Kyle Pope 27c65ce40d Fix Round 2 code review findings: type safety, security, and correctness
Backend:
- Add Literal types for status/priority fields (project_task, todo, project schemas)
- Add AccentColor Literal validation to prevent CSS injection (settings schema)
- Add PIN max-length (72 char bcrypt limit) validation
- Fix event date filtering to use correct range overlap logic
- Add revocation check to auth_status endpoint for consistency
- Config: env-aware SECRET_KEY fail-fast, configurable COOKIE_SECURE

Frontend:
- Add withCredentials to axios for cross-origin cookie support
- Replace .toISOString() with local date formatter in DashboardPage
- Replace `as any` casts with proper indexed type access in forms
- Nginx: add CSP, Referrer-Policy headers; remove deprecated X-XSS-Protection
- Nginx: duplicate security headers in static asset location block

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 15:18:49 +08:00

44 lines
1.1 KiB
Python

from pydantic import BaseModel, ConfigDict
from datetime import datetime, date
from typing import Optional, Literal
TodoPriority = Literal["low", "medium", "high"]
class TodoCreate(BaseModel):
title: str
description: Optional[str] = None
priority: TodoPriority = "medium"
due_date: Optional[date] = None
category: Optional[str] = None
recurrence_rule: Optional[str] = None
project_id: Optional[int] = None
class TodoUpdate(BaseModel):
title: Optional[str] = None
description: Optional[str] = None
priority: Optional[TodoPriority] = None
due_date: Optional[date] = None
completed: Optional[bool] = None
category: Optional[str] = None
recurrence_rule: Optional[str] = None
project_id: Optional[int] = None
class TodoResponse(BaseModel):
id: int
title: str
description: Optional[str]
priority: str
due_date: Optional[date]
completed: bool
completed_at: Optional[datetime]
category: Optional[str]
recurrence_rule: Optional[str]
project_id: Optional[int]
created_at: datetime
updated_at: datetime
model_config = ConfigDict(from_attributes=True)