" + + def test_admin_has_full_access(self): + """Test that admin has full access to all tasks.""" + admin = get_mock_user(is_admin=True) + project = get_mock_project() + task = get_mock_task() + + assert check_task_access(admin, task, project) == True + assert check_task_edit_access(admin, task, project) == True + + def test_project_owner_can_edit_any_task(self): + """Test that project owner can edit any task in the project.""" + user = get_mock_user() + project = get_mock_project(owner_id=user.id) + task = get_mock_task(created_by="other-user") + + assert check_task_edit_access(user, task, project) == True + + def test_creator_can_edit_own_task(self): + """Test that task creator can edit their own task.""" + user = get_mock_user() + project = get_mock_project(owner_id="other-user") + task = get_mock_task(created_by=user.id) + + assert check_task_edit_access(user, task, project) == True + + def test_assignee_can_edit_assigned_task(self): + """Test that assignee can edit their assigned task.""" + user = get_mock_user() + project = get_mock_project(owner_id="other-user") + task = get_mock_task(created_by="other-user", assignee_id=user.id) + + assert check_task_edit_access(user, task, project) == True + + def test_unrelated_user_cannot_edit(self): + """Test that unrelated user cannot edit task.""" + user = get_mock_user() + project = get_mock_project(owner_id="project-owner") + task = get_mock_task(created_by="creator", assignee_id="assignee") + + assert check_task_edit_access(user, task, project) == False + + +class TestSubtaskDepth: + """Test subtask depth limiting.""" + + def test_max_depth_constant(self): + """Test that MAX_SUBTASK_DEPTH is defined.""" + from app.api.tasks.router import MAX_SUBTASK_DEPTH + assert MAX_SUBTASK_DEPTH == 2 diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx index 397bb4f..7f1540b 100644 --- a/frontend/src/App.tsx +++ b/frontend/src/App.tsx @@ -2,7 +2,11 @@ import { Routes, Route, Navigate } from 'react-router-dom' import { useAuth } from './contexts/AuthContext' import Login from './pages/Login' import Dashboard from './pages/Dashboard' +import Spaces from './pages/Spaces' +import Projects from './pages/Projects' +import Tasks from './pages/Tasks' import ProtectedRoute from './components/ProtectedRoute' +import Layout from './components/Layout' function App() { const { isAuthenticated, loading } = useAuth() @@ -21,7 +25,39 @@ function App() { path="/" element={ - + + + + + } + /> + + + + + + } + /> + + + + + + } + /> + + + + } /> diff --git a/frontend/src/components/Layout.tsx b/frontend/src/components/Layout.tsx new file mode 100644 index 0000000..3d9cbfe --- /dev/null +++ b/frontend/src/components/Layout.tsx @@ -0,0 +1,131 @@ +import { ReactNode } from 'react' +import { useNavigate, useLocation } from 'react-router-dom' +import { useAuth } from '../contexts/AuthContext' + +interface LayoutProps { + children: ReactNode +} + +export default function Layout({ children }: LayoutProps) { + const { user, logout } = useAuth() + const navigate = useNavigate() + const location = useLocation() + + const handleLogout = async () => { + await logout() + } + + const navItems = [ + { path: '/', label: 'Dashboard' }, + { path: '/spaces', label: 'Spaces' }, + ] + + return ( +
+
+
+

navigate('/')}> + Project Control +

+ +
+
+ {user?.name} + {user?.is_system_admin && ( + Admin + )} + +
+
+
{children}
+
+ ) +} + +const styles: { [key: string]: React.CSSProperties } = { + container: { + minHeight: '100vh', + backgroundColor: '#f5f5f5', + }, + header: { + display: 'flex', + justifyContent: 'space-between', + alignItems: 'center', + padding: '12px 24px', + backgroundColor: 'white', + boxShadow: '0 1px 3px rgba(0, 0, 0, 0.1)', + }, + headerLeft: { + display: 'flex', + alignItems: 'center', + gap: '24px', + }, + logo: { + fontSize: '18px', + fontWeight: 600, + color: '#333', + margin: 0, + cursor: 'pointer', + }, + nav: { + display: 'flex', + gap: '4px', + }, + navItem: { + padding: '8px 16px', + backgroundColor: 'transparent', + border: 'none', + borderRadius: '4px', + cursor: 'pointer', + fontSize: '14px', + color: '#666', + }, + navItemActive: { + backgroundColor: '#e3f2fd', + color: '#0066cc', + fontWeight: 500, + }, + headerRight: { + display: 'flex', + alignItems: 'center', + gap: '12px', + }, + userName: { + color: '#666', + fontSize: '14px', + }, + badge: { + backgroundColor: '#0066cc', + color: 'white', + padding: '2px 8px', + borderRadius: '4px', + fontSize: '11px', + fontWeight: 500, + }, + logoutButton: { + padding: '8px 16px', + backgroundColor: '#f5f5f5', + border: '1px solid #ddd', + borderRadius: '4px', + cursor: 'pointer', + fontSize: '14px', + }, + main: { + minHeight: 'calc(100vh - 60px)', + }, +} diff --git a/frontend/src/pages/Projects.tsx b/frontend/src/pages/Projects.tsx new file mode 100644 index 0000000..5e30252 --- /dev/null +++ b/frontend/src/pages/Projects.tsx @@ -0,0 +1,351 @@ +import { useState, useEffect } from 'react' +import { useParams, useNavigate } from 'react-router-dom' +import api from '../services/api' + +interface Project { + id: string + space_id: string + title: string + description: string | null + owner_id: string + owner_name: string | null + security_level: string + status: string + task_count: number + created_at: string +} + +interface Space { + id: string + name: string +} + +export default function Projects() { + const { spaceId } = useParams() + const navigate = useNavigate() + const [space, setSpace] = useState(null) + const [projects, setProjects] = useState([]) + const [loading, setLoading] = useState(true) + const [showCreateModal, setShowCreateModal] = useState(false) + const [newProject, setNewProject] = useState({ + title: '', + description: '', + security_level: 'department', + }) + const [creating, setCreating] = useState(false) + + useEffect(() => { + loadData() + }, [spaceId]) + + const loadData = async () => { + try { + const [spaceRes, projectsRes] = await Promise.all([ + api.get(`/api/spaces/${spaceId}`), + api.get(`/api/spaces/${spaceId}/projects`), + ]) + setSpace(spaceRes.data) + setProjects(projectsRes.data) + } catch (err) { + console.error('Failed to load data:', err) + } finally { + setLoading(false) + } + } + + const handleCreateProject = async () => { + if (!newProject.title.trim()) return + + setCreating(true) + try { + await api.post(`/api/spaces/${spaceId}/projects`, newProject) + setShowCreateModal(false) + setNewProject({ title: '', description: '', security_level: 'department' }) + loadData() + } catch (err) { + console.error('Failed to create project:', err) + } finally { + setCreating(false) + } + } + + const getSecurityBadgeStyle = (level: string): React.CSSProperties => { + const colors: { [key: string]: { bg: string; text: string } } = { + public: { bg: '#e8f5e9', text: '#2e7d32' }, + department: { bg: '#e3f2fd', text: '#1565c0' }, + confidential: { bg: '#fce4ec', text: '#c62828' }, + } + const color = colors[level] || colors.department + return { + ...styles.badge, + backgroundColor: color.bg, + color: color.text, + } + } + + if (loading) { + return
Loading...
+ } + + return ( +
+
+ navigate('/spaces')} style={styles.breadcrumbLink}> + Spaces + + / + {space?.name} +
+ +
+

Projects

+ +
+ +
+ {projects.map((project) => ( +
navigate(`/projects/${project.id}`)} + > +
+

{project.title}

+ + {project.security_level} + +
+

+ {project.description || 'No description'} +

+
+ {project.task_count} tasks + Owner: {project.owner_name || 'Unknown'} +
+
+ ))} + + {projects.length === 0 && ( +
+

No projects yet. Create your first project!

+
+ )} +
+ + {showCreateModal && ( +
+
+

Create New Project

+ setNewProject({ ...newProject, title: e.target.value })} + style={styles.input} + /> +