102 lines
3.8 KiB
Markdown
102 lines
3.8 KiB
Markdown
# Task 1 Report: Presentation Helpers And Password Policy
|
|
|
|
## Status
|
|
|
|
Implemented Task 1 only. The existing server-rendered architecture and fiscal behavior were not changed.
|
|
|
|
## Changed Files
|
|
|
|
- `central/app/panel_presentation.py`: added timezone-aware UI datetime, age, duration, operational priority, and health-label helpers.
|
|
- `central/app/config.py`: added `ui_timezone` (default `America/Bahia`) and `allow_weak_dev_password` settings.
|
|
- `central/app/human_auth.py`: restored the 12-character minimum unless the process is non-production and `ALLOW_WEAK_DEV_PASSWORD=1`; the flag is read at call time.
|
|
- `central/tests/test_panel_presentation.py`: added helper contract tests.
|
|
- `central/tests/test_control_plane.py`: added explicit opt-in and production password-policy tests.
|
|
- `docker-compose.yml`: explicitly enables weak development passwords for the local `fiscal-hub` service.
|
|
|
|
## RED Evidence
|
|
|
|
Command:
|
|
|
|
```text
|
|
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q
|
|
```
|
|
|
|
Result: collection failed with `ModuleNotFoundError: No module named 'central.app.panel_presentation'`, proving the new helper module was absent.
|
|
|
|
The control-plane tests were then run independently:
|
|
|
|
```text
|
|
python -m pytest central/tests/test_control_plane.py -q
|
|
```
|
|
|
|
Result: `2 failed, 3 passed`. Both new password-policy tests failed because the pre-change implementation accepted short passwords without the required environment gate.
|
|
|
|
## GREEN Evidence
|
|
|
|
Focused command:
|
|
|
|
```text
|
|
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q
|
|
```
|
|
|
|
Result: `10 passed`.
|
|
|
|
Focused command including configuration coverage:
|
|
|
|
```text
|
|
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py central/tests/test_config.py -q
|
|
```
|
|
|
|
Result: `11 passed`.
|
|
|
|
Full central regression:
|
|
|
|
```text
|
|
python -m pytest central/tests -q
|
|
```
|
|
|
|
Result: `241 passed, 1 warning`. The warning is the existing `openpyxl` print-area warning from `central/tests/test_bootstrap_v1_extra.py`.
|
|
|
|
`git diff --check` and the staged diff check completed without whitespace errors.
|
|
|
|
## Commit
|
|
|
|
Implementation commit: `0846b9d1b076c60c57ad2a30a3071480a680bccf` (`feat: add operational panel presentation helpers`).
|
|
|
|
## Concerns
|
|
|
|
- The existing pytest environment emits one non-failing `pytest-asyncio` deprecation warning; the full central suite also emits the pre-existing `openpyxl` warning noted above.
|
|
- `operational_priority` intentionally uses only operational blocker type, field, and reason signals; it does not infer fiscal severity.
|
|
|
|
## Reviewed Finding Fix
|
|
|
|
Finding: `create_admin` used the import-time `settings.allow_weak_dev_password` value as the default for the call-time environment lookup. If the flag was enabled during import and later removed, short passwords remained accepted.
|
|
|
|
Fix: `ALLOW_WEAK_DEV_PASSWORD` now defaults to `"0"` at every call. The existing `APP_ENV != production` check remains enforced, and Docker Compose still explicitly sets `ALLOW_WEAK_DEV_PASSWORD: "1"` for the local `fiscal-hub` service.
|
|
|
|
Regression RED command:
|
|
|
|
```text
|
|
python -m pytest central/tests/test_control_plane.py::test_removed_weak_password_flag_is_fail_closed_after_import -q
|
|
```
|
|
|
|
Result before the fix: `1 failed`; after reloading configuration/auth with the flag enabled, removing the flag did not raise `ValueError` for a short password.
|
|
|
|
Regression GREEN command:
|
|
|
|
```text
|
|
python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q
|
|
```
|
|
|
|
Result: `11 passed`.
|
|
|
|
Full central regression:
|
|
|
|
```text
|
|
python -m pytest central/tests -q
|
|
```
|
|
|
|
Result: `242 passed, 1 warning`; the warning is the existing `openpyxl` print-area warning.
|
|
|
|
Fix commit: `de571e3ac2ce214677e1f9baa673181350b7d411` (`fix: fail closed weak password opt-in`).
|