spencermandClaude Fable 5.1
97b0973130
AD sign-in over LDAPS (search with the service account, bind as the user, nested groups through LDAP_MATCHING_RULE_IN_CHAIN, disabled accounts refused), roles as the union of PS-* groups mapped by a table derived from the seeded departments. Server-side sessions with idle, lock and absolute timeouts, Origin and X-Requested-With check, step-up unlock. Optional Argon2id PIN set with the domain password; PIN sign-in by employee ID on registered devices only; five wrong attempts disable the PIN, three wrong at unlock or signature end the session. Rate limits per account and per address before any bind. Devices, signatures table and sign helper, audit rows for every identity event, SSE over LISTEN/NOTIFY with presence. Account settings and Admin APIs and screens (AD view, devices, PIN clearing, group map with missing-group flags, refresh from AD now). CLI ad-groups --list and ad-refresh. Migration 0002. Frontend: real sign-in (password tab, PIN keypad on registered devices), lock screen, role switcher, Account settings, Admin shell, screen placeholders. CI: Samba AD DC container (PSTEST.LOCAL) with a generated CA, 49 of the 50 groups plus one extra, 17 test users; wired into the CI compose overlay and the Gitea workflow; Playwright sign-in scenario. Verified on docker-1: 171 server tests green inside the CI stack against PostgreSQL and the Samba DC, 48 frontend tests, 8 Playwright scenarios against the live stack (password and PIN sign-in, lock and unlock, Admin group map). Findings recorded in the docs: the DC needs CAP_SYS_ADMIN, a hidden tab locks only after a minute as the old build did, and the app uses the alias ps-app for Playwright because "app" is on Chromium's HSTS preload list. Co-Authored-By: Claude Fable 5.1 <[email protected]>
105 lines
6.3 KiB
Markdown
105 lines
6.3 KiB
Markdown
# Packet Station
|
|
|
|
Digital job packets for the PESCO shop floor. A packet moves through each department on screen instead of on paper. VISUAL releases the work and Packet Station builds the packet with the drawing from M-Files at the rev the job pull calls. Clerical checks anything flagged. Warehouse pulls parts and records heat numbers, MTRs and shorts. A supervisor assigns a station and welder. The station logs welds on the weld map, works the checklist and runs the timer. The supervisor sends it to Q.C. Q.C. inspects, accepts or rejects, and adds reports. Clerical closes the job in VISUAL, exports the manufacturing data book PDF and files it. A change in VISUAL to a packet already in the shop goes to Clerical as a change order before it reaches the shop.
|
|
|
|
This repo is the rebuild of Packet Station as a server application: Docker Compose on `docker-1`, PostgreSQL 16, a Python server that enforces every rule, a worker for the VISUAL feed and M-Files drawing lookups, and a React frontend as a pure client. Sign-in is PESCO's Active Directory. VISUAL is read through VisualKit and M-Files through MFilesKit, read-only.
|
|
|
|
## Status
|
|
|
|
**Rebuild in progress. Phase 1 done: identity, sessions, audit, frontend shell.**
|
|
|
|
People can sign in; no packet feature exists yet. The old build on `M:\Production\Packet Station` stays the live system until go-live. The new system starts empty; nothing is migrated from M:.
|
|
|
|
| Area | Exists yet? |
|
|
|---|---|
|
|
| Repo, docs, CLAUDE.md | Yes (phase 0) |
|
|
| Image, compose, CI, `doctor`, migration runner, security headers, build version endpoint | Yes (phase 0, image and stack verified on docker-1) |
|
|
| Sign-in (AD password, PIN on registered devices), sessions, lock screen, Account settings, Admin shell, audit, SSE | Yes (phase 1, verified against the Samba DC in the CI stack on docker-1) |
|
|
| Packets, policy, Clerical screens | No (phase 2) |
|
|
| VISUAL feed and drawings | No (phase 3) |
|
|
| Warehouse, shop, Q.C., close and file, PDFs | No (phases 4 to 7) |
|
|
| Project Management, Admin, notifications, backups | No (phases 8 and 9) |
|
|
| Regression bench and go-live | No (phase 10) |
|
|
|
|
## Phases
|
|
|
|
The full plan is in [docs/PLAN.md](docs/PLAN.md).
|
|
|
|
| Phase | What it delivers |
|
|
|---|---|
|
|
| 0 | Skeleton: repo, docs, Dockerfile, compose, CI, `packetstation doctor`, migration runner, headers and CSP. |
|
|
| 1 | Identity: AD sign-in, sessions, optional PIN, devices, signatures, audit, SSE, frontend shell and theme. |
|
|
| 2 | Core domain: schema, policy engine in Python, packet API, Clerical screen, packet page. |
|
|
| 3 | VISUAL feed and M-Files drawings in the worker, change orders, Clerical "From VISUAL" panel. |
|
|
| 4 | Warehouse: task board, pull table, heats, MTRs, shorts, upload pipeline. |
|
|
| 5 | Shop: supervisor and stall screens, weld map, heat table, timer, change-order verification. |
|
|
| 6 | Q.C.: inspection, accept and reject, Q.C. documents, digital ITP. |
|
|
| 7 | Close and file, HMAC seals, server-side PDFs (data book, traveler, ITP, prints, stamps). |
|
|
| 8 | Project Management screen, find bar, list view, presence. |
|
|
| 9 | Admin completion, AD reconcile, integrity job, notifications, backups and restore. |
|
|
| 10 | Regression bench, hardening, go-live and paper-fallback docs. |
|
|
|
|
## Folder map
|
|
|
|
```
|
|
CLAUDE.md README.md CHANGELOG.md pyproject.toml Dockerfile .env.example
|
|
docs/ the brief, the plan, security, deploy, feed, policy, schema, go-live, paper fallback
|
|
server/packetstation/ the Python package: app, worker, CLI, migrations, policy, domain, feed, drawings, PDFs
|
|
frontend/ Vite + React + TypeScript client
|
|
tests/ server tests (pytest), e2e scenarios (Playwright), synthetic fixture generator
|
|
deploy/ compose files (base, NPM overlay, CI overlay), PostgreSQL init, Samba AD for CI
|
|
docker/ the image entrypoint
|
|
scripts/ host backup and restore scripts, systemd timer
|
|
.gitea/workflows/ CI
|
|
```
|
|
|
|
Not in git: `.env`, `tests/fixtures/local/`, `reference/`, `recordings/`. Real job data stays out of git and CI.
|
|
|
|
## How to run
|
|
|
|
Developer machine:
|
|
|
|
```bash
|
|
python -m venv .venv
|
|
.venv\Scripts\python -m pip install -e ".[dev]"
|
|
.venv\Scripts\python -m pytest
|
|
cd frontend && npm ci && npm run build
|
|
packetstation doctor
|
|
```
|
|
|
|
`visualkit` and `mfileskit` install from PESCO's Gitea index with `--index-url`. Everything else installs from public PyPI in a separate step. See [docs/DEPLOY.md](docs/DEPLOY.md).
|
|
|
|
Test stack on `docker-1`:
|
|
|
|
```bash
|
|
docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
|
|
-f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
|
|
```
|
|
|
|
The `packetstation` command has `doctor`, `migrate`, `app`, `worker`, `ad-groups --list` (the 50 AD group names the app expects) and `ad-refresh` (create or refresh the users from the groups' members).
|
|
|
|
CI stack with the Samba domain controller and the Playwright scenario, on a Docker host:
|
|
|
|
```bash
|
|
deploy/ci/make-secrets.sh
|
|
docker compose -p packetstation-ci --env-file deploy/ci/ci.env -f deploy/compose.yaml -f deploy/compose.ci.yaml up -d --build --wait
|
|
docker compose -p packetstation-ci --env-file deploy/ci/ci.env -f deploy/compose.yaml -f deploy/compose.ci.yaml --profile e2e run --rm playwright
|
|
docker compose -p packetstation-ci --env-file deploy/ci/ci.env -f deploy/compose.yaml -f deploy/compose.ci.yaml down -v
|
|
```
|
|
|
|
Server tests that need PostgreSQL run when `TEST_PG_SUPERUSER_URL` is set; the ones that need the domain controller run when the `TEST_LDAP_*` variables and `TEST_DC_USERS_FILE` are set. See [deploy/samba/README.md](deploy/samba/README.md).
|
|
|
|
## Docs
|
|
|
|
- [docs/BRIEF.md](docs/BRIEF.md): the brief this rebuild follows.
|
|
- [docs/PLAN.md](docs/PLAN.md): the approved phased plan and open questions.
|
|
- [docs/SECURITY.md](docs/SECURITY.md): old layers and where they live now, the new controls, the requirement ID table.
|
|
- [docs/DEPLOY.md](docs/DEPLOY.md): host, stacks, secrets, NPM proxy host, doctor, backups.
|
|
- [docs/FEED.md](docs/FEED.md): the VISUAL feed and drawing jobs (phase 3).
|
|
- [docs/POLICY.md](docs/POLICY.md): who may do what (phase 2).
|
|
- [docs/SCHEMA.md](docs/SCHEMA.md): the database schema (phases 1 to 3).
|
|
- [docs/GO-LIVE.md](docs/GO-LIVE.md): go-live procedure (phase 10).
|
|
- [docs/PAPER-FALLBACK.md](docs/PAPER-FALLBACK.md): what the shop does when the server is down (phase 10).
|
|
- [CHANGELOG.md](CHANGELOG.md): what changed.
|
|
- [CLAUDE.md](CLAUDE.md): rules for Claude Code sessions in this repo.
|