bruno
69a0aceba6
- `app/templating.py` : `ENV = Environment(loader=FileSystemLoader("app/templates"), autoescape=select_autoescape(["html"]))`
- les 29 instantiations `Environment(loader=FileSystemLoader("app/templates"))` (9 routers) remplacées par `env = ENV` — plus aucune interpolation `{{ … }}` servie crue, les `|safe` redeviennent efficaces
- re-tri des `|safe` : `card_detail.html` corps d'issue et commentaires échappés (XSS stocké), placeholder de description sorti du ternaire, `sidebar_config` passé en dict + `|tojson` (échappement `</script>` en contexte script)
- `|safe` conservé sur `right_actions` (HTML fabriqué dans les templates, fiable)
- `ruff check app tests` OK · suite **1016/1016 verts**
53 lines
1.9 KiB
Python
53 lines
1.9 KiB
Python
"""FlowDeck — Notes markdown par projet."""
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
|
|
from fastapi import APIRouter, Request
|
|
from fastapi.responses import HTMLResponse
|
|
|
|
from app.db import get_conn
|
|
|
|
logger = logging.getLogger(__name__)
|
|
router = APIRouter(tags=["notes"], prefix="/notes")
|
|
|
|
|
|
@router.get("/{owner}/{repo}", response_class=HTMLResponse)
|
|
async def get_notes(request: Request, owner: str, repo: str):
|
|
with get_conn() as conn:
|
|
row = conn.execute(
|
|
"SELECT content FROM notes WHERE project_owner=? AND project_name=? AND title='Notes'",
|
|
(owner, repo),
|
|
).fetchone()
|
|
content = row["content"] if row else ""
|
|
|
|
from app.auth.session import SessionManager
|
|
from app.templating import ENV
|
|
env = ENV
|
|
user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
|
|
template = env.get_template("notes.html")
|
|
return template.render(request=request, owner=owner, repo=repo, content=content, user=user)
|
|
|
|
|
|
@router.post("/{owner}/{repo}", response_class=HTMLResponse)
|
|
async def save_notes(request: Request, owner: str, repo: str):
|
|
form = await request.form()
|
|
content = form.get("content", "")
|
|
|
|
with get_conn() as conn:
|
|
conn.execute(
|
|
"""INSERT INTO notes (project_owner, project_name, title, content, updated_at)
|
|
VALUES (?, ?, 'Notes', ?, CURRENT_TIMESTAMP)
|
|
ON CONFLICT(project_owner, project_name, title)
|
|
DO UPDATE SET content=excluded.content, updated_at=CURRENT_TIMESTAMP""",
|
|
(owner, repo, content),
|
|
)
|
|
conn.commit()
|
|
|
|
from app.auth.session import SessionManager
|
|
from app.templating import ENV
|
|
env = ENV
|
|
user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
|
|
template = env.get_template("notes.html")
|
|
return template.render(request=request, owner=owner, repo=repo, content=content, user=user)
|