Initial commit: Key Ajans portfolio site

request_routes.py

@@ -0,0 +1,73 @@
+"""Kullanıcı talepleri: gönderim (herkes) + admin gelen kutusu."""
+from flask import Blueprint, abort, flash, redirect, render_template, request, session, url_for
+
+import security
+from db import get_db
+
+request_bp = Blueprint("talepler", __name__)
+
+SUBJECT_MAX = 150
+BODY_MAX = 5000
+NAME_MAX = 100
+
+
+@request_bp.get("/talep")
+def new_talep():
+    return render_template(
+        "new_talep.html",
+        prefill_name=session.get("name", ""),
+        prefill_email=session.get("email", ""),
+    )
+
+
+@request_bp.post("/talep")
+@security.rate_limited("talep", 6, 900)
+def do_talep():
+    sender_name = security.clean_text(request.form.get("sender_name"), NAME_MAX)
+    sender_email = security.validate_email(request.form.get("sender_email"))
+    subject = security.clean_text(request.form.get("subject"), SUBJECT_MAX)
+    body = security.clean_multiline(request.form.get("body"), BODY_MAX)
+
+    if not sender_name:
+        flash("Adınızı yazmalısınız.", "error")
+        return redirect(url_for("talepler.new_talep"))
+    if sender_email is None:
+        flash("Geçerli bir e-posta adresi girin.", "error")
+        return redirect(url_for("talepler.new_talep"))
+    if not subject:
+        flash("Talep başlığı zorunlu.", "error")
+        return redirect(url_for("talepler.new_talep"))
+    if not body:
+        flash("Talep açıklaması boş olamaz.", "error")
+        return redirect(url_for("talepler.new_talep"))
+
+    db = get_db()
+    db.execute(
+        "INSERT INTO requests (sender_name, sender_email, subject, body) VALUES (?, ?, ?, ?)",
+        (sender_name, sender_email, subject, body),
+    )
+    db.commit()
+    flash("Talebiniz iletildi. Teşekkürler!", "success")
+    return redirect(url_for("index"))
+
+
+@request_bp.get("/admin/talepler")
+def admin_inbox():
+    if session.get("role") != "admin":
+        abort(403)
+    db = get_db()
+    requests = db.execute(
+        "SELECT * FROM requests ORDER BY created_at DESC"
+    ).fetchall()
+    return render_template("admin/requests.html", requests=requests)
+
+
+@request_bp.post("/admin/talepler/<int:rid>/sil")
+def admin_delete(rid):
+    if session.get("role") != "admin":
+        abort(403)
+    db = get_db()
+    db.execute("DELETE FROM requests WHERE id = ?", (rid,))
+    db.commit()
+    flash("Talep silindi.", "info")
+    return redirect(url_for("talepler.admin_inbox"))