feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_identity.py

@@ -0,0 +1,145 @@
+"""Tests for the TeamHUB trusted-identity adapter and enforcement middleware."""
+
+from __future__ import annotations
+
+import importlib
+import os
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.integrations.identity import (
+    SCOPE_DOCUMENTS_ADMIN,
+    SCOPE_DOCUMENTS_INGEST,
+    SCOPE_DOCUMENTS_READ,
+    parse_identity,
+)
+
+
+def test_parse_returns_none_without_actor():
+    assert parse_identity({}) is None
+    assert parse_identity({"X-TeamHub-Actor": "  "}) is None
+
+
+def test_parse_reads_all_headers_and_splits_csv():
+    ident = parse_identity(
+        {
+            "X-TeamHub-Actor": "alice",
+            "X-TeamHub-Actor-Id": "person-42",
+            "X-TeamHub-App": "legacyhub",
+            "X-TeamHub-Role": "admin",
+            "X-TeamHub-Roles": "admin, qa",
+            "X-TeamHub-Scopes": "documents:read, documents:approve",
+            "X-TeamHub-Entitlements-Version": "v7",
+        }
+    )
+    assert ident is not None
+    assert ident.actor == "alice"
+    assert ident.actor_id == "person-42"
+    assert ident.app == "legacyhub"
+    assert ident.primary_role == "admin"
+    assert ident.roles == ("admin", "qa")
+    assert ident.scopes == ("documents:read", "documents:approve")
+    assert ident.entitlements_version == "v7"
+
+
+def test_primary_role_is_included_in_roles():
+    ident = parse_identity({"X-TeamHub-Actor": "bob", "X-TeamHub-Role": "viewer"})
+    assert ident is not None
+    assert "viewer" in ident.roles
+
+
+def test_resolved_scopes_combine_roles_and_explicit_scopes():
+    ident = parse_identity(
+        {"X-TeamHub-Actor": "carol", "X-TeamHub-Roles": "ingestor", "X-TeamHub-Scopes": "extra:scope"}
+    )
+    assert ident is not None
+    resolved = ident.resolved_scopes()
+    assert SCOPE_DOCUMENTS_READ in resolved
+    assert SCOPE_DOCUMENTS_INGEST in resolved
+    assert "extra:scope" in resolved
+    assert SCOPE_DOCUMENTS_ADMIN not in resolved
+    assert ident.has_scope(SCOPE_DOCUMENTS_INGEST)
+    assert not ident.has_scope(SCOPE_DOCUMENTS_ADMIN)
+
+
+def test_admin_role_resolves_admin_scope():
+    ident = parse_identity({"X-TeamHub-Actor": "root", "X-TeamHub-Roles": "admin"})
+    assert ident is not None
+    assert ident.has_scope(SCOPE_DOCUMENTS_ADMIN)
+
+
+# ---- enforcement middleware integration ----
+
+@pytest.fixture
+def identity_required_app(monkeypatch):
+    monkeypatch.setenv("AUTH_REQUIRE_IDENTITY", "true")
+    monkeypatch.delenv("API_KEY", raising=False)
+    import app.config as cfg
+    import app.main as main_module
+
+    cfg.get_settings.cache_clear()
+    importlib.reload(cfg)
+    importlib.reload(main_module)
+    yield main_module.app
+    for _k in ("API_KEY", "INGEST_API_KEY", "AUTH_REQUIRE_IDENTITY"):
+        os.environ.pop(_k, None)
+    cfg.get_settings.cache_clear()
+    importlib.reload(cfg)
+    importlib.reload(main_module)
+
+
+def _patch_health(monkeypatch):
+    from app.api import routes_health
+    from app.api.schemas import ComponentHealth
+
+    for name in ("_check_postgres", "_check_minio", "_check_opensearch", "_check_qdrant", "_check_redis"):
+        monkeypatch.setattr(
+            routes_health,
+            name,
+            lambda n=name: ComponentHealth(name=n.removeprefix("_check_"), status="ok", detail={}),
+        )
+
+
+def test_health_open_without_identity(identity_required_app, monkeypatch):
+    from app.config import settings
+
+    _patch_health(monkeypatch)
+    client = TestClient(identity_required_app)
+    res = client.get(f"{settings.app_api_prefix}/health")
+    assert res.status_code == 200
+
+
+def test_protected_route_rejected_without_identity(identity_required_app, monkeypatch):
+    from app.config import settings
+    from app.indexing import hybrid_search
+
+    monkeypatch.setattr(hybrid_search, "run_search", lambda req: pytest.fail("must not run"))
+    client = TestClient(identity_required_app)
+    res = client.post(
+        f"{settings.app_api_prefix}/search",
+        json={"query": "x", "limit": 1, "filters": {}, "search_mode": "hybrid"},
+    )
+    assert res.status_code == 401
+    assert "identity" in res.json()["detail"]
+
+
+def test_protected_route_allowed_with_identity(identity_required_app, monkeypatch):
+    from app.api.schemas import SearchResponse
+    from app.config import settings
+    from app.indexing import hybrid_search
+
+    monkeypatch.setattr(
+        hybrid_search,
+        "run_search",
+        lambda req: SearchResponse(
+            query=req.query, mode=req.search_mode, total_candidates=0, reranked=False, results=[]
+        ),
+    )
+    client = TestClient(identity_required_app)
+    res = client.post(
+        f"{settings.app_api_prefix}/search",
+        headers={"X-TeamHub-Actor": "alice", "X-TeamHub-Roles": "qa"},
+        json={"query": "x", "limit": 1, "filters": {}, "search_mode": "hybrid"},
+    )
+    assert res.status_code == 200