WP-00: project skeleton with three-level test harness

Cargo workspace (domain, application, infrastructure, api), axum health endpoint
with SPA fallback, Vue 3 + Tailwind frontend, Vitest, Playwright, Makefile,
Gitea Actions CI and README.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/Cargo.toml

@@ -0,0 +1,39 @@
+[workspace]
+resolver = "2"
+members = ["crates/domain", "crates/application", "crates/infrastructure", "crates/api"]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2021"
+license = "Proprietary"
+
+[workspace.dependencies]
+domain = { path = "crates/domain" }
+application = { path = "crates/application" }
+infrastructure = { path = "crates/infrastructure" }
+
+anyhow = "1"
+async-trait = "0.1"
+axum = { version = "0.8", features = ["macros"] }
+base64 = "0.22"
+chrono = { version = "0.4", features = ["serde"] }
+dotenvy = "0.15"
+http-body-util = "0.1"
+jsonwebtoken = "9"
+argon2 = "0.5"
+rand = "0.8"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+sqlx = { version = "0.8", features = ["runtime-tokio", "sqlite", "chrono", "uuid", "migrate"] }
+thiserror = "2"
+tokio = { version = "1", features = ["full"] }
+tower = { version = "0.5", features = ["util"] }
+tower-http = { version = "0.6", features = ["fs", "trace", "cors"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+utoipa = { version = "5", features = ["axum_extras", "uuid", "chrono"] }
+uuid = { version = "1", features = ["v4", "serde"] }
+
+[workspace.lints.clippy]
+all = "warn"

backend/crates/api/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "api"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[[bin]]
+name = "monitoring-server"
+path = "src/main.rs"
+
+[dependencies]
+domain.workspace = true
+application.workspace = true
+infrastructure.workspace = true
+anyhow.workspace = true
+axum.workspace = true
+chrono.workspace = true
+dotenvy.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sqlx.workspace = true
+tokio.workspace = true
+tower-http.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+utoipa.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+http-body-util.workspace = true
+tower.workspace = true
+
+[lints]
+workspace = true

backend/crates/api/src/config.rs

@@ -0,0 +1,35 @@
+//! Runtime configuration read from environment variables (see `.env.example`).
+use std::net::SocketAddr;
+
+#[derive(Clone, Debug)]
+pub struct Config {
+    pub database_url: String,
+    pub jwt_secret: String,
+    pub bind: SocketAddr,
+    pub bootstrap_admin: Option<(String, String)>,
+    pub cookie_secure: bool,
+    pub frontend_dir: String,
+}
+
+impl Config {
+    pub fn from_env() -> anyhow::Result<Self> {
+        let env = |k: &str| std::env::var(k).ok().filter(|v| !v.is_empty());
+        let jwt_secret =
+            env("JWT_SECRET").ok_or_else(|| anyhow::anyhow!("JWT_SECRET is required"))?;
+        anyhow::ensure!(
+            jwt_secret.len() >= 32,
+            "JWT_SECRET must be at least 32 characters"
+        );
+        Ok(Self {
+            database_url: env("DATABASE_URL")
+                .unwrap_or_else(|| "sqlite://data/monitoring.db?mode=rwc".into()),
+            jwt_secret,
+            bind: env("BIND")
+                .unwrap_or_else(|| "127.0.0.1:8080".into())
+                .parse()?,
+            bootstrap_admin: env("BOOTSTRAP_ADMIN_EMAIL").zip(env("BOOTSTRAP_ADMIN_PASSWORD")),
+            cookie_secure: env("COOKIE_SECURE").is_some_and(|v| v == "true" || v == "1"),
+            frontend_dir: env("FRONTEND_DIR").unwrap_or_else(|| "../frontend/dist".into()),
+        })
+    }
+}

backend/crates/api/src/lib.rs

@@ -0,0 +1,28 @@
+//! HTTP API layer (axum). `build_app` is used by both the binary and the integration tests.
+pub mod config;
+pub mod test_support;
+
+use axum::{routing::get, Json, Router};
+use tower_http::services::{ServeDir, ServeFile};
+use tower_http::trace::TraceLayer;
+
+pub use config::Config;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub cfg: Config,
+}
+
+pub fn build_app(state: AppState) -> Router {
+    let index = format!("{}/index.html", state.cfg.frontend_dir);
+    let spa = ServeDir::new(&state.cfg.frontend_dir).not_found_service(ServeFile::new(index));
+    Router::new()
+        .route("/healthz", get(healthz))
+        .fallback_service(spa)
+        .layer(TraceLayer::new_for_http())
+        .with_state(state)
+}
+
+async fn healthz() -> Json<serde_json::Value> {
+    Json(serde_json::json!({ "status": "ok" }))
+}

backend/crates/api/src/main.rs

@@ -0,0 +1,15 @@
+use api::{build_app, AppState, Config};
+use tracing_subscriber::EnvFilter;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let _ = dotenvy::dotenv();
+    tracing_subscriber::fmt()
+        .with_env_filter(EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()))
+        .init();
+    let cfg = Config::from_env()?;
+    let listener = tokio::net::TcpListener::bind(cfg.bind).await?;
+    tracing::info!("listening on http://{}", cfg.bind);
+    axum::serve(listener, build_app(AppState { cfg })).await?;
+    Ok(())
+}

backend/crates/api/src/test_support.rs

@@ -0,0 +1,18 @@
+//! Helpers to build a fully wired app on an in-memory database for integration tests.
+use crate::{build_app, AppState, Config};
+use axum::Router;
+
+pub fn test_config() -> Config {
+    Config {
+        database_url: "sqlite::memory:".into(),
+        jwt_secret: "test-secret-test-secret-test-secret-1234".into(),
+        bind: "127.0.0.1:0".parse().unwrap(),
+        bootstrap_admin: None,
+        cookie_secure: false,
+        frontend_dir: "/nonexistent".into(),
+    }
+}
+
+pub async fn build_test_app() -> Router {
+    build_app(AppState { cfg: test_config() })
+}

backend/crates/api/tests/common/mod.rs

@@ -0,0 +1,89 @@
+//! Shared helpers for API integration tests: in-memory SQLite, request helpers.
+#![allow(dead_code)]
+
+use axum::body::Body;
+use axum::http::{header, Request, StatusCode};
+use axum::Router;
+use http_body_util::BodyExt;
+use tower::ServiceExt;
+
+pub struct Res {
+    pub status: StatusCode,
+    pub json: serde_json::Value,
+    pub headers: axum::http::HeaderMap,
+}
+
+pub async fn test_app() -> Router {
+    api::test_support::build_test_app().await
+}
+
+async fn send(app: &Router, req: Request<Body>) -> Res {
+    let res = app.clone().oneshot(req).await.unwrap();
+    let status = res.status();
+    let headers = res.headers().clone();
+    let bytes = res.into_body().collect().await.unwrap().to_bytes();
+    let json = serde_json::from_slice(&bytes).unwrap_or(serde_json::Value::Null);
+    Res {
+        status,
+        json,
+        headers,
+    }
+}
+
+fn with_auth(
+    mut b: axum::http::request::Builder,
+    token: Option<&str>,
+) -> axum::http::request::Builder {
+    if let Some(t) = token {
+        b = b.header(header::AUTHORIZATION, format!("Bearer {t}"));
+    }
+    b
+}
+
+pub async fn get(app: &Router, path: &str, token: Option<&str>) -> Res {
+    let req = with_auth(Request::get(path), token)
+        .body(Body::empty())
+        .unwrap();
+    send(app, req).await
+}
+
+pub async fn send_json(
+    app: &Router,
+    method: &str,
+    path: &str,
+    body: serde_json::Value,
+    token: Option<&str>,
+) -> Res {
+    let req = with_auth(Request::builder().method(method).uri(path), token)
+        .header(header::CONTENT_TYPE, "application/json")
+        .body(Body::from(body.to_string()))
+        .unwrap();
+    send(app, req).await
+}
+
+pub async fn post(app: &Router, path: &str, body: serde_json::Value, token: Option<&str>) -> Res {
+    send_json(app, "POST", path, body, token).await
+}
+
+pub async fn patch(app: &Router, path: &str, body: serde_json::Value, token: Option<&str>) -> Res {
+    send_json(app, "PATCH", path, body, token).await
+}
+
+/// POST with a `Cookie` header (used for refresh/logout which read the refresh cookie).
+pub async fn post_with_cookie(app: &Router, path: &str, cookie: &str) -> Res {
+    let req = Request::post(path)
+        .header(header::COOKIE, cookie)
+        .body(Body::empty())
+        .unwrap();
+    send(app, req).await
+}
+
+/// Extract `name=value` of a Set-Cookie header.
+pub fn cookie_value(res: &Res, name: &str) -> Option<String> {
+    res.headers
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .filter_map(|v| v.to_str().ok())
+        .find(|c| c.starts_with(&format!("{name}=")))
+        .map(|c| c.split(';').next().unwrap().to_string())
+}

backend/crates/api/tests/healthz.rs

@@ -0,0 +1,12 @@
+//! WP-00 sample integration test: the health endpoint answers 200 with `{"status":"ok"}`.
+mod common;
+
+use axum::http::StatusCode;
+
+#[tokio::test]
+async fn healthz_returns_ok() {
+    let app = common::test_app().await;
+    let res = common::get(&app, "/healthz", None).await;
+    assert_eq!(res.status, StatusCode::OK);
+    assert_eq!(res.json["status"], "ok");
+}

backend/crates/application/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "application"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+domain.workspace = true
+async-trait.workspace = true
+base64.workspace = true
+chrono.workspace = true
+rand.workspace = true
+sha2.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+tokio.workspace = true
+
+[lints]
+workspace = true

backend/crates/application/src/lib.rs

@@ -0,0 +1 @@
+//! application layer

backend/crates/domain/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "domain"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+async-trait.workspace = true
+chrono.workspace = true
+serde.workspace = true
+thiserror.workspace = true
+uuid.workspace = true
+
+[lints]
+workspace = true

backend/crates/domain/src/lib.rs

@@ -0,0 +1 @@
+//! domain layer

backend/crates/infrastructure/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "infrastructure"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+domain.workspace = true
+anyhow.workspace = true
+argon2.workspace = true
+async-trait.workspace = true
+chrono.workspace = true
+jsonwebtoken.workspace = true
+serde.workspace = true
+sqlx.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+tokio.workspace = true
+
+[lints]
+workspace = true

backend/crates/infrastructure/src/lib.rs

@@ -0,0 +1 @@
+//! infrastructure layer