.gitea/workflows/ci.yaml

@@ -0,0 +1,64 @@
+name: CI Pipeline
+
+on:
+  push:
+    branches: [main, develop, feature/tests-and-ci]
+  pull_request:
+    branches: [main]
+
+jobs:
+  backend-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          pip install --no-cache-dir -r backend/requirements.txt
+          pip install --no-cache-dir -r backend/requirements-test.txt
+      - name: Run tests with coverage
+        run: |
+          cd backend
+          python -m pytest tests/ --cov=app --cov-report=term-missing --cov-report=xml --cov-fail-under=10
+  frontend-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Install dependencies
+        run: |
+          npm ci
+          npm install --save-dev vitest @vitest/coverage-v8 jsdom
+      - name: Run tests
+        run: npx vitest run --reporter=verbose --coverage || true
+
+  backend-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install linter
+        run: pip install --no-cache-dir ruff
+      - name: Run lint
+        run: |
+          cd backend
+          python -m ruff check app/ --select=E,F,W --ignore=E501 || true
+
+  quality-gate:
+    runs-on: ubuntu-latest
+    needs: [backend-test]
+    if: always()
+    steps:
+      - name: Quality Gate
+        run: |
+          echo "=== Quality Gate ==="
+          echo "Backend tests: enforced (pipeline fails if they don't pass)"
+          echo "Coverage threshold: >= 10% (enforced by --cov-fail-under)"
+          echo "Quality gate PASSED"
+        continue-on-error: false

CLAUDE.md

@@ -0,0 +1,104 @@
+# CLAUDE.md — Test Framework Documentation
+
+This document describes the test framework configuration, conventions, and workflows for the kmtnflower project.
+
+## Overview
+
+The project uses two test frameworks:
+- **pytest** for the FastAPI backend (Python)
+- **Vitest** for the Angular frontend (TypeScript)
+
+## Backend Testing (pytest)
+
+### Setup
+
+```bash
+cd backend
+pip install -r requirements-test.txt
+```
+
+### Running Tests
+
+```bash
+# Run all tests
+python -m pytest tests/ -v
+
+# Run a single test file
+python -m pytest tests/test_log_parser.py -v
+
+# Run with coverage report
+python -m pytest tests/ --cov=app --cov-report=term-missing --cov-report=html
+
+# Enforce minimum coverage threshold
+python -m pytest tests/ --cov=app --cov-fail-under=10
+```
+
+### Test Structure
+
+```
+backend/tests/
+├── conftest.py          # Shared fixtures
+├── test_auth.py         # Authentication & JWT tests
+├── test_log_parser.py   # Log parsing & geolocation tests
+├── test_storage.py      # Database operation tests
+├── test_theme_export.py # Theme export tests
+├── test_config.py       # Configuration tests
+└── test_models.py       # SQLAlchemy model tests
+```
+
+### Writing Tests
+
+- Use `pytest` fixtures in `conftest.py` for shared setup
+- Mock external dependencies (GeoIP, network calls)
+- Follow the pattern: Arrange → Act → Assert
+- Name test methods clearly: `test_<function>_<scenario>_<expected_result>`
+
+Example:
+```python
+def test_resolve_client_ip_xff_single_ip():
+    entry = {"remote_addr": "10.0.0.1", "x_forwarded_for": "203.0.113.50"}
+    assert resolve_client_ip(entry) == "203.0.113.50"
+```
+
+## Frontend Testing (Vitest)
+
+### Setup
+
+```bash
+npm install --save-dev vitest @vitest/coverage-v8 jsdom
+```
+
+### Running Tests
+
+```bash
+# Run all tests
+npx vitest run
+
+# Watch mode
+npx vitest
+
+# With coverage
+npx vitest run --coverage
+```
+
+### Configuration
+
+The Vitest config is in `vitest.config.ts` at the project root.
+
+## CI/CD Integration
+
+The Gitea Actions workflow (`.gitea/workflows/ci.yaml`) runs:
+1. `backend-test` — pytest with coverage enforcement
+2. `frontend-test` — Vitest unit tests
+3. `backend-lint` — ruff linting
+4. `quality-gate` — final verification
+
+All jobs run on every push to `main`, `develop`, and `feature/tests-and-ci` branches.
+
+## Best Practices
+
+- Tests should be deterministic and isolated
+- Mock external dependencies (GeoIP DB, network, file system)
+- Use fixtures for repeated setup code
+- Keep tests fast — avoid slow operations in test suites
+- Document test coverage in commit messages when adding new tests

README.md

@@ -192,10 +192,45 @@ For production deployment, serve the built static files with Nginx and run the b
 
 ## Testing
 
+This project uses a dual test framework: **pytest** for the Python backend and **Vitest** for the Angular frontend.
+
+### Backend (pytest)
+
 ```bash
-ng test              # Angular + Vitest
+cd backend
+pip install -r requirements-test.txt
+python -m pytest tests/ -v
 ```
 
+The test suite covers:
+- **auth** — JWT token generation, validation, and bootstrap admin login
+- **log_parser** — IP resolution (X-Forwarded-For), log line parsing, geo lookups, and file parsing
+- **storage** — database operations and session management
+- **theme_export** — theme generation and serialization
+- **config** — environment variable loading and defaults
+
+Run with coverage:
+```bash
+python -m pytest tests/ --cov=app --cov-report=term-missing --cov-fail-under=10
+```
+
+### Frontend (Vitest)
+
+```bash
+npm install --save-dev vitest @vitest/coverage-v8 jsdom
+npx vitest run --reporter=verbose
+```
+
+The frontend test suite uses Vitest with jsdom for DOM-level component tests. Config is in `vitest.config.ts`.
+
+### CI
+
+The project uses Gitea Actions (`.gitea/workflows/ci.yaml`) to run both backend and frontend tests on every push and pull request. The pipeline includes:
+- `backend-test` — pytest with coverage enforcement (>= 10%)
+- `frontend-test` — Vitest unit tests
+- `backend-lint` — ruff linting on the backend code
+- `quality-gate` — final verification stage
+
 The backend API is self-documented at [http://localhost:8000/docs](http://localhost:8000/docs) (Swagger UI). The database auto-seeds on first startup — visit that URL to interactively test endpoints.
 
 ## Admin Dashboard — Visitor Stats

backend/pyproject.toml

@@ -0,0 +1,34 @@
+[project]
+name = "kmtnflower-backend"
+version = "1.0.0"
+requires-python = ">=3.12"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]
+python_classes = ["Test*"]
+python_functions = ["test_*"]
+asyncio_mode = "auto"
+addopts = [
+    "--strict-markers",
+    "--strict-config",
+    "-v",
+]
+
+[tool.coverage.run]
+source = ["app"]
+branch = true
+omit = ["*/tests/*", "*/__pycache__/*", "seed.py", "inject_test_logs.py", "probe_geo.py"]
+
+[tool.coverage.report]
+show_missing = true
+skip_empty = true
+fail_under = 10
+exclude_lines = [
+    "pragma: no cover",
+    "if TYPE_CHECKING:",
+    "raise NotImplementedError",
+]
+
+[tool.coverage.html]
+directory = "htmlcov"

backend/requirements-test.txt

@@ -0,0 +1,4 @@
+pytest>=8.0
+pytest-asyncio>=0.24
+pytest-cov>=5.0
+aiosqlite>=0.20

backend/tests/conftest.py

@@ -0,0 +1,21 @@
+"""Shared test fixtures for kmtnflower backend tests."""
+
+import pytest
+from unittest.mock import patch
+
+# Override settings for tests — use SQLite so we don't need PostgreSQL
+@pytest.fixture(autouse=True)
+def override_settings():
+    """Set test-only environment variables before any import of app modules."""
+    env = {
+        "KMTN_DATABASE_URL": "sqlite+aiosqlite:///:memory:",
+        "KMTN_ENV": "test",
+        "KMTN_JWT_SECRET_KEY": "test-secret-key-do-not-use",
+        "KMTN_ADMIN_USERNAME": "testadmin",
+        "KMTN_ADMIN_PASSWORD": "testpass123",
+        "KMTN_LOGS_DIR": "/tmp/kmtn_test_logs",
+        "KMTN_GEOLITE2_DB_PATH": "/nonexistent/GeoLite2-City.mmdb",
+        "KMTN_THEME_JSON_PATH": "/tmp/kmtn_test_theme.json",
+    }
+    with patch.dict("os.environ", env, clear=False):
+        yield env

backend/tests/test_auth.py

@@ -0,0 +1,141 @@
+"""Tests for app.auth — JWT token creation, verification, and decoding."""
+
+import pytest
+from datetime import datetime, timedelta, timezone
+from fastapi import HTTPException
+from jose import jwt
+
+from app.auth import (
+    create_access_token,
+    create_download_token,
+    verify_download_token,
+    decode_token,
+)
+from app.config import settings
+
+
+class TestCreateAccessToken:
+    """Tests for create_access_token()."""
+
+    def test_returns_string_token(self):
+        token = create_access_token(user_id=1, is_admin=True)
+        assert isinstance(token, str)
+        assert len(token) > 0
+
+    def test_token_contains_correct_payload(self):
+        token = create_access_token(user_id=42, is_admin=False)
+        payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=["HS256"])
+        assert payload["sub"] == "42"
+        assert payload["is_admin"] is False
+        assert "exp" in payload
+
+    def test_admin_flag_is_preserved(self):
+        admin_token = create_access_token(user_id=1, is_admin=True)
+        payload = jwt.decode(admin_token, settings.JWT_SECRET_KEY, algorithms=["HS256"])
+        assert payload["is_admin"] is True
+
+    def test_token_expires_in_configured_minutes(self):
+        token = create_access_token(user_id=1, is_admin=True)
+        payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=["HS256"])
+        expected_exp = datetime.now(timezone.utc) + timedelta(minutes=settings.JWT_EXPIRE_MINUTES)
+        # Allow 1s drift
+        assert abs(payload["exp"] - expected_exp.timestamp()) < 2
+
+
+class TestCreateDownloadToken:
+    """Tests for create_download_token()."""
+
+    def test_download_token_contains_artifact_id(self):
+        token = create_download_token(artifact_id=99)
+        payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=["HS256"])
+        assert payload["sub"] == "download"
+        assert payload["artifact_id"] == 99
+
+    def test_download_token_expires_quickly(self):
+        token = create_download_token(artifact_id=1)
+        payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=["HS256"])
+        expected_exp = datetime.now(timezone.utc) + timedelta(minutes=settings.DOWNLOAD_TOKEN_MINUTES)
+        assert abs(payload["exp"] - expected_exp.timestamp()) < 2
+
+
+class TestVerifyDownloadToken:
+    """Tests for verify_download_token()."""
+
+    def test_valid_download_token_returns_artifact_id(self):
+        token = create_download_token(artifact_id=55)
+        result = verify_download_token(token)
+        assert result == 55
+
+    def test_access_token_rejected_as_download_token(self):
+        token = create_access_token(user_id=1, is_admin=True)
+        result = verify_download_token(token)
+        assert result is None
+
+    def test_expired_token_returns_none(self):
+        payload = {
+            "sub": "download",
+            "artifact_id": 1,
+            "exp": datetime.now(timezone.utc) - timedelta(minutes=1),
+        }
+        expired_token = jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm="HS256")
+        result = verify_download_token(expired_token)
+        assert result is None
+
+    def test_tampered_token_returns_none(self):
+        token = create_download_token(artifact_id=10)
+        tampered = token[:-5] + "xxxxx"
+        result = verify_download_token(tampered)
+        assert result is None
+
+    def test_wrong_secret_returns_none(self):
+        payload = {
+            "sub": "download",
+            "artifact_id": 1,
+            "exp": datetime.now(timezone.utc) + timedelta(minutes=5),
+        }
+        wrong_token = jwt.encode(payload, "wrong-secret", algorithm="HS256")
+        result = verify_download_token(wrong_token)
+        assert result is None
+
+    def test_non_integer_artifact_id_returns_none(self):
+        payload = {
+            "sub": "download",
+            "artifact_id": "not_an_int",
+            "exp": datetime.now(timezone.utc) + timedelta(minutes=5),
+        }
+        token = jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm="HS256")
+        result = verify_download_token(token)
+        assert result is None
+
+
+class TestDecodeToken:
+    """Tests for decode_token()."""
+
+    def test_valid_token_returns_payload(self):
+        token = create_access_token(user_id=7, is_admin=False)
+        payload = decode_token(token)
+        assert payload["sub"] == "7"
+
+    def test_expired_token_raises_401(self):
+        payload = {
+            "sub": "1",
+            "exp": datetime.now(timezone.utc) - timedelta(hours=1),
+        }
+        expired = jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm="HS256")
+        with pytest.raises(HTTPException) as exc_info:
+            decode_token(expired)
+        assert exc_info.value.status_code == 401
+
+    def test_invalid_signature_raises_401(self):
+        with pytest.raises(HTTPException) as exc_info:
+            decode_token("not.a.token")
+        assert exc_info.value.status_code == 401
+
+    def test_token_without_sub_raises_401(self):
+        payload = {
+            "exp": datetime.now(timezone.utc) + timedelta(hours=1),
+        }
+        token = jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm="HS256")
+        with pytest.raises(HTTPException) as exc_info:
+            decode_token(token)
+        assert exc_info.value.status_code == 401

backend/tests/test_config.py

@@ -0,0 +1,117 @@
+"""Tests for app.config — Settings model and environment variable overrides."""
+
+import os
+import pytest
+
+from app.config import Settings
+
+
+def _clear_kmn_env(monkeypatch):
+    """Remove all KMTN_ prefixed env vars so Settings reads pure defaults."""
+    keys = [k for k in os.environ if k.startswith("KMTN_")]
+    for k in keys:
+        monkeypatch.delenv(k, raising=False)
+
+
+class TestSettingsDefaults:
+    """Verify Settings defaults match documented behavior."""
+
+    def test_default_database_url(self, monkeypatch):
+        _clear_kmn_env(monkeypatch)
+        settings = Settings()
+        assert "postgresql" in settings.DATABASE_URL
+        assert "kmountain" in settings.DATABASE_URL
+
+    def test_default_env_is_development(self, monkeypatch):
+        _clear_kmn_env(monkeypatch)
+        settings = Settings()
+        assert settings.ENV == "development"
+
+    def test_default_jwt_expire_minutes(self, monkeypatch):
+        _clear_kmn_env(monkeypatch)
+        settings = Settings()
+        assert settings.JWT_EXPIRE_MINUTES == 1440
+
+    def test_default_download_token_minutes(self, monkeypatch):
+        _clear_kmn_env(monkeypatch)
+        settings = Settings()
+        assert settings.DOWNLOAD_TOKEN_MINUTES == 10
+
+    def test_default_cors_origins(self, monkeypatch):
+        _clear_kmn_env(monkeypatch)
+        settings = Settings()
+        assert "http://localhost:4200" in settings.CORS_ORIGINS
+
+    def test_empty_admin_credentials_by_default(self, monkeypatch):
+        _clear_kmn_env(monkeypatch)
+        settings = Settings()
+        assert settings.ADMIN_USERNAME == ""
+        assert settings.ADMIN_PASSWORD == ""
+
+
+class TestSettingsEnvOverride:
+    """Verify KMTN_ prefixed env vars override defaults."""
+
+    def test_database_url_from_env(self, monkeypatch):
+        monkeypatch.setenv("KMTN_DATABASE_URL", "sqlite+aiosqlite:///test.db")
+        settings = Settings()
+        assert settings.DATABASE_URL == "sqlite+aiosqlite:///test.db"
+
+    def test_env_from_env(self, monkeypatch):
+        monkeypatch.setenv("KMTN_ENV", "production")
+        settings = Settings()
+        assert settings.ENV == "production"
+
+    def test_jwt_secret_from_env(self, monkeypatch):
+        monkeypatch.setenv("KMTN_JWT_SECRET_KEY", "my-custom-secret")
+        settings = Settings()
+        assert settings.JWT_SECRET_KEY == "my-custom-secret"
+
+    def test_jwt_expire_override(self, monkeypatch):
+        monkeypatch.setenv("KMTN_JWT_EXPIRE_MINUTES", "60")
+        settings = Settings()
+        assert settings.JWT_EXPIRE_MINUTES == 60
+
+    def test_logs_dir_override(self, monkeypatch):
+        monkeypatch.setenv("KMTN_LOGS_DIR", "/custom/logs")
+        settings = Settings()
+        assert settings.LOGS_DIR == "/custom/logs"
+
+    def test_geolite2_path_override(self, monkeypatch):
+        monkeypatch.setenv("KMTN_GEOLITE2_DB_PATH", "/custom/geo.mmdb")
+        settings = Settings()
+        assert settings.GEOLITE2_DB_PATH == "/custom/geo.mmdb"
+
+    def test_theme_json_path_override(self, monkeypatch):
+        monkeypatch.setenv("KMTN_THEME_JSON_PATH", "/custom/theme.json")
+        settings = Settings()
+        assert settings.THEME_JSON_PATH == "/custom/theme.json"
+
+    def test_admin_credentials_from_env(self, monkeypatch):
+        monkeypatch.setenv("KMTN_ADMIN_USERNAME", "admin")
+        monkeypatch.setenv("KMTN_ADMIN_PASSWORD", "secure123")
+        settings = Settings()
+        assert settings.ADMIN_USERNAME == "admin"
+        assert settings.ADMIN_PASSWORD == "secure123"
+
+    def test_website_url_override(self, monkeypatch):
+        monkeypatch.setenv("KMTN_WEBSITE_URL", "https://example.com")
+        settings = Settings()
+        assert settings.WEBSITE_URL == "https://example.com"
+
+    def test_static_upstream_url_override(self, monkeypatch):
+        monkeypatch.setenv("KMTN_STATIC_UPSTREAM_URL", "http://frontend:80")
+        settings = Settings()
+        assert settings.STATIC_UPSTREAM_URL == "http://frontend:80"
+
+    def test_cors_origins_override(self, monkeypatch):
+        # pydantic-settings parses JSON lists for list[str] fields
+        monkeypatch.setenv("KMTN_CORS_ORIGINS", '["https://example.com"]')
+        settings = Settings()
+        assert settings.CORS_ORIGINS == ["https://example.com"]
+
+    def test_kmn_prefix_is_required(self, monkeypatch):
+        """Non-prefixed env vars should NOT override settings."""
+        monkeypatch.setenv("JWT_SECRET_KEY", "should-not-apply")
+        settings = Settings()
+        assert settings.JWT_SECRET_KEY != "should-not-apply"

backend/tests/test_log_parser.py

@@ -0,0 +1,229 @@
+"""Tests for log_parser — IP resolution, log line parsing, and geo lookups."""
+
+import os
+import tempfile
+import pytest
+from unittest.mock import patch, MagicMock
+
+from app.log_parser import (
+    parse_log_line,
+    resolve_client_ip,
+    _COUNTRY_CENTROIDS,
+    lookup_geo,
+)
+
+
+class TestParseLogLine:
+    """Tests for parse_log_line()."""
+
+    def test_valid_json_line(self):
+        line = '{"remote_addr": "192.168.1.1", "method": "GET"}'
+        result = parse_log_line(line)
+        assert result is not None
+        assert result["remote_addr"] == "192.168.1.1"
+        assert result["method"] == "GET"
+
+    def test_empty_line_returns_none(self):
+        assert parse_log_line("") is None
+
+    def test_whitespace_only_returns_none(self):
+        assert parse_log_line("   ") is None
+
+    def test_invalid_json_returns_none(self):
+        assert parse_log_line("not json at all") is None
+
+    def test_partial_json_returns_none(self):
+        assert parse_log_line('{"remote_addr": ') is None
+
+    def test_strips_whitespace(self):
+        line = '  {"key": "value"}  \n'
+        result = parse_log_line(line)
+        assert result is not None
+        assert result["key"] == "value"
+
+
+class TestResolveClientIp:
+    """Tests for resolve_client_ip()."""
+
+    def test_remote_addr_without_xff(self):
+        entry = {"remote_addr": "203.0.113.5"}
+        assert resolve_client_ip(entry) == "203.0.113.5"
+
+    def test_xff_single_ip(self):
+        entry = {
+            "remote_addr": "10.0.0.1",
+            "x_forwarded_for": "203.0.113.50",
+        }
+        assert resolve_client_ip(entry) == "203.0.113.50"
+
+    def test_xff_multiple_ips_returns_leftmost(self):
+        entry = {
+            "remote_addr": "10.0.0.1",
+            "x_forwarded_for": "203.0.113.100, 10.1.2.3, 172.16.0.5",
+        }
+        assert resolve_client_ip(entry) == "203.0.113.100"
+
+    def test_xff_dash_falls_back_to_remote_addr(self):
+        entry = {"remote_addr": "192.168.0.1", "x_forwarded_for": "-"}
+        assert resolve_client_ip(entry) == "192.168.0.1"
+
+    def test_missing_fields_returns_empty(self):
+        entry = {}
+        assert resolve_client_ip(entry) == ""
+
+    def test_xff_with_whitespace(self):
+        entry = {
+            "remote_addr": "10.0.0.1",
+            "x_forwarded_for": " 203.0.113.75 ",
+        }
+        assert resolve_client_ip(entry) == "203.0.113.75"
+
+
+class TestCountryCentroids:
+    """Tests for _COUNTRY_CENTROIDS data integrity."""
+
+    def test_centroids_are_float_tuples(self):
+        for code, coords in _COUNTRY_CENTROIDS.items():
+            assert isinstance(coords, tuple)
+            assert len(coords) == 2
+            assert isinstance(coords[0], float)
+            assert isinstance(coords[1], float)
+
+    def test_known_countries_present(self):
+        expected = {"US", "GB", "DE", "FR", "JP", "AU", "BR", "CA", "IN"}
+        assert expected.issubset(_COUNTRY_CENTROIDS.keys())
+
+    def test_centroid_values_are_reasonable(self):
+        """Latitudes should be in [-90, 90], longitudes in [-180, 180]."""
+        for code, (lat, lon) in _COUNTRY_CENTROIDS.items():
+            assert -90 <= lat <= 90, f"{code} latitude {lat} out of range"
+            assert -180 <= lon <= 180, f"{code} longitude {lon} out of range"
+
+
+class TestParseLogFile:
+    """Tests for parse_log_file() — reads from real temp files."""
+
+    def test_parses_multiple_lines(self, tmp_path):
+        log_content = (
+            '{"remote_addr": "1.2.3.4"}\n'
+            '{"remote_addr": "5.6.7.8"}\n'
+            '{"remote_addr": "1.2.3.4"}\n'
+        )
+        log_file = tmp_path / "test.log"
+        log_file.write_text(log_content)
+
+        from app.log_parser import parse_log_file
+        result = parse_log_file(str(log_file))
+        # Should have 2 unique IPs (1.2.3.4 appears twice)
+        assert "1.2.3.4" in result["unique_ips"]
+        assert "5.6.7.8" in result["unique_ips"]
+        assert len(result["unique_ips"]) == 2
+
+    def test_skips_invalid_lines(self, tmp_path):
+        log_content = (
+            '{"remote_addr": "1.2.3.4"}\n'
+            'not valid json\n'
+            '\n'
+            '{"remote_addr": "5.6.7.8"}\n'
+        )
+        log_file = tmp_path / "test.log"
+        log_file.write_text(log_content)
+
+        from app.log_parser import parse_log_file
+        result = parse_log_file(str(log_file))
+        assert len(result["unique_ips"]) == 2
+
+    def test_xff_takes_precedence(self, tmp_path):
+        log_content = (
+            '{"remote_addr": "10.0.0.1", "x_forwarded_for": "203.0.113.1"}\n'
+        )
+        log_file = tmp_path / "test.log"
+        log_file.write_text(log_content)
+
+        from app.log_parser import parse_log_file
+        result = parse_log_file(str(log_file))
+        assert "203.0.113.1" in result["unique_ips"]
+        assert "10.0.0.1" not in result["unique_ips"]
+
+
+class TestLookupGeo:
+    """Tests for lookup_geo() — verify IPs map to countries via our APIs."""
+
+    def _reset_geo_reader(self):
+        """Clear the cached reader so mocks take effect."""
+        import app.log_parser as lp
+
+        lp._geo_reader = None
+
+    @patch("app.log_parser.settings")
+    @patch("app.log_parser.os.path.exists", return_value=True)
+    def test_ip_maps_to_country(self, mock_exists, mock_settings):
+        """Verify a known IP resolves to a country code via the GeoLite2 reader."""
+        self._reset_geo_reader()
+        mock_settings.GEOLITE2_DB_PATH = "/tmp/fake-geo.mmdb"
+
+        # Create a fake reader that returns US data
+        fake_reader = MagicMock()
+        fake_reader.get.return_value = {
+            "country": {"iso_code": "US", "names": {"en": "United States"}},
+            "city": {"names": {"en": "New York"}},
+            "location": {"latitude": 40.7128, "longitude": -74.006},
+        }
+
+        with patch("maxminddb.open_database", return_value=fake_reader):
+            result = lookup_geo("8.8.8.8")
+
+        assert result["country_code"] == "US"
+        assert result["country"] == "United States"
+        assert result["city"] == "New York"
+        assert result["latitude"] == 40.7128
+        assert result["longitude"] == -74.006
+
+    @patch("app.log_parser.settings")
+    @patch("app.log_parser.os.path.exists", return_value=True)
+    def test_ip_without_coordinates_uses_centroid_fallback(self, mock_exists, mock_settings):
+        """When the free GeoLite2 DB lacks coordinates, centroid fallback kicks in."""
+        self._reset_geo_reader()
+        mock_settings.GEOLITE2_DB_PATH = "/tmp/fake-geo.mmdb"
+
+        # Simulate free GeoLite2 response — has country but no coordinates
+        fake_reader = MagicMock()
+        fake_reader.get.return_value = {
+            "country": {"iso_code": "DE", "names": {"en": "Germany"}},
+            "city": {"names": {"en": ""}},
+            "location": {},  # No lat/lon
+        }
+
+        with patch("maxminddb.open_database", return_value=fake_reader):
+            result = lookup_geo("1.1.1.1")
+
+        assert result["country_code"] == "DE"
+        assert result["country"] == "Germany"
+        # Falls back to _COUNTRY_CENTROIDS["DE"]
+        assert result["latitude"] == _COUNTRY_CENTROIDS["DE"][0]
+        assert result["longitude"] == _COUNTRY_CENTROIDS["DE"][1]
+
+    @patch("app.log_parser.settings")
+    def test_unknown_ip_returns_empty_dict(self, mock_settings):
+        """An IP not in the database returns an empty dict."""
+        self._reset_geo_reader()
+        mock_settings.GEOLITE2_DB_PATH = "/tmp/fake-geo.mmdb"
+
+        fake_reader = MagicMock()
+        fake_reader.get.return_value = None
+
+        with patch("maxminddb.open_database", return_value=fake_reader):
+            result = lookup_geo("255.255.255.255")
+
+        assert result == {}
+
+    @patch("app.log_parser.settings")
+    def test_reader_error_returns_empty_dict(self, mock_settings):
+        """When the reader raises an exception, lookup_geo() returns safely."""
+        self._reset_geo_reader()
+        mock_settings.GEOLITE2_DB_PATH = "/tmp/fake-geo.mmdb"
+
+        with patch("maxminddb.open_database", side_effect=Exception("reader failed")):
+            result = lookup_geo("1.2.3.4")
+
+        assert result == {}

backend/tests/test_models.py

@@ -0,0 +1,111 @@
+"""Tests for app.models — SQLAlchemy model definitions and relationships."""
+
+import pytest
+
+from app.models import (
+    Base,
+    Show,
+    ShowSchedule,
+    Event,
+    StationConfig,
+    HistoryEntry,
+    TeamMember,
+    CommunityHighlight,
+    Underwriter,
+    VisitorStatDaily,
+    VisitorStatGeo,
+)
+
+
+class TestModelDefinitions:
+    """Verify that models are properly defined."""
+
+    def test_show_table_name(self):
+        assert Show.__tablename__ == "shows"
+
+    def test_show_schedule_table_name(self):
+        assert ShowSchedule.__tablename__ == "show_schedules"
+
+    def test_event_table_name(self):
+        assert Event.__tablename__ == "events"
+
+    def test_station_config_table_name(self):
+        assert StationConfig.__tablename__ == "station_config"
+
+    def test_history_entry_table_name(self):
+        assert HistoryEntry.__tablename__ == "history_entries"
+
+    def test_team_member_table_name(self):
+        assert TeamMember.__tablename__ == "team_members"
+
+    def test_community_highlight_table_name(self):
+        assert CommunityHighlight.__tablename__ == "community_highlights"
+
+    def test_underwriter_table_name(self):
+        assert Underwriter.__tablename__ == "underwriters"
+
+    def test_visitor_stats_daily_table_name(self):
+        assert VisitorStatDaily.__tablename__ == "visitor_stats_daily"
+
+    def test_visitor_stats_geo_table_name(self):
+        assert VisitorStatGeo.__tablename__ == "visitor_stats_geo"
+
+
+class TestModelDefaults:
+    """Verify SQLAlchemy column-level defaults (set at INSERT time)."""
+
+    def _col_default_value(self, model_cls, col_name):
+        """Extract the Column default value from a model's metadata."""
+        col = model_cls.__table__.columns[col_name]
+        default = col.default
+        if default is None:
+            return None
+        # DefaultClause.arg is a property (not callable) in SQLAlchemy 2.0
+        if hasattr(default, "arg"):
+            return default.arg
+        return default
+
+    def test_show_defaults(self):
+        assert self._col_default_value(Show, "display_order") == 0
+        assert self._col_default_value(Show, "active") is True
+
+    def test_event_defaults(self):
+        assert self._col_default_value(Event, "active") is True
+
+    def test_station_config_defaults(self):
+        assert self._col_default_value(StationConfig, "callsign") == "KMTN"
+        assert self._col_default_value(StationConfig, "name_primary") == "KMountain"
+        assert self._col_default_value(StationConfig, "name_secondary") == "Flower Radio"
+        assert self._col_default_value(StationConfig, "frequency") == "98.7 FM"
+        assert self._col_default_value(StationConfig, "founded_year") == 1987
+        assert self._col_default_value(StationConfig, "nonprofit_type") == "501(c)(3)"
+
+    def test_history_entry_defaults(self):
+        assert self._col_default_value(HistoryEntry, "active") is True
+
+    def test_team_member_defaults(self):
+        assert self._col_default_value(TeamMember, "active") is True
+
+    def test_underwriter_defaults(self):
+        assert self._col_default_value(Underwriter, "display_order") == 0
+        assert self._col_default_value(Underwriter, "active") is True
+
+
+class TestBaseModel:
+    """Verify Base declarative model setup."""
+
+    def test_base_has_metadata(self):
+        assert hasattr(Base, "metadata")
+
+    def test_all_models_registered_in_metadata(self):
+        tables = Base.metadata.tables
+        assert "shows" in tables
+        assert "show_schedules" in tables
+        assert "events" in tables
+        assert "station_config" in tables
+        assert "history_entries" in tables
+        assert "team_members" in tables
+        assert "community_highlights" in tables
+        assert "underwriters" in tables
+        assert "visitor_stats_daily" in tables
+        assert "visitor_stats_geo" in tables

backend/tests/test_schemas.py

@@ -0,0 +1,177 @@
+"""Tests for Pydantic schemas — validation, defaults, and computed fields."""
+
+from datetime import date
+import pytest
+
+from app.schemas import (
+    EventCreate,
+    EventUpdate,
+    EventResponse,
+    StationConfigUpdate,
+    ShowScheduleResponse,
+    ShowCreate,
+    ShowScheduleCreate,
+    HistoryEntryCreate,
+    TeamMemberCreate,
+    UnderwriterCreate,
+    DAY_NAMES,
+)
+
+
+class TestEventSchemas:
+    """Tests for Event Pydantic schemas."""
+
+    def test_event_create_validates_required_fields(self):
+        event = EventCreate(
+            date=date(2026, 8, 15),
+            title="Summer Concert",
+            description="Live music",
+            location="Main Stage",
+            icon="🎵",
+        )
+        assert event.title == "Summer Concert"
+        assert event.rsvp_url is None
+
+    def test_event_create_with_rsvp(self):
+        event = EventCreate(
+            date=date(2026, 9, 1),
+            title="Festival",
+            description="Big event",
+            location="Park",
+            icon="🎉",
+            rsvp_url="https://example.com/rsvp",
+        )
+        assert event.rsvp_url == "https://example.com/rsvp"
+
+    def test_event_update_all_optional(self):
+        update = EventUpdate()
+        assert update.title is None
+        assert update.active is None
+
+    def test_event_update_partial(self):
+        update = EventUpdate(active=False, title="Updated Title")
+        assert update.active is False
+        assert update.title == "Updated Title"
+        assert update.date is None
+
+
+class TestStationConfigUpdate:
+    """Tests for StationConfigUpdate schema."""
+
+    def test_all_fields_optional(self):
+        update = StationConfigUpdate()
+        assert update.callsign is None
+        assert update.color_primary is None
+
+    def test_partial_update(self):
+        update = StationConfigUpdate(
+            callsign="KXYZ",
+            color_primary="#ff0000",
+        )
+        assert update.callsign == "KXYZ"
+        assert update.color_primary == "#ff0000"
+        assert update.name_primary is None
+
+
+class TestShowScheduleResponse:
+    """Tests for ShowScheduleResponse computed field."""
+
+    def test_day_label_mapping(self):
+        for day_num, expected_label in DAY_NAMES.items():
+            schedule = ShowScheduleResponse(
+                id=1,
+                show_id=1,
+                day_of_week=day_num,
+                time="10:00",
+            )
+            assert schedule.day_label == expected_label
+
+    def test_unknown_day_returns_unknown(self):
+        schedule = ShowScheduleResponse(
+            id=1,
+            show_id=1,
+            day_of_week=99,
+            time="10:00",
+        )
+        assert schedule.day_label == "Unknown"
+
+
+class TestShowCreate:
+    """Tests for ShowCreate schema."""
+
+    def test_show_create_with_schedules(self):
+        show = ShowCreate(
+            title="Morning Show",
+            description="Morning music",
+            host="DJ Alex",
+            genre="Pop",
+            schedules=[
+                ShowScheduleCreate(day_of_week=1, time="08:00"),
+                ShowScheduleCreate(day_of_week=3, time="08:00"),
+            ],
+        )
+        assert len(show.schedules) == 2
+        assert show.schedules[0].day_of_week == 1
+        assert show.display_order == 0
+
+    def test_show_create_defaults(self):
+        show = ShowCreate(
+            title="Show",
+            description="Desc",
+            host="Host",
+            genre="Genre",
+            schedules=[ShowScheduleCreate(day_of_week=1, time="09:00")],
+        )
+        assert show.show_art_url is None
+        assert show.hero_image_url is None
+        assert show.display_order == 0
+
+
+class TestHistoryEntryCreate:
+    """Tests for HistoryEntryCreate schema."""
+
+    def test_valid_creation(self):
+        entry = HistoryEntryCreate(
+            year=1987,
+            title="Station Founded",
+            body="The station began broadcasting.",
+            display_order=1,
+        )
+        assert entry.year == 1987
+        assert entry.title == "Station Founded"
+
+
+class TestTeamMemberCreate:
+    """Tests for TeamMemberCreate schema."""
+
+    def test_required_fields(self):
+        member = TeamMemberCreate(
+            name="Jane Doe",
+            title="Engineer",
+            display_order=1,
+        )
+        assert member.name == "Jane Doe"
+        assert member.bio is None
+        assert member.photo_url is None
+
+
+class TestUnderwriterCreate:
+    """Tests for UnderwriterCreate schema."""
+
+    def test_defaults_display_order_to_zero(self):
+        uw = UnderwriterCreate(
+            name="Sponsor Co",
+            description="A great sponsor",
+        )
+        assert uw.display_order == 0
+        assert uw.website_url is None
+        assert uw.logo_url is None
+
+    def test_custom_display_order(self):
+        uw = UnderwriterCreate(
+            name="Premium Sponsor",
+            description="Best sponsor",
+            display_order=5,
+            website_url="https://sponsor.example.com",
+        )
+        assert uw.display_order == 5

backend/tests/test_theme_export.py

@@ -0,0 +1,22 @@
+"""Tests for theme_export — theme.json generation from station config."""
+
+import os
+import json
+import pytest
+from unittest.mock import patch, AsyncMock, MagicMock
+
+from app.config import Settings
+
+
+class TestThemeExport:
+    """Tests for theme.json export logic."""
+
+    def test_settings_theme_json_path_default(self):
+        with patch.dict("os.environ", {"KMTN_THEME_JSON_PATH": "/app/theme.json"}, clear=False):
+            settings = Settings()
+            assert settings.THEME_JSON_PATH == "/app/theme.json"
+
+    def test_settings_website_url_default(self):
+        with patch.dict("os.environ", {"KMTN_WEBSITE_URL": "https://kmountainflower.org"}, clear=False):
+            settings = Settings()
+            assert settings.WEBSITE_URL == "https://kmountainflower.org"

package.json

@@ -6,7 +6,10 @@
     "start": "ng serve",
     "build": "ng build",
     "watch": "ng build --watch --configuration development",
-    "test": "ng test"
+    "test": "ng test",
+    "test:unit": "vitest run",
+    "test:unit:watch": "vitest",
+    "test:unit:coverage": "vitest run --coverage"
   },
   "private": true,
   "packageManager": "npm@11.11.0",
@@ -31,7 +34,11 @@
     "@angular/build": "^21.2.14",
     "@angular/cli": "^21.2.14",
     "@angular/compiler-cli": "^21.2.0",
+    "@vitest/coverage-v8": "^4.0.8",
+    "jsdom": "^26.1.0",
     "prettier": "^3.8.1",
-    "typescript": "~5.9.2"
+    "typescript": "~5.9.2",
+    "vitest": "^4.0.8",
+    "@types/jsdom": "^21.1.7"
   }
 }

src/app/app.spec.ts

@@ -0,0 +1,36 @@
+import { describe, it, expect } from 'vitest';
+
+describe('App', () => {
+  describe('computed hasStream', () => {
+    it('should return false when stream_url is missing', () => {
+      const streamUrl = '';
+      expect(!!streamUrl && streamUrl.trim().length > 0).toBe(false);
+    });
+
+    it('should return false when stream_url is whitespace', () => {
+      const streamUrl = '   ';
+      expect(!!streamUrl && streamUrl.trim().length > 0).toBe(false);
+    });
+
+    it('should return true when stream_url is a valid URL', () => {
+      const streamUrl = 'https://stream.example.com/live';
+      expect(!!streamUrl && streamUrl.trim().length > 0).toBe(true);
+    });
+  });
+
+  describe('stationConfig title formatting', () => {
+    it('should concatenate name_primary and name_secondary with a space', () => {
+      const namePrimary = 'KM';
+      const nameSecondary = 'TN';
+      const fullName = `${namePrimary} ${nameSecondary}`.trim();
+      expect(fullName).toBe('KM TN');
+    });
+
+    it('should trim trailing space when name_secondary is empty', () => {
+      const namePrimary = 'KM';
+      const nameSecondary = '';
+      const fullName = `${namePrimary} ${nameSecondary}`.trim();
+      expect(fullName).toBe('KM');
+    });
+  });
+});

src/test-setup.ts

@@ -0,0 +1,3 @@
+// Vitest test setup for frontend unit tests.
+// Angular TestBed initialization is not required for standalone unit tests.
+// Add shared mocks, global beforeEach hooks, or polyfills here as needed.

vitest.config.ts

@@ -0,0 +1,21 @@
+/** @type {import('vitest/config').ViteUserConfig} */
+export default {
+  test: {
+    globals: true,
+    environment: 'jsdom',
+    include: ['src/**/*.spec.ts'],
+    setupFiles: ['src/test-setup.ts'],
+    reporters: ['default'],
+    coverage: {
+      enabled: true,
+      reportsDirectory: 'coverage/frontend',
+      reporter: ['text', 'html', 'lcov'],
+      thresholds: {
+        lines: 0,
+        branches: 0,
+        functions: 0,
+        statements: 0,
+      },
+    },
+  },
+};