Complete HTTP Routes Reference for Hábito. Flask App

Hábito. organises its HTTP surface into three Flask Blueprints, each registered inside create_app() in app/__init__.py. The auth_bp blueprint (prefix /auth) handles registration, login, and logout. The pag_principal_bp blueprint (prefix /pagina_principal) owns the main dashboard. The habito_bp blueprint (prefix /habitos) manages the full habit CRUD lifecycle. There is also a bare root route (/) that immediately redirects every visitor to the login page.

Root Route

Path	Method	Auth Required	Behaviour
`/`	GET	No	Redirects to `/auth/inicio_sesion`

@app.route('/')
def index():
    return redirect(url_for('auth.inicio_sesion'))

Auth Blueprint

Blueprint name: auth_bp · URL prefix: /auth · Source: app/routes/auth.py The auth blueprint is registered as 'auth', so all internal url_for() calls use the auth. namespace (e.g. url_for('auth.inicio_sesion')).

Endpoints

GET /auth/registro
POST /auth/registro
GET /auth/inicio_sesion
POST /auth/inicio_sesion
GET /auth/cerrar_sesion

Method: GET
Auth required: No
Description: Renders the registro.html registration form. If the user already has an active session (current_user.is_authenticated), they are redirected to the dashboard instead with a "success" flash.Redirect on already-authenticated: → pag_principal.inicio

Method: POST
Auth required: No
Description: Reads correo, contrasena, and nombre_usuario from the form. Performs server-side presence validation, then calls UsuarioRepository.crear_usuario(). On success, flashes a confirmation and redirects back to the registration form (login redirect in a future version).Redirect on success: → auth.registro (with "success" flash)
Redirect on missing fields: → auth.registro (with "error" flash)
Redirect on IntegrityError: → auth.registro (with "error" flash — duplicate email or username)

Method: GET
Auth required: No
Description: Renders the inicio_sesion.html login form. If the user already has an active session, they are redirected to the dashboard.Redirect on already-authenticated: → pag_principal.inicio

Method: POST
Auth required: No
Description: Reads correo and contrasena from the form and calls UsuarioRepository.verificar_credenciales(). If the returned value is a Usuario object, login_user(usuario) is called to establish the Flask-Login session. On failure, an "error" flash is shown.Redirect on success: → pag_principal.inicio (with "success" flash)
Redirect on failure: → auth.inicio_sesion (with "error" flash)

Method: GET
Auth required: Yes (@login_required)
Description: Calls logout_user() to destroy the session cookie, then flashes a confirmation message.Redirect: → auth.inicio_sesion (with "success" flash)

Auth route summary table

Route	Methods	Login Required	Success Redirect
`/auth/registro`	GET, POST	No	`auth.registro` (POST)
`/auth/inicio_sesion`	GET, POST	No	`pag_principal.inicio` (POST)
`/auth/cerrar_sesion`	GET	Yes	`auth.inicio_sesion`

Dashboard Blueprint

Blueprint name: pag_principal_bp · URL prefix: /pagina_principal · Source: app/routes/pagina_principal.py The dashboard is a single, read-only view. It aggregates data from several repository calls and passes everything to the pagina_principal.html template.

Endpoints

GET /pagina_principal/inicio

Method: GET
Auth required: Yes (@login_required)
Description: Builds and renders the main dashboard. Performs the following work before rendering:

Fetches all active habits for current_user via HabitoRepository.obtener_habitos_por_usuario(current_user.id).
Determines today’s day-letter (L–D) and filters habits that are both activo=True and scheduled for today.
Annotates each habit with a transient completado_hoy attribute (bool) by scanning habito.registros.
Queries HabitoRepository.obtener_dias_activos_mes() to produce the set of calendar day-numbers used by the heat-map.
Computes three KPIs: habits completed today, current best streak, all-time best streak.

Template variables passed:

Variable	Type	Description
`usuario`	`Usuario`	The logged-in user object
`habitos`	`list[Habito]`	Today’s active habits (with `completado_hoy`)
`mes_actual`	`str`	Spanish month name (e.g. `"Julio"`)
`num_dias`	`int`	Number of days in current month
`dia_semana_inicio`	`int`	Weekday of the 1st of the month (0=Mon)
`dias_completados`	`set[int]`	Day numbers with ≥1 completion this month
`habitos_completados_hoy`	`int`	Count of today’s completed habits
`racha_actual`	`int`	Highest current streak across all habits
`mejor_racha`	`int`	Highest all-time streak across all habits

Habits Blueprint

Blueprint name: habito_bp · URL prefix: /habitos · Source: app/routes/habito.py All routes in this blueprint require an authenticated session. Routes that operate on a specific habit by id additionally check that habito.usuario_id == current_user.id before proceeding — see Ownership Security below.

All POST routes in this blueprint modify database state and are not idempotent. Refreshing the browser after a POST will resubmit the form. The app does not implement CSRF protection beyond Flask’s signed session cookie.

Endpoints

Method: GET
Auth required: Yes
Description: Renders habitos.html with the full list of the user’s habits. Accepts an optional ?estado= query parameter.

`estado` value	Effect
`activos` (default)	Only habits with `activo=True`
`inactivos`	Only habits with `activo=False`
`todos`	All habits regardless of status

GET /habitos/mis_habitos?estado=inactivos

Method: POST
Auth required: Yes
Description: Reads nombre, descripcion, and dias (multi-value list) from the form, joins days into a comma-separated string, and calls HabitoRepository.crear_habito().Validation: nombre and at least one value in dias must be present; otherwise an "error" flash is shown.Redirect on success: → pag_principal.inicio (with "success" flash)
Redirect on validation failure: → pag_principal.inicio (with "error" flash)

Method: GET
Auth required: Yes
Description: Looks up the habit by id_habito. Applies the ownership check. Renders editar_habito.html with the habit object pre-populated.Redirect on not-found / unauthorized: → habitos.mis_habitos (with "error" flash)

Method: POST
Auth required: Yes
Description: Applies the same ownership check, then reads nombre, descripcion, dias (list), and activo (checkbox → "on" / absent) from the form. Calls HabitoRepository.editar_habito().Redirect on success: → habitos.mis_habitos (with "success" flash)
Redirect on not-found / unauthorized: → habitos.mis_habitos (with "error" flash)

Method: POST
Auth required: Yes
Description: Applies the ownership check, then calls HabitoRepository.eliminar_habito(). Because cascade="all, delete-orphan" is set on Habito.registros, all related RegistroHabito rows are deleted automatically.Redirect on success: → habitos.mis_habitos (with "success" flash)
Redirect on not-found / unauthorized: → habitos.mis_habitos (with "error" flash)

Method: POST
Auth required: Yes
Description: Applies the ownership check, then delegates entirely to HabitoRepository.marcar_completado_hoy(). The repository method toggles completion: if a RegistroHabito row exists for today it is deleted (unmarked); otherwise one is created (marked). The route inspects the returned boolean to choose the appropriate flash message.Redirect: → pag_principal.inicio (always, with "success" flash)
Redirect on unauthorized: → pag_principal.inicio (with "error" flash)

Method: GET
Auth required: Yes
Description: Applies the ownership check, then calls EstadisticasService.generar_grafica_ultimos_dias(habito.registros) to generate an embedded Plotly chart covering the last 30 days. Renders visualizar_progreso.html with the chart HTML string.Redirect on not-found / unauthorized: → habitos.mis_habitos (with "error" flash)

Habits route summary table

Route	Methods	Login Required	Ownership Check
`/habitos/mis_habitos`	GET	Yes	No
`/habitos/crear`	POST	Yes	No
`/habitos/editar/<id>`	GET, POST	Yes	Yes
`/habitos/eliminar/<id>`	POST	Yes	Yes
`/habitos/completar/<id>`	POST	Yes	Yes
`/habitos/visualizar_progreso/<id>`	GET	Yes	Yes

Ownership Security Checks

Any route that targets a specific habit by ID applies the following guard before doing any work:

habito = HabitoRepository.obtener_habito_por_id(id_habito)
if not habito or habito.usuario_id != current_user.id:
    flash("...", "error")
    return redirect(url_for('habitos.mis_habitos'))

This pattern protects the edit, delete, completar, and visualizar_progreso routes. If the habit does not exist (None returned by the repository) or belongs to a different user, the request is silently rejected with an error flash and a redirect — no habit data is leaked to the requester.

Flash Messages

Hábito. uses Flask’s flash() function throughout all three blueprints to communicate outcomes to the user. Flash messages are stored in the session for one request and rendered by the template on the next page load. Two categories are used:

Category	When used
`"success"`	Operation completed successfully (login, registration, habit created, etc.)
`"error"`	Validation failure, wrong credentials, ownership violation, or missing resource

Example flash calls from the source:

flash("¡Registro exitoso! Ahora puedes iniciar sesión.", "success")
flash("Este correo electrónico o nombre de usuario ya está registrado.", "error")
flash(f"¡Genial! Has completado '{habito.nombre}' hoy. 🔥", "success")
flash("No tienes permiso para modificar este hábito.", "error")

Flask-Login itself also emits a flash when it redirects an unauthenticated user, using the category configured in app/__init__.py:

login_manager.login_message = 'Por favor inicia sesión para acceder.'
login_manager.login_message_category = 'error'

Get Started

Core Features

Technical Reference

Complete HTTP Routes Reference for Hábito. Flask App

Root Route

Auth Blueprint

Endpoints

Auth route summary table

Dashboard Blueprint

Endpoints

Habits Blueprint

Endpoints

Habits route summary table

Ownership Security Checks

Flash Messages

Build docs developers (and LLMs) love

Get Started

Core Features

Technical Reference

Documentation Index

​Root Route

​Auth Blueprint

​Endpoints

​Auth route summary table

​Dashboard Blueprint

​Endpoints

​Habits Blueprint

​Endpoints

​Habits route summary table

​Ownership Security Checks

​Flash Messages

Build docs developers (and LLMs) love

Root Route

Auth Blueprint

Endpoints

Auth route summary table

Dashboard Blueprint

Endpoints

Habits Blueprint

Endpoints

Habits route summary table

Ownership Security Checks

Flash Messages