from flask import Flask, abort
from markupsafe import escape

app = Flask(__name__)
projects = {1: "Robot controller", 2: "Study planner"}

@app.get("/")
def home():
    return "<h1>My first Flask application</h1>"

@app.get("/hello/<name>")
def hello(name):
    return f"<p>Hello, {escape(name)}!</p>"

@app.get("/projects/<int:project_id>")
def project(project_id):
    if project_id not in projects:
        abort(404)
    return {"id": project_id, "title": projects[project_id]}

@app.get("/api/status")
def status():
    return {"service": "learning", "ready": True}

# Run these assertions with the app defined above.
client = app.test_client()
assert client.get("/").status_code == 200
assert client.get("/projects/1").json["title"] == "Robot controller"
assert client.get("/projects/99").status_code == 404
assert client.post("/projects/1").status_code == 405
print("Route contracts checked")

The test client reaches handlers without a live browser. Assertions check both the expected record and failure contracts. Save this complete source, then use python -m flask --app route_demo run --debug for manual local browsing.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from flask import Flask
from markupsafe import escape

app = Flask(__name__)
titles = ["Robot controller", "<Study planner>"]

@app.get("/report")
def report():
    items = "".join(f"<li>{escape(title)}</li>" for title in titles)
    return f"<h1>Projects</h1><ul>{items}</ul>"

@app.get("/api/projects")
def project_data():
    return {"titles": titles, "count": len(titles)}

client = app.test_client()
html = client.get("/report")
assert html.mimetype == "text/html"
assert b"&lt;Study planner&gt;" in html.data
assert client.get("/api/projects").json["count"] == 2
print("Two representations checked")

This small route escapes interpolated text directly; larger pages use templates. JSON serialisation is not the same operation as rendering HTML.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from flask import Flask, render_template_string

app = Flask(__name__)

@app.get("/tasks")
def tasks():
    records = [{"title": "Trace loops", "minutes": 25}]
    template = """<h1>Study tasks</h1><ul>
    {% for task in tasks %}
      <li>{{ task['title'] }}: {{ task['minutes'] }} minutes</li>
    {% else %}
      <li>No tasks yet.</li>
    {% endfor %}</ul>"""
    return render_template_string(template, tasks=records)

from flask import render_template_string
client = app.test_client()
assert b"Trace loops" in client.get("/tasks").data
with app.app_context():
    empty = render_template_string("{% for task in tasks %}{{ task.title }}{% else %}No tasks{% endfor %}", tasks=[])
assert empty == "No tasks"
print("Collection and empty state checked")

The short string template is executable as shown. The lab download demonstrates separate templates and inheritance for actual pages.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from flask import Flask, render_template_string

app = Flask(__name__)
with app.app_context():
    html = render_template_string("<h1>{{ title }}</h1>", title="<script>fictional text</script>")
assert "<script>" not in html
assert "&lt;script&gt;" in html
print("Title rendered as text")

# In the lab base.html, the stylesheet link is:
# <link rel="stylesheet" href="{{ url_for('static', filename='lab.css') }}">

The supplied Python checks the title boundary. The commented template line belongs in HTML, not in a Python route. The lab already includes this structure for comparison.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from pathlib import Path
from tempfile import TemporaryDirectory
from app import create_app

with TemporaryDirectory() as folder:
    app = create_app({"TESTING": True, "SECRET_KEY": "test-only-" + "x" * 64, "DATABASE": str(Path(folder) / "tasks.sqlite3")})
    client = app.test_client()
    client.get("/tasks/new")
    with client.session_transaction() as session:
        token = session["csrf"]
    data = {"csrf": token, "title": "Trace a loop", "minutes": "25"}
    assert client.post("/tasks/new", data=data).status_code == 303
    before = client.get("/api/summary").json
    for bad in ["0", "241", "text"]:
        assert client.post("/tasks/new", data={**data, "minutes": bad}).status_code == 400
        assert client.get("/api/summary").json == before
    print("Accepted save and rejected writes checked")

The isolated app writes only a temporary database. The comparison checks actual saved effects, not just whether an error message appeared.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

import sqlite3
from pathlib import Path
from tempfile import TemporaryDirectory

with TemporaryDirectory() as folder:
    path = Path(folder) / "practice.sqlite3"
    with sqlite3.connect(path) as db:
        db.execute("CREATE TABLE tasks (id INTEGER PRIMARY KEY, title TEXT NOT NULL)")
        db.executemany("INSERT INTO tasks(title) VALUES (?)", [("Maya's planner",), ("x'); DROP TABLE tasks; --",)])
    db.close()
    reopened = sqlite3.connect(path)
    rows = reopened.execute("SELECT title FROM tasks ORDER BY id").fetchall()
    assert len(rows) == 2
    assert rows[0][0] == "Maya's planner"
    assert "DROP TABLE" in rows[1][0]
    reopened.close()
    print("Committed values reopened as data")

The connection context commits successful writes, but it does not close the connection automatically. This example closes each explicitly. The temporary directory is deleted after the exercise.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from werkzeug.security import generate_password_hash, check_password_hash

fictional = "Fictional practice phrase 42"
first = generate_password_hash(fictional, method="scrypt")
second = generate_password_hash(fictional, method="scrypt")
assert first != second
assert check_password_hash(first, fictional)
assert not check_password_hash(first, "wrong")
assert first != fictional
print("Salted hash verification checked")

The app can verify a candidate without recovering the original password. This exercise does not add login rate limits, password recovery or broader session revocation.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

def may_read(user, project):
    if user is None or not user["active"]:
        return False
    return user["id"] == project["owner_id"] or (user["role"] == "teacher" and project["status"] == "shared")

owner = {"id": 1, "role": "student", "active": True}
peer = {"id": 2, "role": "student", "active": True}
teacher = {"id": 3, "role": "teacher", "active": True}
draft = {"owner_id": 1, "status": "draft"}
shared = {**draft, "status": "shared"}
assert may_read(owner, draft)
assert not may_read(peer, shared)
assert not may_read(teacher, draft)
assert may_read(teacher, shared)
assert not may_read(None, shared)
assert not may_read({**owner, "active": False}, draft)
print("Six read-policy cases checked")

The function models authorisation after identity is established. It does not validate passwords or signed cookies. Run the portal’s direct-route tests to check enforcement around real stored records.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from pathlib import Path
from tempfile import TemporaryDirectory
from app import create_app

with TemporaryDirectory() as folder:
    app = create_app({"TESTING": True, "SECRET_KEY": "test-only-" + "x" * 64, "DATABASE": str(Path(folder) / "tasks.sqlite3")})
    client = app.test_client()
    fields = {"title": "Debug a route", "minutes": "20"}
    assert client.post("/tasks/new", data=fields).status_code == 400
    assert client.post("/tasks/new", data={**fields, "csrf": "wrong"}).status_code == 400
    assert client.get("/api/summary").json["task_count"] == 0
    client.get("/tasks/new")
    with client.session_transaction() as session:
        token = session["csrf"]
    assert client.post("/tasks/new", data={**fields, "csrf": token}).status_code == 303
    assert client.get("/api/summary").json["task_count"] == 1
    print("Token rejection and acceptance checked")

Run beside app.py in the learning lab. The sample proves a token boundary, not user ownership, because this first lab deliberately has no accounts.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

import os
from pathlib import Path
from tempfile import TemporaryDirectory
from unittest.mock import patch
from portal import create_app

with TemporaryDirectory() as folder:
    config = {"PORTAL_MODE": "production", "PORTAL_SECRET": "test-only-" + "x" * 64, "PORTAL_DATABASE": str(Path(folder) / "portal.sqlite3")}
    with patch.dict(os.environ, config):
        app = create_app()
    assert app.config["SESSION_COOKIE_SECURE"]
    assert app.config["SESSION_COOKIE_HTTPONLY"]
    assert app.config["SESSION_COOKIE_SAMESITE"] == "Lax"
    response = app.test_client().get("/login", base_url="https://example.test")
    assert response.status_code == 200
    assert "Secure" in response.headers["Set-Cookie"]
    assert "Strict-Transport-Security" in response.headers
    print("Production response configuration checked")

A fixed secret is acceptable only for isolated fictional tests. Real deployment must use strong private configuration and supported HTTPS hosting, backups, monitoring and abuse controls.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from test_portal import PortalTests

PortalTests.setUpClass()
case = PortalTests(methodName="test_public_home_and_protected_redirect")
case.setUp()
try:
    before = case.row(1)
    assert case.login("noor").status_code == 303
    response = case.post("/projects/1/edit", {"title": "Forged edit", "summary": "Not the owner", "language": "Python", "status": "shared"})
    assert response.status_code == 403
    assert case.row(1) == before
    print("Forbidden direct write left the record unchanged")
finally:
    case.doCleanups()

The sample reuses the supplied fixture for compactness; its temporary directory is cleaned in finally. It tests a real route and stored effect, not merely the pure policy function.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.

from test_portal import PortalTests

PortalTests.setUpClass()
case = PortalTests(methodName="test_public_home_and_protected_redirect")
case.setUp()
try:
    assert case.login("teacher").status_code == 303
    assert case.client.get("/projects/1").status_code == 403
    assert case.client.get("/projects/2").status_code == 200
    assert case.post("/projects/2/feedback", {"feedback": "Explain your test cases."}).status_code == 303
    assert case.row(2)["feedback"] == "Explain your test cases."
    case.post("/logout")
    assert case.login("maya").status_code == 303
    assert case.post("/projects/2/edit", {"title": "Revised project", "summary": "Added testing evidence", "language": "Python", "status": "shared"}).status_code == 303
    assert case.row(2)["feedback"] == ""
    print("Teacher review and owner revision checked")
finally:
    case.doCleanups()

Earlier feedback refers to an earlier version. This model clears it explicitly rather than silently claiming it applies to new work. It does not preserve feedback history; versioning is an extension.

A different implementation can also be correct if it meets the requirements and tests. Compare meaning and behaviour, rather than only copying the source.