Weaviate version and expose gRPC port; adjust service dependencies

fix(analytics-service): enhance Dockerfile for runtime requirements and healthcheck

test(rls): add tests for RLS GUC context management in database connections

test(security): implement tests for async token revocation and rate limiting middleware

feat(security): add RS256/JWKS signing and migration from HS256

Author: Rayyan9477

.editorconfig

@@ -12,6 +12,20 @@ concurrency:
 
 env:
   PYTHON_VERSION: "3.12"
+  # Test-only CI secrets/config, inherited by all test jobs below.
+  AUTH_SECRET_KEY: ci-test-secret-key-minimum-32-characters-long!!
+  SECURITY_JWT_SECRET: ci-test-secret-key-minimum-32-characters-long!!
+  USER_SERVICE_JWT_SECRET_KEY: ci-test-secret-key-minimum-32-characters-long!!
+  ENCRYPTION_MASTER_KEY: ci-test-encrypt-key-exactly-32ch
+  USER_SERVICE_FIELD_ENCRYPTION_KEY: ci-test-encrypt-key-exactly-32ch
+  FERNET_TOKEN_KEY: sp1gRbNPAdgva1NX4vYC3gZDNu--cUiGM5H9xhtltN8=
+  FERNET_FIELD_KEY: aQyP7tOjb06jmhH0Ni3Y04CqcrzrnK_KnuurAOUWl4c=
+  POSTGRES_PASSWORD: ci_test_password
+  USER_DB_PASSWORD: ci_test_password
+  SERVICE_AUTH_SERVICE_SECRET: ci-test-service-secret-for-auth-32chars!!
+  ENVIRONMENT: test
+  KAFKA_ENABLED: "false"
+  LOG_LEVEL: WARNING
 
 jobs:
   lint:
@@ -37,29 +51,12 @@ jobs:
         continue-on-error: true
         run: ruff check . --statistics 2>&1 | tail -25
 
+  # Shared-library + cross-cutting suites. All steps HARD-GATED (no masking):
+  # a red step fails the job, which is the whole point of Phase 0.
   test:
-    name: Unit Tests
+    name: Core & Shared Tests
     runs-on: ubuntu-latest
     needs: lint
-    env:
-      # Auth / JWT
-      AUTH_SECRET_KEY: ci-test-secret-key-minimum-32-characters-long!!
-      SECURITY_JWT_SECRET: ci-test-secret-key-minimum-32-characters-long!!
-      USER_SERVICE_JWT_SECRET_KEY: ci-test-secret-key-minimum-32-characters-long!!
-      # Encryption
-      ENCRYPTION_MASTER_KEY: ci-test-encrypt-key-exactly-32ch
-      USER_SERVICE_FIELD_ENCRYPTION_KEY: ci-test-encrypt-key-exactly-32ch
-      FERNET_TOKEN_KEY: sp1gRbNPAdgva1NX4vYC3gZDNu--cUiGM5H9xhtltN8=
-      FERNET_FIELD_KEY: aQyP7tOjb06jmhH0Ni3Y04CqcrzrnK_KnuurAOUWl4c=
-      # Database
-      POSTGRES_PASSWORD: ci_test_password
-      USER_DB_PASSWORD: ci_test_password
-      # Service Auth
-      SERVICE_AUTH_SERVICE_SECRET: ci-test-service-secret-for-auth-32chars!!
-      # Runtime
-      ENVIRONMENT: test
-      KAFKA_ENABLED: "false"
-      LOG_LEVEL: WARNING
     steps:
       - uses: actions/checkout@v4
 
@@ -82,23 +79,71 @@ jobs:
         run: pytest tests/alignment/ -x -q --no-header
 
       - name: Run shared library tests
-        continue-on-error: true
         run: |
-          pytest tests/solace_common/ -x -q --no-header 2>&1 || true
-          pytest tests/solace_security/ -x -q --no-header 2>&1 || true
+          pytest tests/solace_common/ -q --no-header
+          pytest tests/solace_security/ -q --no-header
 
-      - name: Run service unit tests
-        continue-on-error: true
+  # Per-service unit tests, one matrix leg each. HARD-GATED, fail-fast off so
+  # every service reports independently. config_service has no tests dir yet.
+  service-tests:
+    name: Service Tests (${{ matrix.service.name }})
+    runs-on: ubuntu-latest
+    needs: lint
+    strategy:
+      fail-fast: false
+      matrix:
+        service:
+          - { dir: "safety_service", name: "safety" }
+          - { dir: "diagnosis_service", name: "diagnosis" }
+          - { dir: "therapy_service", name: "therapy" }
+          - { dir: "memory_service", name: "memory" }
+          - { dir: "personality_service", name: "personality" }
+          - { dir: "orchestrator_service", name: "orchestrator" }
+          - { dir: "user-service", name: "user" }
+          - { dir: "notification-service", name: "notification" }
+          - { dir: "analytics-service", name: "analytics" }
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+          pip install pytest-mock pytest-asyncio httpx
+
+      - name: Run ${{ matrix.service.name }} tests
+        run: pytest services/${{ matrix.service.dir }}/tests/ -q --no-header
+
+  # Integration suites that run against mocked/in-memory deps. HARD-GATED.
+  # The live-infra file needs real Postgres/Redis/Kafka/Weaviate and is deferred
+  # to Sprint B.3 (staging) rather than silently masked here.
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: pip
+
+      - name: Install dependencies
         run: |
-          pytest services/safety_service/tests/ -q --no-header --ignore=services/safety_service/tests/test_api.py 2>&1 || true
-          pytest services/diagnosis_service/tests/ -q --no-header 2>&1 || true
-          pytest services/therapy_service/tests/ -q --no-header 2>&1 || true
-          pytest services/memory_service/tests/ -q --no-header 2>&1 || true
-          pytest services/personality_service/tests/ -q --no-header 2>&1 || true
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+          pip install pytest-mock pytest-asyncio httpx
 
-      - name: Run integration tests
-        continue-on-error: true
-        run: pytest tests/integration/ -q --no-header 2>&1 || true
+      - name: Run integration tests (mocked deps)
+        run: pytest tests/integration/ -q --no-header --ignore=tests/integration/test_service_integration.py
 
   docker-build:
     name: Docker Build

.github/workflows/ci.yml

@@ -1,7 +1,14 @@
 # Solace-AI production override (Sprint 8).
 #
-# Applied on top of the base ``docker-compose.yml``:
-#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+# Applied on top of the base ``docker-compose.yml``. Deploy with --env-file so that
+# ${...} interpolation is sourced from .env.prod (NOT the shell / a dev .env), and so the
+# required-secret guards below actually read the prod values:
+#   docker compose --env-file .env.prod -f docker-compose.yml -f docker-compose.prod.yml up -d
+#
+# The dev debug UIs (mailhog, kafka-ui) are behind the "dev" profile in the base file, so
+# they are never started here (no --profile dev). Secrets below use the ${VAR:?msg} form:
+# compose FAILS FAST if a required secret is missing from .env.prod instead of silently
+# falling back to the base file's dev default (REV-11).
 #
 # Adds:
 #   - Caddy as the TLS-terminating reverse proxy (the only container with
@@ -33,6 +40,11 @@ x-logging: &default-logging
 x-restart: &default-restart
   restart: unless-stopped
 
+# Required secrets — override the base file's dev-default fallbacks so a missing value in
+# .env.prod fails the deploy instead of silently shipping the dev JWT key to prod (REV-11).
+x-app-secrets: &app-secrets
+  AUTH_SECRET_KEY: ${JWT_SECRET_KEY:?JWT_SECRET_KEY must be set in .env.prod}
+
 services:
   caddy:
     image: caddy:2.8-alpine
@@ -64,6 +76,8 @@ services:
   orchestrator-service:
     ports: []  # Only reachable via Caddy
     env_file: .env.prod
+    environment:
+      <<: *app-secrets
     logging: *default-logging
     <<: *default-restart
     deploy:
@@ -74,6 +88,14 @@ services:
   user-service:
     ports: []
     env_file: .env.prod
+    environment:
+      <<: *app-secrets
+      USER_SERVICE_JWT_SECRET_KEY: ${JWT_SECRET_KEY:?JWT_SECRET_KEY must be set in .env.prod}
+      SECURITY_JWT_SECRET: ${JWT_SECRET_KEY:?JWT_SECRET_KEY must be set in .env.prod}
+      USER_SERVICE_FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY:?FIELD_ENCRYPTION_KEY must be set in .env.prod}
+      FERNET_TOKEN_KEY: ${FERNET_TOKEN_KEY:?FERNET_TOKEN_KEY must be set in .env.prod}
+      FERNET_FIELD_KEY: ${FERNET_FIELD_KEY:?FERNET_FIELD_KEY must be set in .env.prod}
+      USER_DB_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env.prod}
     logging: *default-logging
     <<: *default-restart
     deploy:
@@ -84,6 +106,8 @@ services:
   safety-service:
     ports: []
     env_file: .env.prod
+    environment:
+      <<: *app-secrets
     logging: *default-logging
     <<: *default-restart
     deploy:
@@ -154,7 +178,7 @@ services:
   postgres:
     ports: []
     environment:
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env.prod}
     logging: *default-logging
     <<: *default-restart
     deploy: