Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell

New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.

- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
  SECURITY rewritten for the server with the requirement ID table, DEPLOY,
  stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
  healthcheck. Settings from the environment with secret files. Stack guard
  (test never points at VISUAL production). Security headers and CSP.
  Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
  hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
  index only), compose base, proxy overlay for npm_default, CI overlay,
  postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
  self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
  database checks pass, 77 server tests pass against PostgreSQL.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/server/test_settings.py

@@ -0,0 +1,123 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from pydantic import ValidationError
+
+from packetstation import logs
+from packetstation.settings import SecretFileError, Settings, read_secret
+
+
+def test_defaults_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("STACK", "TEST")
+    monkeypatch.setenv("PG_PORT", "5433")
+    monkeypatch.setenv("LDAP_URL", "ldaps://dc1.pesco.com ldaps://dc2.pesco.com")
+    monkeypatch.setenv("LDAP_CA_BUNDLE", "")
+    s = Settings()
+    assert s.stack == "test"
+    assert s.pg_port == 5433
+    assert s.site_tz == "America/Denver"
+    assert s.pg_app_user == "ps_app" and s.pg_migrate_user == "ps_migrate"
+    assert s.pg_app_password_file == Path("/run/secrets/postgres_app_password")
+    assert s.ldap_urls == ["ldaps://dc1.pesco.com", "ldaps://dc2.pesco.com"]
+    assert s.ldap_ca_bundle is None
+    assert s.ldap_user_filter == "(|(sAMAccountName={0})(userPrincipalName={0}))"
+    assert s.smtp_starttls is True and s.notify_dry_run is False
+    assert s.ps_build == "dev"
+
+
+def test_stack_required(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("STACK")
+    with pytest.raises(ValidationError):
+        Settings()
+
+
+def test_stack_rejects_unknown(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("STACK", "staging")
+    with pytest.raises(ValidationError):
+        Settings()
+
+
+def test_ps_env_file(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    env = tmp_path / "dev.env"
+    env.write_text("STACK=dev\nSITE_ID=TESTSITE\n")
+    monkeypatch.delenv("STACK")
+    monkeypatch.setenv("PS_ENV_FILE", str(env))
+    s = Settings()
+    assert s.stack == "dev" and s.site_id == "TESTSITE"
+
+
+def test_read_secret_strips_crlf(tmp_path: Path) -> None:
+    f = tmp_path / "pw"
+    f.write_bytes(b"s3cr3t value\r\n\r\n")
+    assert read_secret(f) == "s3cr3t value"
+
+
+def test_read_secret_keeps_inner_whitespace(tmp_path: Path) -> None:
+    f = tmp_path / "pw"
+    f.write_bytes(b" a b \n")
+    assert read_secret(f) == " a b "
+
+
+def test_read_secret_empty_is_error(tmp_path: Path) -> None:
+    f = tmp_path / "pw"
+    f.write_bytes(b"\r\n")
+    with pytest.raises(SecretFileError, match="empty"):
+        read_secret(f)
+
+
+def test_read_secret_missing_names_file(tmp_path: Path) -> None:
+    with pytest.raises(SecretFileError, match="nope"):
+        read_secret(tmp_path / "nope", "PG_APP_PASSWORD_FILE")
+
+
+def test_pg_password_by_role(tmp_path: Path) -> None:
+    (tmp_path / "app").write_text("apppw\n")
+    (tmp_path / "mig").write_text("migpw\n")
+    s = Settings(
+        _env_file=None, stack="ci", pg_app_password_file=tmp_path / "app", pg_migrate_password_file=tmp_path / "mig"
+    )
+    assert s.pg_password("app") == "apppw"
+    assert s.pg_password("migrate") == "migpw"
+
+
+def test_db_connect_kwargs(tmp_path: Path) -> None:
+    from packetstation import db
+
+    (tmp_path / "app").write_text("apppw\n")
+    s = Settings(_env_file=None, stack="ci", pg_app_password_file=tmp_path / "app")
+    k = db.connect_kwargs("worker", s)
+    assert k["user"] == "ps_app" and k["application_name"] == "ps-worker" and k["password"] == "apppw"
+    assert db.connect_kwargs("app", s)["application_name"] == "ps-app"
+
+
+def test_ldap_insecure_refused_on_prod() -> None:
+    with pytest.raises(ValidationError, match="LDAP_ALLOW_INSECURE"):
+        Settings(_env_file=None, stack="prod", ldap_allow_insecure=True)
+    assert Settings(_env_file=None, stack="test", ldap_allow_insecure=True).ldap_allow_insecure
+
+
+def test_log_level_validated() -> None:
+    assert Settings(_env_file=None, stack="ci", log_level="debug").log_level == "DEBUG"
+    with pytest.raises(ValidationError):
+        Settings(_env_file=None, stack="ci", log_level="loud")
+
+
+@pytest.mark.parametrize("text", ["password=hunter2", "PWD=abc;x", "connect secret=xyz now", "user=a Password=p@ss"])
+def test_redaction(text: str) -> None:
+    out = logs.redact(text)
+    for word in ("hunter2", "abc;x", "xyz", "p@ss"):
+        assert word not in out
+    assert "***" in out
+
+
+def test_log_lines_are_redacted_json(capsys: pytest.CaptureFixture[str]) -> None:
+    import json
+    import logging
+
+    logs.setup("INFO")
+    logging.getLogger("t").info("dsn host=x password=%s", "topsecret")
+    line = capsys.readouterr().out.strip().splitlines()[-1]
+    rec = json.loads(line)
+    assert rec["level"] == "INFO" and "topsecret" not in line and "password=***" in rec["msg"]