major: kestrel is now a tak server (#6)

## Added

- CoT (Cursor on Target) server on port 8089 enabling ATAK/iTAK device connectivity
- Support for TAK stream protocol and traditional XML CoT messages
- TLS/SSL support with automatic fallback to plain TCP
- Username/password authentication for CoT connections
- Real-time device position tracking with TTL-based expiration (90s default)
- API endpoints: `/api/cot/config`, `/api/cot/server-package`, `/api/cot/truststore`, `/api/me/cot-password`
- TAK Server section in Settings with QR code for iTAK setup
- ATAK password management in Account page for OIDC users
- CoT device markers on map showing real-time positions
- Comprehensive documentation in `docs/` directory
- Environment variables: `COT_PORT`, `COT_TTL_MS`, `COT_REQUIRE_AUTH`, `COT_SSL_CERT`, `COT_SSL_KEY`, `COT_DEBUG`
- Dependencies: `fast-xml-parser`, `jszip`, `qrcode`

## Changed

- Authentication system supports CoT password management for OIDC users
- Database schema includes `cot_password_hash` field
- Test suite refactored to follow functional design principles

## Removed

- Consolidated utility modules: `authConfig.js`, `authSkipPaths.js`, `bootstrap.js`, `poiConstants.js`, `session.js`

## Security

- XML entity expansion protection in CoT parser
- Enhanced input validation and SQL injection prevention
- Authentication timeout to prevent hanging connections

## Breaking Changes

- Port 8089 must be exposed for CoT server. Update firewall rules and Docker/Kubernetes configurations.

## Migration Notes

- OIDC users must set ATAK password via Account settings before connecting
- Docker: expose port 8089 (`-p 8089:8089`)
- Kubernetes: update Helm values to expose port 8089

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #6

test/unit/logger.spec.js

@@ -1,71 +1,121 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { initLogger, logError, logWarn, logInfo, logDebug } from '../../app/utils/logger.js'
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { info, error, warn, debug, setContext, clearContext, runWithContext } from '../../server/utils/logger.js'
 
 describe('logger', () => {
-  let fetchMock
+  const testState = {
+    originalLog: null,
+    originalError: null,
+    originalWarn: null,
+    originalDebug: null,
+    logCalls: [],
+    errorCalls: [],
+    warnCalls: [],
+    debugCalls: [],
+  }
 
   beforeEach(() => {
-    fetchMock = vi.fn().mockResolvedValue(undefined)
-    vi.stubGlobal('$fetch', fetchMock)
-    vi.useFakeTimers()
+    testState.logCalls = []
+    testState.errorCalls = []
+    testState.warnCalls = []
+    testState.debugCalls = []
+    testState.originalLog = console.log
+    testState.originalError = console.error
+    testState.originalWarn = console.warn
+    testState.originalDebug = console.debug
+    console.log = vi.fn((...args) => testState.logCalls.push(args))
+    console.error = vi.fn((...args) => testState.errorCalls.push(args))
+    console.warn = vi.fn((...args) => testState.warnCalls.push(args))
+    console.debug = vi.fn((...args) => testState.debugCalls.push(args))
   })
 
   afterEach(() => {
-    vi.useRealTimers()
-    vi.unstubAllGlobals()
+    console.log = testState.originalLog
+    console.error = testState.originalError
+    console.warn = testState.originalWarn
+    console.debug = testState.originalDebug
   })
 
-  it('initLogger sets context', () => {
-    initLogger('sess-1', 'user-1')
-    logError('test', {})
-    vi.advanceTimersByTime(10)
-    expect(fetchMock).toHaveBeenCalledWith('/api/log', expect.objectContaining({
-      method: 'POST',
-      body: expect.objectContaining({
-        sessionId: 'sess-1',
-        userId: 'user-1',
-        level: 'error',
-        message: 'test',
-      }),
-    }))
+  it('logs info message', () => {
+    info('Test message')
+    expect(testState.logCalls.length).toBe(1)
+    const logMsg = testState.logCalls[0][0]
+    expect(logMsg).toContain('[INFO]')
+    expect(logMsg).toContain('Test message')
   })
 
-  it('logError sends error level', () => {
-    logError('err', { code: 1 })
-    vi.advanceTimersByTime(10)
-    expect(fetchMock).toHaveBeenCalledWith('/api/log', expect.objectContaining({
-      body: expect.objectContaining({ level: 'error', message: 'err', data: { code: 1 } }),
-    }))
+  it('includes request context when set', async () => {
+    await runWithContext('req-123', 'user-456', async () => {
+      info('Test message')
+      const logMsg = testState.logCalls[0][0]
+      expect(logMsg).toContain('req-123')
+      expect(logMsg).toContain('user-456')
+    })
   })
 
-  it('logWarn sends warn level', () => {
-    logWarn('warn', {})
-    vi.advanceTimersByTime(10)
-    expect(fetchMock).toHaveBeenCalledWith('/api/log', expect.objectContaining({
-      body: expect.objectContaining({ level: 'warn', message: 'warn' }),
-    }))
+  it('includes additional context', () => {
+    info('Test message', { key: 'value', count: 42 })
+    const logMsg = testState.logCalls[0][0]
+    expect(logMsg).toContain('key')
+    expect(logMsg).toContain('value')
+    expect(logMsg).toContain('42')
   })
 
-  it('logInfo sends info level', () => {
-    logInfo('info', {})
-    vi.advanceTimersByTime(10)
-    expect(fetchMock).toHaveBeenCalledWith('/api/log', expect.objectContaining({
-      body: expect.objectContaining({ level: 'info', message: 'info' }),
-    }))
+  it('logs error with stack trace', () => {
+    const err = new Error('Test error')
+    error('Failed', { error: err })
+    expect(testState.errorCalls.length).toBe(1)
+    const errorMsg = testState.errorCalls[0][0]
+    expect(errorMsg).toContain('[ERROR]')
+    expect(errorMsg).toContain('Failed')
+    expect(errorMsg).toContain('stack')
   })
 
-  it('logDebug sends debug level', () => {
-    logDebug('debug', {})
-    vi.advanceTimersByTime(10)
-    expect(fetchMock).toHaveBeenCalledWith('/api/log', expect.objectContaining({
-      body: expect.objectContaining({ level: 'debug', message: 'debug' }),
-    }))
+  it('logs warning', () => {
+    warn('Warning message')
+    expect(testState.warnCalls.length).toBe(1)
+    const warnMsg = testState.warnCalls[0][0]
+    expect(warnMsg).toContain('[WARN]')
   })
 
-  it('does not throw when $fetch rejects', async () => {
-    vi.stubGlobal('$fetch', vi.fn().mockRejectedValue(new Error('network')))
-    logError('x', {})
-    vi.advanceTimersByTime(10)
-    await vi.advanceTimersByTimeAsync(0)
+  it('logs debug only in development', () => {
+    const originalEnv = process.env.NODE_ENV
+    process.env.NODE_ENV = 'development'
+    debug('Debug message')
+    expect(testState.debugCalls.length).toBe(1)
+    process.env.NODE_ENV = originalEnv
+  })
+
+  it('does not log debug in production', () => {
+    const originalEnv = process.env.NODE_ENV
+    process.env.NODE_ENV = 'production'
+    debug('Debug message')
+    expect(testState.debugCalls.length).toBe(0)
+    process.env.NODE_ENV = originalEnv
+  })
+
+  it('clears context', async () => {
+    await runWithContext('req-123', 'user-456', async () => {
+      info('Test with context')
+      const logMsg = testState.logCalls[0][0]
+      expect(logMsg).toContain('req-123')
+    })
+    // Context should be cleared after runWithContext completes
+    info('Test without context')
+    const logMsg = testState.logCalls[testState.logCalls.length - 1][0]
+    expect(logMsg).not.toContain('req-123')
+  })
+
+  it('supports deprecated setContext/clearContext API', async () => {
+    await runWithContext(null, null, async () => {
+      setContext('req-123', 'user-456')
+      info('Test message')
+      const logMsg = testState.logCalls[0][0]
+      expect(logMsg).toContain('req-123')
+      expect(logMsg).toContain('user-456')
+      clearContext()
+      info('Test after clear')
+      const logMsg2 = testState.logCalls[1][0]
+      expect(logMsg2).not.toContain('req-123')
+    })
   })
 })