Merge pull request #114 from alvin000009238/dev

Enhance share functionality with metadata, expiry options, and updates

Author: alvin000009238

app/routes/share.py

@@ -1,17 +1,24 @@
-from flask import Blueprint, current_app, jsonify, request, send_from_directory
+from flask import Blueprint, current_app, jsonify, request, send_from_directory, session
 
 from app.services.rate_limiter import is_rate_limited
 from app.services.share_service import (
     generate_share_id,
     is_valid_share_id,
+    refresh_share_metadata_ttl,
+    read_share_metadata,
     read_shared_data,
     validate_share_payload,
+    write_share_metadata,
     write_shared_data,
 )
 from app.services.turnstile_service import verify_turnstile_token
 import logging
 
 logger = logging.getLogger('SchoolGradesServer.Share')
+SHARE_EXPIRY_OPTIONS = {
+    '2h': 7200,
+    '7d': 604800,
+}
 
 bp = Blueprint('share', __name__)
 
@@ -23,6 +30,14 @@ def create_share_link():
         if not data or not isinstance(data, dict):
             return jsonify({'error': 'No data provided or invalid format'}), 400
 
+        student_no = session.get('student_no')
+        if not student_no:
+            return jsonify({'error': 'Unauthorized'}), 401
+
+        redis_client = current_app.config.get('REDIS_CLIENT')
+        if redis_client is None:
+            return jsonify({'error': 'Share service unavailable'}), 503
+
         # Turnstile 人機驗證
         ts_ok, ts_err = verify_turnstile_token(
             data.get('turnstile_token'),
@@ -32,7 +47,6 @@ def create_share_link():
             return jsonify({'error': ts_err}), 403
 
         # 速率限制檢查（在 Turnstile 之後）
-        redis_client = current_app.config.get('REDIS_CLIENT')
         if redis_client:
             try:
                 # 較寬鬆的速率限制：每小時 (3600 秒) 10 次
@@ -57,21 +71,96 @@ def create_share_link():
         if not valid:
             return jsonify({'error': err}), 400
 
+        requested_expiry = data.get('share_expiry', '2h')
+        if requested_expiry not in SHARE_EXPIRY_OPTIONS:
+            return jsonify({'error': 'Invalid share expiry option'}), 400
+
         share_id = generate_share_id()
-        write_shared_data(current_app.config['REDIS_CLIENT'], share_id, cleaned, current_app.config['SHARE_TTL'])
+        share_ttl = SHARE_EXPIRY_OPTIONS[requested_expiry]
+        write_shared_data(redis_client, share_id, cleaned, share_ttl)
+        write_share_metadata(redis_client, share_id, student_no, share_ttl)
         return jsonify({'success': True, 'id': share_id})
     except Exception as exc:
         logger.error(f'Error creating share: {exc}', exc_info = True)
         return jsonify({'error': str(exc)}), 500
 
 
+@bp.route('/api/share/<share_id>', methods=['PUT'])
+def update_share_link(share_id):
+    try:
+        if not is_valid_share_id(share_id):
+            return jsonify({'error': 'Invalid ID format'}), 400
+
+        data = request.json
+        if not data or not isinstance(data, dict):
+            return jsonify({'error': 'No data provided or invalid format'}), 400
+
+        redis_client = current_app.config.get('REDIS_CLIENT')
+        if redis_client is None:
+            return jsonify({'error': 'Share service unavailable'}), 503
+
+        requester_student_no = session.get('student_no')
+        if requester_student_no is None:
+            return jsonify({'error': 'Unauthorized'}), 401
+
+        rate_limit_subject = requester_student_no or request.remote_addr
+        if redis_client:
+            try:
+                limited, remaining, retry_after = is_rate_limited(
+                    redis_client,
+                    rate_limit_subject,
+                    max_attempts=10,
+                    window_seconds=60,
+                    key_prefix='share_update'
+                )
+                if limited:
+                    resp = jsonify({
+                        'error': f'更新分享過於頻繁，請在 {retry_after} 秒後再試',
+                    })
+                    resp.headers['Retry-After'] = str(retry_after)
+                    return resp, 429
+            except Exception as exc:
+                logger.error(f'Share update rate limiter error: {exc}', exc_info=True)
+
+        metadata = read_share_metadata(redis_client, share_id)
+        if metadata is None:
+            return jsonify({'error': 'Link expired or not found'}), 404
+
+        creator_student_no = metadata.get('creator_student_no')
+        if not creator_student_no:
+            return jsonify({'error': 'Forbidden'}), 403
+
+        if requester_student_no != creator_student_no:
+            return jsonify({'error': 'Forbidden'}), 403
+
+        valid, err, cleaned = validate_share_payload(data)
+        if not valid:
+            return jsonify({'error': err}), 400
+
+        share_ttl = metadata.get('ttl_seconds', current_app.config['SHARE_TTL'])
+        if share_ttl not in SHARE_EXPIRY_OPTIONS.values():
+            return jsonify({'error': 'Share metadata state conflict'}), 409
+        metadata_ttl_refreshed = refresh_share_metadata_ttl(redis_client, share_id, share_ttl)
+        if not metadata_ttl_refreshed:
+            return jsonify({'error': 'Share metadata state conflict'}), 409
+        write_shared_data(redis_client, share_id, cleaned, share_ttl)
+        return jsonify({'success': True, 'id': share_id})
+    except Exception as exc:
+        logger.error(f'Error updating share: {exc}', exc_info=True)
+        return jsonify({'error': str(exc)}), 500
+
+
 @bp.route('/api/share/<share_id>', methods=['GET'])
 def get_shared_grades(share_id):
     try:
         if not is_valid_share_id(share_id):
             return jsonify({'error': 'Invalid ID format'}), 400
 
-        data = read_shared_data(current_app.config['REDIS_CLIENT'], share_id)
+        redis_client = current_app.config.get('REDIS_CLIENT')
+        if redis_client is None:
+            return jsonify({'error': 'Share service unavailable'}), 503
+
+        data = read_shared_data(redis_client, share_id)
         if data is None:
             return jsonify({'error': 'Link expired or not found'}), 404
 

app/services/share_service.py

@@ -1,17 +1,19 @@
 import json
 import secrets
 import string
+from datetime import datetime, timezone
 
 CHARS = string.ascii_letters + string.digits + '-_.~'
+SHARE_ID_LENGTH = 15
 SHARE_MAX_PAYLOAD_BYTES = 512_000  # 500 KB
 
 
-def generate_share_id(length=15):
-    return ''.join(secrets.choice(CHARS) for _ in range(length))
+def generate_share_id():
+    return ''.join(secrets.choice(CHARS) for _ in range(SHARE_ID_LENGTH))
 
 
 def is_valid_share_id(share_id):
-    return all(c in CHARS for c in share_id)
+    return len(share_id) == SHARE_ID_LENGTH and all(c in CHARS for c in share_id)
 
 
 def validate_share_payload(data, max_bytes=SHARE_MAX_PAYLOAD_BYTES):
@@ -28,7 +30,7 @@ def validate_share_payload(data, max_bytes=SHARE_MAX_PAYLOAD_BYTES):
         return False, 'Payload 必須為 JSON 物件', None
 
     # 剝離非必要欄位
-    cleaned = {k: v for k, v in data.items() if k != 'turnstile_token'}
+    cleaned = {k: v for k, v in data.items() if k not in ('turnstile_token', 'share_expiry')}
 
     # 大小檢查
     serialized = json.dumps(cleaned, ensure_ascii=False)
@@ -51,10 +53,32 @@ def write_shared_data(redis_client, share_id, data, ttl=7200):
     redis_client.setex(cache_key, ttl, json.dumps(data, ensure_ascii=False))
 
 
+def write_share_metadata(redis_client, share_id, creator_student_no, ttl=7200):
+    cache_key = f"share_meta:{share_id}"
+    metadata = {
+        'creator_student_no': creator_student_no,
+        'created_at': datetime.now(timezone.utc).isoformat(),
+        'ttl_seconds': ttl,
+    }
+    redis_client.setex(cache_key, ttl, json.dumps(metadata, ensure_ascii=False))
+
+
 def read_shared_data(redis_client, share_id):
     cache_key = f"share:{share_id}"
     data_str = redis_client.get(cache_key)
     if not data_str:
         return None
     return json.loads(data_str)
 
+
+def read_share_metadata(redis_client, share_id):
+    cache_key = f"share_meta:{share_id}"
+    data_str = redis_client.get(cache_key)
+    if not data_str:
+        return None
+    return json.loads(data_str)
+
+
+def refresh_share_metadata_ttl(redis_client, share_id, ttl=7200):
+    cache_key = f"share_meta:{share_id}"
+    return redis_client.expire(cache_key, ttl) == 1

frontend/share.js

@@ -8,6 +8,30 @@ import { initDashboard } from './dashboard.js';
 import { emitOnboardingEvent, ONBOARDING_EVENTS } from './onboarding-events.js';
 import { showAlert } from './dialog.js';
 
+const ACTIVE_SHARE_ID_KEY = 'activeShareId';
+
+export function getActiveShareId() {
+    return localStorage.getItem(ACTIVE_SHARE_ID_KEY);
+}
+
+export async function updateActiveShare(gradesData) {
+    const shareId = getActiveShareId();
+    if (!shareId || !gradesData) return { attempted: false, ok: false, status: null };
+
+    const res = await fetch(`/api/share/${shareId}`, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'include',
+        body: JSON.stringify(gradesData)
+    });
+
+    if (!res.ok && (res.status === 400 || res.status === 403 || res.status === 404)) {
+        localStorage.removeItem(ACTIVE_SHARE_ID_KEY);
+    }
+
+    return { attempted: true, ok: res.ok, status: res.status };
+}
+
 export function setupShareFeature() {
     const shareBtn = document.getElementById('shareBtn');
     const shareModal = document.getElementById('shareModal');
@@ -21,9 +45,15 @@ export function setupShareFeature() {
         sharePreview.innerHTML = `
             <div class="share-modal-container">
                 <p class="share-modal-text">
-                    建立一個唯讀的分享連結，讓他人查看此成績單。<br>
-                    連結將於 <strong class="text-warning">2 小時後</strong> 自動失效。
+                    建立一個唯讀的分享連結，讓他人查看此成績單。
                 </p>
+                <p class="share-modal-text mb-12">連結有效期限</p>
+                <div class="form-group mb-12">
+                    <select id="shareExpirySelect" aria-label="連結有效期限" class="form-input">
+                        <option value="2h">2 小時</option>
+                        <option value="7d">7 天</option>
+                    </select>
+                </div>
                 <div id="linkContainer" class="share-link-container hidden">
                     <div class="form-group mb-12">
                         <input type="text" id="shareLinkInput" readonly
@@ -57,6 +87,7 @@ export function setupShareFeature() {
         const shareLinkInput = document.getElementById('shareLinkInput');
         const copyLinkBtn = document.getElementById('copyLinkBtn');
         const shareStatus = document.getElementById('shareStatus');
+        const shareExpirySelect = document.getElementById('shareExpirySelect');
 
         createLinkBtn.addEventListener('click', async () => {
             const gradesData = getStoredGrades();
@@ -82,16 +113,22 @@ export function setupShareFeature() {
             shareStatus.textContent = '';
 
             try {
-                const payload = { ...gradesData, turnstile_token: turnstileToken };
+                const payload = {
+                    ...gradesData,
+                    turnstile_token: turnstileToken,
+                    share_expiry: shareExpirySelect?.value || '2h'
+                };
                 const res = await fetch('/api/share', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/json' },
+                    credentials: 'include',
                     body: JSON.stringify(payload)
                 });
                 const data = await res.json();
 
                 if (data.success) {
                     const link = `${window.location.origin}/share/${data.id}`;
+                    localStorage.setItem(ACTIVE_SHARE_ID_KEY, data.id);
                     shareLinkInput.value = link;
                     linkContainer.style.display = 'block';
                     createLinkBtn.style.display = 'none';

frontend/sync.js

@@ -6,6 +6,7 @@ import { requestTurnstileVerification } from './turnstile.js';
 import { validateGradesData, storeGradesData } from './storage.js';
 import { initDashboard } from './dashboard.js';
 import { getDemoCredentials, getDemoResultData, getDemoStructure, isDemoModeEnabled } from './demo-mode.js';
+import { updateActiveShare } from './share.js';
 import { emitOnboardingEvent, ONBOARDING_EVENTS } from './onboarding-events.js';
 import { showConfirm, showAlert } from './dialog.js';
 
@@ -336,6 +337,9 @@ export function setupSyncFeature() {
                 validateGradesData(data.data);
                 storeGradesData(data.data);
                 initDashboard(data.data);
+                updateActiveShare(data.data).catch((err) => {
+                    console.error('Failed to update share', err);
+                });
 
                 setTimeout(() => {
                     toggleModal(selectExamModal, false);

tests/backend/test_share.py

@@ -1,10 +1,15 @@
 from app.services.share_service import generate_share_id, is_valid_share_id, validate_share_payload
 
 def test_generate_share_id():
-    sid = generate_share_id(15)
+    sid = generate_share_id()
     assert len(sid) == 15
     assert is_valid_share_id(sid)
 
+
+def test_is_valid_share_id_rejects_invalid_length():
+    assert not is_valid_share_id('a' * 14)
+    assert not is_valid_share_id('a' * 16)
+
 def test_validate_share_payload_invalid():
     # Not a dict
     is_valid, err, _ = validate_share_payload([])
@@ -26,10 +31,12 @@ def test_validate_share_payload_valid():
         'Result': {
             'SubjectExamInfoList': []
         },
-        'turnstile_token': 'abc'
+        'turnstile_token': 'abc',
+        'share_expiry': '7d'
     }
     is_valid, err, cleaned = validate_share_payload(payload)
     assert is_valid
     assert err is None
     assert 'turnstile_token' not in cleaned
+    assert 'share_expiry' not in cleaned
     assert 'Result' in cleaned