Merge pull request 'Merge dev-2026-03-22 into main' (#12) from dev-2026-03-22 into main

Reviewed-on: #12

app/api/rbac.py

@@ -20,8 +20,8 @@ def get_user_role(db: Session, user_id: int, project_id: int) -> Role | None:
     # Check global admin
     user = db.query(models.User).filter(models.User.id == user_id).first()
     if user and user.is_admin:
-        # Return global admin role
-        return db.query(Role).filter(Role.is_global == True, Role.name == "superadmin").first()
+        # Return global admin role (name="admin")
+        return db.query(Role).filter(Role.is_global == True, Role.name == "admin").first()
 
     return None
 

app/api/routers/comments.py

@@ -51,8 +51,16 @@ def create_comment(comment: schemas.CommentCreate, db: Session = Depends(get_db)
 
 
 @router.get("/tasks/{task_id}/comments")
-def list_comments(task_id: int, db: Session = Depends(get_db)):
-    comments = db.query(models.Comment).filter(models.Comment.task_id == task_id).all()
+def list_comments(task_id: str, db: Session = Depends(get_db)):
+    """List comments for a task. task_id can be numeric id or task_code."""
+    try:
+        tid = int(task_id)
+    except (ValueError, TypeError):
+        task = db.query(Task).filter(Task.task_code == task_id).first()
+        if not task:
+            raise HTTPException(status_code=404, detail="Task not found")
+        tid = task.id
+    comments = db.query(models.Comment).filter(models.Comment.task_id == tid).all()
     result = []
     for c in comments:
         author = db.query(models.User).filter(models.User.id == c.author_id).first()

app/api/routers/misc.py

@@ -28,6 +28,19 @@ from app.schemas import schemas
 router = APIRouter()
 
 
+def _resolve_milestone(db: Session, identifier: str) -> MilestoneModel:
+    """Resolve a milestone by numeric id or milestone_code string.
+    Raises 404 if not found."""
+    try:
+        ms_id = int(identifier)
+        ms = db.query(MilestoneModel).filter(MilestoneModel.id == ms_id).first()
+    except (ValueError, TypeError):
+        ms = db.query(MilestoneModel).filter(MilestoneModel.milestone_code == identifier).first()
+    if not ms:
+        raise HTTPException(status_code=404, detail="Milestone not found")
+    return ms
+
+
 # ============ API Keys ============
 
 class APIKeyCreate(BaseModel):
@@ -170,17 +183,12 @@ def _find_milestone_by_id_or_code(db, identifier) -> MilestoneModel | None:
 
 @router.get("/milestones/{milestone_id}", response_model=schemas.MilestoneResponse, tags=["Milestones"])
 def get_milestone(milestone_id: str, db: Session = Depends(get_db)):
-    ms = _find_milestone_by_id_or_code(db, milestone_id)
-    if not ms:
-        raise HTTPException(status_code=404, detail="Milestone not found")
-    return ms
+    return _resolve_milestone(db, milestone_id)
 
 
 @router.patch("/milestones/{milestone_id}", response_model=schemas.MilestoneResponse, tags=["Milestones"])
 def update_milestone(milestone_id: str, ms_update: schemas.MilestoneUpdate, db: Session = Depends(get_db), current_user: models.User = Depends(get_current_user_or_apikey)):
-    ms = _find_milestone_by_id_or_code(db, milestone_id)
-    if not ms:
-        raise HTTPException(status_code=404, detail="Milestone not found")
+    ms = _resolve_milestone(db, milestone_id)
     ensure_can_edit_milestone(db, current_user.id, ms)
     for field, value in ms_update.model_dump(exclude_unset=True).items():
         setattr(ms, field, value)
@@ -191,9 +199,7 @@ def update_milestone(milestone_id: str, ms_update: schemas.MilestoneUpdate, db:
 
 @router.delete("/milestones/{milestone_id}", status_code=status.HTTP_204_NO_CONTENT, tags=["Milestones"])
 def delete_milestone(milestone_id: str, db: Session = Depends(get_db)):
-    ms = _find_milestone_by_id_or_code(db, milestone_id)
-    if not ms:
-        raise HTTPException(status_code=404, detail="Milestone not found")
+    ms = _resolve_milestone(db, milestone_id)
     db.delete(ms)
     db.commit()
     return None
@@ -201,10 +207,8 @@ def delete_milestone(milestone_id: str, db: Session = Depends(get_db)):
 
 @router.get("/milestones/{milestone_id}/progress", tags=["Milestones"])
 def milestone_progress(milestone_id: str, db: Session = Depends(get_db)):
-    ms = _find_milestone_by_id_or_code(db, milestone_id)
-    if not ms:
-        raise HTTPException(status_code=404, detail="Milestone not found")
-    tasks = db.query(Task).filter(Task.milestone_id == milestone_id).all()
+    ms = _resolve_milestone(db, milestone_id)
+    tasks = db.query(Task).filter(Task.milestone_id == ms.id).all()
     total = len(tasks)
     done = sum(1 for t in tasks if t.status == TaskStatus.CLOSED)
 
@@ -216,7 +220,7 @@ def milestone_progress(milestone_id: str, db: Session = Depends(get_db)):
         time_progress = min(100, max(0, (elapsed / total_duration * 100)))
 
     return {
-        "milestone_id": milestone_id,
+        "milestone_id": ms.id,
         "title": ms.title,
         "total": total,
         "total_tasks": total,
@@ -334,18 +338,34 @@ def create_worklog(wl: WorkLogCreate, db: Session = Depends(get_db)):
 
 
 @router.get("/tasks/{task_id}/worklogs", response_model=List[WorkLogResponse], tags=["Time Tracking"])
-def list_task_worklogs(task_id: int, db: Session = Depends(get_db)):
-    return db.query(WorkLog).filter(WorkLog.task_id == task_id).order_by(WorkLog.logged_date.desc()).all()
+def list_task_worklogs(task_id: str, db: Session = Depends(get_db)):
+    """List worklogs for a task. task_id can be numeric id or task_code."""
+    try:
+        tid = int(task_id)
+    except (ValueError, TypeError):
+        task = db.query(Task).filter(Task.task_code == task_id).first()
+        if not task:
+            raise HTTPException(status_code=404, detail="Task not found")
+        tid = task.id
+    return db.query(WorkLog).filter(WorkLog.task_id == tid).order_by(WorkLog.logged_date.desc()).all()
 
 
 @router.get("/tasks/{task_id}/worklogs/summary", tags=["Time Tracking"])
-def task_worklog_summary(task_id: int, db: Session = Depends(get_db)):
-    task = db.query(Task).filter(Task.id == task_id).first()
+def task_worklog_summary(task_id: str, db: Session = Depends(get_db)):
+    """Worklog summary for a task. task_id can be numeric id or task_code."""
+    try:
+        tid = int(task_id)
+    except (ValueError, TypeError):
+        t = db.query(Task).filter(Task.task_code == task_id).first()
+        if not t:
+            raise HTTPException(status_code=404, detail="Task not found")
+        tid = t.id
+    task = db.query(Task).filter(Task.id == tid).first()
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
-    total = db.query(sqlfunc.sum(WorkLog.hours)).filter(WorkLog.task_id == task_id).scalar() or 0
-    count = db.query(WorkLog).filter(WorkLog.task_id == task_id).count()
-    return {"task_id": task_id, "total_hours": round(total, 2), "log_count": count}
+    total = db.query(sqlfunc.sum(WorkLog.hours)).filter(WorkLog.task_id == tid).scalar() or 0
+    count = db.query(WorkLog).filter(WorkLog.task_id == tid).count()
+    return {"task_id": tid, "total_hours": round(total, 2), "log_count": count}
 
 
 @router.delete("/worklogs/{worklog_id}", status_code=status.HTTP_204_NO_CONTENT, tags=["Time Tracking"])

app/api/routers/projects.py

@@ -15,6 +15,19 @@ from app.api.rbac import check_project_role, check_permission, ensure_can_edit_p
 router = APIRouter(prefix="/projects", tags=["Projects"])
 
 
+def _resolve_project(db: Session, identifier: str) -> models.Project:
+    """Resolve a project by numeric id or project_code string.
+    Raises 404 if not found."""
+    try:
+        pid = int(identifier)
+        project = db.query(models.Project).filter(models.Project.id == pid).first()
+    except (ValueError, TypeError):
+        project = db.query(models.Project).filter(models.Project.project_code == identifier).first()
+    if not project:
+        raise HTTPException(status_code=404, detail="Project not found")
+    return project
+
+
 def _validate_project_links(db, codes: list[str] | None, self_code: str | None = None) -> list[str] | None:
     if not codes:
         return None
@@ -196,10 +209,7 @@ def _find_project_by_id_or_code(db, identifier) -> models.Project | None:
 
 @router.get("/{project_id}", response_model=schemas.ProjectResponse)
 def get_project(project_id: str, db: Session = Depends(get_db)):
-    project = _find_project_by_id_or_code(db, project_id)
-    if not project:
-        raise HTTPException(status_code=404, detail="Project not found")
-    return project
+    return _resolve_project(db, project_id)
 
 
 @router.patch("/{project_id}", response_model=schemas.ProjectResponse)
@@ -209,9 +219,7 @@ def update_project(
     db: Session = Depends(get_db),
     current_user: models.User = Depends(get_current_user_or_apikey),
 ):
-    project = _find_project_by_id_or_code(db, project_id)
-    if not project:
-        raise HTTPException(status_code=404, detail="Project not found")
+    project = _resolve_project(db, project_id)
     ensure_can_edit_project(db, current_user.id, project)
     update_data = project_update.model_dump(exclude_unset=True)
     update_data.pop("name", None)
@@ -236,18 +244,16 @@ def delete_project(
     db: Session = Depends(get_db),
     current_user: models.User = Depends(get_current_user_or_apikey),
 ):
-    project = _find_project_by_id_or_code(db, project_id)
-    if not project:
-        raise HTTPException(status_code=404, detail="Project not found")
-    
+    project = _resolve_project(db, project_id)
     check_project_role(db, current_user.id, project.id, min_role="admin")
     
     project_code = project.project_code
+    project_id_val = project.id
     
     # Delete milestones and their tasks
     from app.models.milestone import Milestone
     from app.models.task import Task
-    milestones = db.query(Milestone).filter(Milestone.project_id == project.id).all()
+    milestones = db.query(Milestone).filter(Milestone.project_id == project_id_val).all()
     for ms in milestones:
         tasks = db.query(Task).filter(Task.milestone_id == ms.id).all()
         for task in tasks:
@@ -287,9 +293,7 @@ def add_project_member(
     db: Session = Depends(get_db),
     current_user: models.User = Depends(get_current_user_or_apikey),
 ):
-    project = _find_project_by_id_or_code(db, project_id)
-    if not project:
-        raise HTTPException(status_code=404, detail="Project not found")
+    project = _resolve_project(db, project_id)
     check_project_role(db, current_user.id, project.id, min_role="mgr")
     user = db.query(models.User).filter(models.User.id == member.user_id).first()
     if not user:
@@ -321,9 +325,7 @@ def add_project_member(
 
 @router.get("/{project_id}/members", response_model=List[schemas.ProjectMemberResponse])
 def list_project_members(project_id: str, db: Session = Depends(get_db)):
-    project = _find_project_by_id_or_code(db, project_id)
-    if not project:
-        raise HTTPException(status_code=404, detail="Project not found")
+    project = _resolve_project(db, project_id)
     members = db.query(models.ProjectMember).filter(models.ProjectMember.project_id == project.id).all()
     result = []
     for m in members:
@@ -351,9 +353,7 @@ def remove_project_member(
     db: Session = Depends(get_db),
     current_user: models.User = Depends(get_current_user_or_apikey),
 ):
-    project = _find_project_by_id_or_code(db, project_id)
-    if not project:
-        raise HTTPException(status_code=404, detail="Project not found")
+    project = _resolve_project(db, project_id)
     check_permission(db, current_user.id, project.id, "member.remove")
     member = db.query(models.ProjectMember).filter(
         models.ProjectMember.project_id == project.id, models.ProjectMember.user_id == user_id
@@ -386,9 +386,7 @@ from sqlalchemy import func as sqlfunc
 @router.get("/{project_id}/worklogs/summary")
 def project_worklog_summary(project_id: str, db: Session = Depends(get_db)):
     from app.models.task import Task as TaskModel
-    project = _find_project_by_id_or_code(db, project_id)
-    if not project:
-        raise HTTPException(status_code=404, detail="Project not found")
+    project = _resolve_project(db, project_id)
     resolved_project_id = project.id
     results = db.query(
         models.User.id, models.User.username,

app/api/routers/tasks.py

@@ -20,6 +20,19 @@ from app.services.dependency_check import check_task_deps
 
 router = APIRouter(tags=["Tasks"])
 
+
+def _resolve_task(db: Session, identifier: str) -> Task:
+    """Resolve a task by numeric id or task_code string.
+    Raises 404 if not found."""
+    try:
+        task_id = int(identifier)
+        task = db.query(Task).filter(Task.id == task_id).first()
+    except (ValueError, TypeError):
+        task = db.query(Task).filter(Task.task_code == identifier).first()
+    if not task:
+        raise HTTPException(status_code=404, detail="Task not found")
+    return task
+
 # ---- State-machine: valid transitions (P5.1-P5.6) ----
 VALID_TRANSITIONS: dict[str, set[str]] = {
     "pending":    {"open", "closed"},
@@ -304,17 +317,13 @@ def search_tasks_alias(
 
 @router.get("/tasks/{task_id}", response_model=schemas.TaskResponse)
 def get_task(task_id: str, db: Session = Depends(get_db)):
-    task = _find_task_by_id_or_code(db, task_id)
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
+    task = _resolve_task(db, task_id)
     return _serialize_task(db, task)
 
 
 @router.patch("/tasks/{task_id}", response_model=schemas.TaskResponse)
 def update_task(task_id: str, task_update: schemas.TaskUpdate, db: Session = Depends(get_db), current_user: models.User = Depends(get_current_user_or_apikey)):
-    task = _find_task_by_id_or_code(db, task_id)
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
+    task = _resolve_task(db, task_id)
 
     # P5.7: status-based edit restrictions
     current_status = task.status.value if hasattr(task.status, 'value') else task.status
@@ -403,9 +412,7 @@ def update_task(task_id: str, task_update: schemas.TaskUpdate, db: Session = Dep
 
 @router.delete("/tasks/{task_id}", status_code=status.HTTP_204_NO_CONTENT)
 def delete_task(task_id: str, db: Session = Depends(get_db), current_user: models.User = Depends(get_current_user_or_apikey)):
-    task = _find_task_by_id_or_code(db, task_id)
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
+    task = _resolve_task(db, task_id)
     check_project_role(db, current_user.id, task.project_id, min_role="mgr")
     log_activity(db, "task.deleted", "task", task.id, current_user.id, {"title": task.title})
     db.delete(task)
@@ -433,9 +440,7 @@ def transition_task(
     valid_statuses = [s.value for s in TaskStatus]
     if new_status not in valid_statuses:
         raise HTTPException(status_code=400, detail=f"Invalid status. Must be one of: {valid_statuses}")
-    task = _find_task_by_id_or_code(db, task_id)
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
+    task = _resolve_task(db, task_id)
     old_status = task.status.value if hasattr(task.status, 'value') else task.status
 
     # P5.1: enforce state-machine
@@ -556,10 +561,8 @@ def take_task(
 # ---- Assignment ----
 
 @router.post("/tasks/{task_id}/assign")
-def assign_task(task_id: int, assignee_id: int, db: Session = Depends(get_db)):
-    task = db.query(Task).filter(Task.id == task_id).first()
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
+def assign_task(task_id: str, assignee_id: int, db: Session = Depends(get_db)):
+    task = _resolve_task(db, task_id)
     user = db.query(models.User).filter(models.User.id == assignee_id).first()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
@@ -575,10 +578,8 @@ def assign_task(task_id: int, assignee_id: int, db: Session = Depends(get_db)):
 # ---- Tags ----
 
 @router.post("/tasks/{task_id}/tags")
-def add_tag(task_id: int, tag: str, db: Session = Depends(get_db)):
-    task = db.query(Task).filter(Task.id == task_id).first()
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
+def add_tag(task_id: str, tag: str, db: Session = Depends(get_db)):
+    task = _resolve_task(db, task_id)
     current = set(task.tags.split(",")) if task.tags else set()
     current.add(tag.strip())
     current.discard("")
@@ -588,10 +589,8 @@ def add_tag(task_id: int, tag: str, db: Session = Depends(get_db)):
 
 
 @router.delete("/tasks/{task_id}/tags")
-def remove_tag(task_id: int, tag: str, db: Session = Depends(get_db)):
-    task = db.query(Task).filter(Task.id == task_id).first()
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
+def remove_tag(task_id: str, tag: str, db: Session = Depends(get_db)):
+    task = _resolve_task(db, task_id)
     current = set(task.tags.split(",")) if task.tags else set()
     current.discard(tag.strip())
     current.discard("")

app/main.py

@@ -26,6 +26,26 @@ def health_check():
 def version():
     return {"name": "HarborForge", "version": "0.3.0", "description": "Agent/人类协同任务管理平台"}
 
+@app.get("/config/status", tags=["System"])
+def config_status():
+    """Check if HarborForge has been initialized (reads from config volume).
+    Frontend uses this instead of contacting the wizard directly."""
+    import os, json
+    config_dir = os.getenv("CONFIG_DIR", "/config")
+    config_file = os.getenv("CONFIG_FILE", "harborforge.json")
+    config_path = os.path.join(config_dir, config_file)
+    if not os.path.exists(config_path):
+        return {"initialized": False}
+    try:
+        with open(config_path, "r") as f:
+            cfg = json.load(f)
+        return {
+            "initialized": cfg.get("initialized", False),
+            "backend_url": cfg.get("backend_url"),
+        }
+    except Exception:
+        return {"initialized": False}
+
 # Register routers
 from app.api.routers.auth import router as auth_router
 from app.api.routers.tasks import router as tasks_router