NuklearRabbit
4bf9afbeff
Ran a dedicated post-M7 release-readiness audit. Found and fixed the one real gap: mypy was a declared dev dependency but had never been run in any milestone's validation loop. Fixed all 43 pre-existing type errors it surfaced, including two genuine defensive- programming gaps (unguarded Optional vehicle/customer lookups that could have crashed with unhandled 500s instead of clean 404/401 responses) rather than suppressing them. make lint now runs ruff + mypy; mypy reports zero errors across 44 source files. Re-verified end to end against a genuinely wiped-volumes clean checkout: automatic migrations, deterministic seed, 66/66 backend tests, and the full user-journey matrix (login, dashboard, vehicle/booking detail, return workflow, invalid-mileage rejection, data-quality review, duplicate-customer merge, audit trail, Knowledge Assistant, n8n, MCP Hub) via curl and Playwright. Live-verified both external-dependency degraded modes, not just unit tests: stopped n8n mid-flow and confirmed a return still commits with the outbox event staying pending and retrying with backoff, then self-healing to succeeded with zero manual intervention once n8n came back; verified RAGcore's unavailable-degradation path against an unreachable host. Added frontend/e2e/interactive-elements.spec.ts (11 tests covering every nav item, filter, tab, and role boundary) alongside the existing demo script test — 12/12 e2e tests passing. Verified no secrets are committed (.env never tracked, clean git history scan) and .env.example covers every operator-configurable setting. Confirmed no placeholders, TODOs, fake responses, hardcoded metrics, or dead routes anywhere in the codebase. Updated README.md with an honest integration-status section and PROJECT_STATE.md with the full audit findings. Added artifacts/final-acceptance/summary.md as the authoritative final evidence document (commands, results, URLs, demo access, integration status per external dependency, known limitations, deployment instructions, five-minute demo flow).
77 lines
2.3 KiB
Python
77 lines
2.3 KiB
Python
from __future__ import annotations
|
|
|
|
import time
|
|
|
|
from fastapi import APIRouter, Depends, Response
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.api.deps import get_db, require_operations_manager
|
|
from app.core.config import get_settings
|
|
from app.core.security import SessionPayload, create_session_token
|
|
from app.models.user import User
|
|
from app.schemas import CurrentUser, DemoLoginRequest
|
|
from app.seed_loader import reset_and_seed
|
|
from app.services.audit import record_audit_event
|
|
|
|
router = APIRouter(prefix="/api/v1/demo", tags=["demo"])
|
|
settings = get_settings()
|
|
|
|
|
|
@router.post("/login", response_model=CurrentUser)
|
|
def demo_login(
|
|
body: DemoLoginRequest, response: Response, db: Session = Depends(get_db)
|
|
) -> CurrentUser:
|
|
public_ref = "USR-OPS" if body.role == "operations_manager" else "USR-EMP"
|
|
user = db.scalar(select(User).where(User.public_ref == public_ref))
|
|
if user is None:
|
|
raise LookupError("Demo users are missing; run the seed loader first.")
|
|
|
|
token = create_session_token(
|
|
SessionPayload(
|
|
user_id=str(user.id),
|
|
public_ref=user.public_ref,
|
|
role=user.role,
|
|
display_name=user.display_name,
|
|
issued_at=int(time.time()),
|
|
)
|
|
)
|
|
response.set_cookie(
|
|
settings.session_cookie_name,
|
|
token,
|
|
httponly=True,
|
|
samesite="lax",
|
|
max_age=settings.session_ttl_seconds,
|
|
)
|
|
record_audit_event(
|
|
db,
|
|
actor_type="user",
|
|
actor_id=user.id,
|
|
actor_label=user.display_name,
|
|
action="demo_login",
|
|
entity_type="user",
|
|
entity_id=user.id,
|
|
)
|
|
db.commit()
|
|
return CurrentUser(public_ref=user.public_ref, display_name=user.display_name, role=body.role)
|
|
|
|
|
|
@router.post("/reset")
|
|
def demo_reset(
|
|
response: Response,
|
|
db: Session = Depends(get_db),
|
|
user: CurrentUser = Depends(require_operations_manager),
|
|
) -> dict:
|
|
result = reset_and_seed(db)
|
|
record_audit_event(
|
|
db,
|
|
actor_type="user",
|
|
actor_label=user.display_name,
|
|
action="demo_reset",
|
|
entity_type="system",
|
|
metadata={"counts": result.counts},
|
|
)
|
|
db.commit()
|
|
response.delete_cookie(settings.session_cookie_name)
|
|
return {"status": "reset", "counts": result.counts}
|