Compare commits

...

6 Commits

Author SHA1 Message Date
08d94a9269 Link to Autorenumgebung shortened, version bump
All checks were successful
Build containers when image tags change / build-if-image-changed (., web, containers, main container, git.baumann.gr/adebaumann/vui) (push) Successful in 5s
Build containers when image tags change / build-if-image-changed (data-loader, loader, initContainers, init-container, git.baumann.gr/adebaumann/vui-data-loader) (push) Successful in 4s
SonarQube Scan / SonarQube Trigger (push) Successful in 55s
2025-12-04 13:37:30 +01:00
6f8f273344 XSS prevention added (with tests)
All checks were successful
Build containers when image tags change / build-if-image-changed (., web, containers, main container, git.baumann.gr/adebaumann/vui) (push) Successful in 15s
Build containers when image tags change / build-if-image-changed (data-loader, loader, initContainers, init-container, git.baumann.gr/adebaumann/vui-data-loader) (push) Successful in 4s
SonarQube Scan / SonarQube Trigger (push) Successful in 55s
2025-12-04 13:26:12 +01:00
f96226170b Add staff-only all comments page and bump versions
All checks were successful
Build containers when image tags change / build-if-image-changed (., web, containers, main container, git.baumann.gr/adebaumann/vui) (push) Successful in 15s
Build containers when image tags change / build-if-image-changed (data-loader, loader, initContainers, init-container, git.baumann.gr/adebaumann/vui-data-loader) (push) Successful in 4s
SonarQube Scan / SonarQube Trigger (push) Successful in 47s
- Add new "alle-kommentare" (all comments) view for staff users only
  - Allows staff to view and manage all user comments across the system
  - Grouped by document with user information displayed
  - Staff can delete any comment via the dedicated delete button
  - Restricts access via user_passes_test decorator

- Create all_comments.html template
  - Based on user_comments template with added username field
  - Shows comment author, creation time, and edit time
  - Provides delete functionality for comment management

- Update navigation menu
  - Add "Alle Kommentare" link in user dropdown menu
  - Link only visible to staff members

- Add URL route for alle-kommentare page
  - Path: /dokumente/alle-kommentare/
  - URL name: all_comments

- Bump application versions
  - Update footer version from 0.965 to 0.966
  - Update K8s deployment version from 0.917 to 0.918
  - ArgoCD deployment already at 0.966

All existing tests pass (148 tests total)
2025-12-04 13:17:35 +01:00
0783033c70 Titles on comment page; Deployment 965
All checks were successful
Build containers when image tags change / build-if-image-changed (., web, containers, main container, git.baumann.gr/adebaumann/vui) (push) Successful in 16s
Build containers when image tags change / build-if-image-changed (data-loader, loader, initContainers, init-container, git.baumann.gr/adebaumann/vui-data-loader) (push) Successful in 4s
SonarQube Scan / SonarQube Trigger (push) Successful in 47s
2025-12-04 08:41:53 +01:00
35fbfdccec Deployment 963
All checks were successful
Build containers when image tags change / build-if-image-changed (., web, containers, main container, git.baumann.gr/adebaumann/vui) (push) Successful in 41s
Build containers when image tags change / build-if-image-changed (data-loader, loader, initContainers, init-container, git.baumann.gr/adebaumann/vui-data-loader) (push) Successful in 4s
SonarQube Scan / SonarQube Trigger (push) Successful in 43s
2025-12-04 01:35:01 +01:00
1196d3cdd2 Merge pull request 'feature/comment-page' (#16) from feature/comment-page into development
All checks were successful
SonarQube Scan / SonarQube Trigger (push) Successful in 45s
Reviewed-on: #16
2025-12-04 00:29:41 +00:00
10 changed files with 341 additions and 23 deletions

View File

@@ -21,7 +21,7 @@ ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
USER appuser
EXPOSE 8000
RUN rm -rf /app/Dockerfile* \
RUN rm -rvf /app/Dockerfile* \
/app/README.md \
/app/argocd \
/app/k8s \
@@ -31,6 +31,6 @@ RUN rm -rf /app/Dockerfile* \
/app/node_modules \
/app/*.json \
/app/test_*.py && \
python3 manage.py collectstatic
python3 /app/manage.py collectstatic --noinput
CMD ["gunicorn","--bind","0.0.0.0:8000","--workers","3","VorgabenUI.wsgi:application"]

View File

@@ -127,7 +127,7 @@ USE_TZ = True
STATIC_URL = '/static/'
#STATIC_ROOT="/home/adebaumann/VorgabenUI/staticfiles/"
STATIC_ROOT="/app/staticfiles/"
STATIC_ROOT="staticfiles/"
STATICFILES_DIRS= (
os.path.join(BASE_DIR,"static"),
)

View File

@@ -25,7 +25,7 @@ spec:
mountPath: /data
containers:
- name: web
image: git.baumann.gr/adebaumann/vui:0.963
image: git.baumann.gr/adebaumann/vui:0.968
imagePullPolicy: Always
ports:
- containerPort: 8000

View File

@@ -0,0 +1,67 @@
{% extends "base.html" %}
{% block content %}
<h1>Alle Kommentare</h1>
{% if total_comments == 0 %}
<div class="alert alert-info">
<p>Es gibt noch keine Kommentare zu Vorgaben.</p>
<p><a href="{% url 'standard_list' %}">Zu den Standards</a></p>
</div>
{% else %}
<p class="text-muted">Insgesamt {{ total_comments }} Kommentar{{ total_comments|pluralize:"e" }}</p>
{% for dokument, comments in comments_by_document.items %}
<div class="panel panel-default" style="margin-top: 2rem;">
<div class="panel-heading">
<h2 style="margin: 0;">
<a href="{% url 'standard_detail' nummer=dokument.nummer %}">
{{ dokument.nummer }} {{ dokument.name }}
</a>
</h2>
<p style="margin: 0; color: #666; font-size: 0.9rem;">
{{ comments|length }} Kommentar{{ comments|length|pluralize:"e" }}
</p>
</div>
<div class="panel-body">
<div class="list-group">
{% for comment in comments %}
<div class="list-group-item" style="border-left: 3px solid #007bff; padding: 1rem;">
<div style="display: flex; justify-content: space-between; align-items: flex-start;">
<div style="flex: 1;">
<h4 style="margin: 0 0 0.5rem 0;">
<a href="{% url 'standard_detail' nummer=comment.vorgabe.dokument.nummer %}#{{ comment.vorgabe.Vorgabennummer }}">
{{ comment.vorgabe.Vorgabennummer }}
</a> {{ comment.vorgabe.titel }}
</h4>
<p style="margin: 0 0 0.75rem 0; color: #666; font-size: 0.9rem;">
<strong>Benutzer:</strong> {{ comment.user.first_name }} {{ comment.user.last_name }}<br>
<strong>Erstellt:</strong> {{ comment.created_at|date:"d.m.Y H:i" }}
{% if comment.updated_at != comment.created_at %}
<br>
<strong>Bearbeitet:</strong> {{ comment.updated_at|date:"d.m.Y H:i" }}
{% endif %}
</p>
</div>
<form method="POST" action="{% url 'delete_vorgabe_comment' comment.id %}"
style="display: inline; margin-left: 1rem;"
onsubmit="return confirm('Sind Sie sicher, dass Sie diesen Kommentar löschen möchten?');">
{% csrf_token %}
<button type="submit" class="btn btn-sm btn-danger">Löschen</button>
</form>
</div>
<div style="background: #f8f9fa; padding: 0.75rem; border-radius: 4px; margin-top: 0.5rem; white-space: pre-wrap; word-wrap: break-word;">
{{ comment.text }}
</div>
</div>
{% endfor %}
</div>
</div>
</div>
{% endfor %}
{% endif %}
<div style="margin-top: 2rem; padding-top: 2rem; border-top: 1px solid #ddd;">
<a href="{% url 'standard_list' %}" class="btn btn-default">Zu den Standards</a>
</div>
{% endblock %}

View File

@@ -32,7 +32,7 @@
<h4 style="margin: 0 0 0.5rem 0;">
<a href="{% url 'standard_detail' nummer=comment.vorgabe.dokument.nummer %}#{{ comment.vorgabe.Vorgabennummer }}">
{{ comment.vorgabe.Vorgabennummer }}
</a>
</a> {{ comment.vorgabe.titel }}
</h4>
<p style="margin: 0 0 0.75rem 0; color: #666; font-size: 0.9rem;">
<strong>Erstellt:</strong> {{ comment.created_at|date:"d.m.Y H:i" }}

View File

@@ -2343,3 +2343,222 @@ class UserCommentsViewTest(TestCase):
self.assertEqual(response.status_code, 200)
self.assertTemplateUsed(response, 'standards/user_comments.html')
class AllCommentsViewTest(TestCase):
"""Test the all comments view that displays all comments from all users (staff only)"""
def setUp(self):
"""Set up test data"""
# Create users
self.user1 = User.objects.create_user(username='user1', password='pass123', first_name='Max', last_name='Mustermann')
self.user2 = User.objects.create_user(username='user2', password='pass123', first_name='Anna', last_name='Mueller')
self.staff_user = User.objects.create_user(username='staff', password='pass123', is_staff=True, first_name='Admin', last_name='User')
# Create documents
self.doc_type = Dokumententyp.objects.create(name='Test Type', verantwortliche_ve='test')
self.doc1 = Dokument.objects.create(nummer='DOC-001', name='Document 1', dokumententyp=self.doc_type, aktiv=True)
self.doc2 = Dokument.objects.create(nummer='DOC-002', name='Document 2', dokumententyp=self.doc_type, aktiv=True)
# Create themes
self.theme1 = Thema.objects.create(name='Theme 1')
self.theme2 = Thema.objects.create(name='Theme 2')
# Create vorgaben
self.vorgabe1 = Vorgabe.objects.create(
nummer=1,
order=1,
dokument=self.doc1,
thema=self.theme1,
titel='Vorgabe 1',
gueltigkeit_von=date.today()
)
self.vorgabe2 = Vorgabe.objects.create(
nummer=2,
order=2,
dokument=self.doc1,
thema=self.theme1,
titel='Vorgabe 2',
gueltigkeit_von=date.today()
)
self.vorgabe3 = Vorgabe.objects.create(
nummer=1,
order=1,
dokument=self.doc2,
thema=self.theme2,
titel='Vorgabe 3',
gueltigkeit_von=date.today()
)
# Create comments from different users
self.comment1 = VorgabeComment.objects.create(
vorgabe=self.vorgabe1,
user=self.user1,
text='User1 comment on vorgabe1'
)
self.comment2 = VorgabeComment.objects.create(
vorgabe=self.vorgabe2,
user=self.user1,
text='User1 comment on vorgabe2'
)
self.comment3 = VorgabeComment.objects.create(
vorgabe=self.vorgabe3,
user=self.user2,
text='User2 comment on vorgabe3'
)
self.comment4 = VorgabeComment.objects.create(
vorgabe=self.vorgabe1,
user=self.user2,
text='User2 comment on vorgabe1'
)
def test_all_comments_requires_login(self):
"""Test that all comments view requires authentication"""
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 302)
self.assertIn('/login/', response.url)
def test_all_comments_staff_only(self):
"""Test that non-staff users cannot access all comments view"""
self.client.login(username='user1', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 302)
self.assertIn('/login/', response.url)
def test_all_comments_staff_can_access(self):
"""Test that staff users can access all comments view"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
def test_all_comments_shows_all_comments(self):
"""Test that staff sees all comments from all users"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
self.assertContains(response, 'User1 comment on vorgabe1')
self.assertContains(response, 'User1 comment on vorgabe2')
self.assertContains(response, 'User2 comment on vorgabe3')
self.assertContains(response, 'User2 comment on vorgabe1')
def test_all_comments_shows_usernames(self):
"""Test that all comments display the username of the author"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
# Check that user names appear in the response
self.assertContains(response, 'Max Mustermann')
self.assertContains(response, 'Anna Mueller')
def test_all_comments_grouped_by_document(self):
"""Test that comments are properly grouped by document"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
# Check that document titles appear
self.assertContains(response, 'DOC-001 Document 1')
self.assertContains(response, 'DOC-002 Document 2')
# Check context
self.assertIn('comments_by_document', response.context)
self.assertEqual(len(response.context['comments_by_document']), 2)
def test_all_comments_count_display(self):
"""Test that total comment count is displayed"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
self.assertEqual(response.context['total_comments'], 4)
self.assertContains(response, '4 Kommentare')
def test_all_comments_empty_view(self):
"""Test the view when there are no comments"""
# Delete all comments
VorgabeComment.objects.all().delete()
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
self.assertEqual(response.context['total_comments'], 0)
self.assertContains(response, 'Es gibt noch keine Kommentare')
def test_all_comments_template_used(self):
"""Test that correct template is used"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
self.assertTemplateUsed(response, 'standards/all_comments.html')
def test_all_comments_has_delete_buttons(self):
"""Test that delete buttons are present for each comment"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
# Check for delete button form elements - look for the delete form action URLs
self.assertContains(response, '/dokumente/comments/delete/', count=4)
# Also check for the delete button text
self.assertContains(response, 'Löschen', count=4)
def test_all_comments_vorgabe_number_link(self):
"""Test that vorgabe numbers are linked correctly"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
# Check that vorgabe numbers appear
self.assertContains(response, 'DOC-001.T.1')
self.assertContains(response, 'DOC-001.T.2')
self.assertContains(response, 'DOC-002.T.1')
def test_all_comments_ordered_by_document_and_date(self):
"""Test that comments are ordered by document then by creation date"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
# Check context has properly grouped comments
comments_by_doc = response.context['comments_by_document']
# Verify all documents are present
doc_numbers = [doc.nummer for doc in comments_by_doc.keys()]
self.assertIn('DOC-001', doc_numbers)
self.assertIn('DOC-002', doc_numbers)
def test_all_comments_displays_timestamps(self):
"""Test that comment timestamps are displayed"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
self.assertEqual(response.status_code, 200)
# Check that timestamp patterns appear (date formatting)
self.assertContains(response, 'Erstellt:')
def test_all_comments_regular_user_redirect(self):
"""Test that regular users are redirected to login"""
# Create and login as regular user
regular_user = User.objects.create_user(username='regular', password='pass123')
self.client.login(username='regular', password='pass123')
response = self.client.get(reverse('all_comments'))
# Should redirect to login since user is not staff
self.assertEqual(response.status_code, 302)
self.assertIn('/login/', response.url)
def test_all_comments_no_own_comments_filter(self):
"""Test that staff sees comments from ALL users, not just their own"""
self.client.login(username='staff', password='pass123')
response = self.client.get(reverse('all_comments'))
# Verify all comments are visible, not filtered by user
self.assertContains(response, 'User1 comment on vorgabe1')
self.assertContains(response, 'User2 comment on vorgabe1')
# Both users' comments on the same vorgabe should be visible
self.assertEqual(response.context['total_comments'], 4)

View File

@@ -5,6 +5,7 @@ urlpatterns = [
path('', views.standard_list, name='standard_list'),
path('unvollstaendig/', views.incomplete_vorgaben, name='incomplete_vorgaben'),
path('meine-kommentare/', views.user_comments, name='user_comments'),
path('alle-kommentare/', views.all_comments, name='all_comments'),
path('<str:nummer>/', views.standard_detail, name='standard_detail'),
path('<str:nummer>/history/<str:check_date>/', views.standard_detail),
path('<str:nummer>/history/', views.standard_detail, {"check_date":"today"}, name='standard_history'),

View File

@@ -392,3 +392,31 @@ def user_comments(request):
'comments_by_document': comments_by_document,
'total_comments': user_comments.count(),
})
@login_required
@user_passes_test(is_staff_user)
def all_comments(request):
"""
Display all comments from all users, grouped by document.
Staff only.
"""
# Get all comments
all_comments_qs = VorgabeComment.objects.select_related(
'vorgabe', 'vorgabe__dokument', 'user'
).order_by(
'vorgabe__dokument__nummer', '-created_at'
)
# Group comments by document
comments_by_document = {}
for comment in all_comments_qs:
dokument = comment.vorgabe.dokument
if dokument not in comments_by_document:
comments_by_document[dokument] = []
comments_by_document[dokument].append(comment)
return render(request, 'standards/all_comments.html', {
'comments_by_document': comments_by_document,
'total_comments': all_comments_qs.count(),
})

View File

@@ -24,8 +24,8 @@ spec:
- name: data
mountPath: /data
containers:
- name: web
image: docker.io/adebaumann/vui:0.917
- name: web
image: docker.io/adebaumann/vui:0.918
imagePullPolicy: Always
ports:
- containerPort: 8000

View File

@@ -52,18 +52,21 @@
<span class="caret" style="margin-left: 8px;"></span>
</a>
<ul class="dropdown-menu dropdown-menu-right" role="menu">
<li><a href="{% url 'user_comments' %}">Meine Kommentare</a></li>
<li><a href="{% url 'password_change' %}">Passwort ändern</a></li>
<li class="divider"></li>
<li>
<form method="post" action="{% url 'logout' %}" style="display: inline;">
{% csrf_token %}
<button type="submit" style="background: none; border: none; color: inherit; padding: 3px 20px; width: 100%; text-align: left; cursor: pointer;">
Abmelden
</button>
</form>
</li>
</ul>
<li><a href="{% url 'user_comments' %}">Meine Kommentare</a></li>
{% if user.is_staff %}
<li><a href="{% url 'all_comments' %}">Alle Kommentare</a></li>
{% endif %}
<li><a href="{% url 'password_change' %}">Passwort ändern</a></li>
<li class="divider"></li>
<li>
<form method="post" action="{% url 'logout' %}" style="display: inline;">
{% csrf_token %}
<button type="submit" style="background: none; border: none; color: inherit; padding: 3px 20px; width: 100%; text-align: left; cursor: pointer;">
Abmelden
</button>
</form>
</li>
</ul>
</div>
</div>
{% else %}
@@ -103,7 +106,7 @@
<li><a href="/dokumente">Standards</a></li>
{% if user.is_staff %}
<li><a href="/dokumente/unvollstaendig/">Unvollständig</a></li>
<li><a href="/autorenumgebung/">Autorenumgebung</a></li>
<li><a href="/autorenumgebung/">Autor</a></li>
{% endif %}
<li><a href="/referenzen">Referenzen</a></li>
<li><a href="/stichworte">Stichworte</a></li>
@@ -134,7 +137,7 @@
<a href="/dokumente/unvollstaendig/">Unvollständig</a>
</li>
<li class="dropdown {% if 'autorenumgebung' in request.path %}current{% endif %}">
<a href="/autorenumgebung/">Autorenumgebung</a>
<a href="/autorenumgebung/">Autor</a>
</li>
{% endif %}
<li class="dropdown {% if 'referenzen' in request.path %}current{% endif %}">
@@ -216,8 +219,8 @@
</p>
</div>
<div class="col-sm-6 text-right">
<p class="text-muted">Version {{ version|default:"0.963" }}</p>
</div>
<p class="text-muted">Version {{ version|default:"0.968" }}</p>
</div>
</div>
</div>
</footer>