Backend security & correctness: - Add rate_limit.py: sliding-window rate limiter (asyncio) applied to login, register, forgot/reset password endpoints (10/60s or 5/300s per IP) - app.py: add security headers in after_request (X-Frame-Options, CSP, X-Content-Type-Options, Referrer-Policy) using setdefault to preserve SSE headers - auth.py: refactor duplicate login_required/admin_required into shared _check_auth() - config.py: add TRUST_PROXY_HEADERS for proxy-aware client IP resolution - routes/auth.py: rate limiting, _client_ip() helper, cleaned-up reset_password route - routes/chat.py, notes.py, tasks.py: int() DoS fix on last_event_id; limit capped at 500; date.fromisoformat() wrapped in try/except → 400 on invalid dates - services/auth.py: fix Setting.user_id update bug (filter on NULL not user.id); reset_password_with_token returns int|None (user_id) instead of bool - services/backup.py: add _security_notice to full backup JSON export - services/assist.py: system prompt explicitly preserves markdown list structure and nested indented sub-items Infrastructure: - docker-compose.yml: add healthcheck on app service (/api/health, 10s interval) - .dockerignore: prevent secrets/node_modules/__pycache__/.env.* leaking into build Frontend bug fixes: - TaskCard.vue, TaskViewerView.vue: fix isOverdue() timezone bug (ISO string compare) - useAssist.ts: accept() now resets state to idle when document changed since proposal - stores/chat.ts: fix memory leak in _pollUntilLoaded() (try/catch around fetchStatus) - TiptapEditor.vue: selection offset uses closest-match strategy (not first-match) - utils/markdown.ts: explicit DOMPurify config with FORCE_BODY; remove as const (DOMPurify expects mutable string[]) New features: - Auto-save (5-minute interval) in NoteEditorView and TaskEditorView — only when editing an existing dirty record; silent on error, shows "Auto-saved" toast - sectionParser.ts: top-level bullet/numbered list items are now individual sections in the AI Assist panel (previously treated as one undifferentiated block) - editor-shared.css: extracted ~500 lines of CSS duplicated between both editors; includes .inline-assist-btn at global scope (required for teleported elements) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
536 lines
17 KiB
Vue
536 lines
17 KiB
Vue
<script setup lang="ts">
|
||
import { ref, onMounted, onUnmounted, computed, nextTick } from "vue";
|
||
import { useRoute, useRouter, onBeforeRouteLeave } from "vue-router";
|
||
import { useTasksStore } from "@/stores/tasks";
|
||
import { useNotesStore } from "@/stores/notes";
|
||
import { useToastStore } from "@/stores/toast";
|
||
import { renderMarkdown } from "@/utils/markdown";
|
||
import { useAssist } from "@/composables/useAssist";
|
||
import { apiPost } from "@/api/client";
|
||
import type { TaskStatus, TaskPriority } from "@/types/task";
|
||
import type { Editor } from "@tiptap/vue-3";
|
||
import MarkdownToolbar from "@/components/MarkdownToolbar.vue";
|
||
import TiptapEditor from "@/components/TiptapEditor.vue";
|
||
|
||
const route = useRoute();
|
||
const router = useRouter();
|
||
const store = useTasksStore();
|
||
const notesStore = useNotesStore();
|
||
const toast = useToastStore();
|
||
|
||
const title = ref("");
|
||
const body = ref("");
|
||
const status = ref<TaskStatus>("todo");
|
||
const priority = ref<TaskPriority>("none");
|
||
const dueDate = ref("");
|
||
const dirty = ref(false);
|
||
const saving = ref(false);
|
||
const showPreview = ref(false);
|
||
const editorRef = ref<InstanceType<typeof TiptapEditor> | null>(null);
|
||
const tiptapEditor = computed<Editor | null>(() => {
|
||
return (editorRef.value?.editor as Editor | undefined) ?? null;
|
||
});
|
||
|
||
const taskId = computed(() =>
|
||
route.params.id ? Number(route.params.id) : null
|
||
);
|
||
const isEditing = computed(() => taskId.value !== null);
|
||
|
||
const renderedPreview = computed(() => renderMarkdown(body.value));
|
||
|
||
// AI Assist
|
||
const assist = useAssist(body);
|
||
|
||
const renderedStreaming = computed(() => renderMarkdown(assist.streamingText.value));
|
||
const renderedProposal = computed(() => renderMarkdown(assist.proposedText.value));
|
||
|
||
// Assist panel toggle (persisted)
|
||
const ASSIST_KEY = 'fa-assist-open';
|
||
const assistOpen = ref(localStorage.getItem(ASSIST_KEY) !== 'false');
|
||
function toggleAssist() {
|
||
assistOpen.value = !assistOpen.value;
|
||
localStorage.setItem(ASSIST_KEY, String(assistOpen.value));
|
||
}
|
||
|
||
// Floating inline assist button
|
||
const floatingAssist = ref({ show: false, top: 0, left: 0 });
|
||
const pendingSelection = ref<{ start: number; end: number } | null>(null);
|
||
const instructionRef = ref<HTMLTextAreaElement | null>(null);
|
||
|
||
function onSelectionChange(payload: { text: string; start: number; end: number }) {
|
||
if (payload.text.trim().length > 0) {
|
||
const sel = window.getSelection();
|
||
if (sel && sel.rangeCount > 0) {
|
||
const rect = sel.getRangeAt(0).getBoundingClientRect();
|
||
floatingAssist.value = { show: true, top: rect.top - 44, left: rect.left + rect.width / 2 };
|
||
pendingSelection.value = { start: payload.start, end: payload.end };
|
||
}
|
||
} else {
|
||
floatingAssist.value.show = false;
|
||
pendingSelection.value = null;
|
||
}
|
||
}
|
||
|
||
function handleInlineAssist() {
|
||
if (!pendingSelection.value) return;
|
||
assist.selectTextRange(pendingSelection.value.start, pendingSelection.value.end);
|
||
assistOpen.value = true;
|
||
localStorage.setItem(ASSIST_KEY, 'true');
|
||
floatingAssist.value.show = false;
|
||
nextTick(() => instructionRef.value?.focus());
|
||
}
|
||
|
||
// Diff view toggle
|
||
const showFullProposed = ref(false);
|
||
|
||
function handleAssistAccept() {
|
||
const newBody = assist.accept();
|
||
if (newBody !== body.value) {
|
||
body.value = newBody;
|
||
markDirty();
|
||
toast.show("Section updated");
|
||
}
|
||
showFullProposed.value = false;
|
||
}
|
||
|
||
function truncateTarget(text: string, max = 60): string {
|
||
const first = text.split("\n")[0];
|
||
return first.length > max ? first.slice(0, max) + "..." : first;
|
||
}
|
||
|
||
// Tag suggestions
|
||
const suggestedTags = ref<string[]>([]);
|
||
const appliedTags = ref<Set<string>>(new Set());
|
||
const suggestingTags = ref(false);
|
||
|
||
async function fetchTagSuggestions() {
|
||
if (suggestingTags.value) return;
|
||
suggestingTags.value = true;
|
||
suggestedTags.value = [];
|
||
appliedTags.value = new Set();
|
||
try {
|
||
const res = await apiPost<{ suggested_tags: string[] }>("/api/notes/suggest-tags", {
|
||
title: title.value,
|
||
body: body.value,
|
||
});
|
||
suggestedTags.value = res.suggested_tags;
|
||
} catch {
|
||
toast.show("Failed to get tag suggestions", "error");
|
||
} finally {
|
||
suggestingTags.value = false;
|
||
}
|
||
}
|
||
|
||
function applyTagSuggestion(tag: string) {
|
||
if (appliedTags.value.has(tag)) return;
|
||
body.value = body.value.trimEnd() + `\n#${tag}`;
|
||
appliedTags.value.add(tag);
|
||
markDirty();
|
||
}
|
||
|
||
function dismissTagSuggestions() {
|
||
suggestedTags.value = [];
|
||
appliedTags.value = new Set();
|
||
}
|
||
|
||
let savedTitle = "";
|
||
let savedBody = "";
|
||
let savedStatus: TaskStatus = "todo";
|
||
let savedPriority: TaskPriority = "none";
|
||
let savedDueDate = "";
|
||
|
||
function markDirty() {
|
||
dirty.value =
|
||
title.value !== savedTitle ||
|
||
body.value !== savedBody ||
|
||
status.value !== savedStatus ||
|
||
priority.value !== savedPriority ||
|
||
dueDate.value !== savedDueDate;
|
||
}
|
||
|
||
function onBodyUpdate(newVal: string) {
|
||
body.value = newVal;
|
||
markDirty();
|
||
}
|
||
|
||
onMounted(async () => {
|
||
if (taskId.value) {
|
||
await store.fetchTask(taskId.value);
|
||
if (store.currentTask) {
|
||
title.value = store.currentTask.title;
|
||
body.value = store.currentTask.body;
|
||
status.value = store.currentTask.status as TaskStatus;
|
||
priority.value = store.currentTask.priority as TaskPriority;
|
||
dueDate.value = store.currentTask.due_date || "";
|
||
savedTitle = title.value;
|
||
savedBody = body.value;
|
||
savedStatus = status.value;
|
||
savedPriority = priority.value;
|
||
savedDueDate = dueDate.value;
|
||
}
|
||
}
|
||
});
|
||
|
||
async function save() {
|
||
if (saving.value) return;
|
||
saving.value = true;
|
||
try {
|
||
const data = {
|
||
title: title.value,
|
||
body: body.value,
|
||
status: status.value,
|
||
priority: priority.value,
|
||
due_date: dueDate.value || null,
|
||
};
|
||
if (isEditing.value) {
|
||
await store.updateTask(taskId.value!, data);
|
||
savedTitle = title.value;
|
||
savedBody = body.value;
|
||
savedStatus = status.value;
|
||
savedPriority = priority.value;
|
||
savedDueDate = dueDate.value;
|
||
dirty.value = false;
|
||
toast.show("Task saved");
|
||
} else {
|
||
const task = await store.createTask(data);
|
||
dirty.value = false;
|
||
toast.show("Task created");
|
||
router.push(`/tasks/${task.id}`);
|
||
}
|
||
} catch {
|
||
toast.show("Failed to save task", "error");
|
||
} finally {
|
||
saving.value = false;
|
||
}
|
||
}
|
||
|
||
const showDeleteConfirm = ref(false);
|
||
|
||
function remove() {
|
||
if (taskId.value) {
|
||
showDeleteConfirm.value = true;
|
||
}
|
||
}
|
||
|
||
async function confirmDelete() {
|
||
showDeleteConfirm.value = false;
|
||
if (!taskId.value) return;
|
||
try {
|
||
await store.deleteTask(taskId.value);
|
||
dirty.value = false;
|
||
toast.show("Task deleted");
|
||
router.push("/tasks");
|
||
} catch {
|
||
toast.show("Failed to delete task", "error");
|
||
}
|
||
}
|
||
|
||
// Auto-save every 5 minutes when editing an existing task
|
||
let autoSaveTimer: ReturnType<typeof setInterval> | null = null;
|
||
|
||
async function autoSave() {
|
||
if (!isEditing.value || !dirty.value || saving.value) return;
|
||
saving.value = true;
|
||
try {
|
||
await store.updateTask(taskId.value!, {
|
||
title: title.value,
|
||
body: body.value,
|
||
status: status.value,
|
||
priority: priority.value,
|
||
due_date: dueDate.value || null,
|
||
});
|
||
savedTitle = title.value;
|
||
savedBody = body.value;
|
||
savedStatus = status.value;
|
||
savedPriority = priority.value;
|
||
savedDueDate = dueDate.value;
|
||
dirty.value = false;
|
||
toast.show("Auto-saved");
|
||
} catch {
|
||
// Silent — user can still save manually
|
||
} finally {
|
||
saving.value = false;
|
||
}
|
||
}
|
||
|
||
onMounted(() => { autoSaveTimer = setInterval(autoSave, 5 * 60 * 1000); });
|
||
onUnmounted(() => { if (autoSaveTimer !== null) clearInterval(autoSaveTimer); });
|
||
|
||
function onKeydown(e: KeyboardEvent) {
|
||
if ((e.ctrlKey || e.metaKey) && e.key === "s") {
|
||
e.preventDefault();
|
||
save();
|
||
}
|
||
}
|
||
|
||
onMounted(() => document.addEventListener("keydown", onKeydown));
|
||
onUnmounted(() => document.removeEventListener("keydown", onKeydown));
|
||
|
||
onBeforeRouteLeave(() => {
|
||
if (dirty.value) {
|
||
return confirm("You have unsaved changes. Leave anyway?");
|
||
}
|
||
});
|
||
|
||
function onBeforeUnload(e: BeforeUnloadEvent) {
|
||
if (dirty.value) {
|
||
e.preventDefault();
|
||
}
|
||
}
|
||
onMounted(() => window.addEventListener("beforeunload", onBeforeUnload));
|
||
onUnmounted(() => window.removeEventListener("beforeunload", onBeforeUnload));
|
||
</script>
|
||
|
||
<template>
|
||
<main class="editor-page">
|
||
<div class="editor-header">
|
||
<div class="toolbar">
|
||
<router-link to="/tasks" class="btn-back">Back</router-link>
|
||
<button class="btn-save" @click="save" :disabled="saving">
|
||
{{ saving ? "Saving..." : "Save" }}
|
||
</button>
|
||
<button v-if="isEditing" class="btn-delete" @click="remove">
|
||
Delete
|
||
</button>
|
||
<button class="btn-assist-toggle" :class="{ active: assistOpen }" @click="toggleAssist">
|
||
✨ Assist
|
||
</button>
|
||
</div>
|
||
<input
|
||
v-model="title"
|
||
type="text"
|
||
placeholder="Task title"
|
||
class="title-input"
|
||
@input="markDirty"
|
||
/>
|
||
|
||
<div class="field-row">
|
||
<div class="field">
|
||
<label>Status</label>
|
||
<select v-model="status" @change="markDirty" class="field-select">
|
||
<option value="todo">Todo</option>
|
||
<option value="in_progress">In Progress</option>
|
||
<option value="done">Done</option>
|
||
</select>
|
||
</div>
|
||
<div class="field">
|
||
<label>Priority</label>
|
||
<select v-model="priority" @change="markDirty" class="field-select">
|
||
<option value="none">None</option>
|
||
<option value="low">Low</option>
|
||
<option value="medium">Medium</option>
|
||
<option value="high">High</option>
|
||
</select>
|
||
</div>
|
||
<div class="field">
|
||
<label>Due Date</label>
|
||
<input
|
||
v-model="dueDate"
|
||
type="date"
|
||
class="field-input"
|
||
@input="markDirty"
|
||
/>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="tag-suggest-row">
|
||
<button class="btn-suggest-tags" @click="fetchTagSuggestions" :disabled="suggestingTags">
|
||
{{ suggestingTags ? "Suggesting..." : "Suggest tags" }}
|
||
</button>
|
||
<template v-if="suggestedTags.length > 0">
|
||
<button
|
||
v-for="tag in suggestedTags"
|
||
:key="tag"
|
||
:class="['tag-pill', { applied: appliedTags.has(tag) }]"
|
||
:disabled="appliedTags.has(tag)"
|
||
@click="applyTagSuggestion(tag)"
|
||
>
|
||
#{{ tag }}
|
||
<span v-if="appliedTags.has(tag)" class="tag-check">✓</span>
|
||
</button>
|
||
<button class="btn-dismiss-tags" @click="dismissTagSuggestions">×</button>
|
||
</template>
|
||
</div>
|
||
|
||
<div class="editor-tabs">
|
||
<button
|
||
:class="['tab', { active: !showPreview }]"
|
||
@click="showPreview = false"
|
||
>
|
||
Write
|
||
</button>
|
||
<button
|
||
:class="['tab', { active: showPreview }]"
|
||
@click="showPreview = true"
|
||
>
|
||
Preview
|
||
</button>
|
||
</div>
|
||
|
||
<MarkdownToolbar v-show="!showPreview" :editor="tiptapEditor" />
|
||
</div>
|
||
|
||
<div class="editor-body">
|
||
<div class="editor-main">
|
||
<div v-show="!showPreview">
|
||
<TiptapEditor
|
||
ref="editorRef"
|
||
:modelValue="body"
|
||
placeholder="Describe this task... Use #tags inline"
|
||
:fetchTags="(q: string) => notesStore.fetchAllTags(q)"
|
||
@update:modelValue="onBodyUpdate"
|
||
@selectionChange="onSelectionChange"
|
||
/>
|
||
</div>
|
||
|
||
<div
|
||
v-show="showPreview"
|
||
class="preview-pane prose"
|
||
v-html="renderedPreview"
|
||
></div>
|
||
</div>
|
||
|
||
<aside v-if="assistOpen" class="assist-panel">
|
||
<!-- Panel header -->
|
||
<div class="assist-panel-header">
|
||
<span class="assist-panel-title">✨ AI Assist</span>
|
||
<button
|
||
class="btn-proofread"
|
||
@click="assist.proofread()"
|
||
:disabled="assist.state.value === 'streaming'"
|
||
>Proofread</button>
|
||
<button class="btn-close-assist" @click="toggleAssist">×</button>
|
||
</div>
|
||
|
||
<!-- Panel body -->
|
||
<div class="assist-panel-body">
|
||
|
||
<!-- IDLE -->
|
||
<div v-if="assist.state.value === 'idle'" class="assist-idle">
|
||
<div class="assist-sections-label">Sections</div>
|
||
<div class="assist-sections">
|
||
<div
|
||
v-for="(section, i) in assist.sections.value"
|
||
:key="i"
|
||
:class="['assist-section-item', { selected: assist.selectedSection.value === section }]"
|
||
@click="assist.selectSection(section)"
|
||
>
|
||
{{ section.heading || '(preamble)' }}
|
||
</div>
|
||
<div v-if="!assist.sections.value.length" class="assist-empty">
|
||
Write some content to get started.
|
||
</div>
|
||
</div>
|
||
<template v-if="assist.target.value">
|
||
<div class="assist-target-preview">
|
||
Editing: <em>{{ truncateTarget(assist.target.value.text) }}</em>
|
||
</div>
|
||
<textarea
|
||
ref="instructionRef"
|
||
v-model="assist.instruction.value"
|
||
placeholder="What should I do with this section?"
|
||
class="assist-instruction"
|
||
rows="3"
|
||
></textarea>
|
||
<div class="assist-input-actions">
|
||
<button
|
||
class="btn-generate"
|
||
@click="assist.submit()"
|
||
:disabled="!assist.canSubmit.value"
|
||
>Generate</button>
|
||
<button class="btn-clear" @click="assist.clearSelection()">Clear</button>
|
||
</div>
|
||
</template>
|
||
<div v-else class="assist-hint">
|
||
Select a section above or highlight text in the editor.
|
||
</div>
|
||
</div>
|
||
|
||
<!-- ERROR -->
|
||
<div v-if="assist.error.value" class="assist-error">{{ assist.error.value }}</div>
|
||
|
||
<!-- STREAMING -->
|
||
<div v-if="assist.state.value === 'streaming'" class="assist-streaming">
|
||
<div class="assist-streaming-label">
|
||
{{ assist.isProofreading.value
|
||
? 'Proofreading document...'
|
||
: `Revising: "${truncateTarget(assist.target.value?.text ?? '')}"` }}
|
||
</div>
|
||
<div class="assist-preview-box prose" v-html="renderedStreaming"></div>
|
||
<span class="typing-indicator">●●●</span>
|
||
</div>
|
||
|
||
<!-- REVIEW -->
|
||
<div v-if="assist.state.value === 'review'" class="assist-review">
|
||
<div class="assist-review-header">
|
||
<span>{{ assist.isProofreading.value ? 'Document proofread' : 'Proposed changes' }}</span>
|
||
<button class="btn-toggle-view" @click="showFullProposed = !showFullProposed">
|
||
{{ showFullProposed ? 'Show diff' : 'Show full text' }}
|
||
</button>
|
||
</div>
|
||
<div v-if="!showFullProposed" class="diff-view">
|
||
<div
|
||
v-for="(line, i) in assist.diff.value"
|
||
:key="i"
|
||
:class="['diff-line', `diff-${line.type}`]"
|
||
>
|
||
<span class="diff-marker">{{ line.type === 'delete' ? '−' : line.type === 'insert' ? '+' : ' ' }}</span>
|
||
<span class="diff-text">{{ line.text }}</span>
|
||
</div>
|
||
<div v-if="!assist.diff.value.length" class="diff-empty">No changes.</div>
|
||
</div>
|
||
<div v-else class="assist-preview-box prose" v-html="renderedProposal"></div>
|
||
<div class="assist-actions">
|
||
<button class="btn-accept" @click="handleAssistAccept">✓ Accept</button>
|
||
<button class="btn-reject" @click="() => { assist.reject(); showFullProposed = false; }">✗ Reject</button>
|
||
</div>
|
||
</div>
|
||
|
||
</div>
|
||
</aside>
|
||
</div>
|
||
|
||
<!-- Floating inline assist button (teleported to body) -->
|
||
<teleport to="body">
|
||
<button
|
||
v-if="floatingAssist.show"
|
||
class="inline-assist-btn"
|
||
:style="{ top: floatingAssist.top + 'px', left: floatingAssist.left + 'px' }"
|
||
@mousedown.prevent="handleInlineAssist"
|
||
>
|
||
✨ Assist
|
||
</button>
|
||
</teleport>
|
||
|
||
<!-- Delete confirmation -->
|
||
<teleport to="body">
|
||
<div v-if="showDeleteConfirm" class="modal-overlay" @click="showDeleteConfirm = false">
|
||
<div class="modal-card" @click.stop>
|
||
<h3 class="modal-title">Delete Task</h3>
|
||
<p class="modal-message">Are you sure you want to delete this task? This cannot be undone.</p>
|
||
<div class="modal-actions">
|
||
<button class="modal-btn" @click="showDeleteConfirm = false">Cancel</button>
|
||
<button class="modal-btn modal-btn-danger" @click="confirmDelete">Delete</button>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</teleport>
|
||
</main>
|
||
</template>
|
||
|
||
<style src="@/assets/editor-shared.css" />
|
||
<style scoped>
|
||
/* Task-specific metadata fields */
|
||
.field-row { display: flex; gap: 1rem; flex-wrap: wrap; }
|
||
.field { display: flex; flex-direction: column; gap: 0.25rem; min-width: 0; flex: 1; }
|
||
.field label { font-size: 0.85rem; color: var(--color-text-secondary); font-weight: 500; }
|
||
.field-select,
|
||
.field-input {
|
||
padding: 0.4rem 0.5rem;
|
||
border: 1px solid var(--color-input-border);
|
||
border-radius: var(--radius-sm);
|
||
background: var(--color-bg-card);
|
||
color: var(--color-text);
|
||
font-size: 0.9rem;
|
||
}
|
||
</style> |