gustavosantos/GTI_GERENCIADOR_FISCAL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: protecao CSRF (double-submit cookie) e paginacao da lista de clientes

Browse Source 
CSRF: novo app/csrf.py + middleware em app/main.py garantem um cookie
csrf_token por navegador; todo formulario que muda estado (criar/editar/
excluir cliente, adicionar/editar/excluir contato) embute esse valor
como campo oculto, e Depends(exigir_csrf) confere no POST que o valor
enviado bate com o cookie antes de deixar a rota executar. Verificado
ponta a ponta com o app real rodando (curl): token errado -> 403,
token correto -> 303.

Paginacao: db_clientes.listar_clientes ganha offset, nova
contar_clientes(); GET /clientes aceita ?pagina=N (100 clientes por
pagina), template mostra Anterior/Proxima e o total.

53/53 testes passando (8 novos).
This commit is contained in:
Gustavo
2026-08-13 11:02:17 -03:00
parent 96cbd8a294
commit bb8fd596b1
12 changed files with 247 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/db/clientes.py
+24 -4
View File
@@ -21,7 +21,7 @@ class ClienteComDependenciasError(Exception):
"""Levantada ao tentar excluir um CLIENTE que ainda tem CLIENTE_CONTATO."""
def listar_clientes(busca: str | None = None, limite: int = 100) -> list[dict]:
def listar_clientes(busca: str | None = None, limite: int = 100, offset: int = 0) -> list[dict]:
conn = get_connection()
try:
with conn.cursor() as cur:
@@ -29,17 +29,37 @@ def listar_clientes(busca: str | None = None, limite: int = 100) -> list[dict]:
sql = (
f"SELECT {_COLUNAS_SELECT} FROM CLIENTE "
"WHERE CODIGO LIKE %s OR CNPJ LIKE %s OR RAZAO LIKE %s OR FANTASIA LIKE %s "
"ORDER BY RAZAO LIMIT %s"
"ORDER BY RAZAO LIMIT %s OFFSET %s"
)
termo = f"%{busca}%"
cur.execute(sql, (termo, termo, termo, termo, limite))
cur.execute(sql, (termo, termo, termo, termo, limite, offset))
else:
cur.execute(f"SELECT {_COLUNAS_SELECT} FROM CLIENTE ORDER BY RAZAO LIMIT %s", (limite,))
cur.execute(
f"SELECT {_COLUNAS_SELECT} FROM CLIENTE ORDER BY RAZAO LIMIT %s OFFSET %s", (limite, offset)
)
return cur.fetchall()
finally:
conn.close()
def contar_clientes(busca: str | None = None) -> int:
conn = get_connection()
try:
with conn.cursor() as cur:
if busca:
sql = (
"SELECT COUNT(*) AS total FROM CLIENTE "
"WHERE CODIGO LIKE %s OR CNPJ LIKE %s OR RAZAO LIKE %s OR FANTASIA LIKE %s"
)
termo = f"%{busca}%"
cur.execute(sql, (termo, termo, termo, termo))
else:
cur.execute("SELECT COUNT(*) AS total FROM CLIENTE")
return cur.fetchone()["total"]
finally:
conn.close()
def obter_cliente(cliente_id: int) -> dict | None:
conn = get_connection()
try: