# Compass / NHS

A school service for Harry and Finn: **Compass** for the daily schedule and
notices, **Teams** for homework and assignments. It stores what is due per child,
puts overdue work first, and tells the family before work is late.

> Build spec: [`AGENTS.md`](AGENTS.md). This repository is at **Phase 1** (the
> skeleton). See §11 of the spec for the phase order.

## Status — Phase 1

Built and deployed on `.13`:

- Go service, SQLite schema for `children`, `items`, `scans`, `notifications`,
  `session` (`internal/store/migrations/001_init.sql`).
- The service's **own session login** — a signed cookie, not SSO.
- Server-rendered **HTMX** shell using the Family Home Lab design tokens
  (`internal/web/static/tokens.css`), phone-friendly with dark mode.
- `GET /health`.
- Its own container and port **8792**, behind Caddy at
  `school.lab.audasmedia.com.au`.

Not built yet (later phases): the Compass login and fetch, parsing, both
children's data, the dashboard data, the calendar write, notifications, and the
Hub API. It does **not** scan the school in this phase.

### Fail loudly (FR-12)

A missing or failed scan is shown as an explicit warning or error, never as an
empty day. The dashboard reads the `scans` table and shows one of:

- **NO SCAN HAS RUN YET** — amber banner.
- **SCAN FAILED** — red banner with the failure on record.
- **Last scan completed** — green banner.

## Layout

```
cmd/school/                 service entry point
internal/config/            environment configuration
internal/store/             SQLite: schema, migrations, queries
internal/auth/              session login (signed cookies, CSRF)
internal/web/               HTTP handlers, templates, static assets
deploy/                     Caddy snippet, deployment notes, verify script
environment.d/              env example (the real file is gitignored)
```

## Run

```bash
cp environment.d/school-service.env.example environment.d/school-service.env
chmod 600 environment.d/school-service.env   # then fill in the secrets
docker compose up -d --build
```

Generate secrets with the built image:

```bash
docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 gen-secret
docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 hash-password 'the-password'
```

Note: Docker Compose interpolates `$VAR` inside `env_file`. A bcrypt hash
contains `$`, so escape each one as `$$` in the env file.

## Verify

```bash
make verify-phase1
```

It checks the container is healthy, `GET /health` returns 200, the login page
renders and a session login succeeds, and Caddy serves the public URL.

## Rules

- **Read-only against the school.** Never post, message, or submit anything.
- A failed scan must be loud — never report an empty day as "nothing due".
- School credentials and harness session state are secrets; never commit them.
- This project has its own folder, container, and port.