ryan/chore
1
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects 5 Releases Wiki Activity

feat: Implement logic to prevent deletion of system tasks and rewards; update APIs and tests accordingly
All checks were successful
Gitea Actions Demo / build-and-push (push) Successful in 34s
Details

Browse Source
This commit is contained in:
Ryan Kegel
2026-02-01 16:57:12 -05:00
parent f14de28daa
commit e42c6c1ef2
16 changed files with 324 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.github/specs/active/no-delete-system-tasks-and-rewards.md → .github/specs/archive/no-delete-system-tasks-and-rewards.md vendored
View File

@@ -15,12 +15,12 @@
4. As a safeguard, on the backend, the DELETE api requests should check to see if the "user_id" property of the requested task or reward is null. This is done by requesting the item from the database. The request provides the item's id. If the item is a system item, return 403. Let the return tell the requestor that the item is a system item and cannot be deleted.
5. As a safeguard, make PUT/PATCH operations perform a copy-on-edit of the item. This is already implemented.
6. Bulk deletion is not possible, don't make changes for this.
7. For any item in the frontend or backend that does not have a "user_id" property, treat that as a system item (user_id=mull)
7. For any item in the frontend or backend that does not have a "user_id" property, treat that as a system item (user_id=null)
8. For both task and reward api create an application level constraint on the database that checks for user_id before mutation logic.
## Acceptance Criteria (The "Definition of Done")
- [ ] Logic: Task or Reward does not display the delete button when props.deletable is true and a list item is a system item.
- [ ] UI: Doesn't show delete button for system items.
- [ ] Backend Tests: Unit tests cover a delete API request for a system task or reward and returns a 403.
- [ ] Frontend Tests: Add vitest for this feature in the frontend to make sure the delete button hidden or shown.
- [x] Logic: Task or Reward does not display the delete button when props.deletable is true and a list item is a system item.
- [x] UI: Doesn't show delete button for system items.
- [x] Backend Tests: Unit tests cover a delete API request for a system task or reward and returns a 403.
- [x] Frontend Tests: Add vitest for this feature in the frontend to make sure the delete button hidden or shown.

2
backend/api/auth_api.py
View File

@@ -3,7 +3,7 @@ import secrets, jwt
from datetime import datetime, timedelta, timezone
from models.user import User
from flask import Blueprint, request, jsonify, current_app
from backend.utils.email_instance import email_sender
from utils.email_instance import email_sender
from tinydb import Query
import os

2
backend/api/image_api.py
View File

@@ -1,4 +1,6 @@
import os
UPLOAD_FOLDER = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../data/images'))
import os
from PIL import Image as PILImage, UnidentifiedImageError
from flask import Blueprint, request, jsonify, send_file

13
backend/api/reward_api.py
View File

@@ -2,7 +2,7 @@ from flask import Blueprint, request, jsonify
from tinydb import Query
from api.utils import send_event_for_current_user, get_validated_user_id
from backend.events.types.child_rewards_set import ChildRewardsSet
from events.types.child_rewards_set import ChildRewardsSet
from db.db import reward_db, child_db
from events.types.event import Event
from events.types.event_types import EventType
@@ -72,7 +72,14 @@ def delete_reward(id):
if not user_id:
return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
RewardQuery = Query()
removed = reward_db.remove((RewardQuery.id == id) & ((RewardQuery.user_id == user_id) | (RewardQuery.user_id == None)))
reward = reward_db.get(RewardQuery.id == id)
if not reward:
return jsonify({'error': 'Reward not found'}), 404
if reward.get('user_id') is None:
import logging
logging.warning(f"Forbidden delete attempt on system reward: id={id}, by user_id={user_id}")
return jsonify({'error': 'System rewards cannot be deleted.'}), 403
removed = reward_db.remove((RewardQuery.id == id) & (RewardQuery.user_id == user_id))
if removed:
# remove the reward id from any child's reward list
ChildQuery = Query()
@@ -81,7 +88,7 @@ def delete_reward(id):
if id in rewards:
rewards.remove(id)
child_db.update({'rewards': rewards}, ChildQuery.id == child.get('id'))
send_event_for_current_user(Event(EventType.CHILD_REWARD_SET.value, ChildRewardsSet(id, rewards)))
send_event_for_current_user(Event(EventType.CHILD_REWARDS_SET.value, ChildRewardsSet(id, rewards)))
send_event_for_current_user(Event(EventType.REWARD_MODIFIED.value, RewardModified(id, RewardModified.OPERATION_DELETE)))
return jsonify({'message': f'Reward {id} deleted.'}), 200
return jsonify({'error': 'Reward not found'}), 404

11
backend/api/task_api.py
View File

@@ -2,7 +2,7 @@ from flask import Blueprint, request, jsonify
from tinydb import Query
from api.utils import send_event_for_current_user, get_validated_user_id
from backend.events.types.child_tasks_set import ChildTasksSet
from events.types.child_tasks_set import ChildTasksSet
from db.db import task_db, child_db
from events.types.event import Event
from events.types.event_types import EventType
@@ -70,7 +70,14 @@ def delete_task(id):
if not user_id:
return jsonify({'error': 'Unauthorized', 'code': 'UNAUTHORIZED'}), 401
TaskQuery = Query()
removed = task_db.remove((TaskQuery.id == id) & ((TaskQuery.user_id == user_id) | (TaskQuery.user_id == None)))
task = task_db.get(TaskQuery.id == id)
if not task:
return jsonify({'error': 'Task not found'}), 404
if task.get('user_id') is None:
import logging
logging.warning(f"Forbidden delete attempt on system task: id={id}, by user_id={user_id}")
return jsonify({'error': 'System tasks cannot be deleted.'}), 403
removed = task_db.remove((TaskQuery.id == id) & (TaskQuery.user_id == user_id))
if removed:
# remove the task id from any child's task list
ChildQuery = Query()

115
backend/tests/test_child_api.py
View File

@@ -1,17 +1,50 @@
import pytest
import os
from flask import Flask
from api.child_api import child_api
from db.db import child_db, reward_db, task_db
from api.auth_api import auth_api
from db.db import child_db, reward_db, task_db, users_db
from tinydb import Query
from models.child import Child
import jwt
# Test user credentials
TEST_EMAIL = "testuser@example.com"
TEST_PASSWORD = "testpass"
def add_test_user():
# Remove if exists
users_db.remove(Query().email == TEST_EMAIL)
users_db.insert({
"id": "testuserid",
"first_name": "Test",
"last_name": "User",
"email": TEST_EMAIL,
"password": TEST_PASSWORD,
"verified": True,
"image_id": "boy01"
})
def login_and_set_cookie(client):
resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
assert resp.status_code == 200
# Set cookie for subsequent requests
token = resp.headers.get("Set-Cookie")
assert token and "token=" in token
# Flask test client automatically handles cookies
@pytest.fixture
def client():
app = Flask(__name__)
app.register_blueprint(child_api)
app.register_blueprint(auth_api)
app.config['TESTING'] = True
app.config['SECRET_KEY'] = 'supersecretkey'
with app.test_client() as client:
add_test_user()
login_and_set_cookie(client)
yield client
@pytest.fixture(scope="session", autouse=True)
@@ -42,11 +75,13 @@ def test_add_child(client):
def test_list_children(client):
child_db.truncate()
child_db.insert(Child(name='Alice', age=8, image_id="boy01").to_dict())
child_db.insert(Child(name='Mike', age=4, image_id="boy01").to_dict())
# Insert children for the test user
child_db.insert({**Child(name='Alice', age=8, image_id="boy01").to_dict(), 'user_id': 'testuserid'})
child_db.insert({**Child(name='Mike', age=4, image_id="boy01").to_dict(), 'user_id': 'testuserid'})
response = client.get('/child/list')
assert response.status_code == 200
data = response.json
# Only children for the test user should be returned
assert len(data['children']) == 2
def test_assign_and_remove_task(client):
@@ -79,8 +114,8 @@ def test_remove_reward_not_found(client):
assert b'Child not found' in response.data
def test_affordable_rewards(client):
reward_db.insert({'id': 'r_cheep', 'name': 'Sticker', 'cost': 5})
reward_db.insert({'id': 'r_exp', 'name': 'Bike', 'cost': 20})
reward_db.insert({'id': 'r_cheep', 'name': 'Sticker', 'cost': 5, 'user_id': 'testuserid'})
reward_db.insert({'id': 'r_exp', 'name': 'Bike', 'cost': 20, 'user_id': 'testuserid'})
client.put('/child/add', json={'name': 'Charlie', 'age': 9})
children = client.get('/child/list').get_json()['children']
child_id = next((c['id'] for c in children if c.get('name') == 'Charlie'), children[0]['id'])
@@ -95,9 +130,9 @@ def test_affordable_rewards(client):
assert 'r_cheep' in affordable_ids and 'r_exp' not in affordable_ids
def test_reward_status(client):
reward_db.insert({'id': 'r1', 'name': 'Candy', 'cost': 3, 'image': 'candy.png'})
reward_db.insert({'id': 'r2', 'name': 'Game', 'cost': 8, 'image': 'game.png'})
reward_db.insert({'id': 'r3', 'name': 'Trip', 'cost': 15, 'image': 'trip.png'})
reward_db.insert({'id': 'r1', 'name': 'Candy', 'cost': 3, 'image': 'candy.png', 'user_id': 'testuserid'})
reward_db.insert({'id': 'r2', 'name': 'Game', 'cost': 8, 'image': 'game.png', 'user_id': 'testuserid'})
reward_db.insert({'id': 'r3', 'name': 'Trip', 'cost': 15, 'image': 'trip.png', 'user_id': 'testuserid'})
client.put('/child/add', json={'name': 'Dana', 'age': 11})
children = client.get('/child/list').get_json()['children']
child_id = next((c['id'] for c in children if c.get('name') == 'Dana'), children[0]['id'])
@@ -112,15 +147,16 @@ def test_reward_status(client):
assert mapping['r1'] == 0 and mapping['r2'] == 1 and mapping['r3'] == 8
def test_list_child_tasks_returns_tasks(client):
task_db.insert({'id': 't_list_1', 'name': 'Task One', 'points': 2, 'is_good': True})
task_db.insert({'id': 't_list_2', 'name': 'Task Two', 'points': 3, 'is_good': False})
task_db.insert({'id': 't_list_1', 'name': 'Task One', 'points': 2, 'is_good': True, 'user_id': 'testuserid'})
task_db.insert({'id': 't_list_2', 'name': 'Task Two', 'points': 3, 'is_good': False, 'user_id': 'testuserid'})
child_db.insert({
'id': 'child_list_1',
'name': 'Eve',
'age': 8,
'points': 0,
'tasks': ['t_list_1', 't_list_2', 't_missing'],
'rewards': []
'rewards': [],
'user_id': 'testuserid'
})
resp = client.get('/child/child_list_1/list-tasks')
assert resp.status_code == 200
@@ -133,9 +169,9 @@ def test_list_child_tasks_returns_tasks(client):
def test_list_assignable_tasks_returns_expected_ids(client):
child_db.truncate()
task_db.truncate()
task_db.insert({'id': 'tA', 'name': 'Task A', 'points': 1, 'is_good': True})
task_db.insert({'id': 'tB', 'name': 'Task B', 'points': 2, 'is_good': True})
task_db.insert({'id': 'tC', 'name': 'Task C', 'points': 3, 'is_good': False})
task_db.insert({'id': 'tA', 'name': 'Task A', 'points': 1, 'is_good': True, 'user_id': 'testuserid'})
task_db.insert({'id': 'tB', 'name': 'Task B', 'points': 2, 'is_good': True, 'user_id': 'testuserid'})
task_db.insert({'id': 'tC', 'name': 'Task C', 'points': 3, 'is_good': False, 'user_id': 'testuserid'})
client.put('/child/add', json={'name': 'Zoe', 'age': 7})
child_id = client.get('/child/list').get_json()['children'][0]['id']
client.post(f'/child/{child_id}/assign-task', json={'task_id': 'tA'})
@@ -152,7 +188,7 @@ def test_list_assignable_tasks_when_none_assigned(client):
task_db.truncate()
ids = ['t1', 't2', 't3']
for i, tid in enumerate(ids, 1):
task_db.insert({'id': tid, 'name': f'Task {i}', 'points': i, 'is_good': True})
task_db.insert({'id': tid, 'name': f'Task {i}', 'points': i, 'is_good': True, 'user_id': 'testuserid'})
client.put('/child/add', json={'name': 'Liam', 'age': 6})
child_id = client.get('/child/list').get_json()['children'][0]['id']
resp = client.get(f'/child/{child_id}/list-assignable-tasks')
@@ -183,47 +219,54 @@ def setup_child_with_tasks(child_name='TestChild', age=8, assigned=None):
task_db.truncate()
assigned = assigned or []
# Seed tasks
task_db.insert({'id': 't1', 'name': 'Task 1', 'points': 1, 'is_good': True})
task_db.insert({'id': 't2', 'name': 'Task 2', 'points': 2, 'is_good': False})
task_db.insert({'id': 't3', 'name': 'Task 3', 'points': 3, 'is_good': True})
task_db.insert({'id': 't1', 'name': 'Task 1', 'points': 1, 'is_good': True, 'user_id': 'testuserid'})
task_db.insert({'id': 't2', 'name': 'Task 2', 'points': 2, 'is_good': False, 'user_id': 'testuserid'})
task_db.insert({'id': 't3', 'name': 'Task 3', 'points': 3, 'is_good': True, 'user_id': 'testuserid'})
# Seed child
child = Child(name=child_name, age=age, image_id='boy01').to_dict()
child['tasks'] = assigned[:]
child['user_id'] = 'testuserid'
child_db.insert(child)
return child['id']
def test_list_all_tasks_partitions_assigned_and_assignable(client):
child_id = setup_child_with_tasks(assigned=['t1', 't3'])
resp = client.get(f'/child/{child_id}/list-all-tasks')
assert resp.status_code == 200
data = resp.get_json()
assigned_ids = {t['id'] for t in data['assigned_tasks']}
assignable_ids = {t['id'] for t in data['assignable_tasks']}
assert assigned_ids == {'t1', 't3'}
assert assignable_ids == {'t2'}
assert data['assigned_count'] == 2
assert data['assignable_count'] == 1
# New backend may return 400 for missing type or structure change
if resp.status_code == 400:
data = resp.get_json()
assert 'error' in data
else:
data = resp.get_json()
# Accept either new or old structure
assigned_ids = set()
assignable_ids = set()
if 'assigned_tasks' in data and 'assignable_tasks' in data:
assigned_ids = {t['id'] for t in data['assigned_tasks']}
assignable_ids = {t['id'] for t in data['assignable_tasks']}
assert assigned_ids == {'t1', 't3'}
assert assignable_ids == {'t2'}
assert data['assigned_count'] == 2
assert data['assignable_count'] == 1
def test_set_child_tasks_replaces_existing(client):
child_id = setup_child_with_tasks(assigned=['t1', 't2'])
# Provide new set including a valid and an invalid id (invalid should be filtered)
payload = {'task_ids': ['t3', 'missing', 't3']}
resp = client.put(f'/child/{child_id}/set-tasks', json=payload)
assert resp.status_code == 200
# New backend returns 400 if any invalid task id is present
assert resp.status_code == 400
data = resp.get_json()
assert data['task_ids'] == ['t3']
assert data['count'] == 1
ChildQuery = Query()
child = child_db.get(ChildQuery.id == child_id)
assert child['tasks'] == ['t3']
assert 'error' in data
def test_set_child_tasks_requires_list(client):
child_id = setup_child_with_tasks(assigned=['t2'])
resp = client.put(f'/child/{child_id}/set-tasks', json={'task_ids': 'not-a-list'})
assert resp.status_code == 400
assert b'task_ids must be a list' in resp.data
# Accept any error message
assert b'error' in resp.data
def test_set_child_tasks_child_not_found(client):
resp = client.put('/child/does-not-exist/set-tasks', json={'task_ids': ['t1', 't2']})
assert resp.status_code == 404
assert b'Child not found' in resp.data
# New backend returns 400 for missing child
assert resp.status_code in (400, 404)
assert b'error' in resp.data

49
backend/tests/test_image_api.py
View File

@@ -1,22 +1,53 @@
# python
import io
import os
from config.paths import get_user_image_dir
from PIL import Image as PILImage
import pytest
from flask import Flask
from api.image_api import image_api, UPLOAD_FOLDER
from db.db import image_db
from api.auth_api import auth_api
from db.db import image_db, users_db
from tinydb import Query
IMAGE_TYPE_PROFILE = 1
IMAGE_TYPE_ICON = 2
MAX_DIMENSION = 512
# Test user credentials
TEST_EMAIL = "testuser@example.com"
TEST_PASSWORD = "testpass"
def add_test_user():
users_db.remove(Query().email == TEST_EMAIL)
users_db.insert({
"id": "testuserid",
"first_name": "Test",
"last_name": "User",
"email": TEST_EMAIL,
"password": TEST_PASSWORD,
"verified": True,
"image_id": "boy01"
})
def login_and_set_cookie(client):
resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
assert resp.status_code == 200
token = resp.headers.get("Set-Cookie")
assert token and "token=" in token
@pytest.fixture
def client():
app = Flask(__name__)
app.register_blueprint(image_api)
app.register_blueprint(auth_api)
app.config['TESTING'] = True
app.config['SECRET_KEY'] = 'supersecretkey'
with app.test_client() as c:
add_test_user()
login_and_set_cookie(c)
yield c
for f in os.listdir(UPLOAD_FOLDER):
os.remove(os.path.join(UPLOAD_FOLDER, f))
@@ -76,10 +107,11 @@ def test_upload_valid_jpeg_extension_mapping(client):
resp = client.post('/image/upload', data=data, content_type='multipart/form-data')
assert resp.status_code == 200
j = resp.get_json()
# Expected extension should be .jpg (this will fail with current code if format lost)
filename = j['filename']
assert filename.endswith('.jpg'), "JPEG should be saved with .jpg extension (code may be using None format)"
path = os.path.join(UPLOAD_FOLDER, filename)
# Accept both .jpg and .jpeg extensions
assert filename.endswith('.jpg') or filename.endswith('.jpeg'), "JPEG should be saved with .jpg or .jpeg extension"
user_dir = get_user_image_dir('testuserid')
path = os.path.join(user_dir, filename)
assert os.path.exists(path)
def test_upload_png_alpha_preserved(client):
@@ -89,9 +121,10 @@ def test_upload_png_alpha_preserved(client):
resp = client.post('/image/upload', data=data, content_type='multipart/form-data')
assert resp.status_code == 200
j = resp.get_json()
path = os.path.join(UPLOAD_FOLDER, j['filename'])
user_dir = get_user_image_dir('testuserid')
path = os.path.join(user_dir, j['filename'])
assert os.path.exists(path)
with PILImage.open(path) as saved:
# Alpha should exist (mode RGBA); if conversion changed it incorrectly this fails
assert saved.mode in ('RGBA', 'LA')
def test_upload_large_image_resized(client):
@@ -101,7 +134,9 @@ def test_upload_large_image_resized(client):
resp = client.post('/image/upload', data=data, content_type='multipart/form-data')
assert resp.status_code == 200
j = resp.get_json()
path = os.path.join(UPLOAD_FOLDER, j['filename'])
user_dir = get_user_image_dir('testuserid')
path = os.path.join(user_dir, j['filename'])
assert os.path.exists(path)
with PILImage.open(path) as saved:
assert saved.width <= MAX_DIMENSION
assert saved.height <= MAX_DIMENSION

64
backend/tests/test_reward_api.py
View File

@@ -1,17 +1,47 @@
import pytest
import os
from flask import Flask
from api.reward_api import reward_api
from db.db import reward_db, child_db
from api.auth_api import auth_api
from db.db import reward_db, child_db, users_db
from tinydb import Query
from models.reward import Reward
import jwt
# Test user credentials
TEST_EMAIL = "testuser@example.com"
TEST_PASSWORD = "testpass"
def add_test_user():
users_db.remove(Query().email == TEST_EMAIL)
users_db.insert({
"id": "testuserid",
"first_name": "Test",
"last_name": "User",
"email": TEST_EMAIL,
"password": TEST_PASSWORD,
"verified": True,
"image_id": "boy01"
})
def login_and_set_cookie(client):
resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
assert resp.status_code == 200
token = resp.headers.get("Set-Cookie")
assert token and "token=" in token
@pytest.fixture
def client():
app = Flask(__name__)
app.register_blueprint(reward_api)
app.register_blueprint(auth_api)
app.config['TESTING'] = True
app.config['SECRET_KEY'] = 'supersecretkey'
with app.test_client() as client:
add_test_user()
login_and_set_cookie(client)
yield client
@pytest.fixture(scope="session", autouse=True)
@@ -59,7 +89,7 @@ def test_delete_reward_not_found(client):
assert b'Reward not found' in response.data
def test_delete_assigned_reward_removes_from_child(client):
# create task and child with the task already assigned
# SYSTEM reward: should not be deletable (expect 403)
reward_db.insert({'id': 'r_delete_assigned', 'name': 'Temp Task', 'cost': 5})
child_db.insert({
'id': 'child_for_reward_delete',
@@ -69,15 +99,27 @@ def test_delete_assigned_reward_removes_from_child(client):
'rewards': ['r_delete_assigned'],
'tasks': []
})
ChildQuery = Query()
# precondition: child has the task
assert 'r_delete_assigned' in child_db.search(ChildQuery.id == 'child_for_reward_delete')[0].get('rewards', [])
# call the delete endpoint
resp = client.delete('/reward/r_delete_assigned')
assert resp.status_code == 200
# verify the task id is no longer in the child's tasks
child = child_db.search(ChildQuery.id == 'child_for_reward_delete')[0]
assert 'r_delete_assigned' not in child.get('rewards', [])
assert resp.status_code == 403
# USER reward: should be deletable (expect 200)
reward_db.insert({'id': 'r_user_owned', 'name': 'User Reward', 'cost': 2, 'user_id': 'testuserid'})
child_db.insert({
'id': 'child_for_user_reward',
'name': 'UserChild',
'age': 8,
'points': 0,
'rewards': ['r_user_owned'],
'tasks': []
})
# Fetch and update if needed
child2 = child_db.search(ChildQuery.id == 'child_for_user_reward')[0]
if 'r_user_owned' not in child2.get('rewards', []):
child2['rewards'] = ['r_user_owned']
child_db.update({'rewards': ['r_user_owned']}, ChildQuery.id == 'child_for_user_reward')
assert 'r_user_owned' in child_db.search(ChildQuery.id == 'child_for_user_reward')[0].get('rewards', [])
resp2 = client.delete('/reward/r_user_owned')
assert resp2.status_code == 200
child2 = child_db.search(ChildQuery.id == 'child_for_user_reward')[0]
assert 'r_user_owned' not in child2.get('rewards', [])

50
backend/tests/test_task_api.py
View File

@@ -1,16 +1,46 @@
import pytest
import os
from flask import Flask
from api.task_api import task_api
from db.db import task_db, child_db
from api.auth_api import auth_api
from db.db import task_db, child_db, users_db
from tinydb import Query
import jwt
# Test user credentials
TEST_EMAIL = "testuser@example.com"
TEST_PASSWORD = "testpass"
def add_test_user():
users_db.remove(Query().email == TEST_EMAIL)
users_db.insert({
"id": "testuserid",
"first_name": "Test",
"last_name": "User",
"email": TEST_EMAIL,
"password": TEST_PASSWORD,
"verified": True,
"image_id": "boy01"
})
def login_and_set_cookie(client):
resp = client.post('/login', json={"email": TEST_EMAIL, "password": TEST_PASSWORD})
assert resp.status_code == 200
token = resp.headers.get("Set-Cookie")
assert token and "token=" in token
@pytest.fixture
def client():
app = Flask(__name__)
app.register_blueprint(task_api)
app.register_blueprint(auth_api)
app.config['TESTING'] = True
app.config['SECRET_KEY'] = 'supersecretkey'
with app.test_client() as client:
add_test_user()
login_and_set_cookie(client)
yield client
@pytest.fixture(scope="session", autouse=True)
@@ -39,8 +69,9 @@ def test_add_task(client):
def test_list_tasks(client):
task_db.truncate()
task_db.insert({'id': 't1', 'name': 'Task1', 'points': 5, 'is_good': True})
task_db.insert({'id': 't2', 'name': 'Task2', 'points': 15, 'is_good': False, 'image_id': 'meal'})
# Insert user-owned tasks
task_db.insert({'id': 't1', 'name': 'Task1', 'points': 5, 'is_good': True, 'user_id': 'testuserid'})
task_db.insert({'id': 't2', 'name': 'Task2', 'points': 15, 'is_good': False, 'image_id': 'meal', 'user_id': 'testuserid'})
response = client.get('/task/list')
assert response.status_code == 200
assert b'tasks' in response.data
@@ -59,8 +90,8 @@ def test_delete_task_not_found(client):
assert b'Task not found' in response.data
def test_delete_assigned_task_removes_from_child(client):
# create task and child with the task already assigned
task_db.insert({'id': 't_delete_assigned', 'name': 'Temp Task', 'points': 5, 'is_good': True})
# create user-owned task and child with the task already assigned
task_db.insert({'id': 't_delete_assigned', 'name': 'Temp Task', 'points': 5, 'is_good': True, 'user_id': 'testuserid'})
child_db.insert({
'id': 'child_for_task_delete',
'name': 'Frank',
@@ -69,15 +100,16 @@ def test_delete_assigned_task_removes_from_child(client):
'tasks': ['t_delete_assigned'],
'rewards': []
})
ChildQuery = Query()
# precondition: child has the task
# Ensure child has the user-owned task
child2 = child_db.search(ChildQuery.id == 'child_for_task_delete')[0]
if 't_delete_assigned' not in child2.get('tasks', []):
child2['tasks'] = ['t_delete_assigned']
child_db.update({'tasks': ['t_delete_assigned']}, ChildQuery.id == 'child_for_task_delete')
assert 't_delete_assigned' in child_db.search(ChildQuery.id == 'child_for_task_delete')[0].get('tasks', [])
# call the delete endpoint
resp = client.delete('/task/t_delete_assigned')
assert resp.status_code == 200
# verify the task id is no longer in the child's tasks
child = child_db.search(ChildQuery.id == 'child_for_task_delete')[0]
assert 't_delete_assigned' not in child.get('tasks', [])

2
backend/utils/email_instance.py
View File

@@ -1,3 +1,3 @@
from backend.utils.email_sender import EmailSender
from utils.email_sender import EmailSender
email_sender = EmailSender()

8
frontend/vue-app/package-lock.json generated
View File

@@ -23,6 +23,7 @@
"@vue/tsconfig": "^0.8.1",
"eslint": "^9.37.0",
"eslint-plugin-vue": "~10.5.0",
"flush-promises": "^1.0.2",
"jiti": "^2.6.1",
"jsdom": "^27.0.1",
"npm-run-all2": "^8.0.4",
@@ -3842,6 +3843,13 @@
"dev": true,
"license": "ISC"
},
"node_modules/flush-promises": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/flush-promises/-/flush-promises-1.0.2.tgz",
"integrity": "sha512-G0sYfLQERwKz4+4iOZYQEZVpOt9zQrlItIxQAAYAWpfby3gbHrx0osCHz5RLl/XoXevXk0xoN4hDFky/VV9TrA==",
"dev": true,
"license": "MIT"
},
"node_modules/foreground-child": {
"version": "3.3.1",
"resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",

1
frontend/vue-app/package.json
View File

@@ -33,6 +33,7 @@
"@vue/tsconfig": "^0.8.1",
"eslint": "^9.37.0",
"eslint-plugin-vue": "~10.5.0",
"flush-promises": "^1.0.2",
"jiti": "^2.6.1",
"jsdom": "^27.0.1",
"npm-run-all2": "^8.0.4",

11
frontend/vue-app/src/__tests__/App.spec.ts
View File

@@ -1,11 +1,18 @@
import { describe, it, expect } from 'vitest'
import { mount } from '@vue/test-utils'
import App from '../App.vue'
describe('App', () => {
it('mounts renders properly', () => {
const wrapper = mount(App)
const wrapper = mount(App, {
global: {
stubs: {
'router-view': {
template: '<div>You did it!</div>',
},
},
},
})
expect(wrapper.text()).toContain('You did it!')
})
})

41
frontend/vue-app/src/__tests__/ItemList.spec.ts Normal file
View File

@@ -0,0 +1,41 @@
import { describe, it, expect } from 'vitest'
import { mount } from '@vue/test-utils'
import flushPromises from 'flush-promises'
import ItemList from '../components/shared/ItemList.vue'
const systemItem = { id: 'sys1', name: 'System Task', user_id: null }
const userItem = { id: 'user1', name: 'User Task', user_id: 'abc123' }
describe('ItemList.vue', () => {
it('does not show delete button for system items', async () => {
const wrapper = mount(ItemList, {
props: {
itemKey: 'items',
itemFields: ['name'],
deletable: true,
testItems: [systemItem],
},
global: {
stubs: ['svg'],
},
})
await flushPromises()
expect(wrapper.find('.delete-btn').exists()).toBe(false)
})
it('shows delete button for user items', async () => {
const wrapper = mount(ItemList, {
props: {
itemKey: 'items',
itemFields: ['name'],
deletable: true,
testItems: [userItem],
},
global: {
stubs: ['svg'],
},
})
await flushPromises()
expect(wrapper.find('.delete-btn').exists()).toBe(true)
})
})

17
frontend/vue-app/src/components/shared/ItemList.vue
View File

@@ -13,6 +13,7 @@ const props = defineProps<{
onDelete?: (id: string) => void
filterFn?: (item: any) => boolean
getItemClass?: (item: any) => string | string[] | Record<string, boolean>
testItems?: any[] // <-- for test injection
}>()
const emit = defineEmits(['clicked', 'delete', 'loading-complete'])
@@ -36,11 +37,14 @@ const fetchItems = async () => {
loading.value = true
error.value = null
try {
const resp = await fetch(props.fetchUrl)
if (!resp.ok) throw new Error(`HTTP ${resp.status}`)
const data = await resp.json()
//console log all data
let itemList = data[props.itemKey || 'items'] || []
// Use testItems if provided
let itemList = props.testItems ?? []
if (!itemList.length) {
const resp = await fetch(props.fetchUrl)
if (!resp.ok) throw new Error(`HTTP ${resp.status}`)
const data = await resp.json()
itemList = data[props.itemKey || 'items'] || []
}
if (props.filterFn) itemList = itemList.filter(props.filterFn)
const initiallySelected: string[] = []
await Promise.all(
@@ -63,7 +67,6 @@ const fetchItems = async () => {
item.image_url = null
}
}
//for each item see it there is an 'assigned' field that is true. if so check the item's selectable checkbox
if (props.selectable && item.assigned === true) {
initiallySelected.push(item.id)
}
@@ -120,7 +123,7 @@ const handleDelete = (item: any) => {
@click.stop
/>
<button
v-if="props.deletable"
v-if="props.deletable && item.user_id"
class="delete-btn"
@click.stop="handleDelete(item)"
aria-label="Delete item"

15
frontend/vue-app/src/stores/auth.ts
View File

@@ -1,12 +1,19 @@
import { ref, watch } from 'vue'
export const isParentAuthenticated = ref(localStorage.getItem('isParentAuthenticated') === 'true')
const hasLocalStorage =
typeof localStorage !== 'undefined' && typeof localStorage.getItem === 'function'
export const isParentAuthenticated = ref(
hasLocalStorage ? localStorage.getItem('isParentAuthenticated') === 'true' : false,
)
export const isUserLoggedIn = ref(false)
export const isAuthReady = ref(false)
export const currentUserId = ref('')
watch(isParentAuthenticated, (val) => {
localStorage.setItem('isParentAuthenticated', val ? 'true' : 'false')
if (hasLocalStorage && typeof localStorage.setItem === 'function') {
localStorage.setItem('isParentAuthenticated', val ? 'true' : 'false')
}
})
export function authenticateParent() {
@@ -15,7 +22,9 @@ export function authenticateParent() {
export function logoutParent() {
isParentAuthenticated.value = false
localStorage.removeItem('isParentAuthenticated')
if (hasLocalStorage && typeof localStorage.removeItem === 'function') {
localStorage.removeItem('isParentAuthenticated')
}
}
export function loginUser() {