Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/packetstation/auth/signin.py

@@ -14,6 +14,7 @@ from psycopg.rows import dict_row
 
 from .. import audit
 from ..api.errors import ApiError
+from ..domain import security_alerts
 from ..settings import Settings
 from . import devices, ratelimit, sessions
 from . import directory as userdir
@@ -91,6 +92,7 @@ def rate_gate(
 def _fail(
     conn: Any,
     *,
+    settings: Settings,
     account: str,
     ip: str | None,
     kind: str,
@@ -111,6 +113,7 @@ def _fail(
                 detail={"reason": reason, "account": account, "kind": kind},
                 ip=ip,
             )
+    security_alerts.after_failure(conn, settings, account=account, ip=ip, kind=kind, user_id=user_id)
     raise ApiError(status, code, detail)
 
 
@@ -187,6 +190,7 @@ def password_signin(
         # Refused before LDAP: an empty password would be an anonymous bind
         _fail(
             conn,
+            settings=settings,
             account=account or "(empty)",
             ip=ip,
             kind="password",
@@ -203,6 +207,7 @@ def password_signin(
     if u is None:
         _fail(
             conn,
+            settings=settings,
             account=account,
             ip=ip,
             kind="password",
@@ -230,6 +235,7 @@ def password_signin(
     if not ok:
         _fail(
             conn,
+            settings=settings,
             account=account,
             ip=ip,
             kind="password",
@@ -242,6 +248,7 @@ def password_signin(
     if u.disabled:
         _fail(
             conn,
+            settings=settings,
             account=account,
             ip=ip,
             kind="password",
@@ -259,6 +266,7 @@ def password_signin(
     if not roles:
         _fail(
             conn,
+            settings=settings,
             account=account,
             ip=ip,
             kind="password",
@@ -302,6 +310,7 @@ def pin_signin(
     def fail(reason: str, user_id: Any = None, *, audited: bool = False) -> NoReturn:
         _fail(
             conn,
+            settings=settings,
             account=account,
             ip=ip,
             kind="pin",
@@ -338,6 +347,7 @@ def pin_signin(
         with conn.transaction():
             ratelimit.record(conn, account=account, ip=ip, kind="pin", ok=False, reason="bad_pin", user_id=uid)
             pins.register_failure(conn, settings, uid, ip=ip, where="signin")
+        security_alerts.after_failure(conn, settings, account=account, ip=ip, kind="pin", user_id=uid)
         raise ApiError(401, "signin_failed", PIN_FAILED)
     try:
         u = directory.get_user_by_guid(uid)
@@ -354,6 +364,7 @@ def pin_signin(
     if not roles:
         _fail(
             conn,
+            settings=settings,
             account=account,
             ip=ip,
             kind="pin",
@@ -423,6 +434,7 @@ def set_pin(
             user_id=actor.user_id,
             session_id=actor.session_id,
         )
+        security_alerts.after_failure(conn, settings, account=account, ip=ip, kind="pin_set", user_id=actor.user_id)
         raise ApiError(403, "bad_password", "The password is wrong.")
     with conn.transaction():
         pins.set_pin(conn, actor.user_id, new_pin)