Some doc stuff

Also delete compiled entry JS and add a Makefile

README.md

@@ -4,11 +4,6 @@
 
 ## Setup
 
-`jon` is a Python WSGI application written using Flask.
-This means you'll have to install a bunch of Python packages to get up and running.
-
-### Dependencies
-
 ```
 pip install -r requirements.txt
 ```
@@ -16,14 +11,6 @@ pip install -r requirements.txt
 You should probably use a virtualenv for that.
 I develop `jon` using Python 3.10 but it should work with older versions as well.
 
-#### Arch Linux
-
-If you're on Arch, these packages are required for running the server:
-
-```
-python python-flask python-flask-login python-psycopg2
-```
-
 ### Building Frontend JS
 
 Most of jon works without JS but there are some features that require it.
@@ -59,13 +46,9 @@ ssh -nNTvL 5432:fsmi-db.fsmi.org:5432 fsmi-login.fsmi.uni-karlsruhe.de
   - [ ] etc.
   - [ ] Make it print nicely
 - [ ] Make it possible to edit entries
-- [ ] Fix unsafe client-side sessions, either:
-  - [ ] Use `flask-session` for file-backed sessions
-  - [ ] Use `flask-login` with a single user stored in memory
 - [ ] Improve project structure
 - [ ] Use `flask.flash` for error messages
 - [x] Implement item and snack entry as Elm application
   - [x] Figure out/Add documentation about building `entry.js`
   - [ ] Clean up the code a little and add some comments
   - [ ] Needs good documentation for maintainability
-- [ ] Use cool new function for deactivating items

frontend/Calculator.elm

@@ -9,15 +9,7 @@ import Select
 
 type Tax = Net | Gross
 
--- Duplicated from Entry.elm but too lazy to sandwich this out
+ctShow ct = case ct of
-type alias TaxGroup =
-  { id : Int
-  , description : String
-  , percentage : Float
-  }
-
-showTax : Tax -> String
-showTax tax = case tax of
   Gross -> "Brutto"
   Net -> "Netto"
 
@@ -27,13 +19,11 @@ type alias Model =
   , bundleSize : NumberInput.Model Int
   }
 
-init : Float -> Model
 init bundlePrice = Model
-  (Select.init showTax showTax Net [Net, Gross])
+  (Select.init ctShow ctShow Net [Net, Gross])
   (NumberInput.fromFloat bundlePrice)
   (NumberInput.fromInt 1)
 
-getResult : Model -> TaxGroup -> Maybe Float
 getResult model taxGroup =
   case (NumberInput.get model.bundlePrice, NumberInput.get model.bundleSize) of
     (Just bundlePrice, Just bundleSize) ->
@@ -51,7 +41,6 @@ type Msg
   | SetBundlePrice String
   | SetBundleSize String
 
-update : Msg -> Model -> Model
 update msg model = case msg of
   SetTax key ->
     { model | tax = Select.update key model.tax }
@@ -60,7 +49,6 @@ update msg model = case msg of
   SetBundleSize str ->
     { model | bundleSize = NumberInput.update str model.bundleSize }
 
-view : Model -> TaxGroup -> Html Msg
 view model taxGroup =
   let
     mainPart =
@@ -124,5 +112,4 @@ view model taxGroup =
         ]
       ]
 
-roundTo : Int -> Float -> Float
+roundTo places x = toFloat (round <| x * 10 ^ places) / 10 ^ places
-roundTo places x = toFloat (round <| x * 10 ^ toFloat places) / 10 ^ toFloat places

frontend/Entry.elm

@@ -14,50 +14,6 @@ import Calculator
 import NumberInput
 import Select
 
-{-
-Elm forces us to use the Elm architecture:
-
-              ┌──────┐
- ┌─────Model──► view ├──Html───────┐
- │            └──────┘             │
- │                                 │
-┌┴─────────────────────────────────▼┐
-│            Elm runtime            │
-└▲─────────────────────────────────┬┘
- │                                 │
- │            ┌──────┐             │
- └─Model+Cmd──┤update◄──Msg+Model──┘
-              └──────┘
-
-This architecture is similar to what React does but its implementation
-in Elm is a bit special since it's purely functional and side effects
-are isolated into the runtime system.
-
-An Elm component is usually centered around two types, Model and Msg.
-Model contains all data the application is concerned with, including the state
-of UI elements. Msg encodes all updates to Model that the application supports.
-
-In addition to Msg and Model, we have to provide two functions, view and update.
-
-view : Model -> Html Msg
-update : Msg -> Model -> (Model, Cmd Msg)
-
-view maps a Model to a DOM tree. Events in this DOM tree create Msg values.
-update maps a Msg and a Model to a new Model. In addition, update can create
-a command. Commands are used to make the runtime do side effects, which in
-turn create new Msg values.
-
-For example, we have a SetSearchTerm message which simply updates the searchTerm
-property in the model. This message is triggered every time the search box input
-is changed. Submitting the search box form triggers a SubmitSearch event.
-This event leaves the model unchanged but issues a command that sends the search
-term to a JSON endpoint. When the request successfully resolves, the runtime
-triggers a ReceiveSearchResults messages which updates the list of search results
-in the model.
-
-See Calculator.elm for a simpler example of this architecture.
--}
-
 main = Browser.element
   { init = \globals ->
     ( Context globals <| ItemSearch { searchTerm = "", searchResults = [] }

jon/__init__.py

@@ -22,7 +22,12 @@ def create_app():
     app.config.from_file("config.json", load=json.load, silent=True)
 
     db.init_app(app)
-    auth.init_app(app)
+
+    # This function denies every request until `auth.ACCESS_TOKEN`
+    # is passed using `?token=` to authenticate the session.
+    @app.before_request
+    def before_req_fun():
+        return auth.before_request()
 
     @app.context_processor
     def utility_processor():

jon/auth.py

@@ -1,10 +1,7 @@
 import secrets
 import string
 
-from flask import Blueprint, request, redirect, render_template
+from flask import Blueprint, request, redirect, render_template, session
-from flask_login import current_user, login_user, logout_user, LoginManager
-from typing import Any, Dict, List, Optional
-
 
 bp = Blueprint("auth", __name__, url_prefix="/auth")
 
@@ -18,67 +15,27 @@ ALLOWED_PATHS = [
 ]
 
 
-# A poor man's replacement for memory-backed session solution.
+def before_request():
-# We keep exactly one User (and the corresponding UserData) in
+    """
-# memory and use that to store session data.
+    If the correct token query parameter is passed along with any request,
-class UserData:
+    we mark this session authenticated by setting `session["authenticated"]`.
-    location: Optional[Dict[str, Any]]
+    Unless the session is authenticated, all requests result in a 403 FORBIDDEN.
-    orders: List[Dict[str, Any]]
+    """
-
-    def __init__(self):
-        self.location = None
-        self.orders = []
-
-
-class User:
-    is_authenticated: bool
-    is_active: bool
-    is_anonymous: bool
-
-    data: UserData
-
-    def __init__(self):
-        self.is_authenticated = True
-        self.is_active = True
-        self.is_anonymous = False
-
-        self.data = UserData()
-
-    def get_id(self) -> str:
-        return ""
-
-
-def init_app(app):
-    login_manager = LoginManager(app)
-    the_one_and_only_user = User()
-
-    @login_manager.user_loader
-    def load_user(user_id: str) -> User:
-        assert user_id == ""
-        return the_one_and_only_user
-
-    # This function denies every request until `auth.ACCESS_TOKEN`
-    # is passed using `?token=` to authenticate the user.
-    # We use this instead of @login_required because otherwise we'd have
-    # to add that annotation to all routes.
-    # See also: https://flask-login.readthedocs.io/en/latest/#flask_login.login_required
-    @app.before_request
-    def before_request():
     if "token" in request.args:
         if request.args["token"] == ACCESS_TOKEN:
-                login_user(the_one_and_only_user)
+            session["authenticated"] = ()
         # Reload the page without query parameters
         return redirect(request.path)
 
-        # Never deny any paths in `ALLOWED_PATHS`
+    # Don't deny any paths in `ALLOWED_PATHS`
     if request.path in ALLOWED_PATHS:
         return
 
-        if not current_user.is_authenticated:
+    if not "authenticated" in session:
         return render_template("auth/denied.html"), 403
 
 
 @bp.get("/logout")
 def logout():
-    logout_user()
+    session.pop("authenticated", None)
     return redirect("/")

jon/db/add_views.sql

@@ -58,56 +58,3 @@ FROM garfield.inventory_items
   ) m USING (item_id)
 ORDER BY inventory_items.name;
 
--- How many *other* active inventory lines exist with the same barcode in the same location that are newer?
-CREATE TEMPORARY VIEW more_recent_inventory_lines_with_same_barcode AS
-SELECT
-  a.item_id,
-  -- It's important not to count(*) here because item_id is NULL
-  -- when no other inventory lines exist.
-  count(b.item_id) AS other_lines_count
-FROM garfield.inventory_items AS a
-LEFT JOIN garfield.inventory_items AS b
-       ON a.item_barcode = b.item_barcode
-      AND a.item_id != b.item_id
-      AND a.location = b.location
-      AND b.available
-      AND b.bought > a.bought
-GROUP BY a.item_id;
-
--- We need to create this table so that we can put an index on it
--- Otherwise the join in the consumption graph query becomes much slower
--- Perhaps it would be nicer to use a materialized view instead
-DROP TABLE IF EXISTS last_n_days;
-CREATE TEMPORARY TABLE last_n_days AS (
-  SELECT
-    generate_series(now() - interval '14 days', now(), interval '1 day')::date AS sale_date
-);
-CREATE UNIQUE INDEX last_n_days_sale_date ON last_n_days (sale_date);
-
--- Get an array of how often items were sold over the last 14 days
-CREATE TEMPORARY VIEW inventory_last_n_days_sales AS
-WITH
-sales_by_date AS (
-  SELECT
-    inventory_line AS item_id,
-    date_trunc('day', snack_sales_log_timestamp AT TIME ZONE 'UTC+1') AS sale_date,
-    count(*)::int AS sales
-  FROM garfield.snack_sales_log
-  GROUP BY item_id, sale_date
-),
-beeg AS (
-  SELECT item_id, sale_date, count(snack_sales_log_timestamp)::int AS sales
-  FROM garfield.inventory_items
-  CROSS JOIN last_n_days
-  LEFT JOIN garfield.snack_sales_log
-         ON inventory_line = item_id
--- snack_sales_log has an index on snack_sales_log_timestamp to speed up this query
--- If that index doesn't exist the query takes much longer.
-        AND sale_date = date_trunc('day', snack_sales_log_timestamp AT TIME ZONE 'UTC+1')
-  WHERE available
-  GROUP BY item_id, sale_date
-  ORDER BY item_id, sale_date
-)
-SELECT item_id, array_agg(sales) AS last_n_days_sales
-FROM beeg
-GROUP BY item_id

jon/db/get_inventory_overview.sql

@@ -1,8 +1,6 @@
 SELECT
   *
 FROM all_inventory_item_overview
-LEFT JOIN more_recent_inventory_lines_with_same_barcode USING (item_id)
-LEFT JOIN inventory_last_n_days_sales USING (item_id)
 WHERE (%(location_id)s IS NULL OR location = %(location_id)s)
   AND available
 ORDER BY

jon/entry.py

@@ -1,5 +1,5 @@
-from flask import Blueprint, flash, redirect, render_template, request
+from flask import Blueprint, flash, redirect, render_template, request, session
-from flask_login import current_user
+
 
 from . import db
 
@@ -9,18 +9,22 @@ bp = Blueprint("entry", __name__, url_prefix="/entry")
 
 @bp.route("/", methods=["GET", "POST"])
 def index():
+    cart = session.get("cart", default=[])
     return render_template(
-        "entry/index.html"
+        "entry/index.html",
+        cart=cart
     )
 
 
 @bp.post("/add-new-items")
 def add_new_entries():
+    print(session)
+
     i_know_what_im_doing = "i-know-what-im-doing" in request.form
     if not i_know_what_im_doing:
         return "Du weißt nicht was du tust", 400
 
-    orders = current_user.data.orders
+    orders = session.get("cart", default=[])
     if not orders:
         return "Keine Aufträge", 404
     
@@ -32,7 +36,7 @@ def add_new_entries():
     db.get_db().commit()
 
     # Reset the cart
-    current_user.data.orders = []
+    session["cart"] = []
 
     return redirect(request.referrer)
 
@@ -44,7 +48,9 @@ def delete_order():
     except:
         return "Incomplete or mistyped form", 400
 
-    del current_user.data.orders[order_index]
+    cart = session.get("cart", default=[])
+    del cart[order_index]
+    session["cart"] = cart
 
     return redirect(request.referrer)
 
@@ -70,7 +76,9 @@ def new_order():
         except:
             return f"Incomplete or mistyped form", 400
         
-        current_user.data.orders.append({
+        cart = session.get("cart", default=[])
+        print(cart)
+        cart.append({
             "barcode": barcode,
             "name": name,
             "sales_units": sales_units,
@@ -83,6 +91,7 @@ def new_order():
             "net_unit_price": net_unit_price,
             "gross_unit_price": gross_unit_price
         })
+        session["cart"] = cart
         return redirect("/entry")
 
     with db.run_query("entry/get_groups.sql") as cursor:
@@ -113,9 +122,10 @@ def api_search_items():
     except:
         return {"error": "Missing query parameter `search-term`"}, 400
 
-    location = current_user.data.location
+    location = session.get("location", None)
+
     with db.run_query("search_items.sql", {
-        "location_id": location["location_id"] if location else None,
+        "location_id": None if location is None else location["location_id"],
         "search_term": search_term
     }) as cursor:
         items = cursor.fetchall()

jon/inventory.py

@@ -1,5 +1,4 @@
-from flask import Blueprint, redirect, render_template, request
+from flask import Blueprint, redirect, render_template, request, session
-from flask_login import current_user
 
 from . import db
 
@@ -9,7 +8,7 @@ bp = Blueprint("inventory", __name__, url_prefix="/inventory")
 
 @bp.get("/")
 def index():
-    location = current_user.data.location
+    location = session.get("location", None)
     items = db.run_query("get_inventory_overview.sql", {
         "location_id": None if location is None else location["location_id"]
     }).fetchall()
@@ -21,7 +20,7 @@ def index():
 
 @bp.get("/report")
 def read_report():
-    location = current_user.data.location
+    location = session.get("location", None)
     items = db.run_query("get_inventory_report.sql", {
         "location_id": None if location is None else location["location_id"]
     }).fetchall()

jon/location.py

@@ -1,5 +1,4 @@
-from flask import Blueprint, render_template, request
+from flask import Blueprint, render_template, request, session
-from flask_login import current_user
 
 from . import db
 
@@ -12,12 +11,13 @@ def index():
     if request.method == "POST":
         location_id = request.form.get("location_id", "")
         if location_id == "":
-            current_user.data.location = None
+            session.pop("location", None)
         else:
             location = db.run_query("get_location_by_id.sql", {
-                "location_id": location_id
+                "location_id": location_id}
-            }).fetchone()
+            ).fetchone()
-            current_user.data.location = location
+            session["location"] = location
+        
 
     locations = db.run_query("get_locations.sql").fetchall()
 

jon/static/jon.css

@@ -71,10 +71,3 @@ th {
   display: block;
   width: 8em;
 }
-details {
-  font-size: 0.8em;
-}
-.consumption-graph {
-  display: block;
-  height: 1em;
-}

jon/templates/base.html

@@ -15,10 +15,10 @@
           <li{{ " class=current-page" if request.path.startswith("/entry") else "" }}><a href="/entry">Eintragen</a></li>
           <li{{ " class=current-page" if request.path.startswith("/location") else "" }}>
             <a href="/location">
-            {% if not current_user.data.location %}
+            {% if "location" not in session %}
               Raum wählen
             {% else %}
-              Raum: {{ current_user.data.location.location_name }}
+              Raum: {{ session.location.location_name }}
             {% endif %}
             </a>
           </li>
@@ -30,16 +30,6 @@
       <details>
         <summary><code>config</code></summary>
         <pre>{% for key, value in config.items() %}{{ key }} = {{ value }}
-{% endfor %}</pre>
-      </details>
-      <details>
-        <summary><code>session</code></summary>
-        <pre>{% for key, value in session.items() %}{{ key }} = {{ value }}
-{% endfor %}</pre>
-      </details>
-      <details>
-        <summary><code>current_user.data</code></summary>
-        <pre>{% for key, value in current_user.data.__dict__.items() %}{{ key }} = {{ value }}
 {% endfor %}</pre>
       </details>
       {% endif %}

jon/templates/entry/index.html

@@ -15,7 +15,7 @@
     <th>VK-Preis (Brutto)</th>
     <th>Aktionen</th>
   </tr>
-  {% for cart_item in current_user.data.orders %}
+  {% for cart_item in cart %}
   <tr>
     <td><code>{{ cart_item.barcode }}</code></td>
     <td>{{ cart_item.name }}</td>

jon/templates/inventory/index.html

@@ -1,34 +1,9 @@
-{% macro consumption_graph_svg(values) -%}
-{% set stroke_width = 8 %}
-{% set width = 300 %}
-{% set height = 100 %}
-{% set padding = 4 %}
-{% set dx = (width - 2 * padding) / ((values | length) + 1) %}
-{% set dy = (height - 2 * padding) / ((values + [1]) | max) %}
-<svg viewBox="0 0 {{ width }} {{ height }}" role="img" class="consumption-graph">
-  <polyline
-    points="
-    {% for value in values %}
-      {{ padding + loop.index * dx }}, {{ height - padding - value * dy }}
-    {% endfor %}
-    "
-    stroke="green"
-    stroke-width="{{ stroke_width }}"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-    fill="none"
-  >
-</svg>
-{% endmacro -%}
-
 {% extends "base.html" %}
 
 {% block content %}
 <table>
   <tr>
-    <th>Stat</th>
     <th>ID</th>
-    <th>Graph</th>
     <th>Barcode</th>
     <th>Name</th>
     <th>Preis (Netto)</th>
@@ -42,12 +17,7 @@
   </tr>
 {% for item in items %}
   <tr>
-    <td>
-      {% if item.units_left == 0 %}<span title="Leerer aktiver Inventareintrag">🅾️</span>{% endif %}
-      {% if item.other_lines_count != 0 %}<span title="{% if item.other_lines_count == 1 %}Neuerer Eintrag mit demselben Barcode ist aktiv{% else %}{{ item.other_lines_count }} Einträge mit demselben Barcode sind aktiv{% endif %}">🔄</span>{% endif %}
-    </td>
     <td><a href="/inventory/item/{{ item.item_id }}">{{ item.item_id }}</a></td>
-    <td>{{ consumption_graph_svg(item.last_n_days_sales) }}</td>
     <td><code>{{ item.item_barcode }}</code></td>
     <td>{{ item.name }}</td>
     <td class="--align-right">{{ format_currency(item.unit_price) }}</td>

jon/templates/location/index.html

@@ -3,9 +3,9 @@
 {% block content %}
 <form method="POST">
   <select name="location_id">
-    <option value="" {{ "selected" if not current_user.data.location else ""}}>-</option>
+    <option value="" {{ "selected" if "location" not in session else ""}}>-</option>
   {% for location in locations %}
-    <option value="{{ location.location_id }}" {{ "selected" if current_user.data.location.location_id == location.location_id else "" }}>{{ location.location_name }}</option>
+    <option value="{{ location.location_id }}" {{ "selected" if "location" in session and session.location.location_id == location.location_id else "" }}>{{ location.location_name }}</option>
   {% endfor %}
   </select>
 

requirements.txt

@@ -1,7 +1,6 @@
 blinker==1.6.2
 click==8.1.3
 Flask==2.3.2
-Flask-Login==0.6.2
 itsdangerous==2.1.2
 Jinja2==3.1.2
 MarkupSafe==2.1.2