Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

server/packetstation/domain/assets.py

@@ -593,33 +593,45 @@ def open_quota_alert(conn: Any) -> dict[str, Any] | None:
 def check_quota(conn: Any, settings: Settings) -> dict[str, Any]:
     """Open or resolve the storage alert. Returns the usage with `alert`: "opened", "resolved" or None.
 
-    Over the threshold with no open `assets_quota` row: insert one (severity warning, subject assets, detail the
-    usage) and audit `storage.quota_warning`. Under it with one open: set its resolved_at.
+    Over the threshold with no open `assets_quota` event: raise one through notify.raise_event (a standing
+    condition, subject assets, detail the usage) and audit `storage.quota_warning`. Under it with one open:
+    notify.resolve_event closes it and queues the recovery notice.
     """
+    from ..notify import raise_event, resolve_event
+
     usage = usage_for(conn, settings)
     change: str | None = None
+    warn_pct = int(settings.assets_quota_warn_pct)
     with conn.transaction():
         open_row = open_quota_alert(conn)
         if usage["warn"] and open_row is None:
-            r = conn.execute(
-                "INSERT INTO notification_events (kind, severity, subject, detail) VALUES (%s, 'warning', %s, %s)"
-                " ON CONFLICT (kind, coalesce(subject, '')) WHERE resolved_at IS NULL DO NOTHING RETURNING id",
-                (QUOTA_KIND, QUOTA_SUBJECT, Jsonb(usage)),
-            ).fetchone()
-            if r is not None:
+            new_id = raise_event(
+                conn,
+                QUOTA_KIND,
+                subject=QUOTA_SUBJECT,
+                title=f"Assets storage is {usage['pct']}% full",
+                body=f"The assets storage is {usage['pct']}% full. The warning is at {warn_pct}%."
+                f" Used {usage['used']} of {usage['total']} bytes.",
+                detail=usage,
+                condition=True,
+            )
+            if new_id is not None:
                 change = "opened"
                 audit.append(
                     conn,
                     action="storage.quota_warning",
                     subject_type="notification",
-                    subject_id=str(r[0]),
-                    detail={**usage, "warn_pct": int(settings.assets_quota_warn_pct)},
-                )
-                log.warning(
-                    "assets storage is %.1f%% full (warning at %s%%)", usage["pct"], settings.assets_quota_warn_pct
+                    subject_id=str(new_id),
+                    detail={**usage, "warn_pct": warn_pct},
                 )
+                log.warning("assets storage is %.1f%% full (warning at %s%%)", usage["pct"], warn_pct)
         elif not usage["warn"] and open_row is not None:
-            conn.execute("UPDATE notification_events SET resolved_at = now() WHERE id = %s", (open_row["id"],))
+            resolve_event(
+                conn,
+                QUOTA_KIND,
+                subject=QUOTA_SUBJECT,
+                body=f"The assets storage is back under the warning: {usage['pct']}% full.",
+            )
             change = "resolved"
             log.info("assets storage is back under the warning: %.1f%%", usage["pct"])
     return {**usage, "alert": change}