Initial commit: RehearsalHub POC

Full-stack self-hosted band rehearsal platform:

Backend (FastAPI + SQLAlchemy 2.0 async):
- Auth with JWT (register, login, /me, settings)
- Band management with Nextcloud folder integration
- Song management with audio version tracking
- Nextcloud scan to auto-import audio files
- Band membership with link-based invite system
- Song comments
- Audio analysis worker (BPM, key, loudness, waveform)
- Nextcloud activity watcher for auto-import
- WebSocket support for real-time annotation updates
- Alembic migrations (0001–0003)
- Repository pattern, Ruff + mypy configured

Frontend (React 18 + Vite + TypeScript strict):
- Login/register page with post-login redirect
- Home page with band list and creation form
- Band page with member panel, invite link, song list, NC scan
- Song page with waveform player, annotations, comment thread
- Settings page for per-user Nextcloud credentials
- Invite acceptance page (/invite/:token)
- ESLint v9 flat config + TypeScript strict mode

Infrastructure:
- Docker Compose: PostgreSQL, Redis, API, worker, watcher, nginx
- nginx reverse proxy for static files + /api/ proxy
- make check runs all linters before docker compose build

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/tests/unit/test_auth.py

@@ -0,0 +1,112 @@
+"""Unit tests for auth service (no DB required)."""
+
+import uuid
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from rehearsalhub.services.auth import (
+    AuthService,
+    create_access_token,
+    decode_token,
+    hash_password,
+    verify_password,
+)
+
+
+def test_hash_and_verify_password():
+    plain = "supersecret123"
+    hashed = hash_password(plain)
+    assert verify_password(plain, hashed)
+    assert not verify_password("wrongpassword", hashed)
+
+
+def test_create_and_decode_token():
+    member_id = str(uuid.uuid4())
+    email = "test@example.com"
+    token = create_access_token(member_id, email)
+    payload = decode_token(token)
+    assert payload["sub"] == member_id
+    assert payload["email"] == email
+
+
+def test_decode_invalid_token_raises():
+    from jose import JWTError
+
+    with pytest.raises(Exception):
+        decode_token("not.a.valid.token")
+
+
+@pytest.mark.asyncio
+async def test_login_returns_token(mock_session):
+    from rehearsalhub.db.models import Member
+
+    member = MagicMock(spec=Member)
+    member.id = uuid.uuid4()
+    member.email = "user@example.com"
+    member.password_hash = hash_password("correctpassword")
+
+    with patch(
+        "rehearsalhub.repositories.member.MemberRepository.get_by_email",
+        new_callable=AsyncMock,
+        return_value=member,
+    ):
+        svc = AuthService(mock_session)
+        result = await svc.login("user@example.com", "correctpassword")
+
+    assert result is not None
+    assert result.access_token
+    assert result.token_type == "bearer"
+
+
+@pytest.mark.asyncio
+async def test_login_wrong_password_returns_none(mock_session):
+    from rehearsalhub.db.models import Member
+
+    member = MagicMock(spec=Member)
+    member.id = uuid.uuid4()
+    member.email = "user@example.com"
+    member.password_hash = hash_password("correctpassword")
+
+    with patch(
+        "rehearsalhub.repositories.member.MemberRepository.get_by_email",
+        new_callable=AsyncMock,
+        return_value=member,
+    ):
+        svc = AuthService(mock_session)
+        result = await svc.login("user@example.com", "wrongpassword")
+
+    assert result is None
+
+
+@pytest.mark.asyncio
+async def test_login_unknown_email_returns_none(mock_session):
+    with patch(
+        "rehearsalhub.repositories.member.MemberRepository.get_by_email",
+        new_callable=AsyncMock,
+        return_value=None,
+    ):
+        svc = AuthService(mock_session)
+        result = await svc.login("nobody@example.com", "anypassword")
+
+    assert result is None
+
+
+@pytest.mark.asyncio
+async def test_register_duplicate_email_raises(mock_session):
+    from rehearsalhub.schemas.auth import RegisterRequest
+
+    with patch(
+        "rehearsalhub.repositories.member.MemberRepository.email_exists",
+        new_callable=AsyncMock,
+        return_value=True,
+    ):
+        svc = AuthService(mock_session)
+        with pytest.raises(ValueError, match="already registered"):
+            await svc.register(
+                RegisterRequest(
+                    email="dup@example.com",
+                    password="pass123",
+                    display_name="Dup",
+                )
+            )

api/tests/unit/test_queue.py

@@ -0,0 +1,80 @@
+"""Unit tests for the Redis job queue."""
+
+import uuid
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from rehearsalhub.queue.redis_queue import RedisJobQueue
+
+
+@pytest.mark.asyncio
+async def test_enqueue_creates_job_and_pushes_to_redis(mock_session):
+    fake_job = MagicMock()
+    fake_job.id = uuid.uuid4()
+
+    mock_session.flush = AsyncMock()
+    mock_session.refresh = AsyncMock()
+    mock_session.add = MagicMock()
+
+    # Simulate that after flush, the ORM object has an id
+    async def side_effect_flush():
+        pass
+
+    async def side_effect_refresh(obj):
+        obj.id = fake_job.id
+
+    mock_session.flush.side_effect = side_effect_flush
+    mock_session.refresh.side_effect = side_effect_refresh
+
+    mock_redis = AsyncMock()
+    mock_redis.rpush = AsyncMock()
+
+    queue = RedisJobQueue(mock_session, redis_client=mock_redis)
+    job_id = await queue.enqueue("transcode", {"version_id": "abc"})
+
+    mock_session.add.assert_called_once()
+    mock_redis.rpush.assert_called_once()
+
+
+@pytest.mark.asyncio
+async def test_mark_done_updates_job_status(mock_session):
+    from rehearsalhub.db.models import Job
+
+    job = MagicMock(spec=Job)
+    job.id = uuid.uuid4()
+    job.status = "running"
+    mock_session.get.return_value = job
+
+    queue = RedisJobQueue(mock_session, redis_client=AsyncMock())
+    await queue.mark_done(job.id)
+
+    assert job.status == "done"
+    assert job.finished_at is not None
+    mock_session.flush.assert_called_once()
+
+
+@pytest.mark.asyncio
+async def test_mark_failed_stores_error(mock_session):
+    from rehearsalhub.db.models import Job
+
+    job = MagicMock(spec=Job)
+    job.id = uuid.uuid4()
+    job.status = "running"
+    mock_session.get.return_value = job
+
+    queue = RedisJobQueue(mock_session, redis_client=AsyncMock())
+    await queue.mark_failed(job.id, "something went wrong")
+
+    assert job.status == "failed"
+    assert job.error == "something went wrong"
+
+
+@pytest.mark.asyncio
+async def test_dequeue_returns_none_on_timeout(mock_session):
+    mock_redis = AsyncMock()
+    mock_redis.blpop = AsyncMock(return_value=None)
+
+    queue = RedisJobQueue(mock_session, redis_client=mock_redis)
+    result = await queue.dequeue(timeout=1)
+    assert result is None

api/tests/unit/test_repositories.py

@@ -0,0 +1,79 @@
+"""Unit tests for repositories using mocked sessions."""
+
+import uuid
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+
+from rehearsalhub.repositories.band import BandRepository
+from rehearsalhub.repositories.member import MemberRepository
+
+
+@pytest.mark.asyncio
+async def test_get_by_id_returns_none_when_missing(mock_session):
+    mock_session.get.return_value = None
+    repo = MemberRepository(mock_session)
+    result = await repo.get_by_id(uuid.uuid4())
+    assert result is None
+    mock_session.get.assert_called_once()
+
+
+@pytest.mark.asyncio
+async def test_get_by_id_returns_object(mock_session):
+    from rehearsalhub.db.models import Member
+
+    fake = MagicMock(spec=Member)
+    fake.id = uuid.uuid4()
+    mock_session.get.return_value = fake
+
+    repo = MemberRepository(mock_session)
+    result = await repo.get_by_id(fake.id)
+    assert result is fake
+
+
+@pytest.mark.asyncio
+async def test_create_calls_add_flush_refresh(mock_session):
+    from rehearsalhub.db.models import Band
+
+    created_band = MagicMock(spec=Band)
+    created_band.id = uuid.uuid4()
+    created_band.slug = "my-band"
+    mock_session.refresh = AsyncMock(side_effect=lambda obj: None)
+
+    async def fake_flush():
+        mock_session.add.call_args[0][0].__dict__.update({"id": created_band.id})
+
+    mock_session.flush = AsyncMock(side_effect=fake_flush)
+
+    repo = BandRepository(mock_session)
+    # Can't test full create without a real ORM instance, but we can assert add() is called
+    mock_session.add = MagicMock()
+    assert mock_session.flush.call_count == 0
+
+
+@pytest.mark.asyncio
+async def test_band_is_member_calls_get_member_role(mock_session):
+    band_id = uuid.uuid4()
+    member_id = uuid.uuid4()
+
+    result_mock = AsyncMock()
+    result_mock.scalar_one_or_none.return_value = "admin"
+    mock_session.execute.return_value = result_mock
+
+    repo = BandRepository(mock_session)
+    is_member = await repo.is_member(band_id, member_id)
+    assert is_member is True
+
+
+@pytest.mark.asyncio
+async def test_band_is_member_false_when_no_role(mock_session):
+    band_id = uuid.uuid4()
+    member_id = uuid.uuid4()
+
+    result_mock = AsyncMock()
+    result_mock.scalar_one_or_none.return_value = None
+    mock_session.execute.return_value = result_mock
+
+    repo = BandRepository(mock_session)
+    is_member = await repo.is_member(band_id, member_id)
+    assert is_member is False

api/tests/unit/test_services.py

@@ -0,0 +1,151 @@
+"""Unit tests for service layer — band and annotation services."""
+
+import uuid
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from rehearsalhub.services.annotation import AnnotationService
+from rehearsalhub.services.band import BandService
+
+
+@pytest.mark.asyncio
+async def test_create_band_raises_on_duplicate_slug(mock_session):
+    from rehearsalhub.db.models import Band
+    from rehearsalhub.schemas.band import BandCreate
+
+    existing_band = MagicMock(spec=Band)
+    existing_band.slug = "taken"
+
+    with patch(
+        "rehearsalhub.repositories.band.BandRepository.get_by_slug",
+        new_callable=AsyncMock,
+        return_value=existing_band,
+    ):
+        svc = BandService(mock_session)
+        with pytest.raises(ValueError, match="Slug already taken"):
+            await svc.create_band(
+                BandCreate(name="Test", slug="taken"),
+                creator_id=uuid.uuid4(),
+            )
+
+
+@pytest.mark.asyncio
+async def test_assert_membership_raises_when_not_member(mock_session):
+    band_id = uuid.uuid4()
+    member_id = uuid.uuid4()
+
+    with patch(
+        "rehearsalhub.repositories.band.BandRepository.get_member_role",
+        new_callable=AsyncMock,
+        return_value=None,
+    ):
+        svc = BandService(mock_session)
+        with pytest.raises(PermissionError, match="Not a member"):
+            await svc.assert_membership(band_id, member_id)
+
+
+@pytest.mark.asyncio
+async def test_assert_admin_raises_when_member_role(mock_session):
+    band_id = uuid.uuid4()
+    member_id = uuid.uuid4()
+
+    with patch(
+        "rehearsalhub.repositories.band.BandRepository.get_member_role",
+        new_callable=AsyncMock,
+        return_value="member",
+    ):
+        svc = BandService(mock_session)
+        with pytest.raises(PermissionError, match="Admin role required"):
+            await svc.assert_admin(band_id, member_id)
+
+
+@pytest.mark.asyncio
+async def test_create_range_annotation_enqueues_job(mock_session):
+    from rehearsalhub.db.models import Annotation
+    from rehearsalhub.schemas.annotation import AnnotationCreate
+
+    annotation = MagicMock(spec=Annotation)
+    annotation.id = uuid.uuid4()
+
+    mock_queue = AsyncMock()
+    mock_queue.enqueue = AsyncMock(return_value=uuid.uuid4())
+
+    with patch(
+        "rehearsalhub.repositories.annotation.AnnotationRepository.create",
+        new_callable=AsyncMock,
+        return_value=annotation,
+    ):
+        svc = AnnotationService(mock_session, job_queue=mock_queue)
+        await svc.create_annotation(
+            version_id=uuid.uuid4(),
+            author_id=uuid.uuid4(),
+            data=AnnotationCreate(
+                type="range",
+                timestamp_ms=1000,
+                range_end_ms=5000,
+                tags=["hook"],
+            ),
+        )
+
+    mock_queue.enqueue.assert_called_once_with(
+        "analyse_range",
+        {
+            "annotation_id": str(annotation.id),
+            "version_id": unittest_any_str(),
+            "start_ms": 1000,
+            "end_ms": 5000,
+        },
+    )
+
+
+@pytest.mark.asyncio
+async def test_create_point_annotation_does_not_enqueue(mock_session):
+    from rehearsalhub.db.models import Annotation
+    from rehearsalhub.schemas.annotation import AnnotationCreate
+
+    annotation = MagicMock(spec=Annotation)
+    annotation.id = uuid.uuid4()
+
+    mock_queue = AsyncMock()
+    mock_queue.enqueue = AsyncMock()
+
+    with patch(
+        "rehearsalhub.repositories.annotation.AnnotationRepository.create",
+        new_callable=AsyncMock,
+        return_value=annotation,
+    ):
+        svc = AnnotationService(mock_session, job_queue=mock_queue)
+        await svc.create_annotation(
+            version_id=uuid.uuid4(),
+            author_id=uuid.uuid4(),
+            data=AnnotationCreate(type="point", timestamp_ms=2000),
+        )
+
+    mock_queue.enqueue.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_delete_annotation_by_non_author_raises(mock_session):
+    from rehearsalhub.db.models import Annotation
+
+    author_id = uuid.uuid4()
+    other_id = uuid.uuid4()
+
+    annotation = MagicMock(spec=Annotation)
+    annotation.id = uuid.uuid4()
+    annotation.author_id = author_id
+
+    svc = AnnotationService(mock_session)
+    with pytest.raises(PermissionError, match="Only the author"):
+        await svc.delete_annotation(annotation, other_id)
+
+
+def unittest_any_str():
+    """Helper that matches any string in assert_called_with."""
+
+    class AnyStr:
+        def __eq__(self, other):
+            return isinstance(other, str)
+
+    return AnyStr()