Build and harden security operations case manager

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.github
+.next
+.wrangler
+dist
+node_modules
+backend/.pytest_cache
+backend/**/__pycache__
+.env

.env.example

@@ -0,0 +1,8 @@
+POSTGRES_PASSWORD=replace-with-a-database-password
+JWT_SECRET=replace-with-at-least-24-random-characters
+COOKIE_SECURE=false
+ENVIRONMENT=development
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_NAME=CaseLens Administrator
+BOOTSTRAP_ADMIN_PASSWORD=replace-with-a-long-admin-password
+MAX_UPLOAD_BYTES=104857600

.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm test
+      - run: npm audit --audit-level=high
+
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: backend/requirements-dev.txt
+      - run: sudo apt-get update && sudo apt-get install -y libyara-dev
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -r backend/requirements-dev.txt
+      - run: python -m pytest tests -q
+        working-directory: backend
+
+  compose:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - run: cp .env.example .env
+      - run: docker compose config --quiet
+      - run: docker compose build api web

.gitignore

@@ -0,0 +1,12 @@
+.env
+.venv/
+node_modules/
+.next/
+.vinext/
+.wrangler/
+dist/
+backend/.pytest_cache/
+backend/**/__pycache__/
+backend/*.db
+coverage.xml
+*.pyc

Dockerfile.web

@@ -0,0 +1,13 @@
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:22-alpine AS runtime
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=build /app ./
+EXPOSE 3000
+CMD ["npm", "run", "start", "--", "--host", "0.0.0.0"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chase Stone
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,103 @@
+# CaseLens
+
+CaseLens is a security operations case manager for file and network investigations. It brings Crucible and PacketLens into one workflow so a team can collect evidence, queue analysis, correlate indicators, document decisions, and produce reports without passing artifacts between separate tools.
+
+## What it covers
+
+- Incident ownership, severity, status, notes, and evidence
+- File and PCAP uploads with SHA-256 verification
+- Background analysis through Celery and Redis
+- Static file inspection through Crucible
+- PCAP inspection through PacketLens
+- Correlation of IP addresses, domains, hashes, and MITRE ATT&CK techniques
+- Admin, analyst, and read-only access levels
+- Append-only, hash-chained audit history
+- Executive and technical HTML reports
+- PostgreSQL persistence, Docker deployment, and CI checks
+
+## Run it with Docker
+
+Requirements: Docker Desktop or Docker Engine with Compose.
+
+```powershell
+Copy-Item .env.example .env
+```
+
+Edit `.env` and replace the database password, JWT secret, and bootstrap administrator password. For a production deployment, set `ENVIRONMENT=production`, `COOKIE_SECURE=true`, and serve CaseLens over HTTPS.
+
+```powershell
+docker compose up --build
+```
+
+Open `http://localhost:8080` and sign in with the bootstrap administrator account from `.env`. The initial account is only created when the users table is empty.
+
+## Investigation flow
+
+1. Create an incident and assign an analyst.
+2. Add investigation notes and upload evidence.
+3. Queue an analysis from the evidence panel.
+4. Review the job output and correlated indicators.
+5. Export an executive summary or technical report.
+
+Crucible is used for static file inspection only. Its dynamic execution path is intentionally disabled in the shared worker. PacketLens handles supported PCAP and PCAPNG captures. The worker stores structured findings in PostgreSQL and keeps original evidence in the configured evidence volume.
+
+## Roles
+
+| Role | Access |
+| --- | --- |
+| Admin | Full investigation access, account management, assignment, audit history, and chain verification |
+| Analyst | Create and update incidents, add notes, upload evidence, queue jobs, and export reports |
+| Read only | Review incidents, evidence metadata, findings, correlations, and reports |
+
+## Local development
+
+The frontend requires Node.js 22 or newer. The API targets Python 3.12.
+
+```powershell
+npm install
+npm run dev
+```
+
+In another terminal:
+
+```powershell
+python -m venv .venv
+.\.venv\Scripts\pip.exe install -r backend\requirements-dev.txt
+$env:DATABASE_URL = "postgresql+psycopg://caselens:password@localhost:5432/caselens"
+$env:REDIS_URL = "redis://localhost:6379/0"
+.\.venv\Scripts\python.exe -m uvicorn app.main:app --app-dir backend --reload
+```
+
+Start a worker after PostgreSQL and Redis are available:
+
+```powershell
+.\.venv\Scripts\python.exe -m celery --workdir backend -A app.celery_app:celery_app worker --loglevel=INFO
+```
+
+Run the checks:
+
+```powershell
+npm test
+npm run lint
+.\.venv\Scripts\python.exe -m pytest backend\tests -q
+docker compose config
+```
+
+## Project layout
+
+- `app/`: analyst web interface
+- `backend/app/`: API, authorization, analysis adapters, audit chain, and reports
+- `backend/migrations/`: PostgreSQL schema and audit immutability trigger
+- `deploy/`: gateway configuration and security headers
+- `docs/`: architecture and deployment security notes
+- `.github/workflows/ci.yml`: frontend, backend, and Compose validation
+
+See [architecture.md](docs/architecture.md) for the service boundaries and [security.md](docs/security.md) before exposing the platform outside a trusted network.
+
+## Upstream analyzers
+
+The worker installs fixed revisions of [Crucible](https://github.com/chasejstone/Crucible) and [PacketLens](https://github.com/chasejstone/PacketLens). Update those pins deliberately, then rerun the backend tests and analyze representative samples before deployment.
+
+## License
+
+MIT