Files
PROJECT-CONTORL/backend/app/api/reports/router.py
beabigegg 3bdc6ff1c9 feat: implement 8 OpenSpec proposals for security, reliability, and UX improvements
## Security Enhancements (P0)
- Add input validation with max_length and numeric range constraints
- Implement WebSocket token authentication via first message
- Add path traversal prevention in file storage service

## Permission Enhancements (P0)
- Add project member management for cross-department access
- Implement is_department_manager flag for workload visibility

## Cycle Detection (P0)
- Add DFS-based cycle detection for task dependencies
- Add formula field circular reference detection
- Display user-friendly cycle path visualization

## Concurrency & Reliability (P1)
- Implement optimistic locking with version field (409 Conflict on mismatch)
- Add trigger retry mechanism with exponential backoff (1s, 2s, 4s)
- Implement cascade restore for soft-deleted tasks

## Rate Limiting (P1)
- Add tiered rate limits: standard (60/min), sensitive (20/min), heavy (5/min)
- Apply rate limits to tasks, reports, attachments, and comments

## Frontend Improvements (P1)
- Add responsive sidebar with hamburger menu for mobile
- Improve touch-friendly UI with proper tap target sizes
- Complete i18n translations for all components

## Backend Reliability (P2)
- Configure database connection pool (size=10, overflow=20)
- Add Redis fallback mechanism with message queue
- Add blocker check before task deletion

## API Enhancements (P3)
- Add standardized response wrapper utility
- Add /health/ready and /health/live endpoints
- Implement project templates with status/field copying

## Tests Added
- test_input_validation.py - Schema and path traversal tests
- test_concurrency_reliability.py - Optimistic locking and retry tests
- test_backend_reliability.py - Connection pool and Redis tests
- test_api_enhancements.py - Health check and template tests

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-10 22:13:43 +08:00

157 lines
5.0 KiB
Python

from fastapi import APIRouter, Depends, HTTPException, status, Query, Request
from sqlalchemy.orm import Session
from typing import Optional
from app.core.database import get_db
from app.core.rate_limiter import limiter
from app.core.config import settings
from app.models import User, ReportHistory, ScheduledReport
from app.schemas.report import (
WeeklyReportContent, ReportHistoryListResponse, ReportHistoryItem,
GenerateReportResponse, ReportSummary
)
from app.middleware.auth import get_current_user
from app.services.report_service import ReportService
router = APIRouter(tags=["reports"])
@router.get("/api/reports/weekly/preview", response_model=WeeklyReportContent)
async def preview_weekly_report(
db: Session = Depends(get_db),
current_user: User = Depends(get_current_user),
):
"""
Preview the weekly report for the current user.
Shows what would be included in the next weekly report.
"""
content = ReportService.get_weekly_stats(db, current_user.id)
return WeeklyReportContent(
week_start=content["week_start"],
week_end=content["week_end"],
generated_at=content["generated_at"],
projects=content["projects"],
summary=ReportSummary(**content["summary"]),
)
@router.post("/api/reports/weekly/generate", response_model=GenerateReportResponse)
@limiter.limit(settings.RATE_LIMIT_HEAVY)
async def generate_weekly_report(
request: Request,
db: Session = Depends(get_db),
current_user: User = Depends(get_current_user),
):
"""
Manually trigger weekly report generation for the current user.
Rate limited: 5 requests per minute (heavy tier).
"""
# Generate report
report_history = ReportService.generate_weekly_report(db, current_user.id)
if not report_history:
raise HTTPException(
status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
detail="Failed to generate report",
)
# Send notification
ReportService.send_report_notification(db, current_user.id, report_history.content)
db.commit()
summary = report_history.content.get("summary", {})
return GenerateReportResponse(
message="Weekly report generated successfully",
report_id=report_history.id,
summary=ReportSummary(
completed_count=summary.get("completed_count", 0),
in_progress_count=summary.get("in_progress_count", 0),
overdue_count=summary.get("overdue_count", 0),
total_tasks=summary.get("total_tasks", 0),
),
)
@router.get("/api/reports/history", response_model=ReportHistoryListResponse)
async def list_report_history(
limit: int = Query(10, ge=1, le=100, description="Number of reports to return"),
offset: int = Query(0, ge=0, description="Number of reports to skip"),
db: Session = Depends(get_db),
current_user: User = Depends(get_current_user),
):
"""
List report history for the current user.
"""
# Get scheduled report for this user
scheduled_report = db.query(ScheduledReport).filter(
ScheduledReport.recipient_id == current_user.id,
).first()
if not scheduled_report:
return ReportHistoryListResponse(reports=[], total=0)
# Get history
total = db.query(ReportHistory).filter(
ReportHistory.report_id == scheduled_report.id,
).count()
history = db.query(ReportHistory).filter(
ReportHistory.report_id == scheduled_report.id,
).order_by(ReportHistory.generated_at.desc()).offset(offset).limit(limit).all()
return ReportHistoryListResponse(
reports=[
ReportHistoryItem(
id=h.id,
report_id=h.report_id,
generated_at=h.generated_at,
content=h.content,
status=h.status,
error_message=h.error_message,
) for h in history
],
total=total,
)
@router.get("/api/reports/history/{report_id}")
@limiter.limit(settings.RATE_LIMIT_SENSITIVE)
async def get_report_detail(
request: Request,
report_id: str,
db: Session = Depends(get_db),
current_user: User = Depends(get_current_user),
):
"""
Get detailed content of a specific report.
Rate limited: 20 requests per minute (sensitive tier).
"""
report = db.query(ReportHistory).filter(ReportHistory.id == report_id).first()
if not report:
raise HTTPException(
status_code=status.HTTP_404_NOT_FOUND,
detail="Report not found",
)
# Check ownership
scheduled_report = report.report
if scheduled_report.recipient_id != current_user.id and not current_user.is_system_admin:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Access denied",
)
return ReportHistoryItem(
id=report.id,
report_id=report.report_id,
generated_at=report.generated_at,
content=report.content,
status=report.status,
error_message=report.error_message,
)