Phillip Tarrant
d9090f5055
Working /contact POST flow: honeypot → hCaptcha server-verify → field validation → SlowAPI 3/hr IP rate limit → contact_submissions row → best-effort Resend notification (Reply-To = submitter) → generic success page. Spam paths don't persist and render the same success page (anti-enumeration). Send failures don't break the request path — the row is already durable. New services: HCaptchaService (async httpx + dev fallback), ContactService. EmailService gains send_contact_notification. Production config validator now requires ADMIN_CONTACT_EMAIL, HCAPTCHA_SECRET, HCAPTCHA_SITE_KEY. 23 new tests, all green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Documentation Folder
This folder contains business planning, architecture decisions, and documentation.
No application code belongs here.
Contents
| Document | Purpose |
|---|---|
ROADMAP.md |
Phased build plan, data model (dataclasses), SQL schema, visual design, env-var contract |
code_guidelines.md |
Generic Python coding standards (FastAPI overrides its Flask default for this project) |
security.md |
Python security baseline (OWASP-aligned) |
MANUAL_TESTING.md (added in Phase 1) |
Manual test checklist for the public site + admin |
Related Docs (in repo root)
| Document | Purpose |
|---|---|
../CLAUDE.md |
Project instructions — stack, topology, security must-haves, git flow |
Guidelines
- Keep documents focused and concise.
- Update docs when architecture decisions change.
- Use markdown tables for structured information.
- Link to external documentation where relevant.