app.py

import os
import csv
import io
from functools import wraps
from flask import Flask, render_template, request, redirect, url_for, flash, session, Response
from datetime import date, datetime
import db
from models import Application
from dotenv import load_dotenv

load_dotenv()
app = Flask(__name__)

SECRET_KEY = os.environ.get("SECRET_KEY", "dev-secret-change-this")
APP_PASSWORD = os.environ.get("APP_PASSWORD")

app.secret_key = SECRET_KEY
app.config['SESSION_COOKIE_SECURE'] = True
app.config['SESSION_COOKIE_HTTPONLY'] = True

# Auto-init DB on startup
with app.app_context():
    db.init_db()


def login_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        if not session.get('logged_in'):
            return redirect(url_for('login'))
        return f(*args, **kwargs)
    return decorated


@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        password = request.form.get('password')
        if APP_PASSWORD and password == APP_PASSWORD:
            session['logged_in'] = True
            return redirect(url_for('index'))
        else:
            flash('Invalid password.', 'danger')
            return redirect(url_for('login'))
    return render_template('login.html')


@app.route('/logout')
def logout():
    session.clear()
    return redirect(url_for('login'))


def parse_form_date(val: str):
    """Parse date string from HTML form input, return None if empty."""
    if not val:
        return None
    try:
        return datetime.strptime(val, "%Y-%m-%d").date()
    except ValueError:
        return None


@app.route('/')
@login_required
def index():
    apps = db.get_all_applications(sort_by_deadline=True)
    return render_template('index.html', apps=apps)


@app.route('/deadlines')
@login_required
def deadlines():
    apps = db.get_upcoming_deadlines()
    return render_template('index.html', apps=apps, title="Upcoming Deadlines")


@app.route('/add', methods=['GET', 'POST'])
@login_required
def add():
    if request.method == 'POST':
        status = request.form['status']
        application = Application(
            id=None,
            title=request.form['title'],
            org=request.form['org'],
            type=request.form['type'],
            platform=request.form['platform'],
            url=request.form.get('url', ''),
            deadline=parse_form_date(request.form.get('deadline')),
            status=status,
            date_applied=date.today() if status == 'applied' else None,
            notes=request.form.get('notes', ''),
            contact_used=request.form.get('contact_used', '')
        )
        db.add_application(application)
        flash('Application added successfully.', 'success')
        return redirect(url_for('index'))
    return render_template('add.html')


@app.route('/edit/<int:app_id>', methods=['GET', 'POST'])
@login_required
def edit(app_id):
    application = db.get_application(app_id)
    if not application:
        flash(f'Application #{app_id} not found.', 'danger')
        return redirect(url_for('index'))

    if request.method == 'POST':
        new_status = request.form['status']
        date_applied = application.date_applied
        if new_status == 'applied' and application.status != 'applied':
            date_applied = date.today()

        application.title = request.form['title']
        application.org = request.form['org']
        application.type = request.form['type']
        application.platform = request.form['platform']
        application.url = request.form.get('url', '')
        application.deadline = parse_form_date(request.form.get('deadline'))
        application.status = new_status
        application.date_applied = date_applied
        application.notes = request.form.get('notes', '')
        application.contact_used = request.form.get('contact_used', '')

        db.update_application(app_id, application)
        flash('Application updated.', 'success')
        return redirect(url_for('index'))

    return render_template('edit.html', app=application)


@app.route('/delete/<int:app_id>', methods=['POST'])
@login_required
def delete(app_id):
    # Delete is POST-only — never expose destructive actions as GET
    db.delete_application(app_id)
    flash('Application deleted.', 'warning')
    return redirect(url_for('index'))


@app.route('/search')
@login_required
def search():
    query = request.args.get('q', '')
    apps = db.search_applications(query) if query else []
    return render_template('index.html', apps=apps, title=f'Search: "{query}"')


@app.route('/stats')
@login_required
def stats():
    stats_data = db.get_stats()
    return render_template('stats.html', stats=stats_data)


@app.route('/export/csv')
@login_required
def export_csv():
    apps = db.get_all_applications(sort_by_deadline=False)
    
    output = io.StringIO()
    writer = csv.writer(output)
    
    # Header row
    writer.writerow([
        'id', 'title', 'org', 'type', 'platform', 'url',
        'deadline', 'status', 'date_applied', 'contact_used', 'notes'
    ])
    
    # Data rows
    for a in apps:
        writer.writerow([
            a.id, a.title, a.org, a.type, a.platform, a.url,
            a.deadline, a.status, a.date_applied, a.contact_used, a.notes
        ])
    
    output.seek(0)
    filename = f"applications_{date.today().strftime('%Y%m%d')}.csv"
    
    return Response(
        output.getvalue(),
        mimetype='text/csv',
        headers={'Content-Disposition': f'attachment; filename={filename}'}
    )

if __name__ == '__main__':
    app.run(debug=True)