Implement Test Coverage on APIs

.gitignore

@@ -1,5 +1,23 @@
 *.pyc
 __pycache__/
-env/
-.env
 .ipynb_checkpoints/
+
+
+# Secrets
+.env
+.flaskenv
+
+# Virutal Environments
+/venv/
+env/
+.venv/
+
+# Local Database
+my_database.db
+
+# Logs
+*.logs
+logs/
+
+migrations/__pycache__/
+migrations/versions/__pycache__/

api/dashboard.py

@@ -4,10 +4,12 @@
 # alternatively, find edited files on planner board > 'Add Endpoint for the Dashboard'.
 import sys
 
-from flask import Blueprint, jsonify
-from models.user import db, UserProfile
+from flask import Blueprint, jsonify, request
+from models import db, UserProfile
 from flask_cors import CORS
 from datetime import datetime, timezone
+from flask_login import login_required, current_user
+from extensions import csrf
 
 # Create the Blueprint for dashboard
 dashboard_bp = Blueprint('dashboard', __name__, url_prefix='/api/dashboard')
@@ -38,3 +40,40 @@ def get_dashboard_data():
         })
 
     return jsonify({'message': 'User not found'}), 404
+
+
+def _is_intlike(x):
+    try:
+        int(x)
+        return True
+    except Exception:
+        return False
+
+@dashboard_bp.route('/activity', methods=['POST'])
+@login_required
+@csrf.exempt 
+def post_activity():
+    body = request.get_json(silent=True) or {}
+
+    # required field
+    date = body.get("date")
+    if not isinstance(date, str):
+        return jsonify({"error": "date is required (YYYY-MM-DD)"}), 400
+
+    # optional numeric fields; default to 0 if missing but validate type if present
+    numeric_fields = [
+        "steps",
+        "minutes_running",
+        "minutes_cycling",
+        "minutes_swimming",
+        "minutes_exercise",
+        "calories",
+    ]
+    out = {"date": date, "user_id": getattr(current_user, "id", None)}
+    for f in numeric_fields:
+        v = body.get(f, 0)
+        if v != 0 and not _is_intlike(v):
+            return jsonify({"error": f"{f} must be an integer"}), 400
+        out[f] = int(v)
+
+    return jsonify(out), 201

api/goals.py

@@ -1,6 +1,7 @@
 from flask import Blueprint, request, jsonify
-from models.goal import db, Goal  # Correctly import db and Goal
+from models import db, Goal  # Correctly import db and Goal
 from datetime import datetime
+from flask_login import login_required, current_user
 
 # Create the Blueprint for goals
 goals_bp = Blueprint('goals', __name__, url_prefix='/api/goals')
@@ -37,6 +38,7 @@ def create_goal():
 
     # Return the goal as a response with a 201 status
     return jsonify(goal.as_dict()), 201
+
 @goals_bp.route('/<int:user_id>', methods=['POST'])
 def create_goal_for_user(user_id):
     data = request.get_json()
@@ -80,33 +82,55 @@ def get_user_goals(user_id):
 
 # Update Goal
 @goals_bp.route('/<int:goal_id>', methods=['PUT'])
+@login_required
 def update_goal(goal_id):
-    data = request.get_json()
+    data = request.get_json() or {}
 
     # Retrieve the goal with the specified goal_id
     goal = Goal.query.get_or_404(goal_id)
 
+    if goal.user_id != current_user.id:
+        return jsonify({"error": "forbidden"}), 403
+
+    # Validation: dates must be ISO format (YYYY-MM-DD)
+    if "start_date" in data:
+        try:
+            goal.start_date = datetime.strptime(data["start_date"], "%Y-%m-%d").date()
+        except ValueError:
+            return jsonify({"error": "Invalid start_date format, expected YYYY-MM-DD"}), 422
+
+    if "end_date" in data:
+        try:
+            goal.end_date = datetime.strptime(data["end_date"], "%Y-%m-%d").date()
+        except ValueError:
+            return jsonify({"error": "Invalid end_date format, expected YYYY-MM-DD"}), 422
+
     # Loop through all the fields to update and check if they exist in the data
     for field in ['start_date', 'end_date', 'steps', 'minutes_running', 'minutes_cycling',
                   'minutes_swimming', 'minutes_exercise', 'calories']:
         if field in data:
-            # If it's a date field, convert it
-            if field in ['start_date', 'end_date']:
-                setattr(goal, field, datetime.strptime(data[field], '%Y-%m-%d').date())
-            else:
-                setattr(goal, field, data[field])
+            try:
+                val = int(data[field])
+            except (TypeError, ValueError):
+                return jsonify({"error": f"{field} must be a number"}), 422
+            if val < 0:
+                return jsonify({"error": f"{field} cannot be negative value"}), 422
+            setattr(goal, field, val)
 
     # Commit the changes to the database
     db.session.commit()
 
     # Return the updated goal as a response
-    return jsonify(goal.as_dict())
+    return jsonify(goal.as_dict()), 200
 
 # Delete Goal
 @goals_bp.route('/<int:goal_id>', methods=['DELETE'])
 def delete_goal(goal_id):
     # Retrieve the goal by goal_id
     goal = Goal.query.get_or_404(goal_id)
+
+    if goal.user_id != current_user.id:
+        return jsonify({"error": "forbidden"}), 403
 
     # Delete the goal from the session
     db.session.delete(goal)

api/profile.py

@@ -1,51 +1,89 @@
 # /api/profile.py
 from flask import Blueprint, jsonify, request
-from models.user import db, UserProfile
+from flask_login import login_required, current_user
+from extensions import db, csrf
+import re
+from models import db, UserProfile
 from flask_cors import CORS
 
 api = Blueprint('profile_api', __name__)
 
 
 # Profile Endpoints #
-
+DATE_RX = re.compile(r"^\d{4}-\d{2}-\d{2}$")
 # These routes are used by the frontend to fetch/update the user profile.
 # Requires frontend request structure from ProfilePage.tsx
 
 @api.route('', methods=['GET'])
+@login_required
 def get_profile():
     # In future develpment get the user_id from a session or token 
-    user_id = 1  # Replace with authenticated user ID
-    user = UserProfile.query.filter_by(id=user_id).first()
+    # user_id = 1  # Replace with authenticated user ID
+    # user = UserProfile.query.filter_by(id=user_id).first()
+
+    # if user:
+    #     return jsonify({
+    #         'name': user.name,
+    #         'account': user.account,
+    #         'birthDate': user.birthDate,
+    #         'gender': user.gender,
+    #         'avatar': user.avatar
+    #     })
+    # return jsonify({'message': 'User not found'}), 404
 
-    if user:
-        return jsonify({
-            'name': user.name,
-            'account': user.account,
-            'birthDate': user.birthDate,
-            'gender': user.gender,
-            'avatar': user.avatar
-        })
-    return jsonify({'message': 'User not found'}), 404
+    profile = UserProfile.query.filter_by(user_id=current_user.id).first()
+    if not profile:
+        return jsonify({"message": "User not found"}), 404
+
+    return jsonify({
+        "user_id": profile.user_id,
+        "name": profile.name,
+        "account": profile.account,
+        "birthDate": profile.birthDate,
+        "gender": profile.gender,
+    }), 200
 
 
 @api.route('', methods=['POST'])
+@login_required
+@csrf.exempt 
 def update_profile():
-    data = request.get_json()  # Get the JSON data sent from the frontend
+    data = request.get_json(silent=True) or {}  # Get the JSON data sent from the frontend
+    errors = {}
+
+    if "name" in data:
+        if not isinstance(data["name"], str) or not data["name"].strip():
+            errors["name"] = "must be a non-empty string"
+
+    if "account" in data:
+        if not isinstance(data["account"], str) or not data["account"].strip():
+            errors["account"] = "must be a non-empty string"
+
+    if "birthDate" in data:
+        if not isinstance(data["birthDate"], str) or not DATE_RX.match(data["birthDate"]):
+            errors["birthDate"] = "use YYYY-MM-DD"
+
+    if "gender" in data:
+        if not isinstance(data["gender"], str):
+            errors["gender"] = "must be a string"
 
-    # In future develpment get the user_id from a session or token
-    user_id = 1  # Replace with authenticated user ID
-    user = UserProfile.query.filter_by(id=user_id).first()
+    if errors:
+        return jsonify({"error": "validation_error", "fields": errors}), 422
 
-    if not user:
-        return jsonify({'message': 'User not found'}), 404
+    profile = UserProfile.query.filter_by(user_id=current_user.id).first()
+    if not profile:
+        return jsonify({"message": "User not found"}), 404
 
-    # Update the user's profile with the new data
-    user.name = data['name']
-    user.account = data['account']
-    user.birthDate = data['birthDate']
-    user.gender = data['gender']
-    user.avatar = data.get('avatar', user.avatar)  # Only update avatar if provided
+    # Only update fields that were provided
+    if "name" in data:
+        profile.name = data["name"].strip()
+    if "account" in data:
+        profile.account = data["account"].strip()
+    if "birthDate" in data:
+        profile.birthDate = data["birthDate"]
+    if "gender" in data:
+        profile.gender = data["gender"]
 
     db.session.commit()  # Save changes to the database
 
-    return jsonify({'message': 'Profile updated successfully'}), 200
+    return jsonify({'message': "Profile Updated Successfully", "user_id": profile.user_id}), 200

api/routes.py

@@ -1,8 +1,27 @@
-# /api/routes.py
-from flask import Blueprint, jsonify
+from flask import Blueprint, jsonify, request
+from flask_login import login_required
+import time
 
 api = Blueprint('api', __name__)
 
 @api.route('/test', methods=['GET'])
 def test_endpoint():
     return jsonify({"message": "Hello, API!"})
+
+
+@api.route("/time-sync", methods=["GET", "POST"])
+@login_required              # keep if you want it behind login
+def time_sync():
+    # GET: simple “what time is it on the server?”
+    if request.method == "GET":
+        return jsonify({"server_time": int(time.time())}), 200
+
+    # POST: minimal schema check (adjust later as your design evolves)
+    body = request.get_json(silent=True) or {}
+    device_id = body.get("device_id")
+    readings  = body.get("readings")
+    if not isinstance(device_id, str) or not isinstance(readings, list):
+        return jsonify({"error": "invalid request"}), 400
+
+    # TODO: store/process readings here if needed
+    return jsonify({"server_time": int(time.time())}), 200