Strengthen CI with Next build + Docker build and expand tests

Add docker-build and next build jobs so Dockerfile/image failures fail
CI. Expand unit coverage for exporters/Zod and integration coverage for
search, MCT import, backup, and token revoke.

.dockerignore

@@ -0,0 +1,15 @@
+node_modules
+.next
+.git
+data
+*.db
+*.db-*
+.env
+.env.*
+!.env.example
+coverage
+tests
+.github
+.cursor
+**/*.md
+!README.md

.env.example

@@ -2,6 +2,14 @@ AUTH_SECRET=change-me-to-a-long-random-string
 # Optional: path to SQLite file (default ./data/rfid.db)
 # RFID_DB_PATH=./data/rfid.db
 
+# Docker Compose published port (default 3000)
+# RFID_PORT=3000
+
+# Optional first-boot user when using Docker entrypoint
+# [email protected]
+# CREATE_USER_PASSWORD=changeme
+# CREATE_USER_NAME=Admin
+
 # Optional OIDC (Authentik, Keycloak, Authelia, etc.)
 # AUTH_OIDC_ISSUER=https://sso.example.com/application/o/rfid/
 # AUTH_OIDC_CLIENT_ID=

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   check:
+    name: lint-typecheck-test-build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -18,3 +19,14 @@ jobs:
       - run: npm run lint
       - run: npm run typecheck
       - run: npm test
+      - run: npm run build
+        env:
+          AUTH_SECRET: ci-build-secret-at-least-32-characters
+
+  docker:
+    name: docker-build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build production image
+        run: docker build -t rfid-database:ci .

Dockerfile

@@ -2,18 +2,21 @@
 
 FROM node:22-bookworm-slim AS deps
 WORKDIR /app
-RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ \
+  && rm -rf /var/lib/apt/lists/*
 COPY package.json package-lock.json ./
 RUN npm ci
 
 FROM node:22-bookworm-slim AS builder
 WORKDIR /app
-RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ \
+  && rm -rf /var/lib/apt/lists/*
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV AUTH_SECRET=build-time-placeholder-secret-32chars
-RUN npm run build
+RUN npm run build \
+  && npm prune --omit=dev
 
 FROM node:22-bookworm-slim AS runner
 WORKDIR /app
@@ -21,16 +24,32 @@ ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV RFID_DB_PATH=/data/rfid.db
 ENV PORT=3000
-RUN apt-get update && apt-get install -y libstdc++6 && rm -rf /var/lib/apt/lists/*
-RUN mkdir -p /data && chown node:node /data
-COPY --from=builder /app/package.json /app/package-lock.json ./
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/.next ./.next
-COPY --from=builder /app/public ./public
-COPY --from=builder /app/scripts ./scripts
-COPY --from=builder /app/src ./src
-COPY --from=builder /app/tsconfig.json ./tsconfig.json
+ENV HOSTNAME=0.0.0.0
+ENV AUTH_TRUST_HOST=true
+
+RUN apt-get update && apt-get install -y --no-install-recommends libstdc++6 curl \
+  && rm -rf /var/lib/apt/lists/* \
+  && mkdir -p /data \
+  && chown node:node /data
+
+COPY --from=builder --chown=node:node /app/package.json /app/package-lock.json ./
+COPY --from=builder --chown=node:node /app/node_modules ./node_modules
+COPY --from=builder --chown=node:node /app/.next ./.next
+COPY --from=builder --chown=node:node /app/public ./public
+COPY --from=builder --chown=node:node /app/scripts ./scripts
+COPY --from=builder --chown=node:node /app/src ./src
+COPY --from=builder --chown=node:node /app/tsconfig.json ./tsconfig.json
+# tsx is needed for create-user / entrypoint bootstrap (devDependency pruned above)
+RUN npm install --omit=dev [email protected] \
+  && chown -R node:node /app/node_modules
+COPY --chown=node:node docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 USER node
 EXPOSE 3000
 VOLUME ["/data"]
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD curl -fsS http://127.0.0.1:3000/login >/dev/null || exit 1
+
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["npm", "run", "start"]

README.md

@@ -80,22 +80,56 @@ curl -sH "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
 npm test
 npm run lint
 npm run typecheck
+npm run build
 ```
 
-GitHub Actions runs lint, typecheck, and tests on every pull request and push to `main`.
+GitHub Actions runs on every pull request and push to `main`:
+
+1. **lint / typecheck / test / Next.js build**
+2. **`docker build`** — catches Dockerfile parse/build failures (the class of break that conflict markers previously caused)
 
 ## Docker
 
+### docker compose (recommended)
+
+```bash
+cp .env.example .env
+# set AUTH_SECRET to a long random string
+
+# optional first user on boot:
+# echo '[email protected]' >> .env
+# echo 'CREATE_USER_PASSWORD=changeme' >> .env
+
+docker compose up -d --build
+```
+
+App: http://localhost:3000 — SQLite persists in the `rfid-data` volume.
+
+Create a user later (if you skipped bootstrap):
+
+```bash
+docker compose exec rfid-database \
+  npx tsx scripts/create-user.ts --email [email protected] --password 'secret' --name You
+```
+
+Stop / remove (keeps volume):
+
+```bash
+docker compose down
+```
+
+### Plain docker
+
 ```bash
 docker build -t rfid-database .
 docker run --rm -p 3000:3000 \
   -e AUTH_SECRET=your-long-secret \
+  -e CREATE_USER_EMAIL=[email protected] \
+  -e CREATE_USER_PASSWORD=changeme \
   -v rfid-data:/data \
   rfid-database
 ```
 
-Create the first user against the mounted DB (exec into the container or run `create-user` with `RFID_DB_PATH` pointed at the volume).
-
 ## Security
 
 Tag dumps often include sector keys. Keep the app behind HTTPS, do not expose it publicly without auth, and treat `data/rfid.db` as sensitive.

docker-compose.yml

@@ -0,0 +1,38 @@
+services:
+  rfid-database:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: rfid-database:local
+    container_name: rfid-database
+    restart: unless-stopped
+    ports:
+      - "${RFID_PORT:-3000}:3000"
+    env_file:
+      - .env
+    environment:
+      NODE_ENV: production
+      RFID_DB_PATH: /data/rfid.db
+      PORT: "3000"
+      HOSTNAME: 0.0.0.0
+      AUTH_TRUST_HOST: "true"
+      # Optional bootstrap (only creates if missing):
+      # CREATE_USER_EMAIL: [email protected]
+      # CREATE_USER_PASSWORD: change-me
+      # CREATE_USER_NAME: Admin
+      # Optional OIDC — also set NEXT_PUBLIC_* in .env if using SSO button
+      # AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER:-}
+      # AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID:-}
+      # AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET:-}
+      # AUTH_OIDC_NAME: ${AUTH_OIDC_NAME:-SSO}
+    volumes:
+      - rfid-data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:3000/login"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 25s
+
+volumes:
+  rfid-data:

docker/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -e
+
+if [ -z "$AUTH_SECRET" ] || [ "$AUTH_SECRET" = "change-me-to-a-long-random-string" ]; then
+  echo "ERROR: AUTH_SECRET must be set to a long random value." >&2
+  exit 1
+fi
+
+mkdir -p "$(dirname "${RFID_DB_PATH:-/data/rfid.db}")"
+
+# Optional first-boot user: set CREATE_USER_EMAIL + CREATE_USER_PASSWORD
+if [ -n "$CREATE_USER_EMAIL" ] && [ -n "$CREATE_USER_PASSWORD" ]; then
+  echo "Ensuring user $CREATE_USER_EMAIL exists (ignored if already present)..."
+  npx tsx scripts/create-user.ts \
+    --email "$CREATE_USER_EMAIL" \
+    --password "$CREATE_USER_PASSWORD" \
+    --name "${CREATE_USER_NAME:-Admin}" \
+    || true
+fi
+
+exec "$@"

tests/integration/api.test.ts

@@ -21,6 +21,10 @@ import { GET as getTags, POST as postTag } from "@/app/api/v1/tags/route";
 import { PUT as putByUid } from "@/app/api/v1/tags/by-uid/[uid]/route";
 import { GET as getExport } from "@/app/api/v1/tags/[id]/export/route";
 import { GET as listTokens, POST as createToken } from "@/app/api/v1/tokens/route";
+import { DELETE as deleteToken } from "@/app/api/v1/tokens/[id]/route";
+import { GET as search } from "@/app/api/v1/search/route";
+import { GET as getBackup, POST as postBackup } from "@/app/api/v1/backup/route";
+import { POST as importTag } from "@/app/api/v1/tags/import/route";
 import { NextRequest } from "next/server";
 
 function req(url: string, init?: ConstructorParameters<typeof NextRequest>[1]) {
@@ -189,9 +193,81 @@ describe("API v1 integration", () => {
       true
     );
 
+    const revoked = await deleteToken(
+      req(`http://localhost/api/v1/tokens/${data.id}`, {
+        method: "DELETE",
+        headers: auth,
+      }),
+      { params: Promise.resolve({ id: data.id }) }
+    );
+    expect(revoked.status).toBe(200);
+
     const db = getDb();
     const user = db.select().from(users).where(eq(users.id, userId)).get();
     expect(user?.email).toBe("[email protected]");
     expect(db.select().from(sites).all().length).toBeGreaterThanOrEqual(0);
   });
+
+  it("searches, imports MCT, and backs up", async () => {
+    const auth = { Authorization: `Bearer ${bearer}` };
+
+    const siteRes = await postSite(
+      req("http://localhost/api/v1/sites", {
+        method: "POST",
+        headers: { ...auth, "Content-Type": "application/json" },
+        body: JSON.stringify({ code: "C", name: "Lab" }),
+      })
+    );
+    const site = await siteRes.json();
+
+    const mct = `+UID: AABBCCDD
++Sector: 0
+AABBCCDD00112233445566778899AABB
+00000000000000000000000000000000
+00000000000000000000000000000000
+FFFFFFFFFFFFFF078069FFFFFFFFFFFF
+`;
+
+    const imported = await importTag(
+      req("http://localhost/api/v1/tags/import", {
+        method: "POST",
+        headers: { ...auth, "Content-Type": "application/json" },
+        body: JSON.stringify({
+          siteId: site.id,
+          label: "Imported fob",
+          content: mct,
+          filename: "sample.mct",
+        }),
+      })
+    );
+    expect(imported.status).toBe(201);
+    const tag = await imported.json();
+    expect(tag.uid).toBe("AABBCCDD");
+
+    const searchRes = await search(
+      req("http://localhost/api/v1/search?q=Imported", { headers: auth })
+    );
+    expect(searchRes.status).toBe(200);
+    const found = await searchRes.json();
+    expect(found.tags.some((t: { label: string }) => t.label === "Imported fob")).toBe(
+      true
+    );
+
+    const backupRes = await getBackup(
+      req("http://localhost/api/v1/backup", { headers: auth })
+    );
+    expect(backupRes.status).toBe(200);
+    const backup = await backupRes.json();
+    expect(backup.sites.length).toBeGreaterThanOrEqual(1);
+    expect(backup.tags.length).toBeGreaterThanOrEqual(1);
+
+    const restore = await postBackup(
+      req("http://localhost/api/v1/backup", {
+        method: "POST",
+        headers: { ...auth, "Content-Type": "application/json" },
+        body: JSON.stringify({ ...backup, mode: "merge" }),
+      })
+    );
+    expect(restore.status).toBe(200);
+  });
 });

tests/unit/exporters-validation.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from "vitest";
+import { exportTag } from "@/lib/rfid/exporters";
+import {
+  dumpDataSchema,
+  mifareClassicDumpSchema,
+  siteCreateSchema,
+  tagCreateSchema,
+} from "@/lib/validation/rfid";
+
+const classicDump = {
+  size: "1K" as const,
+  sectors: [
+    {
+      index: 0,
+      blocks: [
+        "04A1B2C304A1B2C304A1B2C304A1B2C3",
+        "00000000000000000000000000000000",
+        "00000000000000000000000000000000",
+        "FFFFFFFFFFFFFF078069FFFFFFFFFFFF",
+      ],
+    },
+  ],
+};
+
+const sampleTag = {
+  id: "00000000-0000-4000-8000-000000000001",
+  label: "Dock fob",
+  frequency: "HF",
+  protocol: "MIFARE_CLASSIC_1K",
+  uid: "04A1B2C3",
+  dumpData: classicDump,
+  keys: { A: ["FFFFFFFFFFFF"], B: [] },
+  notes: null as string | null,
+};
+
+describe("exporters", () => {
+  it("exports canonical JSON", () => {
+    const out = exportTag(sampleTag, "json");
+    expect(out.contentType).toBe("application/json");
+    const parsed = JSON.parse(out.body);
+    expect(parsed.uid).toBe("04A1B2C3");
+    expect(parsed.dumpData.size).toBe("1K");
+  });
+
+  it("exports proxmark JSON with blocks", () => {
+    const out = exportTag(sampleTag, "proxmark");
+    const parsed = JSON.parse(out.body);
+    expect(parsed.FileType).toBe("mfcard");
+    expect(parsed.blocks).toHaveLength(4);
+    expect(parsed.Card.UID).toBe("04A1B2C3");
+  });
+
+  it("exports MCT text", () => {
+    const out = exportTag(sampleTag, "mct");
+    expect(out.body).toContain("+UID: 04A1B2C3");
+    expect(out.body).toContain("+Sector: 0");
+  });
+
+  it("exports hex listing", () => {
+    const out = exportTag(sampleTag, "hex");
+    expect(out.body).toContain("# UID 04A1B2C3");
+    expect(out.body).toContain("S0B0");
+  });
+});
+
+describe("validation schemas", () => {
+  it("accepts valid classic dump", () => {
+    expect(mifareClassicDumpSchema.safeParse(classicDump).success).toBe(true);
+    expect(dumpDataSchema.safeParse(classicDump).success).toBe(true);
+  });
+
+  it("rejects invalid site codes", () => {
+    expect(
+      siteCreateSchema.safeParse({ name: "Lab", code: "bad code!" }).success
+    ).toBe(false);
+  });
+
+  it("accepts valid tag create payload", () => {
+    const parsed = tagCreateSchema.safeParse({
+      siteId: "00000000-0000-4000-8000-000000000099",
+      label: "Dock",
+      frequency: "HF",
+      protocol: "MIFARE_CLASSIC_1K",
+      uid: "04:A1:B2:C3",
+      dumpData: classicDump,
+      keys: { A: ["FFFFFFFFFFFF"] },
+    });
+    expect(parsed.success).toBe(true);
+  });
+});