feat: allow admins to update audit checklist configuration

2026-09-04 09:17:11 +07:00
parent aeba055e43
commit 4f4c7df4ed
8 changed files with 309 additions and 2 deletions
@@ -0,0 +1,38 @@
+# Upload Checklist Configuration Implementation Plan
+
+> **For Hermes:** Implement task-by-task with TDD and verify the Docker deployment contract.
+
+**Goal:** Bổ sung tại trang quản lý công cụ chức năng admin upload/thay thế cặp file checklist `.xlsx` và rule config `.json` cho từng OS.
+
+**Architecture:** Dùng mapping `OS_CONFIG` hiện có làm allowlist tên đích; không cho client tự chọn đường dẫn/tên file. Backend validate role admin, extension, JSON, tạo `.bak`, rồi ghi file vào `config/`. Đổi bind mount `config` sang read-write để chức năng hoạt động trong Docker.
+
+**Tech Stack:** FastAPI, Jinja2, Docker Compose, Python stdlib JSON/file I/O.
+
+---
+
+### Task 1: Add regression tests
+- Create `tests/test_checklist_config_upload.py`.
+- Assert route exists, admin authorization is required, safe OS mapping is used, JSON is validated, and Compose config mount is writable.
+- Run test and confirm RED.
+
+### Task 2: Implement secure upload endpoint
+- Modify `app/web_app_fastapi.py`.
+- Add `POST /admin/checklists/upload`.
+- Require admin session.
+- Accept `os_type`, optional checklist `.xlsx`, optional config `.json`; require at least one.
+- Resolve destination only from `OS_CONFIG`.
+- Validate JSON before write; write temporary file then atomic replace; back up existing files.
+- Redirect with PRG status message.
+
+### Task 3: Add admin UI
+- Modify `app/templates/admin_tools.html`.
+- Add admin-only card showing current file names/status and multipart upload form.
+- Analyzer remains limited to tool upload and cannot change checklist/rules.
+
+### Task 4: Enable persistence in Docker
+- Modify `docker-compose.yml` from `./config:/app/config:ro` to `./config:/app/config`.
+- Keep `config/` as the only writable configuration directory required by this feature.
+
+### Task 5: Verify
+- Run regression tests, Python compile/AST, Jinja parse, JSON checks, `docker compose config`, and `git diff --check`.
+- Grok execution review; fix any blocking findings.