taskdog-server 0.28.0__tar.gz → 0.29.0__tar.gz

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taskdog-server
-Version: 0.28.0
+Version: 0.29.0
 Summary: FastAPI server for Taskdog task management system
 Author: Kohei Wada
 License: MIT
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: taskdog-core==0.28.0
+Requires-Dist: taskdog-core==0.29.0
 Requires-Dist: fastapi>=0.141.1
 Requires-Dist: uvicorn[standard]>=0.52.3
 Requires-Dist: pydantic>=2.10.0
@@ -109,7 +109,7 @@ See [Authentication Documentation](https://kohei-wada.github.io/taskdog/referenc
 
 ## WebSocket Real-time Updates
 
-Connect to `/ws` for real-time task notifications:
+Connect to `/ws` for real-time task notifications. Clients that can set headers should send `X-Api-Key`; browsers can only use `?token=`, which is written to access logs:
 
 ```javascript
 const ws = new WebSocket('ws://localhost:8000/ws?token=your-api-key');

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/README.md

@@ -79,7 +79,7 @@ See [Authentication Documentation](https://kohei-wada.github.io/taskdog/referenc
 
 ## WebSocket Real-time Updates
 
-Connect to `/ws` for real-time task notifications:
+Connect to `/ws` for real-time task notifications. Clients that can set headers should send `X-Api-Key`; browsers can only use `?token=`, which is written to access logs:
 
 ```javascript
 const ws = new WebSocket('ws://localhost:8000/ws?token=your-api-key');

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "taskdog-server"
-version = "0.28.0"
+version = "0.29.0"
 description = "FastAPI server for Taskdog task management system"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -18,7 +18,7 @@ classifiers = [
 ]
 
 dependencies = [
-    "taskdog-core==0.28.0",
+    "taskdog-core==0.29.0",
     "fastapi>=0.141.1",
     "uvicorn[standard]>=0.52.3",
     "pydantic>=2.10.0",
@@ -54,12 +54,6 @@ include = ["taskdog*"]
 [tool.setuptools.package-data]
 taskdog_server = ["py.typed"]
 
-[tool.mypy]
-python_version = "3.13"
-strict = true
-# Disable unused-ignore warnings (environment-dependent)
-warn_unused_ignores = false
-
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 python_files = ["test_*.py"]

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server/api/dependencies.py

@@ -102,23 +102,27 @@ def initialize_api_context(
             holiday_checker = HolidayChecker(config.region.country)
 
     # Initialize repository using factory based on storage config (shared engine)
-    repository = RepositoryFactory.create(config.storage, engine=engine)
+    repository = RepositoryFactory.create(
+        config.storage, engine=engine, time_provider=time_provider
+    )
 
     # Initialize audit log repository (shared engine)
     audit_log_repository = SqliteAuditLogRepository(db_url, engine=engine)
 
     # Initialize controllers
     query_controller = QueryController(repository, notes_repository, time_provider)
-    lifecycle_controller = TaskLifecycleController(repository, config)
+    lifecycle_controller = TaskLifecycleController(repository, config, time_provider)
     relationship_controller = TaskRelationshipController(repository, config)
     analytics_controller = TaskAnalyticsController(
         repository, config, holiday_checker, audit_log_repository
     )
-    crud_controller = TaskCrudController(repository, config, holiday_checker)
+    crud_controller = TaskCrudController(
+        repository, config, time_provider, holiday_checker
+    )
     audit_log_controller = AuditLogController(audit_log_repository, time_provider)
     notes_controller = NotesController(repository, notes_repository)
 
-    bulk_service = BulkOperationService(repository)
+    bulk_service = BulkOperationService(repository, time_provider)
 
     # Backup/restore controller over a storage-neutral port
     backup_controller = BackupController(SqliteBackupStore(db_url))

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server/api/models/requests.py

@@ -6,6 +6,10 @@ from pydantic import BaseModel, Field, field_validator, model_validator
 
 from taskdog_core.domain.entities.task import TaskStatus
 from taskdog_core.shared.constants import MAX_TASK_NAME_LENGTH
+from taskdog_server.api.validators import (
+    MAX_NOTES_LENGTH,
+    MAX_TASK_IDS_PER_REQUEST,
+)
 from taskdog_server.api.validators import validate_tags as _validate_tags
 
 
@@ -147,7 +151,10 @@ class BulkTaskIdsRequest(BaseModel):
     """Request model for bulk task operations."""
 
     task_ids: list[int] = Field(
-        ..., min_length=1, description="List of task IDs to operate on"
+        ...,
+        min_length=1,
+        max_length=MAX_TASK_IDS_PER_REQUEST,
+        description="List of task IDs to operate on",
     )
 
 
@@ -166,6 +173,7 @@ class OptimizeScheduleRequest(BaseModel):
     )
     task_ids: list[int] | None = Field(
         None,
+        max_length=MAX_TASK_IDS_PER_REQUEST,
         description="Specific task IDs to optimize (None means all schedulable tasks)",
     )
     include_all_days: bool = Field(
@@ -177,4 +185,6 @@ class OptimizeScheduleRequest(BaseModel):
 class UpdateNotesRequest(BaseModel):
     """Request model for updating task notes."""
 
-    content: str = Field(..., description="Notes content (markdown)")
+    content: str = Field(
+        ..., max_length=MAX_NOTES_LENGTH, description="Notes content (markdown)"
+    )

taskdog_server-0.29.0/src/taskdog_server/api/routers/analytics.py

@@ -0,0 +1,420 @@
+"""Analytics endpoints (statistics, optimization, gantt chart)."""
+
+from typing import TYPE_CHECKING, Annotated, Literal
+
+from fastapi import APIRouter, Query
+
+from taskdog_core.application.dto.query_inputs import ListTasksInput
+
+if TYPE_CHECKING:
+    from taskdog_core.application.dto.task_dto import TaskSummaryDto
+
+from taskdog_server.api.dependencies import (
+    AnalyticsControllerDep,
+    AuditLogControllerDep,
+    AuthenticatedClientDep,
+    EventBroadcasterDep,
+    HolidayCheckerDep,
+    QueryControllerDep,
+    TimeProviderDep,
+)
+from taskdog_server.api.models.requests import OptimizeScheduleRequest
+from taskdog_server.api.models.responses import (
+    ActivityPattern,
+    CompletionStatistics,
+    DeadlineStatistics,
+    EstimationStatistics,
+    OptimizationResponse,
+    OptimizationSummary,
+    PriorityDistribution,
+    RescheduleStatisticsData,
+    SchedulingFailure,
+    StatisticsResponse,
+    TagStatisticsItem,
+    TagStatisticsResponse,
+    TaskListResponse,
+    TaskSummaryResponse,
+    TimeStatistics,
+    TrendData,
+)
+from taskdog_server.api.utils import parse_iso_date
+from taskdog_server.api.validators import MAX_TAG_FILTERS
+
+router = APIRouter()
+
+
+@router.get("/statistics", response_model=StatisticsResponse)
+def get_statistics(
+    controller: AnalyticsControllerDep,
+    _client_name: AuthenticatedClientDep,
+    period: Literal["all", "7d", "30d"] = Query(
+        "all", description="Time period: all, 7d, or 30d"
+    ),
+) -> StatisticsResponse:
+    """Get task statistics for a time period.
+
+    Args:
+        controller: Analytics controller dependency
+        period: Time period (all, 7d, 30d)
+
+    Returns:
+        Task statistics including completion, time, estimation, deadline, and trends
+    """
+    result = controller.calculate_statistics(period=period)
+
+    # Helper to convert TaskSummaryDto to TaskSummaryResponse
+    def to_task_summary(
+        dto: "TaskSummaryDto | None",
+    ) -> TaskSummaryResponse | None:
+        if dto is None:
+            return None
+        return TaskSummaryResponse(
+            id=dto.id,
+            name=dto.name,
+            estimated_duration=dto.estimated_duration,
+            actual_duration_hours=dto.actual_duration_hours,
+        )
+
+    def to_task_summary_list(
+        dtos: "list[TaskSummaryDto]",
+    ) -> list[TaskSummaryResponse]:
+        if not dtos:
+            return []
+        return [
+            TaskSummaryResponse(
+                id=d.id,
+                name=d.name,
+                estimated_duration=d.estimated_duration,
+                actual_duration_hours=d.actual_duration_hours,
+            )
+            for d in dtos
+        ]
+
+    # Convert DTO to response model
+    response = StatisticsResponse(
+        completion=CompletionStatistics(
+            total=result.task_stats.total_tasks,
+            completed=result.task_stats.completed_count,
+            in_progress=result.task_stats.in_progress_count,
+            pending=result.task_stats.pending_count,
+            canceled=result.task_stats.canceled_count,
+            completion_rate=result.task_stats.completion_rate,
+        ),
+        time=(
+            TimeStatistics(
+                total_work_hours=result.time_stats.total_work_hours,
+                average_work_hours=result.time_stats.average_work_hours,
+                median_work_hours=result.time_stats.median_work_hours,
+                longest_task=to_task_summary(result.time_stats.longest_task),
+                shortest_task=to_task_summary(result.time_stats.shortest_task),
+                tasks_with_time_tracking=result.time_stats.tasks_with_time_tracking,
+            )
+            if result.time_stats
+            else None
+        ),
+        estimation=(
+            EstimationStatistics(
+                total_tasks_with_estimation=result.estimation_stats.total_tasks_with_estimation,
+                accuracy_rate=result.estimation_stats.accuracy_rate,
+                over_estimated_count=result.estimation_stats.over_estimated_count,
+                under_estimated_count=result.estimation_stats.under_estimated_count,
+                exact_count=result.estimation_stats.exact_count,
+                best_estimated_tasks=to_task_summary_list(
+                    result.estimation_stats.best_estimated_tasks
+                ),
+                worst_estimated_tasks=to_task_summary_list(
+                    result.estimation_stats.worst_estimated_tasks
+                ),
+                estimation_pairs=result.estimation_stats.estimation_pairs,
+            )
+            if result.estimation_stats
+            else None
+        ),
+        deadline=(
+            DeadlineStatistics(
+                total_tasks_with_deadline=result.deadline_stats.total_tasks_with_deadline,
+                met_deadline_count=result.deadline_stats.met_deadline_count,
+                missed_deadline_count=result.deadline_stats.missed_deadline_count,
+                compliance_rate=result.deadline_stats.compliance_rate,
+                average_delay_days=result.deadline_stats.average_delay_days,
+            )
+            if result.deadline_stats
+            else None
+        ),
+        priority=PriorityDistribution(
+            distribution=result.priority_stats.priority_completion_map,
+            high_priority_count=result.priority_stats.high_priority_count,
+            medium_priority_count=result.priority_stats.medium_priority_count,
+            low_priority_count=result.priority_stats.low_priority_count,
+            high_priority_completion_rate=result.priority_stats.high_priority_completion_rate,
+        ),
+        trends=(
+            TrendData(
+                last_7_days_completed=result.trend_stats.last_7_days_completed,
+                last_30_days_completed=result.trend_stats.last_30_days_completed,
+                weekly_completion_trend=result.trend_stats.weekly_completion_trend,
+                monthly_completion_trend=result.trend_stats.monthly_completion_trend,
+            )
+            if result.trend_stats
+            else None
+        ),
+        activity=(
+            ActivityPattern(
+                hourly_completions=result.activity_stats.hourly_completions,
+                daily_completions=result.activity_stats.daily_completions,
+                heatmap=result.activity_stats.heatmap,
+                total_completed_with_time=result.activity_stats.total_completed_with_time,
+            )
+            if result.activity_stats
+            else None
+        ),
+        reschedule=(
+            RescheduleStatisticsData.model_validate(
+                result.reschedule_stats, from_attributes=True
+            )
+            if result.reschedule_stats
+            else None
+        ),
+    )
+    return response
+
+
+@router.get("/tags/statistics", response_model=TagStatisticsResponse)
+def get_tag_statistics(
+    controller: QueryControllerDep,
+    _client_name: AuthenticatedClientDep,
+) -> TagStatisticsResponse:
+    """Get tag usage statistics.
+
+    Args:
+        controller: Query controller dependency
+
+    Returns:
+        Tag statistics including count and completion rate per tag
+    """
+    result = controller.get_tag_statistics()
+
+    # Convert DTO to response model
+    # Note: TagStatisticsOutput.tag_counts is a dict[str, int]
+    # completion_rate is not available in the DTO, so we set it to 0.0
+    tags = [
+        TagStatisticsItem(tag=tag_name, count=count, completion_rate=0.0)
+        for tag_name, count in result.tag_counts.items()
+    ]
+
+    return TagStatisticsResponse(tags=tags, total_tags=result.total_tags)
+
+
+@router.get("/gantt", response_model=TaskListResponse)
+def get_gantt_chart(
+    controller: QueryControllerDep,
+    holiday_checker: HolidayCheckerDep,
+    _client_name: AuthenticatedClientDep,
+    include_archived: Annotated[
+        bool, Query(alias="all", description="Include archived tasks")
+    ] = False,
+    status_filter: Annotated[
+        str | None, Query(alias="status", description="Filter by status")
+    ] = None,
+    tags: Annotated[
+        list[str] | None,
+        Query(max_length=MAX_TAG_FILTERS, description="Filter by tags (OR logic)"),
+    ] = None,
+    filter_start_date: Annotated[
+        str | None, Query(description="Task filter start date (ISO format)")
+    ] = None,
+    filter_end_date: Annotated[
+        str | None, Query(description="Task filter end date (ISO format)")
+    ] = None,
+    start_date: Annotated[
+        str | None,
+        Query(
+            description="Chart start date (ISO format). "
+            "Filters tasks when no task filter dates are given."
+        ),
+    ] = None,
+    end_date: Annotated[
+        str | None,
+        Query(
+            description="Chart end date (ISO format). "
+            "Filters tasks when no task filter dates are given."
+        ),
+    ] = None,
+    sort: Annotated[str, Query(description="Sort field")] = "deadline",
+    reverse: Annotated[bool, Query(description="Reverse sort order")] = False,
+) -> TaskListResponse:
+    """Get Gantt chart data with workload calculations.
+
+    Returns the shared task list plus the Gantt overlay (daily hours, workload,
+    holidays); clients join them by task id.
+
+    Without task filter dates, chart dates also filter tasks.
+
+    Args:
+        controller: Query controller dependency
+        holiday_checker: Holiday checker dependency
+        include_archived: Include archived tasks
+        status_filter: Filter by task status
+        tags: Filter by tags (OR logic)
+        filter_start_date: Task filter start date
+        filter_end_date: Task filter end date
+        start_date: Chart start date
+        end_date: Chart end date
+        sort: Sort field name
+        reverse: Reverse sort order
+
+    Returns:
+        Task list with the Gantt overlay populated
+    """
+    # Parse date strings to date objects
+    start = parse_iso_date(start_date)
+    end = parse_iso_date(end_date)
+    if filter_start_date is None and filter_end_date is None:
+        task_start = start
+        task_end = end
+    else:
+        task_start = parse_iso_date(filter_start_date)
+        task_end = parse_iso_date(filter_end_date)
+
+    # Create Input DTO (filter building is done in Use Case)
+    input_dto = ListTasksInput(
+        include_archived=include_archived,
+        status=status_filter,
+        tags=tags or [],
+        start_date=task_start,
+        end_date=task_end,
+        sort_by=sort,
+        reverse=reverse,
+    )
+
+    # Single fetch builds both the task list and the Gantt overlay
+    result = controller.list_tasks(
+        input_dto=input_dto,
+        include_gantt=True,
+        gantt_start_date=start,
+        gantt_end_date=end,
+        holiday_checker=holiday_checker,
+    )
+
+    return TaskListResponse.from_dto(result)
+
+
+@router.post("/optimize", response_model=OptimizationResponse)
+def optimize_schedule(
+    request: OptimizeScheduleRequest,
+    controller: AnalyticsControllerDep,
+    broadcaster: EventBroadcasterDep,
+    audit_controller: AuditLogControllerDep,
+    time_provider: TimeProviderDep,
+    client_name: AuthenticatedClientDep,
+) -> OptimizationResponse:
+    """Optimize task schedules using specified algorithm.
+
+    Args:
+        request: Optimization parameters
+        controller: Analytics controller dependency
+        broadcaster: Event broadcaster dependency
+        time_provider: Time provider dependency
+        client_name: Authenticated client name (used for broadcast exclusion)
+
+    Returns:
+        Optimization results with summary and failures
+
+    Raises:
+        TaskNotFoundException: 404 via app-wide handler if a task ID is unknown
+        TaskValidationError: 400 via app-wide handler (incl. NoSchedulableTasksError)
+    """
+    # Use current date if not specified
+    start_date = request.start_date or time_provider.now()
+
+    # Run synchronously
+    result = controller.optimize_schedule(
+        algorithm=request.algorithm,
+        start_date=start_date,
+        max_hours_per_day=request.max_hours_per_day,
+        force_override=request.force_override,
+        task_ids=request.task_ids,
+        include_all_days=request.include_all_days,
+    )
+
+    # Broadcast WebSocket event in background (exclude the requester by client name)
+    broadcaster.schedule_optimized(
+        len(result.successful_tasks),
+        len(result.failed_tasks),
+        request.algorithm,
+        client_name,
+    )
+
+    # Audit log
+    audit_controller.log_operation(
+        operation="optimize_schedule",
+        resource_type="schedule",
+        resource_id=None,
+        resource_name=None,
+        client_name=client_name,
+        new_values={
+            "algorithm": request.algorithm,
+            "scheduled_tasks": len(result.successful_tasks),
+            "failed_tasks": len(result.failed_tasks),
+            "total_hours": result.summary.total_hours,
+            "task_ids": request.task_ids,
+        },
+        success=True,
+    )
+
+    # Convert DTO to response model
+    failures = [
+        SchedulingFailure(task_id=f.task.id, task_name=f.task.name, reason=f.reason)
+        for f in result.failed_tasks
+    ]
+
+    # Calculate date range from daily allocations
+    if result.daily_allocations:
+        dates = list(result.daily_allocations.keys())
+        opt_start_date = min(dates)
+        opt_end_date = max(dates)
+    else:
+        opt_start_date = start_date.date()
+        opt_end_date = start_date.date()
+
+    # Build optimization message
+    if result.all_failed():
+        message = f"No tasks were scheduled. {len(result.failed_tasks)} task(s) failed."
+    elif result.has_failures():
+        message = f"Partially optimized: {len(result.successful_tasks)} succeeded, {len(result.failed_tasks)} failed."
+    else:
+        message = f"Successfully optimized {len(result.successful_tasks)} task(s)."
+
+    return OptimizationResponse(
+        summary=OptimizationSummary(
+            total_tasks=len(result.successful_tasks) + len(result.failed_tasks),
+            scheduled_tasks=len(result.successful_tasks),
+            failed_tasks=len(result.failed_tasks),
+            total_hours=result.summary.total_hours,
+            start_date=opt_start_date,
+            end_date=opt_end_date,
+            algorithm=request.algorithm,
+        ),
+        failures=failures,
+        message=message,
+    )
+
+
+@router.get("/algorithms", response_model=list[dict[str, str]])
+def list_algorithms(
+    controller: QueryControllerDep,
+    _client_name: AuthenticatedClientDep,
+) -> list[dict[str, str]]:
+    """List available optimization algorithms.
+
+    Args:
+        controller: Query controller dependency
+
+    Returns:
+        List of algorithms with name, display name, and description
+    """
+    algorithms = controller.get_algorithm_metadata()
+    return [
+        {"name": name, "display_name": display_name, "description": description}
+        for name, display_name, description in algorithms
+    ]

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server/api/routers/tasks.py

@@ -27,6 +27,7 @@ from taskdog_server.api.models.responses import (
     UpdateTaskResponse,
 )
 from taskdog_server.api.utils import parse_iso_date
+from taskdog_server.api.validators import MAX_TAG_FILTERS
 
 router = APIRouter()
 
@@ -97,7 +98,8 @@ def list_tasks(
         str | None, Query(alias="status", description="Filter by status")
     ] = None,
     tags: Annotated[
-        list[str] | None, Query(description="Filter by tags (OR logic)")
+        list[str] | None,
+        Query(max_length=MAX_TAG_FILTERS, description="Filter by tags (OR logic)"),
     ] = None,
     start_date: Annotated[str | None, Query(description="Filter by start date")] = None,
     end_date: Annotated[str | None, Query(description="Filter by end date")] = None,
@@ -190,7 +192,8 @@ def get_executable_tasks(
     controller: QueryControllerDep,
     _client_name: AuthenticatedClientDep,
     tags: Annotated[
-        list[str] | None, Query(description="Filter by tags (OR logic)")
+        list[str] | None,
+        Query(max_length=MAX_TAG_FILTERS, description="Filter by tags (OR logic)"),
     ] = None,
     limit: Annotated[int, Query(ge=1, description="Maximum tasks to return")] = 10,
 ) -> NextTasksResponse:
@@ -372,7 +375,7 @@ def restore_task(
     return TaskOperationResponse.from_dto(result)
 
 
-@router.delete("/{task_id}")
+@router.delete("/{task_id}", response_model=TaskOperationResponse)
 def delete_task(
     task_id: int,
     controller: CrudControllerDep,

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server/api/routers/websocket.py

@@ -6,7 +6,7 @@ real-time notifications about task changes.
 
 import uuid
 
-from fastapi import APIRouter, Query, WebSocket, WebSocketDisconnect
+from fastapi import APIRouter, Header, Query, WebSocket, WebSocketDisconnect
 
 from taskdog_server.api.dependencies import (
     ConnectionManagerWsDep,
@@ -22,7 +22,12 @@ async def websocket_endpoint(
     websocket: WebSocket,
     manager: ConnectionManagerWsDep,
     server_config: ServerConfigWsDep,
-    token: str | None = Query(None, description="API key for authentication"),
+    x_api_key: str | None = Header(None, description="API key for authentication"),
+    token: str | None = Query(
+        None,
+        description="API key as query parameter, for clients that cannot set "
+        "headers (browsers). It appears in access logs; prefer X-Api-Key.",
+    ),
 ) -> None:
     """WebSocket endpoint for real-time task updates.
 
@@ -30,13 +35,16 @@ async def websocket_endpoint(
     when tasks are created, updated, or deleted.
 
     Authentication:
-        Pass API key as query parameter: /ws?token=sk-xxx
+        Send the API key in the X-Api-Key header. Browsers cannot set
+        WebSocket headers, so ?token= is still accepted, but the key then
+        shows up in access logs. The header wins when both are present.
 
     Args:
         websocket: The WebSocket connection
         manager: Connection manager dependency
         server_config: Server configuration dependency
-        token: API key for authentication (query parameter)
+        x_api_key: API key from the X-Api-Key header
+        token: API key from the query string (fallback)
 
     Message Format:
         {
@@ -48,7 +56,9 @@ async def websocket_endpoint(
     """
     # Validate API key before accepting connection
     try:
-        client_name = validate_api_key_for_websocket(token, server_config)
+        client_name = validate_api_key_for_websocket(
+            x_api_key if x_api_key is not None else token, server_config
+        )
     except ValueError as e:
         # Use standard WebSocket close code 1008 (Policy Violation) for auth failures
         await websocket.close(code=1008, reason=str(e))

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server/api/validators.py

@@ -2,6 +2,11 @@
 
 from taskdog_core.shared.constants import MAX_TAG_LENGTH, MAX_TAGS_PER_TASK
 
+# Request size bounds against oversized payloads; far above real usage.
+MAX_TASK_IDS_PER_REQUEST = 1000
+MAX_NOTES_LENGTH = 1_000_000
+MAX_TAG_FILTERS = 100
+
 
 def validate_tags(tags: list[str]) -> list[str]:
     """Validate tags are non-empty, unique, and within limits.

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server/main.py

@@ -1,9 +1,20 @@
 """Main entry point for Taskdog API server."""
 
 import argparse
+import ipaddress
 import sys
 
 from taskdog_server import __version__
+from taskdog_server.config.server_config_manager import ServerConfigManager
+
+
+def _is_loopback(host: str) -> bool:
+    if host == "localhost":
+        return True
+    try:
+        return ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return False
 
 
 def main() -> None:
@@ -14,7 +25,7 @@ def main() -> None:
         epilog="""
 Examples:
   taskdog-server                        # Start server on default host:port
-  taskdog-server --host 0.0.0.0         # Listen on all interfaces
+  taskdog-server --host 0.0.0.0         # Listen on all interfaces (enable auth first)
   taskdog-server --port 3000            # Use custom port
   taskdog-server --reload               # Enable auto-reload for dev
 
@@ -56,6 +67,14 @@ The API will be available at:
         )
         sys.exit(1)
 
+    if not _is_loopback(args.host) and not ServerConfigManager.load().auth.enabled:
+        print(
+            f"WARNING: authentication is disabled but the server listens on {args.host}. "
+            "Anyone who can reach this address can read and delete your tasks. "
+            "Enable [auth] in server.toml or set TASKDOG_AUTH_ENABLED=true.",
+            file=sys.stderr,
+        )
+
     print(f"Starting Taskdog API server on {args.host}:{args.port}")
     print(f"API documentation: http://{args.host}:{args.port}/docs")
     print(f"Health check: http://{args.host}:{args.port}/health")

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taskdog-server
-Version: 0.28.0
+Version: 0.29.0
 Summary: FastAPI server for Taskdog task management system
 Author: Kohei Wada
 License: MIT
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: taskdog-core==0.28.0
+Requires-Dist: taskdog-core==0.29.0
 Requires-Dist: fastapi>=0.141.1
 Requires-Dist: uvicorn[standard]>=0.52.3
 Requires-Dist: pydantic>=2.10.0
@@ -109,7 +109,7 @@ See [Authentication Documentation](https://kohei-wada.github.io/taskdog/referenc
 
 ## WebSocket Real-time Updates
 
-Connect to `/ws` for real-time task notifications:
+Connect to `/ws` for real-time task notifications. Clients that can set headers should send `X-Api-Key`; browsers can only use `?token=`, which is written to access logs:
 
 ```javascript
 const ws = new WebSocket('ws://localhost:8000/ws?token=your-api-key');

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server.egg-info/SOURCES.txt

@@ -39,4 +39,5 @@ src/taskdog_server/infrastructure/logging/__init__.py
 src/taskdog_server/infrastructure/logging/config.py
 src/taskdog_server/websocket/__init__.py
 src/taskdog_server/websocket/broadcaster.py
-src/taskdog_server/websocket/connection_manager.py
+src/taskdog_server/websocket/connection_manager.py
+tests/test_main.py

{taskdog_server-0.28.0 → taskdog_server-0.29.0}/src/taskdog_server.egg-info/requires.txt

@@ -1,4 +1,4 @@
-taskdog-core==0.28.0
+taskdog-core==0.29.0
 fastapi>=0.141.1
 uvicorn[standard]>=0.52.3
 pydantic>=2.10.0

taskdog_server-0.29.0/tests/test_main.py

@@ -0,0 +1,39 @@
+"""Tests for the server entry point."""
+
+from unittest.mock import patch
+
+import pytest
+
+from taskdog_server.config.server_config_manager import AuthConfig, ServerConfig
+from taskdog_server.main import main
+
+
+def _run_main(host: str, auth_enabled: bool) -> None:
+    config = ServerConfig(auth=AuthConfig(enabled=auth_enabled))
+    with (
+        patch("sys.argv", ["taskdog-server", "--host", host]),
+        patch("taskdog_server.main.ServerConfigManager.load", return_value=config),
+        patch("uvicorn.run"),
+    ):
+        main()
+
+
+class TestExposureWarning:
+    """Test the warning for non-loopback binds without auth."""
+
+    @pytest.mark.parametrize("host", ["0.0.0.0", "192.168.1.10", "::"])
+    def test_warns_on_non_loopback_without_auth(self, capsys, host):
+        _run_main(host, auth_enabled=False)
+
+        assert "authentication is disabled" in capsys.readouterr().err
+
+    @pytest.mark.parametrize("host", ["127.0.0.1", "localhost", "::1"])
+    def test_no_warning_on_loopback(self, capsys, host):
+        _run_main(host, auth_enabled=False)
+
+        assert capsys.readouterr().err == ""
+
+    def test_no_warning_when_auth_enabled(self, capsys):
+        _run_main("0.0.0.0", auth_enabled=True)
+
+        assert capsys.readouterr().err == ""

taskdog_server-0.28.0/src/taskdog_server/api/routers/analytics.py

@@ -1,425 +0,0 @@
-"""Analytics endpoints (statistics, optimization, gantt chart)."""
-
-from typing import TYPE_CHECKING, Annotated
-
-from fastapi import APIRouter, HTTPException, Query, status
-
-from taskdog_core.application.dto.query_inputs import ListTasksInput
-
-if TYPE_CHECKING:
-    from taskdog_core.application.dto.task_dto import TaskSummaryDto
-
-from taskdog_core.domain.exceptions.task_exceptions import (
-    NoSchedulableTasksError,
-    TaskNotFoundException,
-    TaskValidationError,
-)
-from taskdog_server.api.dependencies import (
-    AnalyticsControllerDep,
-    AuditLogControllerDep,
-    AuthenticatedClientDep,
-    EventBroadcasterDep,
-    HolidayCheckerDep,
-    QueryControllerDep,
-    TimeProviderDep,
-)
-from taskdog_server.api.models.requests import OptimizeScheduleRequest
-from taskdog_server.api.models.responses import (
-    ActivityPattern,
-    CompletionStatistics,
-    DeadlineStatistics,
-    EstimationStatistics,
-    OptimizationResponse,
-    OptimizationSummary,
-    PriorityDistribution,
-    RescheduleStatisticsData,
-    SchedulingFailure,
-    StatisticsResponse,
-    TagStatisticsItem,
-    TagStatisticsResponse,
-    TaskListResponse,
-    TaskSummaryResponse,
-    TimeStatistics,
-    TrendData,
-)
-from taskdog_server.api.utils import parse_iso_date
-
-VALID_PERIODS = ("all", "7d", "30d")
-
-router = APIRouter()
-
-
-@router.get("/statistics", response_model=StatisticsResponse)
-def get_statistics(
-    controller: AnalyticsControllerDep,
-    _client_name: AuthenticatedClientDep,
-    period: str = Query(VALID_PERIODS[0], description="Time period: all, 7d, or 30d"),
-) -> StatisticsResponse:
-    """Get task statistics for a time period.
-
-    Args:
-        controller: Analytics controller dependency
-        period: Time period (all, 7d, 30d)
-
-    Returns:
-        Task statistics including completion, time, estimation, deadline, and trends
-
-    Raises:
-        HTTPException: 400 if period is invalid
-    """
-    if period not in VALID_PERIODS:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="Period must be one of: all, 7d, 30d",
-        )
-
-    try:
-        result = controller.calculate_statistics(period=period)
-
-        # Helper to convert TaskSummaryDto to TaskSummaryResponse
-        def to_task_summary(
-            dto: "TaskSummaryDto | None",
-        ) -> TaskSummaryResponse | None:
-            if dto is None:
-                return None
-            return TaskSummaryResponse(
-                id=dto.id,
-                name=dto.name,
-                estimated_duration=dto.estimated_duration,
-                actual_duration_hours=dto.actual_duration_hours,
-            )
-
-        def to_task_summary_list(
-            dtos: "list[TaskSummaryDto]",
-        ) -> list[TaskSummaryResponse]:
-            if not dtos:
-                return []
-            return [
-                TaskSummaryResponse(
-                    id=d.id,
-                    name=d.name,
-                    estimated_duration=d.estimated_duration,
-                    actual_duration_hours=d.actual_duration_hours,
-                )
-                for d in dtos
-            ]
-
-        # Convert DTO to response model
-        response = StatisticsResponse(
-            completion=CompletionStatistics(
-                total=result.task_stats.total_tasks,
-                completed=result.task_stats.completed_count,
-                in_progress=result.task_stats.in_progress_count,
-                pending=result.task_stats.pending_count,
-                canceled=result.task_stats.canceled_count,
-                completion_rate=result.task_stats.completion_rate,
-            ),
-            time=(
-                TimeStatistics(
-                    total_work_hours=result.time_stats.total_work_hours,
-                    average_work_hours=result.time_stats.average_work_hours,
-                    median_work_hours=result.time_stats.median_work_hours,
-                    longest_task=to_task_summary(result.time_stats.longest_task),
-                    shortest_task=to_task_summary(result.time_stats.shortest_task),
-                    tasks_with_time_tracking=result.time_stats.tasks_with_time_tracking,
-                )
-                if result.time_stats
-                else None
-            ),
-            estimation=(
-                EstimationStatistics(
-                    total_tasks_with_estimation=result.estimation_stats.total_tasks_with_estimation,
-                    accuracy_rate=result.estimation_stats.accuracy_rate,
-                    over_estimated_count=result.estimation_stats.over_estimated_count,
-                    under_estimated_count=result.estimation_stats.under_estimated_count,
-                    exact_count=result.estimation_stats.exact_count,
-                    best_estimated_tasks=to_task_summary_list(
-                        result.estimation_stats.best_estimated_tasks
-                    ),
-                    worst_estimated_tasks=to_task_summary_list(
-                        result.estimation_stats.worst_estimated_tasks
-                    ),
-                    estimation_pairs=result.estimation_stats.estimation_pairs,
-                )
-                if result.estimation_stats
-                else None
-            ),
-            deadline=(
-                DeadlineStatistics(
-                    total_tasks_with_deadline=result.deadline_stats.total_tasks_with_deadline,
-                    met_deadline_count=result.deadline_stats.met_deadline_count,
-                    missed_deadline_count=result.deadline_stats.missed_deadline_count,
-                    compliance_rate=result.deadline_stats.compliance_rate,
-                    average_delay_days=result.deadline_stats.average_delay_days,
-                )
-                if result.deadline_stats
-                else None
-            ),
-            priority=PriorityDistribution(
-                distribution=result.priority_stats.priority_completion_map,
-                high_priority_count=result.priority_stats.high_priority_count,
-                medium_priority_count=result.priority_stats.medium_priority_count,
-                low_priority_count=result.priority_stats.low_priority_count,
-                high_priority_completion_rate=result.priority_stats.high_priority_completion_rate,
-            ),
-            trends=(
-                TrendData(
-                    last_7_days_completed=result.trend_stats.last_7_days_completed,
-                    last_30_days_completed=result.trend_stats.last_30_days_completed,
-                    weekly_completion_trend=result.trend_stats.weekly_completion_trend,
-                    monthly_completion_trend=result.trend_stats.monthly_completion_trend,
-                )
-                if result.trend_stats
-                else None
-            ),
-            activity=(
-                ActivityPattern(
-                    hourly_completions=result.activity_stats.hourly_completions,
-                    daily_completions=result.activity_stats.daily_completions,
-                    heatmap=result.activity_stats.heatmap,
-                    total_completed_with_time=result.activity_stats.total_completed_with_time,
-                )
-                if result.activity_stats
-                else None
-            ),
-            reschedule=(
-                RescheduleStatisticsData.model_validate(
-                    result.reschedule_stats, from_attributes=True
-                )
-                if result.reschedule_stats
-                else None
-            ),
-        )
-        return response
-    except TaskValidationError as e:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)
-        ) from e
-
-
-@router.get("/tags/statistics", response_model=TagStatisticsResponse)
-def get_tag_statistics(
-    controller: QueryControllerDep,
-    _client_name: AuthenticatedClientDep,
-) -> TagStatisticsResponse:
-    """Get tag usage statistics.
-
-    Args:
-        controller: Query controller dependency
-
-    Returns:
-        Tag statistics including count and completion rate per tag
-    """
-    result = controller.get_tag_statistics()
-
-    # Convert DTO to response model
-    # Note: TagStatisticsOutput.tag_counts is a dict[str, int]
-    # completion_rate is not available in the DTO, so we set it to 0.0
-    tags = [
-        TagStatisticsItem(tag=tag_name, count=count, completion_rate=0.0)
-        for tag_name, count in result.tag_counts.items()
-    ]
-
-    return TagStatisticsResponse(tags=tags, total_tags=result.total_tags)
-
-
-@router.get("/gantt", response_model=TaskListResponse)
-def get_gantt_chart(
-    controller: QueryControllerDep,
-    holiday_checker: HolidayCheckerDep,
-    _client_name: AuthenticatedClientDep,
-    include_archived: Annotated[
-        bool, Query(alias="all", description="Include archived tasks")
-    ] = False,
-    status_filter: Annotated[
-        str | None, Query(alias="status", description="Filter by status")
-    ] = None,
-    tags: Annotated[
-        list[str] | None, Query(description="Filter by tags (OR logic)")
-    ] = None,
-    start_date: Annotated[
-        str | None, Query(description="Chart start date (ISO format)")
-    ] = None,
-    end_date: Annotated[
-        str | None, Query(description="Chart end date (ISO format)")
-    ] = None,
-    sort: Annotated[str, Query(description="Sort field")] = "deadline",
-    reverse: Annotated[bool, Query(description="Reverse sort order")] = False,
-) -> TaskListResponse:
-    """Get Gantt chart data with workload calculations.
-
-    Returns the shared task list plus the Gantt overlay (daily hours, workload,
-    holidays); clients join them by task id.
-
-    Args:
-        controller: Query controller dependency
-        holiday_checker: Holiday checker dependency
-        include_archived: Include archived tasks
-        status_filter: Filter by task status
-        tags: Filter by tags (OR logic)
-        start_date: Chart start date
-        end_date: Chart end date
-        sort: Sort field name
-        reverse: Reverse sort order
-
-    Returns:
-        Task list with the Gantt overlay populated
-    """
-    # Parse date strings to date objects
-    start = parse_iso_date(start_date)
-    end = parse_iso_date(end_date)
-
-    # Create Input DTO (filter building is done in Use Case)
-    input_dto = ListTasksInput(
-        include_archived=include_archived,
-        status=status_filter,
-        tags=tags or [],
-        start_date=start,
-        end_date=end,
-        sort_by=sort,
-        reverse=reverse,
-    )
-
-    # Single fetch builds both the task list and the Gantt overlay
-    result = controller.list_tasks(
-        input_dto=input_dto,
-        include_gantt=True,
-        gantt_start_date=start,
-        gantt_end_date=end,
-        holiday_checker=holiday_checker,
-    )
-
-    return TaskListResponse.from_dto(result)
-
-
-@router.post("/optimize", response_model=OptimizationResponse)
-def optimize_schedule(
-    request: OptimizeScheduleRequest,
-    controller: AnalyticsControllerDep,
-    broadcaster: EventBroadcasterDep,
-    audit_controller: AuditLogControllerDep,
-    time_provider: TimeProviderDep,
-    client_name: AuthenticatedClientDep,
-) -> OptimizationResponse:
-    """Optimize task schedules using specified algorithm.
-
-    Args:
-        request: Optimization parameters
-        controller: Analytics controller dependency
-        broadcaster: Event broadcaster dependency
-        time_provider: Time provider dependency
-        client_name: Authenticated client name (used for broadcast exclusion)
-
-    Returns:
-        Optimization results with summary and failures
-
-    Raises:
-        HTTPException: 400 if validation fails
-    """
-    try:
-        # Use current date if not specified
-        start_date = request.start_date or time_provider.now()
-
-        # Run synchronously
-        result = controller.optimize_schedule(
-            algorithm=request.algorithm,
-            start_date=start_date,
-            max_hours_per_day=request.max_hours_per_day,
-            force_override=request.force_override,
-            task_ids=request.task_ids,
-            include_all_days=request.include_all_days,
-        )
-
-        # Broadcast WebSocket event in background (exclude the requester by client name)
-        broadcaster.schedule_optimized(
-            len(result.successful_tasks),
-            len(result.failed_tasks),
-            request.algorithm,
-            client_name,
-        )
-
-        # Audit log
-        audit_controller.log_operation(
-            operation="optimize_schedule",
-            resource_type="schedule",
-            resource_id=None,
-            resource_name=None,
-            client_name=client_name,
-            new_values={
-                "algorithm": request.algorithm,
-                "scheduled_tasks": len(result.successful_tasks),
-                "failed_tasks": len(result.failed_tasks),
-                "total_hours": result.summary.total_hours,
-                "task_ids": request.task_ids,
-            },
-            success=True,
-        )
-
-        # Convert DTO to response model
-        failures = [
-            SchedulingFailure(task_id=f.task.id, task_name=f.task.name, reason=f.reason)
-            for f in result.failed_tasks
-        ]
-
-        # Calculate date range from daily allocations
-        if result.daily_allocations:
-            dates = list(result.daily_allocations.keys())
-            opt_start_date = min(dates)
-            opt_end_date = max(dates)
-        else:
-            opt_start_date = start_date.date()
-            opt_end_date = start_date.date()
-
-        # Build optimization message
-        if result.all_failed():
-            message = (
-                f"No tasks were scheduled. {len(result.failed_tasks)} task(s) failed."
-            )
-        elif result.has_failures():
-            message = f"Partially optimized: {len(result.successful_tasks)} succeeded, {len(result.failed_tasks)} failed."
-        else:
-            message = f"Successfully optimized {len(result.successful_tasks)} task(s)."
-
-        return OptimizationResponse(
-            summary=OptimizationSummary(
-                total_tasks=len(result.successful_tasks) + len(result.failed_tasks),
-                scheduled_tasks=len(result.successful_tasks),
-                failed_tasks=len(result.failed_tasks),
-                total_hours=result.summary.total_hours,
-                start_date=opt_start_date,
-                end_date=opt_end_date,
-                algorithm=request.algorithm,
-            ),
-            failures=failures,
-            message=message,
-        )
-    except TaskNotFoundException as e:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e)) from e
-    except NoSchedulableTasksError as e:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)
-        ) from e
-    except TaskValidationError as e:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)
-        ) from e
-
-
-@router.get("/algorithms", response_model=list[dict[str, str]])
-def list_algorithms(
-    controller: QueryControllerDep,
-    _client_name: AuthenticatedClientDep,
-) -> list[dict[str, str]]:
-    """List available optimization algorithms.
-
-    Args:
-        controller: Query controller dependency
-
-    Returns:
-        List of algorithms with name, display name, and description
-    """
-    algorithms = controller.get_algorithm_metadata()
-    return [
-        {"name": name, "display_name": display_name, "description": description}
-        for name, display_name, description in algorithms
-    ]