Add a new method to remove an entry

flaskr/flaskr.py

@@ -59,7 +59,7 @@ def close_db(error):
 @app.route('/')
 def show_entries():
     db = get_db()
-    cur = db.execute('SELECT title, text FROM entries ORDER BY id DESC')
+    cur = db.execute('SELECT id, title, text FROM entries ORDER BY id DESC')
     entries = cur.fetchall()
     return render_template('show_entries.html', entries=entries)
 
@@ -96,3 +96,14 @@ def logout():
     session.pop('logged_in', None)
     flash('You were logged out')
     return redirect(url_for('show_entries'))
+
+
+@app.route('/remove/<int:entry_id>', methods=['POST'])
+def remove_entry(entry_id):
+    if not session.get('logged_in'):
+        abort(401)
+    db = get_db()
+    db.execute('DELETE FROM entries WHERE id = ?', [entry_id])
+    db.commit()
+    flash('Entry was successfully removed')
+    return redirect(url_for('show_entries'))

flaskr/templates/show_entries.html

@@ -13,7 +13,14 @@
   {% endif %}
   <ul class=entries>
   {% for entry in entries %}
-    <li><h2>{{ entry.title }}</h2>{{ entry.text|safe }}
+    <li>
+      <h2>{{ entry.title }}</h2>{{ entry.text|safe }}
+      {% if session.logged_in %}
+        <form action="{{ url_for('remove_entry', entry_id=entry.id) }}" method=post class=remove-entry style="display: inline;">
+          <input type=submit value="Delete" onclick="return confirm('Are you sure you want to delete this entry?');">
+        </form>
+      {% endif %}
+    </li>
   {% else %}
     <li><em>Unbelievable.  No entries here so far</em>
   {% endfor %}

tests/test_flaskr.py

@@ -144,6 +144,59 @@ def test_show_entries(self):
             # the database state is not guaranteed. In a real-world scenario,
             # you might want to set up a known database state before running this test.
 
+    def test_remove_entry_unauthorized(self, client):
+        """
+        Test that an unauthorized user cannot remove an entry.
+        """
+        # First add an entry as a logged-in user
+        client.post('/login', data={'username': 'admin', 'password': 'default'})
+        client.post('/add', data={'title': 'Test Title', 'text': 'Test Text'})
+        client.get('/logout')
+
+        # Get the entry ID
+        with app.app_context():
+            db = get_db()
+            entry_id = db.execute('SELECT id FROM entries WHERE title = ?', ['Test Title']).fetchone()['id']
+
+        # Try to remove the entry without being logged in
+        response = client.post(f'/remove/{entry_id}', follow_redirects=True)
+
+        # Check that we get a 401 Unauthorized response
+        assert response.status_code == 401
+
+        # Verify the entry still exists
+        with app.app_context():
+            db = get_db()
+            entry = db.execute('SELECT * FROM entries WHERE id = ?', [entry_id]).fetchone()
+            assert entry is not None
+            assert entry['title'] == 'Test Title'
+
+    def test_remove_entry_authorized(self, client):
+        """
+        Test that an authorized user can remove an entry.
+        """
+        # First add an entry as a logged-in user
+        client.post('/login', data={'username': 'admin', 'password': 'default'})
+        client.post('/add', data={'title': 'Test Title', 'text': 'Test Text'})
+
+        # Get the entry ID
+        with app.app_context():
+            db = get_db()
+            entry_id = db.execute('SELECT id FROM entries WHERE title = ?', ['Test Title']).fetchone()['id']
+
+        # Remove the entry
+        response = client.post(f'/remove/{entry_id}', follow_redirects=True)
+
+        # Check that the removal was successful
+        assert response.status_code == 200
+        assert b'Entry was successfully removed' in response.data
+
+        # Verify the entry no longer exists
+        with app.app_context():
+            db = get_db()
+            entry = db.execute('SELECT * FROM entries WHERE id = ?', [entry_id]).fetchone()
+            assert entry is None
+
 
 
 class AuthActions(object):