curo1305
343f12259c
Backend: - app/core/sanitize.py: shared sanitize_str, normalize_email, validate_phone, validate_date_of_birth — applied to every user-supplied DB-bound input - app/schemas/user.py: sanitize full_name, normalize email on UserCreate - app/models/profile.py: profiles table (position, phone, dob, address, updated_at) - app/models/user.py: Profile back-ref, is_superuser admin-role comment - app/schemas/profile.py: ProfileRead/ProfileUpdate with full sanitization - app/routers/profile.py: GET+PUT /api/profile/me (lazy profile creation) - app/main.py: register /api/profile router - alembic migration 676084df61d1: create profiles table Frontend: - components/Nav.tsx: shared nav (Dashboard | Profile | Logout) - pages/ProfilePage.tsx: profile view + inline edit form with error handling - pages/DashboardPage.tsx: use Nav component - api/client.ts: ProfileData type, getProfile, updateProfile - App.tsx: /profile private route Security: - scripts/security_check.py: tighter SQL injection patterns (f-string/format/% in execute/query/text()), new SANIT category for raw request→DB patterns Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
45 lines
1.2 KiB
Python
45 lines
1.2 KiB
Python
from datetime import date, datetime
|
|
|
|
from pydantic import BaseModel, field_validator
|
|
|
|
from app.core.sanitize import sanitize_str, validate_date_of_birth, validate_phone
|
|
|
|
|
|
class ProfileRead(BaseModel):
|
|
id: str
|
|
user_id: str
|
|
phone: str | None
|
|
date_of_birth: date | None
|
|
position: str | None
|
|
address: str | None
|
|
updated_at: datetime
|
|
|
|
model_config = {"from_attributes": True}
|
|
|
|
|
|
class ProfileUpdate(BaseModel):
|
|
phone: str | None = None
|
|
date_of_birth: date | None = None
|
|
position: str | None = None
|
|
address: str | None = None
|
|
|
|
@field_validator("phone", mode="before")
|
|
@classmethod
|
|
def clean_phone(cls, v: str | None) -> str | None:
|
|
return validate_phone(v)
|
|
|
|
@field_validator("position", mode="before")
|
|
@classmethod
|
|
def clean_position(cls, v: str | None) -> str | None:
|
|
return sanitize_str(v, max_len=128)
|
|
|
|
@field_validator("address", mode="before")
|
|
@classmethod
|
|
def clean_address(cls, v: str | None) -> str | None:
|
|
return sanitize_str(v, max_len=255)
|
|
|
|
@field_validator("date_of_birth", mode="after")
|
|
@classmethod
|
|
def clean_dob(cls, v: date | None) -> date | None:
|
|
return validate_date_of_birth(v)
|