Phase 9: Admin completion, reconcile, notifications, integrity, backups

Admin: Departments (name and stations; add shows the three groups IT must create), Profiles (welder stamp, station limits, active) with a CSV import that previews and applies only when clean, Checklists (weld and plain), Security (session, lockout and rate-limit settings with bounds, alerts for the last 24 hours, the integrity result), Access log with filters and a guarded CSV, Who is in, Stamp check, Notifications, and the employeeID flags. Every Admin change is audited. Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh (15 minutes), integrity (seals, asset hashes, missing and orphan files, the audit chain), backup-check, notify-send and notify-digest. Notifications route per event type to AD groups, users, mailboxes or the department Supervisor group, immediately or in a daily digest, over STARTTLS verified against the PESCO CA, with dry run on the test stack. Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21. CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19. Migration 0010. Closes the app part of I6, M3, O1, O2 and S3. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-21 18:27:09 -06:00
parent ce28d2f3c6
commit a82e056b6a
116 changed files with 15125 additions and 297 deletions
@@ -0,0 +1,38 @@
+"""Seed the routing rules: every missing event type enabled, immediate, digest 07:00, to PS-Admins.
+
+Idempotent. An existing rule is never touched, so the Admin's choices stand.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ..auth.groups import ADMIN_GROUP
+from ..settings import Settings
+from .catalog import EVENT_TYPES
+
+
+def admins_dn(settings: Settings) -> str:
+    base = settings.ldap_group_base_dn.strip()
+    return f"CN={ADMIN_GROUP},{base}" if base else f"CN={ADMIN_GROUP}"
+
+
+def seed(conn: Any, settings: Settings) -> list[str]:
+    """Insert the missing rules. Returns the event types it inserted."""
+    added: list[str] = []
+    with conn.transaction():
+        for key, et in EVENT_TYPES.items():
+            row = conn.execute(
+                "INSERT INTO notification_rules (event_type, enabled, delivery, digest_time, param)"
+                " VALUES (%s, true, 'immediate', '07:00', %s) ON CONFLICT (event_type) DO NOTHING RETURNING event_type",
+                (key, et.param_default),
+            ).fetchone()
+            if row is None:
+                continue
+            conn.execute(
+                "INSERT INTO notification_recipients (event_type, kind, group_dn, group_name)"
+                " VALUES (%s, 'group', %s, %s)",
+                (key, admins_dn(settings), ADMIN_GROUP),
+            )
+            added.append(key)
+    return added