home · contact · privacy
Fix bug of /day POSTS breaking on empty new_todo fields.
[plomtask] / plomtask / http.py
index 01a949e019eddbf9919f333d252a05aeb7dcd4e7..bb6e4edb9702248442da467ba3b7800e824eff1b 100644 (file)
@@ -1,12 +1,24 @@
 """Web server stuff."""
+from __future__ import annotations
+from inspect import signature
+from typing import Any, Callable
+from base64 import b64encode, b64decode
+from binascii import Error as binascii_Exception
 from http.server import BaseHTTPRequestHandler
 from http.server import HTTPServer
 from urllib.parse import urlparse, parse_qs
+from json import dumps as json_dumps
 from os.path import split as path_split
 from jinja2 import Environment as JinjaEnv, FileSystemLoader as JinjaFSLoader
+from plomtask.dating import date_in_n_days
 from plomtask.days import Day
-from plomtask.misc import HandledException
-from plomtask.db import DatabaseConnection
+from plomtask.exceptions import (HandledException, BadFormatException,
+                                 NotFoundException)
+from plomtask.db import DatabaseConnection, DatabaseFile, BaseModel
+from plomtask.processes import Process, ProcessStep, ProcessStepsNode
+from plomtask.conditions import Condition
+from plomtask.todos import Todo, TodoOrProcStepNode
+from plomtask.misc import DictableNode
 
 TEMPLATES_DIR = 'templates'
 
@@ -14,85 +26,792 @@ TEMPLATES_DIR = 'templates'
 class TaskServer(HTTPServer):
     """Variant of HTTPServer that knows .jinja as Jinja Environment."""
 
-    def __init__(self, db_file, *args, **kwargs):
+    def __init__(self, db_file: DatabaseFile,
+                 *args: Any, **kwargs: Any) -> None:
         super().__init__(*args, **kwargs)
         self.db = db_file
+        self.render_mode = 'html'
         self.jinja = JinjaEnv(loader=JinjaFSLoader(TEMPLATES_DIR))
 
 
+class InputsParser:
+    """Wrapper for validating and retrieving dict-like HTTP inputs."""
+
+    def __init__(self, dict_: dict[str, list[str]]) -> None:
+        self.inputs = dict_
+
+    def get_all_str(self, key: str) -> list[str]:
+        """Retrieve list of string values at key (empty if no key)."""
+        if key not in self.inputs.keys():
+            return []
+        return self.inputs[key]
+
+    def get_all_int(self, key: str, fail_on_empty: bool = False) -> list[int]:
+        """Retrieve list of int values at key."""
+        all_str = self.get_all_str(key)
+        try:
+            return [int(s) for s in all_str if fail_on_empty or s != '']
+        except ValueError as e:
+            msg = f'cannot int a form field value for key {key} in: {all_str}'
+            raise BadFormatException(msg) from e
+
+    def get_str(self, key: str, default: str | None = None) -> str | None:
+        """Retrieve single/first string value of key, or default."""
+        vals = self.get_all_str(key)
+        if vals:
+            return vals[0]
+        return default
+
+    def get_str_or_fail(self, key: str, default: str | None = None) -> str:
+        """Retrieve first string value of key, if none: fail or default."""
+        vals = self.get_all_str(key)
+        if not vals:
+            if default is not None:
+                return default
+            raise BadFormatException(f'no value found for key: {key}')
+        return vals[0]
+
+    def get_int_or_none(self, key: str) -> int | None:
+        """Retrieve single/first value of key as int, return None if empty."""
+        val = self.get_str_or_fail(key, '')
+        if val == '':
+            return None
+        try:
+            return int(val)
+        except (ValueError, TypeError) as e:
+            msg = f'cannot int form field value for key {key}: {val}'
+            raise BadFormatException(msg) from e
+
+    def get_bool_or_none(self, key: str) -> bool | None:
+        """Return value to key if truish; if no value to key, None."""
+        val = self.get_str(key)
+        if val is None:
+            return None
+        return val in {'True', 'true', '1', 'on'}
+
+    def get_all_of_key_prefixed(self, key_prefix: str) -> dict[str, list[str]]:
+        """Retrieve dict of strings at keys starting with key_prefix."""
+        ret = {}
+        for key in [k for k in self.inputs.keys() if k.startswith(key_prefix)]:
+            ret[key[len(key_prefix):]] = self.inputs[key]
+        return ret
+
+    def get_float_or_fail(self, key: str) -> float:
+        """Retrieve float value of key from self.postvars, fail if none."""
+        val = self.get_str_or_fail(key)
+        try:
+            return float(val)
+        except ValueError as e:
+            msg = f'cannot float form field value for key {key}: {val}'
+            raise BadFormatException(msg) from e
+
+    def get_all_floats_or_nones(self, key: str) -> list[float | None]:
+        """Retrieve list of float value at key, None if empty strings."""
+        ret: list[float | None] = []
+        for val in self.get_all_str(key):
+            if '' == val:
+                ret += [None]
+            else:
+                try:
+                    ret += [float(val)]
+                except ValueError as e:
+                    msg = f'cannot float form field value for key {key}: {val}'
+                    raise BadFormatException(msg) from e
+        return ret
+
+
 class TaskHandler(BaseHTTPRequestHandler):
     """Handles single HTTP request."""
+    # pylint: disable=too-many-public-methods
     server: TaskServer
+    _conn: DatabaseConnection
+    _site: str
+    _form: InputsParser
+    _params: InputsParser
 
-    def do_GET(self):
-        """Handle any GET request."""
-        try:
-            conn, site, params = self._init_handling()
-            if 'calendar' == site:
-                html = self.do_GET_calendar(conn)
-            elif 'day' == site:
-                date = params.get('date', ['2024-01-01'])[0]
-                html = self.do_GET_day(conn, date)
-            else:
-                raise HandledException('Test!')
-            conn.commit()
-            conn.close()
-            self._send_html(html)
-        except HandledException as error:
-            self._send_msg(error)
-
-    def do_GET_calendar(self, conn: DatabaseConnection):
-        """Show Days."""
-        return self.server.jinja.get_template('calendar.html').render(
-                days=Day.all(conn))
-
-    def do_GET_day(self, conn: DatabaseConnection, date: str):
-        """Show single Day."""
-        day = Day.by_date(conn, date)
-        return self.server.jinja.get_template('day.html').render(day=day)
-
-    def do_POST(self):
-        """Handle any POST request."""
-        try:
-            conn, site, params = self._init_handling()
-            length = int(self.headers['content-length'])
-            postvars = parse_qs(self.rfile.read(length).decode(),
-                                keep_blank_values=1)
-            if 'day' == site:
-                date = params.get('date', ['2024-01-01'])[0]
-                self.do_POST_day(conn, date, postvars)
-            conn.commit()
-            conn.close()
-            self._redirect('/')
-        except HandledException as error:
-            self._send_msg(error)
-
-    def do_POST_day(self, conn: DatabaseConnection, date: str, postvars: dict):
-        """Update or insert Day of date and fields defined in postvars."""
-        comment = postvars['comment'][0]
-        day = Day.by_date(conn, date, create=True)
-        day.comment = comment
-        day.save(conn)
-
-    def _init_handling(self):
-        conn = DatabaseConnection(self.server.db)
-        parsed_url = urlparse(self.path)
-        site = path_split(parsed_url.path)[1]
-        params = parse_qs(parsed_url.query)
-        return conn, site, params
-
-    def _redirect(self, target: str):
-        self.send_response(302)
-        self.send_header('Location', target)
-        self.end_headers()
+    def _send_page(
+            self, ctx: dict[str, Any], tmpl_name: str, code: int = 200
+            ) -> None:
+        """HTTP-send ctx as HTML or JSON, as defined by .server.render_mode.
 
-    def _send_html(self, html: str, code: int = 200):
-        """Send HTML as proper HTTP response."""
+        The differentiation by .server.render_mode serves to allow easily
+        comparable JSON responses for automatic testing.
+        """
+        body: str
+        headers: list[tuple[str, str]] = []
+        if 'html' == self.server.render_mode:
+            tmpl = self.server.jinja.get_template(f'{tmpl_name}.html')
+            body = tmpl.render(ctx)
+        else:
+            body = self._ctx_to_json(ctx)
+            headers += [('Content-Type', 'application/json')]
         self.send_response(code)
+        for header_tuple in headers:
+            self.send_header(*header_tuple)
         self.end_headers()
-        self.wfile.write(bytes(html, 'utf-8'))
+        self.wfile.write(bytes(body, 'utf-8'))
+
+    def _ctx_to_json(self, ctx: dict[str, object]) -> str:
+        """Render ctx into JSON string.
+
+        Flattens any objects that json.dumps might not want to serialize, and
+        turns occurrences of BaseModel objects into listings of their .id_, to
+        be resolved to a full dict inside a top-level '_library' dictionary,
+        to avoid endless and circular nesting.
+        """
+
+        def flatten(node: object) -> object:
+
+            def update_library_with(
+                    item: BaseModel[int] | BaseModel[str]) -> None:
+                cls_name = item.__class__.__name__
+                if cls_name not in library:
+                    library[cls_name] = {}
+                if item.id_ not in library[cls_name]:
+                    d, refs = item.as_dict_and_refs
+                    id_key = '?' if item.id_ is None else item.id_
+                    library[cls_name][id_key] = d
+                    for ref in refs:
+                        update_library_with(ref)
+
+            if isinstance(node, BaseModel):
+                update_library_with(node)
+                return node.id_
+            if isinstance(node, DictableNode):
+                d, refs = node.as_dict_and_refs
+                for ref in refs:
+                    update_library_with(ref)
+                return d
+            if isinstance(node, (list, tuple)):
+                return [flatten(item) for item in node]
+            if isinstance(node, dict):
+                d = {}
+                for k, v in node.items():
+                    d[k] = flatten(v)
+                return d
+            if isinstance(node, HandledException):
+                return str(node)
+            return node
+
+        library: dict[str, dict[str | int, object]] = {}
+        for k, v in ctx.items():
+            ctx[k] = flatten(v)
+        ctx['_library'] = library
+        return json_dumps(ctx)
+
+    @staticmethod
+    def _request_wrapper(http_method: str, not_found_msg: str
+                         ) -> Callable[..., Callable[[TaskHandler], None]]:
+        """Wrapper for do_GET… and do_POST… handlers, to init and clean up.
+
+        Among other things, conditionally cleans all caches, but only on POST
+        requests, as only those are expected to change the states of objects
+        that may be cached, and certainly only those are expected to write any
+        changes to the database. We want to call them as early though as
+        possible here, either exactly after the specific request handler
+        returns successfully, or right after any exception is triggered –
+        otherwise, race conditions become plausible.
+
+        Note that otherwise any POST attempt, even a failed one, may end in
+        problematic inconsistencies:
+
+        - if the POST handler experiences an Exception, changes to objects
+          won't get written to the DB, but the changed objects may remain in
+          the cache and affect other objects despite their possibly illegal
+          state
+
+        - even if an object was just saved to the DB, we cannot be sure its
+          current state is completely identical to what we'd get if loading it
+          fresh from the DB (e.g. currently Process.n_owners is only updated
+          when loaded anew via .from_table_row, nor is its state written to
+          the DB by .save; a questionable design choice, but proof that we
+          have no guarantee that objects' .save stores all their states we'd
+          prefer at their most up-to-date.
+        """
+
+        def clear_caches() -> None:
+            for cls in (Day, Todo, Condition, Process, ProcessStep):
+                assert hasattr(cls, 'empty_cache')
+                cls.empty_cache()
+
+        def decorator(f: Callable[..., str | None]
+                      ) -> Callable[[TaskHandler], None]:
+            def wrapper(self: TaskHandler) -> None:
+                # pylint: disable=protected-access
+                # (because pylint here fails to detect the use of wrapper as a
+                # method to self with respective access privileges)
+                try:
+                    self._conn = DatabaseConnection(self.server.db)
+                    parsed_url = urlparse(self.path)
+                    self._site = path_split(parsed_url.path)[1]
+                    params = parse_qs(parsed_url.query,
+                                      keep_blank_values=True,
+                                      strict_parsing=True)
+                    self._params = InputsParser(params)
+                    handler_name = f'do_{http_method}_{self._site}'
+                    if hasattr(self, handler_name):
+                        handler = getattr(self, handler_name)
+                        redir_target = f(self, handler)
+                        if 'POST' == http_method:
+                            clear_caches()
+                        if redir_target:
+                            self.send_response(302)
+                            self.send_header('Location', redir_target)
+                            self.end_headers()
+                    else:
+                        msg = f'{not_found_msg}: {self._site}'
+                        raise NotFoundException(msg)
+                except HandledException as error:
+                    if 'POST' == http_method:
+                        clear_caches()
+                    ctx = {'msg': error}
+                    self._send_page(ctx, 'msg', error.http_code)
+                finally:
+                    self._conn.close()
+            return wrapper
+        return decorator
+
+    @_request_wrapper('GET', 'Unknown page')
+    def do_GET(self, handler: Callable[[], str | dict[str, object]]
+               ) -> str | None:
+        """Render page with result of handler, or redirect if result is str."""
+        tmpl_name = f'{self._site}'
+        ctx_or_redir_target = handler()
+        if isinstance(ctx_or_redir_target, str):
+            return ctx_or_redir_target
+        self._send_page(ctx_or_redir_target, tmpl_name)
+        return None
+
+    @_request_wrapper('POST', 'Unknown POST target')
+    def do_POST(self, handler: Callable[[], str]) -> str:
+        """Handle POST with handler, prepare redirection to result."""
+        length = int(self.headers['content-length'])
+        postvars = parse_qs(self.rfile.read(length).decode(),
+                            keep_blank_values=True)
+        self._form = InputsParser(postvars)
+        redir_target = handler()
+        self._conn.commit()
+        return redir_target
+
+    # GET handlers
+
+    @staticmethod
+    def _get_item(target_class: Any
+                  ) -> Callable[..., Callable[[TaskHandler],
+                                              dict[str, object]]]:
+        def decorator(f: Callable[..., dict[str, object]]
+                      ) -> Callable[[TaskHandler], dict[str, object]]:
+            def wrapper(self: TaskHandler) -> dict[str, object]:
+                # pylint: disable=protected-access
+                # (because pylint here fails to detect the use of wrapper as a
+                # method to self with respective access privileges)
+                id_ = None
+                for val in self._params.get_all_int('id', fail_on_empty=True):
+                    id_ = val
+                if target_class.can_create_by_id:
+                    item = target_class.by_id_or_create(self._conn, id_)
+                else:
+                    item = target_class.by_id(self._conn, id_)
+                if 'exists' in signature(f).parameters:
+                    exists = id_ is not None and target_class._get_cached(id_)
+                    return f(self, item, exists)
+                return f(self, item)
+            return wrapper
+        return decorator
+
+    def do_GET_(self) -> str:
+        """Return redirect target on GET /."""
+        return '/day'
+
+    def _do_GET_calendar(self) -> dict[str, object]:
+        """Show Days from ?start= to ?end=.
+
+        Both .do_GET_calendar and .do_GET_calendar_txt refer to this to do the
+        same, the only difference being the HTML template they are rendered to,
+        which .do_GET selects from their method name.
+        """
+        start = self._params.get_str_or_fail('start', '')
+        end = self._params.get_str_or_fail('end', '')
+        end = end if end != '' else date_in_n_days(366)
+        #
+        days, start, end = Day.by_date_range_with_limits(self._conn,
+                                                         (start, end), 'id')
+        days = Day.with_filled_gaps(days, start, end)
+        today = date_in_n_days(0)
+        return {'start': start, 'end': end, 'days': days, 'today': today}
+
+    def do_GET_calendar(self) -> dict[str, object]:
+        """Show Days from ?start= to ?end= – normal view."""
+        return self._do_GET_calendar()
+
+    def do_GET_calendar_txt(self) -> dict[str, object]:
+        """Show Days from ?start= to ?end= – minimalist view."""
+        return self._do_GET_calendar()
+
+    def do_GET_day(self) -> dict[str, object]:
+        """Show single Day of ?date=."""
+        date = self._params.get_str('date', date_in_n_days(0))
+        make_type = self._params.get_str_or_fail('make_type', 'full')
+        #
+        day = Day.by_id_or_create(self._conn, date)
+        conditions_present = []
+        enablers_for = {}
+        disablers_for = {}
+        for todo in day.todos:
+            for condition in todo.conditions + todo.blockers:
+                if condition not in conditions_present:
+                    conditions_present += [condition]
+                    enablers_for[condition.id_] = [p for p in
+                                                   Process.all(self._conn)
+                                                   if condition in p.enables]
+                    disablers_for[condition.id_] = [p for p in
+                                                    Process.all(self._conn)
+                                                    if condition in p.disables]
+        seen_todos: set[int] = set()
+        top_nodes = [t.get_step_tree(seen_todos)
+                     for t in day.todos if not t.parents]
+        return {'day': day,
+                'top_nodes': top_nodes,
+                'make_type': make_type,
+                'enablers_for': enablers_for,
+                'disablers_for': disablers_for,
+                'conditions_present': conditions_present,
+                'processes': Process.all(self._conn)}
+
+    @_get_item(Todo)
+    def do_GET_todo(self, todo: Todo) -> dict[str, object]:
+        """Show single Todo of ?id=."""
+
+        def walk_process_steps(node_id: int,
+                               process_step_nodes: list[ProcessStepsNode],
+                               steps_nodes: list[TodoOrProcStepNode]) -> int:
+            for process_step_node in process_step_nodes:
+                node_id += 1
+                proc = Process.by_id(self._conn,
+                                     process_step_node.step.step_process_id)
+                node = TodoOrProcStepNode(node_id, None, proc, [])
+                steps_nodes += [node]
+                node_id = walk_process_steps(
+                        node_id, process_step_node.steps, node.children)
+            return node_id
+
+        def walk_todo_steps(node_id: int, todos: list[Todo],
+                            steps_nodes: list[TodoOrProcStepNode]) -> int:
+            for todo in todos:
+                matched = False
+                for match in [item for item in steps_nodes
+                              if item.process
+                              and item.process == todo.process]:
+                    match.todo = todo
+                    matched = True
+                    for child in match.children:
+                        child.fillable = True
+                    node_id = walk_todo_steps(
+                            node_id, todo.children, match.children)
+                if not matched:
+                    node_id += 1
+                    node = TodoOrProcStepNode(node_id, todo, None, [])
+                    steps_nodes += [node]
+                    node_id = walk_todo_steps(
+                            node_id, todo.children, node.children)
+            return node_id
+
+        def collect_adoptables_keys(
+                steps_nodes: list[TodoOrProcStepNode]) -> set[int]:
+            ids = set()
+            for node in steps_nodes:
+                if not node.todo:
+                    assert isinstance(node.process, Process)
+                    assert isinstance(node.process.id_, int)
+                    ids.add(node.process.id_)
+                ids = ids | collect_adoptables_keys(node.children)
+            return ids
+
+        todo_steps = [step.todo for step in todo.get_step_tree(set()).children]
+        process_tree = todo.process.get_steps(self._conn, None)
+        steps_todo_to_process: list[TodoOrProcStepNode] = []
+        last_node_id = walk_process_steps(0, process_tree,
+                                          steps_todo_to_process)
+        for steps_node in steps_todo_to_process:
+            steps_node.fillable = True
+        walk_todo_steps(last_node_id, todo_steps, steps_todo_to_process)
+        adoptables: dict[int, list[Todo]] = {}
+        any_adoptables = [Todo.by_id(self._conn, t.id_)
+                          for t in Todo.by_date(self._conn, todo.date)
+                          if t.id_ is not None
+                          and t != todo]
+        for id_ in collect_adoptables_keys(steps_todo_to_process):
+            adoptables[id_] = [t for t in any_adoptables
+                               if t.process.id_ == id_]
+        return {'todo': todo,
+                'steps_todo_to_process': steps_todo_to_process,
+                'adoption_candidates_for': adoptables,
+                'process_candidates': sorted(Process.all(self._conn)),
+                'todo_candidates': any_adoptables,
+                'condition_candidates': Condition.all(self._conn)}
+
+    def do_GET_todos(self) -> dict[str, object]:
+        """Show Todos from ?start= to ?end=, of ?process=, ?comment= pattern"""
+        sort_by = self._params.get_str_or_fail('sort_by', 'title')
+        start = self._params.get_str_or_fail('start', '')
+        end = self._params.get_str_or_fail('end', '')
+        process_id = self._params.get_int_or_none('process_id')
+        comment_pattern = self._params.get_str_or_fail('comment_pattern', '')
+        #
+        ret = Todo.by_date_range_with_limits(self._conn, (start, end))
+        todos_by_date_range, start, end = ret
+        todos = [t for t in todos_by_date_range
+                 if comment_pattern in t.comment
+                 and ((not process_id) or t.process.id_ == process_id)]
+        sort_by = Todo.sort_by(todos, sort_by)
+        return {'start': start, 'end': end, 'process_id': process_id,
+                'comment_pattern': comment_pattern, 'todos': todos,
+                'all_processes': Process.all(self._conn), 'sort_by': sort_by}
+
+    def do_GET_conditions(self) -> dict[str, object]:
+        """Show all Conditions."""
+        pattern = self._params.get_str_or_fail('pattern', '')
+        sort_by = self._params.get_str_or_fail('sort_by', 'title')
+        #
+        conditions = Condition.matching(self._conn, pattern)
+        sort_by = Condition.sort_by(conditions, sort_by)
+        return {'conditions': conditions,
+                'sort_by': sort_by,
+                'pattern': pattern}
+
+    @_get_item(Condition)
+    def do_GET_condition(self,
+                         c: Condition,
+                         exists: bool
+                         ) -> dict[str, object]:
+        """Show Condition of ?id=."""
+        ps = Process.all(self._conn)
+        return {'condition': c,
+                'is_new': not exists,
+                'enabled_processes': [p for p in ps if c in p.conditions],
+                'disabled_processes': [p for p in ps if c in p.blockers],
+                'enabling_processes': [p for p in ps if c in p.enables],
+                'disabling_processes': [p for p in ps if c in p.disables]}
+
+    @_get_item(Condition)
+    def do_GET_condition_titles(self, c: Condition) -> dict[str, object]:
+        """Show title history of Condition of ?id=."""
+        return {'condition': c}
+
+    @_get_item(Condition)
+    def do_GET_condition_descriptions(self, c: Condition) -> dict[str, object]:
+        """Show description historys of Condition of ?id=."""
+        return {'condition': c}
+
+    @_get_item(Process)
+    def do_GET_process(self,
+                       process: Process,
+                       exists: bool
+                       ) -> dict[str, object]:
+        """Show Process of ?id=."""
+        owner_ids = self._params.get_all_int('step_to')
+        owned_ids = self._params.get_all_int('has_step')
+        title_64 = self._params.get_str('title_b64')
+        title_new = None
+        if title_64:
+            try:
+                title_new = b64decode(title_64.encode()).decode()
+            except binascii_Exception as exc:
+                msg = 'invalid base64 for ?title_b64='
+                raise BadFormatException(msg) from exc
+        #
+        if title_new:
+            process.title.set(title_new)
+        preset_top_step = None
+        owners = process.used_as_step_by(self._conn)
+        for step_id in owner_ids:
+            owners += [Process.by_id(self._conn, step_id)]
+        for process_id in owned_ids:
+            Process.by_id(self._conn, process_id)  # to ensure ID exists
+            preset_top_step = process_id
+        return {'process': process,
+                'is_new': not exists,
+                'preset_top_step': preset_top_step,
+                'steps': process.get_steps(self._conn),
+                'owners': owners,
+                'n_todos': len(Todo.by_process_id(self._conn, process.id_)),
+                'process_candidates': Process.all(self._conn),
+                'condition_candidates': Condition.all(self._conn)}
+
+    @_get_item(Process)
+    def do_GET_process_titles(self, p: Process) -> dict[str, object]:
+        """Show title history of Process of ?id=."""
+        return {'process': p}
+
+    @_get_item(Process)
+    def do_GET_process_descriptions(self, p: Process) -> dict[str, object]:
+        """Show description historys of Process of ?id=."""
+        return {'process': p}
+
+    @_get_item(Process)
+    def do_GET_process_efforts(self, p: Process) -> dict[str, object]:
+        """Show default effort history of Process of ?id=."""
+        return {'process': p}
+
+    def do_GET_processes(self) -> dict[str, object]:
+        """Show all Processes."""
+        pattern = self._params.get_str_or_fail('pattern', '')
+        sort_by = self._params.get_str_or_fail('sort_by', 'title')
+        #
+        processes = Process.matching(self._conn, pattern)
+        sort_by = Process.sort_by(processes, sort_by)
+        return {'processes': processes, 'sort_by': sort_by, 'pattern': pattern}
+
+    # POST handlers
+
+    @staticmethod
+    def _delete_or_post(target_class: Any, redir_target: str = '/'
+                        ) -> Callable[..., Callable[[TaskHandler], str]]:
+        def decorator(f: Callable[..., str]
+                      ) -> Callable[[TaskHandler], str]:
+            def wrapper(self: TaskHandler) -> str:
+                # pylint: disable=protected-access
+                # (because pylint here fails to detect the use of wrapper as a
+                # method to self with respective access privileges)
+                id_ = self._params.get_int_or_none('id')
+                for _ in self._form.get_all_str('delete'):
+                    if id_ is None:
+                        msg = 'trying to delete non-saved ' +\
+                                f'{target_class.__name__}'
+                        raise NotFoundException(msg)
+                    item = target_class.by_id(self._conn, id_)
+                    item.remove(self._conn)
+                    return redir_target
+                if target_class.can_create_by_id:
+                    item = target_class.by_id_or_create(self._conn, id_)
+                else:
+                    item = target_class.by_id(self._conn, id_)
+                return f(self, item)
+            return wrapper
+        return decorator
+
+    def _change_versioned_timestamps(self, cls: Any, attr_name: str) -> str:
+        """Update history timestamps for VersionedAttribute."""
+        id_ = self._params.get_int_or_none('id')
+        item = cls.by_id(self._conn, id_)
+        attr = getattr(item, attr_name)
+        for k, vals in self._form.get_all_of_key_prefixed('at:').items():
+            if k[19:] != vals[0]:
+                attr.reset_timestamp(k, f'{vals[0]}.0')
+        attr.save(self._conn)
+        return f'/{cls.name_lowercase()}_{attr_name}s?id={item.id_}'
+
+    def do_POST_day(self) -> str:
+        """Update or insert Day of date and Todos mapped to it."""
+        # pylint: disable=too-many-locals
+        date = self._params.get_str_or_fail('date')
+        day_comment = self._form.get_str_or_fail('day_comment')
+        make_type = self._form.get_str_or_fail('make_type')
+        old_todos = self._form.get_all_int('todo_id')
+        new_todos_by_process = self._form.get_all_int('new_todo')
+        comments = self._form.get_all_str('comment')
+        efforts = self._form.get_all_floats_or_nones('effort')
+        done_todos = self._form.get_all_int('done')
+        is_done = [t_id in done_todos for t_id in old_todos]
+        if not (len(old_todos) == len(is_done) == len(comments)
+                == len(efforts)):
+            msg = 'not equal number each of number of todo_id, comments, ' +\
+                    'and efforts inputs'
+            raise BadFormatException(msg)
+        for _ in [id_ for id_ in done_todos if id_ not in old_todos]:
+            raise BadFormatException('"done" field refers to unknown Todo')
+        #
+        day = Day.by_id_or_create(self._conn, date)
+        day.comment = day_comment
+        day.save(self._conn)
+        new_todos = []
+        for process_id in sorted(new_todos_by_process):
+            process = Process.by_id(self._conn, process_id)
+            todo = Todo(None, process, False, date)
+            todo.save(self._conn)
+            new_todos += [todo]
+        if 'full' == make_type:
+            for todo in new_todos:
+                todo.ensure_children(self._conn)
+        for i, todo_id in enumerate(old_todos):
+            todo = Todo.by_id(self._conn, todo_id)
+            todo.is_done = is_done[i]
+            todo.comment = comments[i]
+            todo.effort = efforts[i]
+            todo.save(self._conn)
+        return f'/day?date={date}&make_type={make_type}'
+
+    @_delete_or_post(Todo, '/')
+    def do_POST_todo(self, todo: Todo) -> str:
+        """Update Todo and its children."""
+        # pylint: disable=too-many-locals
+        # pylint: disable=too-many-branches
+        # pylint: disable=too-many-statements
+        assert todo.id_ is not None
+        adoptees = [(id_, todo.id_) for id_ in self._form.get_all_int('adopt')]
+        to_make = {'full': [(id_, todo.id_)
+                            for id_ in self._form.get_all_int('make_full')],
+                   'empty': [(id_, todo.id_)
+                             for id_ in self._form.get_all_int('make_empty')]}
+        step_fillers_to = self._form.get_all_of_key_prefixed('step_filler_to_')
+        to_update: dict[str, Any] = {
+            'comment': self._form.get_str_or_fail('comment', '')}
+        for k in ('is_done', 'calendarize'):
+            v = self._form.get_bool_or_none(k)
+            if v is not None:
+                to_update[k] = v
+        cond_rels = [self._form.get_all_int(name) for name in
+                     ['conditions', 'blockers', 'enables', 'disables']]
+        effort_or_not = self._form.get_str('effort')
+        if effort_or_not is not None:
+            if effort_or_not == '':
+                to_update['effort'] = None
+            else:
+                try:
+                    to_update['effort'] = float(effort_or_not)
+                except ValueError as e:
+                    msg = 'cannot float form field value for key: effort'
+                    raise BadFormatException(msg) from e
+        for k, fillers in step_fillers_to.items():
+            try:
+                parent_id = int(k)
+            except ValueError as e:
+                msg = f'bad step_filler_to_ key: {k}'
+                raise BadFormatException(msg) from e
+            for filler in [f for f in fillers if f != 'ignore']:
+                target_id: int
+                prefix = 'make_'
+                to_int = filler[5:] if filler.startswith(prefix) else filler
+                try:
+                    target_id = int(to_int)
+                except ValueError as e:
+                    msg = f'bad fill_for target: {filler}'
+                    raise BadFormatException(msg) from e
+                if filler.startswith(prefix):
+                    to_make['empty'] += [(target_id, parent_id)]
+                else:
+                    adoptees += [(target_id, parent_id)]
+        #
+        todo.set_condition_relations(self._conn, *cond_rels)
+        for parent in [Todo.by_id(self._conn, a[1])
+                       for a in adoptees] + [todo]:
+            for child in parent.children:
+                if child not in [t[0] for t in adoptees
+                                 if t[0] == child.id_ and t[1] == parent.id_]:
+                    parent.remove_child(child)
+                    parent.save(self._conn)
+        for child_id, parent_id in adoptees:
+            parent = Todo.by_id(self._conn, parent_id)
+            if child_id not in [c.id_ for c in parent.children]:
+                parent.add_child(Todo.by_id(self._conn, child_id))
+                parent.save(self._conn)
+        todo.update_attrs(**to_update)
+        for approach, make_data in to_make.items():
+            for process_id, parent_id in make_data:
+                parent = Todo.by_id(self._conn, parent_id)
+                process = Process.by_id(self._conn, process_id)
+                made = Todo(None, process, False, todo.date)
+                made.save(self._conn)
+                if 'full' == approach:
+                    made.ensure_children(self._conn)
+                parent.add_child(made)
+                parent.save(self._conn)
+        # todo.save() may destroy Todo if .effort < 0, so retrieve .id_ early
+        url = f'/todo?id={todo.id_}'
+        todo.save(self._conn)
+        return url
+
+    def do_POST_process_descriptions(self) -> str:
+        """Update history timestamps for Process.description."""
+        return self._change_versioned_timestamps(Process, 'description')
+
+    def do_POST_process_efforts(self) -> str:
+        """Update history timestamps for Process.effort."""
+        return self._change_versioned_timestamps(Process, 'effort')
+
+    def do_POST_process_titles(self) -> str:
+        """Update history timestamps for Process.title."""
+        return self._change_versioned_timestamps(Process, 'title')
+
+    @_delete_or_post(Process, '/processes')
+    def do_POST_process(self, process: Process) -> str:
+        """Update or insert Process of ?id= and fields defined in postvars."""
+        # pylint: disable=too-many-locals
+
+        def id_or_title(l_id_or_title: list[str]) -> tuple[str, list[int]]:
+            l_ids, title = [], ''
+            for id_or_title in l_id_or_title:
+                try:
+                    l_ids += [int(id_or_title)]
+                except ValueError:
+                    title = id_or_title
+            return title, l_ids
+
+        versioned = {'title': self._form.get_str_or_fail('title'),
+                     'description': self._form.get_str_or_fail('description'),
+                     'effort': self._form.get_float_or_fail('effort')}
+        cond_rels = [self._form.get_all_int(s) for s
+                     in ['conditions', 'blockers', 'enables', 'disables']]
+        calendarize = self._form.get_bool_or_none('calendarize')
+        step_of = self._form.get_all_str('step_of')
+        suppressions = self._form.get_all_int('suppresses')
+        kept_steps = self._form.get_all_int('kept_steps')
+        new_top_step_procs = self._form.get_all_str('new_top_step')
+        new_steps_to = {}
+        for step_id in kept_steps:
+            name = f'new_step_to_{step_id}'
+            new_steps_to[step_id] = self._form.get_all_int(name)
+        new_owner_title, owners_to_set = id_or_title(step_of)
+        new_step_title, new_top_step_proc_ids = id_or_title(new_top_step_procs)
+        #
+        for k, v in versioned.items():
+            getattr(process, k).set(v)
+        if calendarize is not None:
+            process.calendarize = calendarize
+        process.save(self._conn)
+        assert isinstance(process.id_, int)
+        # set relations to Conditions and ProcessSteps / other Processes
+        process.set_condition_relations(self._conn, *cond_rels)
+        owned_steps = []
+        for step_id in kept_steps:
+            owned_steps += [ProcessStep.by_id(self._conn, step_id)]
+            owned_steps += [  # new sub-steps
+                    ProcessStep(None, process.id_, step_process_id, step_id)
+                    for step_process_id in new_steps_to[step_id]]
+        for step_process_id in new_top_step_proc_ids:
+            owned_steps += [ProcessStep(None, process.id_, step_process_id,
+                                        None)]
+        process.set_step_relations(self._conn, owners_to_set, suppressions,
+                                   owned_steps)
+        # encode titles for potential newly-to-create Processes up or down
+        params = f'id={process.id_}'
+        if new_step_title:
+            title_b64_encoded = b64encode(new_step_title.encode()).decode()
+            params = f'step_to={process.id_}&title_b64={title_b64_encoded}'
+        elif new_owner_title:
+            title_b64_encoded = b64encode(new_owner_title.encode()).decode()
+            params = f'has_step={process.id_}&title_b64={title_b64_encoded}'
+        process.save(self._conn)
+        return f'/process?{params}'
+
+    def do_POST_condition_descriptions(self) -> str:
+        """Update history timestamps for Condition.description."""
+        return self._change_versioned_timestamps(Condition, 'description')
+
+    def do_POST_condition_titles(self) -> str:
+        """Update history timestamps for Condition.title."""
+        return self._change_versioned_timestamps(Condition, 'title')
 
-    def _send_msg(self, msg: str, code: int = 400):
-        """Send message in HTML formatting as HTTP response."""
-        html = self.server.jinja.get_template('msg.html').render(msg=msg)
-        self._send_html(html, code)
+    @_delete_or_post(Condition, '/conditions')
+    def do_POST_condition(self, condition: Condition) -> str:
+        """Update/insert Condition of ?id= and fields defined in postvars."""
+        title = self._form.get_str_or_fail('title')
+        description = self._form.get_str_or_fail('description')
+        is_active = self._form.get_bool_or_none('is_active')
+        #
+        if is_active is not None:
+            condition.is_active = is_active
+        condition.title.set(title)
+        condition.description.set(description)
+        condition.save(self._conn)
+        return f'/condition?id={condition.id_}'