Canalul web trece de la 100% deschis (hardcodat cont 1) la autentificat si multi-tenant. Un service nou se inregistreaza din browser, primeste o cheie API (o singura data) si o sesiune; contul se creeaza "in asteptare" (active=0) si nu trimite la RAR pana la activarea de catre admin (tools/account.py activate). - users + app/users.py: parole scrypt (salt per-user, eticheta parametri onorata la verify pentru migrare cost), email unic case-insensitive - sesiune: SessionMiddleware (same_site=strict, https_only config) + app/web/session.py (current_account/web_account/require_login->LoginRequired, set_session clear-inainte) - CSRF (app/web/csrf.py) enforce in prod inclusiv pe login/signup + rate-limit in-proces (app/web/ratelimit.py) pe signup si login - signup/login/logout (app/web/auth_routes.py): signup tranzactie atomica, cheie-o-data, log SIGNUP pentru descoperire admin - dashboard + import scoped pe contul sesiunii (regula NULL->cont 1); toate rutele web care ating date sensibile sub require_login; nomenclator ramane global - banner "cont in asteptare" pentru conturi active=0 - gate worker: claim_one LEFT JOIN accounts COALESCE(active,1)=1 (account_id NULL=activ) VERIFY context curat (2 runde): leak cross-account /_fragments/mapari prins+reparat. /code-review high: csrf_token lipsa pe re-randari de eroare, scrypt_params ignorat, login fara rate-limit -- toate reparate. 361 teste pass (de la 313). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
108 lines
3.5 KiB
HTML
108 lines
3.5 KiB
HTML
<div id="import-section">
|
|
<div class="card">
|
|
<h2 style="font-size:15px; margin:0 0 12px;">Import fisier (xlsx / csv)</h2>
|
|
|
|
{% if message %}
|
|
<div class="flash" style="margin-bottom:12px;">{{ message }}</div>
|
|
{% endif %}
|
|
|
|
{% if error %}
|
|
<div class="flash" style="border-color:var(--err); background:#241a1a; margin-bottom:12px;"
|
|
role="alert">{{ error }}</div>
|
|
{% endif %}
|
|
|
|
{% if sheets %}
|
|
<div class="flash" style="border-color:var(--warn); background:#201c0f; margin-bottom:12px;">
|
|
Fisierul are mai multe foi de lucru. Alege foaia de mai jos si incarca din nou.
|
|
</div>
|
|
{% endif %}
|
|
|
|
<form id="upload-form"
|
|
hx-post="/_import/upload"
|
|
hx-target="#import-section"
|
|
hx-swap="outerHTML"
|
|
hx-encoding="multipart/form-data"
|
|
hx-indicator="#upload-spinner">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token or '' }}">
|
|
|
|
{% if sheets %}
|
|
<div style="margin-bottom:12px;">
|
|
<label for="sheet-select"
|
|
style="display:block; margin-bottom:4px; font-size:13px; color:var(--muted);">
|
|
Foaie de lucru
|
|
</label>
|
|
<select id="sheet-select" name="sheet_name" style="min-width:200px;">
|
|
{% for s in sheets %}
|
|
<option value="{{ s }}">{{ s }}</option>
|
|
{% endfor %}
|
|
</select>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<div class="drop-zone" id="drop-zone"
|
|
role="region" aria-label="Zona de incarcare fisier">
|
|
{% if not sheets %}
|
|
<p style="font-size:17px; margin:0 0 4px; font-weight:600;">Primul fisier? Trage-l aici.</p>
|
|
<p class="muted" style="margin:0 0 16px; font-size:13px;">xlsx sau csv, max 5000 randuri</p>
|
|
{% else %}
|
|
<p class="muted" style="margin:0 0 16px; font-size:14px;">
|
|
Incarca fisierul din nou dupa ce ai ales foaia.
|
|
</p>
|
|
{% endif %}
|
|
|
|
<input id="file-input" type="file" name="file" accept=".xlsx,.xls,.csv"
|
|
style="display:none;" aria-label="Selecteaza fisier xlsx sau csv">
|
|
<button type="button" id="upload-btn"
|
|
style="min-height:44px; padding:10px 24px; font-size:14px;">
|
|
Alege fisier
|
|
</button>
|
|
</div>
|
|
|
|
<p class="muted" style="margin:8px 0 0; font-size:12px;">
|
|
NU se trimite nimic la RAR pana confirmi explicit.
|
|
</p>
|
|
|
|
<span id="upload-spinner" class="htmx-indicator muted"
|
|
style="font-size:13px; margin-top:6px; display:inline;">
|
|
se parseaza fisierul...
|
|
</span>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
(function() {
|
|
var btn = document.getElementById('upload-btn');
|
|
var fi = document.getElementById('file-input');
|
|
var dz = document.getElementById('drop-zone');
|
|
var frm = document.getElementById('upload-form');
|
|
if (!btn || !fi || !frm) return;
|
|
|
|
btn.addEventListener('click', function() { fi.click(); });
|
|
|
|
fi.addEventListener('change', function() {
|
|
if (fi.files.length > 0) frm.requestSubmit();
|
|
});
|
|
|
|
dz.addEventListener('dragover', function(e) {
|
|
e.preventDefault();
|
|
dz.classList.add('drag-over');
|
|
});
|
|
dz.addEventListener('dragleave', function(e) {
|
|
if (!dz.contains(e.relatedTarget)) dz.classList.remove('drag-over');
|
|
});
|
|
dz.addEventListener('drop', function(e) {
|
|
e.preventDefault();
|
|
dz.classList.remove('drag-over');
|
|
var f = (e.dataTransfer.files || [])[0];
|
|
if (!f) return;
|
|
try {
|
|
var dt = new DataTransfer();
|
|
dt.items.add(f);
|
|
fi.files = dt.files;
|
|
} catch (_) {}
|
|
frm.requestSubmit();
|
|
});
|
|
})();
|
|
</script>
|