fix preprod

L'assistant publiait directement dans le wiki global. La politique de contenu
ecarte la faute franche — conseil FCL, cas client, hors perimetre — mais une
heuristique ne juge pas la justesse : une page fausse mais bien ecrite la
franchissait, et se retrouvait citee comme documentation Xpeditis aupres de
tous les clients.

Domaine
- `WikiContributionStatus` : pending / published / rejected. `create()` ne
  prend pas le statut en parametre — rien ne nait publie.
- `publish(reviewerId, edits?)` valide, en acceptant une correction du
  relecteur, qui repasse la meme politique de contenu.
- `reject(reviewerId, note?)` ecarte sans supprimer : la liste des refus montre
  ou l'assistant se trompe.
- `revise()` remet une page validee en attente : sans cela, la validation
  porterait sur un texte que l'assistant a remplace depuis.

Ce qui sort du depot
- `findPublished` pour la recherche et la page publique, `findForReview` pour
  l'administration. Le statut est porte par la requete, pas filtre en memoire :
  une page en attente ne peut pas sortir par le chemin des clients.
- `revision()` ne compte que le publie, donc l'index vectoriel ne se reconstruit
  que sur une decision.

Relecture
- `GET /admin/wiki-contributions`, `POST :id/publish`, `POST :id/reject`, sous
  JwtAuthGuard + RolesGuard et @Roles('admin').
- Chaque decision est journalisee (`WIKI_CONTRIBUTION_REVIEWED`) : une page
  publiee engage la marque, on doit pouvoir dire qui l'a laissee passer.
- Ecran `/admin/wiki` : file par statut, corps complet affiche, correction et
  motif de refus facultatifs.

L'assistant
- La capacite rend `pending_review` et un message d'attente, plus d'URL : le
  modele annonce une proposition, jamais une publication. La consigne le lui
  dit explicitement.

SQL de la migration verifie sur la base locale : l'upsert sur index
d'expression met bien a jour a la casse pres, la contrainte de statut refuse
une valeur inconnue.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/skills/source-command-explore-and-plan/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: "source-command-explore-and-plan"
+description: "Explore codebase, create implementation plan, code, and test following EPCT workflow"
+---
+
+# source-command-explore-and-plan
+
+Use this skill when the user asks to run the migrated source command `explore-and-plan`.
+
+## Command Template
+
+# Explore, Plan, Code, Test Workflow
+
+At the end of this message, I will ask you to do something.
+Please follow the "Explore, Plan, Code, Test" workflow when you start.
+
+## Explore
+
+First, use parallel subagents to find and read all files that may be useful for implementing the ticket, either as examples or as edit targets. The subagents should return relevant file paths, and any other info that may be useful.
+
+## Plan
+
+Next, think hard and write up a detailed implementation plan. Don't forget to include tests, lookbook components, and documentation. Use your judgement as to what is necessary, given the standards of this repo.
+
+If there are things you are not sure about, use parallel subagents to do some web research. They should only return useful information, no noise.
+
+If there are things you still do not understand or questions you have for the user, pause here to ask them before continuing.
+
+## Code
+
+When you have a thorough implementation plan, you are ready to start writing code. Follow the style of the existing codebase (e.g. we prefer clearly named variables and methods to extensive comments). Make sure to run our autoformatting script when you're done, and fix linter warnings that seem reasonable to you.
+
+## Test
+
+Use parallel subagents to run tests, and make sure they all pass.
+
+If your changes touch the UX in a major way, use the browser to make sure that everything works correctly. Make a list of what to test for, and use a subagent for this step.
+
+If your testing shows problems, go back to the planning stage and think ultrahard.
+
+## Write up your work
+
+When you are happy with your work, write up a short report that could be used as the PR description. Include what you set out to do, the choices you made with their brief justification, and any commands you ran in the process that may be useful for future developers to know about.

.agents/skills/source-command-fix-pr-comments/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: "source-command-fix-pr-comments"
+description: "Fetch all comments for the current pull request and fix them."
+---
+
+# source-command-fix-pr-comments
+
+Use this skill when the user asks to run the migrated source command `fix-pr-comments`.
+
+## Command Template
+
+Workflow:
+
+1. Use `gh cli` to fetch the comments that are NOT resolved from the pull request.
+2. Define all the modifications you should actually make.
+3. Act and update the files.
+4. Create a commit and push.

.agents/skills/source-command-quick-commit/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: "source-command-quick-commit"
+description: "Quickly commit all changes with an auto-generated message"
+---
+
+# source-command-quick-commit
+
+Use this skill when the user asks to run the migrated source command `quick-commit`.
+
+## Command Template
+
+Workflow for quick Git commits:
+
+1. Check git status to see what changes are present
+2. Analyze changes to generate a short, clear commit message
+3. Stage all changes (tracked and untracked files)
+4. Create the commit with DH7789-dev signature
+5. Optionally push to remote if tracking branch exists
+
+The commit message will be automatically generated by analyzing:
+- Modified files and their purposes (components, configs, tests, docs, etc.)
+- New files added and their function
+- Deleted files and cleanup operations
+- Overall scope of changes to determine action verb (add, update, fix, refactor, remove, etc.)
+
+Commit message format: `[action] [what was changed]`
+Examples:
+- `add user authentication system`
+- `fix navigation menu responsive issues`
+- `update API endpoints configuration`
+- `refactor database connection logic`
+- `remove deprecated utility functions`
+
+This command is ideal for:
+- Quick iteration cycles
+- Work-in-progress commits
+- Feature development checkpoints
+- Bug fix commits
+
+The commit will include your custom signature:
+```
+Signed-off-by: DH7789-dev
+```

.codex/hooks.json

@@ -0,0 +1,25 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bun /Users/david/.claude/scripts/validate-command.js"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "afplay /Users/david/.claude/song/finish.mp3"
+          }
+        ]
+      }
+    ]
+  }
+}

.gitea/actionlint.yaml

@@ -0,0 +1,2 @@
+# All jobs use the existing ubuntu-latest runner label.
+{}

.gitea/actions/security/action.yml

@@ -0,0 +1,31 @@
+name: Security gate
+description: Dependency, secrets, infrastructure and workflow checks for Gitea 1.22.
+runs:
+  using: composite
+  steps:
+    - uses: ./.gitea/actions/setup-node
+    - name: Install Trivy
+      shell: bash
+      run: |
+        trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
+        "$trivy_bin" --version
+    - name: Validate workflows and deployment checks
+      shell: bash
+      run: |
+        actionlint_bin=$(bash scripts/ci/install-tool.sh actionlint)
+        ACTIONLINT_BIN="$actionlint_bin" bash scripts/ci/validate-workflows.sh
+    - name: Audit dependencies, secrets and infrastructure
+      shell: bash
+      run: bash scripts/ci/security-audit.sh
+    - name: Show security results
+      if: always()
+      shell: bash
+      run: python3 scripts/ci/summarize-security.py
+    - name: Save security reports on Gitea
+      if: always()
+      uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
+      with:
+        name: security-reports
+        path: ${{ runner.temp }}/security-reports/*.json
+        retention-days: 7
+        if-no-files-found: error

.gitea/actions/setup-node/action.yml

@@ -0,0 +1,11 @@
+name: Install and activate Node 22
+description: Set up Node and verify the executable selected by the Gitea runner.
+runs:
+  using: composite
+  steps:
+    - uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version: '22'
+    - name: Activate and verify Node 22
+      shell: bash
+      run: bash scripts/ci/activate-node.sh

.gitea/actions/setup-trivy/action.yml

@@ -0,0 +1,9 @@
+name: Install verified Trivy
+description: Install a pinned native scanner with a checked SHA256.
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
+        "$trivy_bin" --version

.gitea/manual/rollback.reference.yml

@@ -126,7 +126,7 @@ jobs:
           docker buildx imagetools inspect "$BACKEND" || { echo "ERROR: $BACKEND not found"; exit 1; }
           docker buildx imagetools inspect "$FRONTEND" || { echo "ERROR: $FRONTEND not found"; exit 1; }
 
-          kubectl set image deployment/xpeditis-backend backend="$BACKEND" -n ${{ env.K8S_NAMESPACE }}
+          kubectl set image deployment/xpeditis-backend backend="$BACKEND" seed-rates="$BACKEND" -n ${{ env.K8S_NAMESPACE }}
           kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=180s
 
           kubectl set image deployment/xpeditis-frontend frontend="$FRONTEND" -n ${{ env.K8S_NAMESPACE }}

.gitea/workflows/cd-main.yml

@@ -0,0 +1,405 @@
+name: CD Production
+
+# Pipeline de production — Hetzner k3s (infra/prod/).
+#
+# Enchaînement : qualité → vérification → promotion/rebuild → déploiement → contrôle
+#
+# TROIS RÈGLES STRUCTURANTES
+#
+# 1. Le BACKEND est PROMU depuis la preprod, jamais reconstruit.
+#    Promouvoir garantit que le binaire déployé en production est exactement
+#    celui qui a passé la chaîne de preprod (lint, tests unitaires, tests
+#    d'intégration, build). Un rebuild casserait cette garantie.
+#
+# 2. Le FRONTEND est RECONSTRUIT pour la production.
+#    next.config.js fige NEXT_PUBLIC_API_URL au moment du build. Promouvoir
+#    l'image de preprod livrerait une application qui appelle
+#    api.preprod.xpeditis.com en production. C'est la raison pour laquelle ce
+#    workflow ne peut pas se contenter de re-taguer.
+#
+# 3. Le déploiement passe par SSH, pas par l'API Kubernetes.
+#    L'API k3s (6443) n'est ouverte qu'aux IP d'administration. Les runners
+#    Gitea n'ont pas d'IP fixe : le job ouvre le port 22 pour la seule IP du
+#    runner via un firewall Hetzner dédié, puis le referme systématiquement.
+#
+# Secrets, runners et limites Gitea : voir docs/CI-CD-SECURITY.md
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
+  K8S_NAMESPACE: xpeditis-prod
+
+jobs:
+  security:
+    name: Security gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - name: Install Trivy
+        shell: bash
+        run: |
+          trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
+          "$trivy_bin" --version
+      - name: Validate workflows and deployment checks
+        shell: bash
+        run: |
+          actionlint_bin=$(bash scripts/ci/install-tool.sh actionlint)
+          ACTIONLINT_BIN="$actionlint_bin" bash scripts/ci/validate-workflows.sh
+      - name: Audit dependencies, secrets and infrastructure
+        shell: bash
+        run: bash scripts/ci/security-audit.sh
+      - name: Show security results
+        if: always()
+        shell: bash
+        run: python3 scripts/ci/summarize-security.py
+      - name: Save security reports on Gitea
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
+        with:
+          name: security-reports
+          path: ${{ runner.temp }}/security-reports/*.json
+          retention-days: 7
+          if-no-files-found: error
+
+  # ═══ 1. Qualité ══════════════════════════════════════════════════════════
+  backend-quality:
+    name: Backend — Lint
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint -- --no-fix
+
+  frontend-quality:
+    name: Frontend — Lint & Type-check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint
+      - run: npm run type-check
+
+  backend-tests:
+    name: Backend — Tests unitaires
+    runs-on: ubuntu-latest
+    needs: backend-quality
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  frontend-tests:
+    name: Frontend — Tests unitaires
+    runs-on: ubuntu-latest
+    needs: frontend-quality
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  # ═══ 2. Vérification de la provenance ════════════════════════════════════
+  # Exige un pipeline preprod réussi ET un arbre Git identique au code testé ici.
+  verify-image:
+    name: Vérifier l'image de preprod
+    runs-on: ubuntu-latest
+    needs: [security, backend-tests, frontend-tests]
+    outputs:
+      sha: ${{ steps.sha.outputs.short }}
+      backend_digest: ${{ steps.sha.outputs.backend_digest }}
+      log_exporter_digest: ${{ steps.sha.outputs.log_exporter_digest }}
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Resolve validated preprod release
+        id: sha
+        run: bash scripts/ci/resolve-release.sh
+
+  # ═══ 3b. Reconstruction du frontend avec les URLs de production ══════════
+  build-frontend:
+    name: Reconstruire le frontend (URLs de production)
+    runs-on: ubuntu-latest
+    needs: verify-image
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          # Cet arbre Git est identique à celui de la release preprod vérifiée.
+          ref: ${{ github.sha }}
+      - uses: https://github.com/docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        with:
+          platforms: amd64,arm64
+          cache-image: false
+      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - id: build
+        uses: https://github.com/docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: ./apps/frontend
+          file: ./apps/frontend/Dockerfile
+          push: true
+          platforms: linux/amd64
+          tags: |
+            ${{ env.REGISTRY }}/xpeditis-frontend:candidate-prod-${{ github.sha }}-${{ github.run_id }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod,mode=max
+          build-args: |
+            NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL_PROD }}
+            NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL_PROD }}
+
+      - name: Contrôle — l'URL de preprod ne doit pas figurer dans le bundle
+        run: |
+          IMAGE="${{ env.REGISTRY }}/xpeditis-frontend@${{ steps.build.outputs.digest }}"
+          CID=$(docker create --platform linux/amd64 "$IMAGE")
+          trap 'docker rm "$CID" >/dev/null' EXIT
+          docker cp "$CID:/app/.next" /tmp/next-check
+          test -d /tmp/next-check
+          trap - EXIT
+          docker rm "$CID" >/dev/null
+          if grep -rq "api.preprod.xpeditis.com" /tmp/next-check 2>/dev/null; then
+            echo "::error::L'URL de preprod est figée dans le bundle de production."
+            echo "Vérifiez le secret NEXT_PUBLIC_API_URL_PROD."
+            exit 1
+          fi
+          echo "Aucune URL de preprod dans le bundle."
+
+  image-security:
+    name: Image security (${{ matrix.service }}, ${{ matrix.arch }})
+    runs-on: ubuntu-latest
+    needs: [verify-image, build-frontend]
+    strategy:
+      fail-fast: false
+      matrix:
+        service: [backend, frontend, log-exporter]
+        arch: [amd64]
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-trivy
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Scan the exact image before deployment
+        env:
+          IMAGE: ${{ env.REGISTRY }}/xpeditis-${{ matrix.service }}@${{ matrix.service == 'frontend' && needs.build-frontend.outputs.digest || (matrix.service == 'backend' && needs.verify-image.outputs.backend_digest || needs.verify-image.outputs.log_exporter_digest) }}
+          PLATFORM: linux/${{ matrix.arch }}
+        run: |
+          trivy image --platform "$PLATFORM" --scanners vuln --severity HIGH,CRITICAL \
+            --ignore-unfixed=false --exit-code 1 --timeout 15m --no-progress --format json \
+            --output "$RUNNER_TEMP/image-security.json" "$IMAGE"
+      - name: Show image scan results
+        if: always()
+        run: python3 scripts/ci/summarize-image-security.py
+      - name: Save image report
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
+        with:
+          name: image-security-${{ matrix.service }}-${{ matrix.arch }}
+          path: ${{ runner.temp }}/image-security.json
+          retention-days: 14
+          if-no-files-found: error
+
+  # ═══ 4. Déploiement ══════════════════════════════════════════════════════
+  deploy:
+    name: Déployer en production
+    runs-on: ubuntu-latest
+    needs: [verify-image, build-frontend, image-security]
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Publish scanned production images
+        env:
+          IMAGE_SHA: ${{ needs.verify-image.outputs.sha }}
+          BACKEND_DIGEST: ${{ needs.verify-image.outputs.backend_digest }}
+          FRONTEND_DIGEST: ${{ needs.build-frontend.outputs.digest }}
+          LOG_EXPORTER_DIGEST: ${{ needs.verify-image.outputs.log_exporter_digest }}
+        run: |
+          for service in backend frontend log-exporter; do
+            case "$service" in
+              backend) digest="$BACKEND_DIGEST" ;;
+              frontend) digest="$FRONTEND_DIGEST" ;;
+              log-exporter) digest="$LOG_EXPORTER_DIGEST" ;;
+            esac
+            docker buildx imagetools create \
+              --tag "$REGISTRY/xpeditis-$service:prod-$IMAGE_SHA" \
+              --tag "$REGISTRY/xpeditis-$service:latest" \
+              "$REGISTRY/xpeditis-$service@$digest"
+          done
+
+      - name: Installer le client Hetzner
+        run: |
+          hcloud_bin=$(bash scripts/ci/install-tool.sh hcloud)
+          "$hcloud_bin" version
+
+      - name: Ouvrir le port 22 pour l'IP de ce runner
+        env:
+          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
+        run: |
+          RUNNER_IP="$(curl -fsS --max-time 10 https://ifconfig.me)"
+          echo "IP du runner : ${RUNNER_IP}"
+          cat > /tmp/fw-open.json <<JSON
+          [{
+            "direction": "in",
+            "protocol": "tcp",
+            "port": "22",
+            "source_ips": ["${RUNNER_IP}/32"],
+            "description": "Gitea Actions run ${{ github.run_id }}"
+          }]
+          JSON
+          hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-open.json
+
+      - name: Préparer SSH
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/deploy-ssh" && chmod 700 "$RUNNER_TEMP/deploy-ssh"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$RUNNER_TEMP/deploy-ssh/id_ed25519"
+          chmod 600 "$RUNNER_TEMP/deploy-ssh/id_ed25519"
+          # Empreinte épinglée : un détournement DNS ou BGP ne peut pas
+          # rediriger le déploiement vers une machine tierce.
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$RUNNER_TEMP/deploy-ssh/known_hosts"
+          chmod 600 "$RUNNER_TEMP/deploy-ssh/known_hosts"
+
+      - name: Synchroniser infra/prod sur le serveur
+        run: |
+          rsync -az --delete \
+            --exclude '.terraform' --exclude '*.tfstate*' --exclude '*.tfvars' \
+            -e "ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$RUNNER_TEMP/deploy-ssh/known_hosts\" -i \"$RUNNER_TEMP/deploy-ssh/id_ed25519\"" \
+            infra/prod/ \
+            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}:/opt/xpeditis/infra-prod/"
+
+      - name: Déployer
+        id: deploy
+        run: |
+          SHA="${{ needs.verify-image.outputs.sha }}"
+          ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/deploy-ssh/known_hosts" -i "$RUNNER_TEMP/deploy-ssh/id_ed25519" \
+            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
+            "deploy prod-${SHA}"
+
+      - name: Tests de fumée depuis l'extérieur
+        id: smoke
+        env:
+          PROD_API_URL: ${{ vars.PROD_API_URL }}
+          PROD_APP_URL: ${{ vars.PROD_APP_URL }}
+        run: bash infra/prod/scripts/smoke-test.sh
+
+      - name: Retour arrière si le déploiement a échoué
+        if: failure() && (steps.deploy.conclusion == 'failure' || steps.smoke.conclusion == 'failure')
+        run: |
+          ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/deploy-ssh/known_hosts" -i "$RUNNER_TEMP/deploy-ssh/id_ed25519" \
+            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
+            "rollback" || true
+
+      - name: Refermer le firewall
+        # `always()` : la fenêtre d'exposition se referme même si le
+        # déploiement a échoué, si le job a été annulé ou s'il a expiré.
+        if: always()
+        env:
+          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
+        run: |
+          echo '[]' > /tmp/fw-close.json
+          hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-close.json
+          echo "Firewall CI refermé."
+
+      - name: Effacer la clé SSH
+        if: always()
+        run: shred -u "$RUNNER_TEMP/deploy-ssh/id_ed25519" 2>/dev/null || rm -f "$RUNNER_TEMP/deploy-ssh/id_ed25519"
+
+  # ═══ 5. Notifications ════════════════════════════════════════════════════
+  notify-success:
+    name: Notifier le succès
+    runs-on: ubuntu-latest
+    needs: [verify-image, deploy]
+    if: success()
+    steps:
+      - run: |
+          curl -sf -H "Content-Type: application/json" -d '{
+            "embeds": [{
+              "title": "Production déployée et saine",
+              "color": 3066993,
+              "fields": [
+                {"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
+                {"name": "Version", "value": "`prod-${{ needs.verify-image.outputs.sha }}`", "inline": true},
+                {"name": "Cible", "value": "Hetzner k3s — xpeditis-prod", "inline": false},
+                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
+              ],
+              "footer": {"text": "Xpeditis CI/CD - Production"}
+            }]
+          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
+
+  notify-failure:
+    name: Notifier l'échec
+    runs-on: ubuntu-latest
+    needs: [security, backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, build-frontend, image-security, deploy]
+    if: failure()
+    steps:
+      - run: |
+          curl -sf -H "Content-Type: application/json" -d '{
+            "content": "@here ECHEC DU PIPELINE DE PRODUCTION",
+            "embeds": [{
+              "title": "Pipeline de production en échec",
+              "description": "Un retour arrière a été tenté si l échec est survenu pendant le déploiement. Vérifiez l état réel avant toute nouvelle tentative.",
+              "color": 15158332,
+              "fields": [
+                {"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
+                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false},
+                {"name": "A vérifier", "value": "Le firewall CI est-il bien refermé ? `hcloud firewall describe xpeditis-prod-fw-cicd`", "inline": false}
+              ],
+              "footer": {"text": "Xpeditis CI/CD - Production"}
+            }]
+          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.gitea/workflows/cd-preprod.yml

@@ -0,0 +1,442 @@
+name: CD Preprod
+
+# Full pipeline triggered on every push to preprod.
+# Flow: lint → unit tests → integration tests → docker build → deploy → notify
+#
+# Secrets required:
+#   REGISTRY_TOKEN            — Scaleway registry (read/write)
+#   NEXT_PUBLIC_API_URL       — https://api.preprod.xpeditis.com
+#   NEXT_PUBLIC_APP_URL       — https://preprod.xpeditis.com
+#   PORTAINER_WEBHOOK_BACKEND — Portainer webhook (preprod backend)
+#   PORTAINER_WEBHOOK_FRONTEND— Portainer webhook (preprod frontend)
+#   DISCORD_WEBHOOK_URL
+# Optional health URL overrides (secrets, then repository variables):
+#   PREPROD_BACKEND_URL       — defaults to https://api.preprod.xpeditis.com
+#   PREPROD_FRONTEND_URL      — defaults to https://app.preprod.xpeditis.com
+
+on:
+  push:
+    branches: [preprod]
+
+env:
+  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
+
+jobs:
+  security:
+    name: Security gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - name: Install Trivy
+        shell: bash
+        run: |
+          trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
+          "$trivy_bin" --version
+      - name: Validate workflows and deployment checks
+        shell: bash
+        run: |
+          actionlint_bin=$(bash scripts/ci/install-tool.sh actionlint)
+          ACTIONLINT_BIN="$actionlint_bin" bash scripts/ci/validate-workflows.sh
+      - name: Audit dependencies, secrets and infrastructure
+        shell: bash
+        run: bash scripts/ci/security-audit.sh
+      - name: Show security results
+        if: always()
+        shell: bash
+        run: python3 scripts/ci/summarize-security.py
+      - name: Save security reports on Gitea
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
+        with:
+          name: security-reports
+          path: ${{ runner.temp }}/security-reports/*.json
+          retention-days: 7
+          if-no-files-found: error
+
+  # ── 1. Lint ─────────────────────────────────────────────────────────
+  backend-quality:
+    name: Backend — Lint
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint -- --no-fix
+
+  frontend-quality:
+    name: Frontend — Lint & Type-check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint
+      - run: npm run type-check
+
+  # ── 2. Unit Tests ────────────────────────────────────────────────────
+  backend-tests:
+    name: Backend — Unit Tests
+    runs-on: ubuntu-latest
+    needs: backend-quality
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  frontend-tests:
+    name: Frontend — Unit Tests
+    runs-on: ubuntu-latest
+    needs: frontend-quality
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  # ── 3. Integration Tests ─────────────────────────────────────────────
+  integration-tests:
+    name: Backend — Integration Tests
+    runs-on: ubuntu-latest
+    needs: [backend-tests, frontend-tests]
+    defaults:
+      run:
+        working-directory: apps/backend
+
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_USER: xpeditis_test
+          POSTGRES_PASSWORD: xpeditis_test_password
+          POSTGRES_DB: xpeditis_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:7-alpine
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - name: Run integration tests
+        env:
+          NODE_ENV: test
+          TEST_DB_HOST: postgres
+          TEST_DB_PORT: 5432
+          TEST_DB_USER: xpeditis_test
+          TEST_DB_PASSWORD: xpeditis_test_password
+          TEST_DB_NAME: xpeditis_test
+          DATABASE_HOST: postgres
+          DATABASE_PORT: 5432
+          DATABASE_USER: xpeditis_test
+          DATABASE_PASSWORD: xpeditis_test_password
+          DATABASE_NAME: xpeditis_test
+          DATABASE_SYNCHRONIZE: 'false'
+          REDIS_HOST: redis
+          REDIS_PORT: 6379
+          REDIS_PASSWORD: ''
+          JWT_SECRET: test-secret-key-ci
+          SMTP_HOST: localhost
+          SMTP_PORT: 1025
+          SMTP_FROM: test@xpeditis.com
+        run: npm run test:integration -- --ci --runInBand
+
+  # ── 4. Docker Build & Push ───────────────────────────────────────────
+  # Tags: preprod (latest for this env) + preprod-SHA (used by prod for exact promotion)
+  build-backend:
+    name: Build Backend
+    runs-on: ubuntu-latest
+    needs: [security, integration-tests]
+    outputs:
+      sha: ${{ steps.sha.outputs.short }}
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Short SHA
+        id: sha
+        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+      - uses: https://github.com/docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        with:
+          platforms: amd64,arm64
+          cache-image: false
+      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - id: build
+        uses: https://github.com/docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: ./apps/backend
+          file: ./apps/backend/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/xpeditis-backend:preprod-${{ steps.sha.outputs.short }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache,mode=max
+          platforms: linux/amd64,linux/arm64
+
+  build-frontend:
+    name: Build Frontend
+    runs-on: ubuntu-latest
+    needs: [security, integration-tests]
+    outputs:
+      sha: ${{ steps.sha.outputs.short }}
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Short SHA
+        id: sha
+        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+      - uses: https://github.com/docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        with:
+          platforms: amd64,arm64
+          cache-image: false
+      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - id: build
+        uses: https://github.com/docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: ./apps/frontend
+          file: ./apps/frontend/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/xpeditis-frontend:preprod-${{ steps.sha.outputs.short }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache,mode=max
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL }}
+            NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL }}
+
+  build-log-exporter:
+    name: Build Log Exporter
+    runs-on: ubuntu-latest
+    needs: [security, integration-tests]
+    outputs:
+      sha: ${{ steps.sha.outputs.short }}
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Short SHA
+        id: sha
+        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+      - uses: https://github.com/docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        with:
+          platforms: amd64,arm64
+          cache-image: false
+      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - id: build
+        uses: https://github.com/docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: ./apps/log-exporter
+          file: ./apps/log-exporter/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/xpeditis-log-exporter:preprod-${{ steps.sha.outputs.short }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-log-exporter:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-log-exporter:buildcache,mode=max
+          platforms: linux/amd64,linux/arm64
+
+  image-security:
+    name: Image security (${{ matrix.service }}, ${{ matrix.arch }})
+    runs-on: ubuntu-latest
+    needs: [build-backend, build-frontend, build-log-exporter]
+    strategy:
+      fail-fast: false
+      matrix:
+        service: [backend, frontend, log-exporter]
+        arch: [amd64, arm64]
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-trivy
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Scan the exact image before deployment
+        env:
+          IMAGE: ${{ env.REGISTRY }}/xpeditis-${{ matrix.service }}@${{ needs[format('build-{0}', matrix.service)].outputs.digest }}
+          PLATFORM: linux/${{ matrix.arch }}
+        run: |
+          trivy image --platform "$PLATFORM" --scanners vuln --severity HIGH,CRITICAL \
+            --ignore-unfixed=false --exit-code 1 --timeout 15m --no-progress --format json \
+            --output "$RUNNER_TEMP/image-security.json" "$IMAGE"
+      - name: Show image scan results
+        if: always()
+        run: python3 scripts/ci/summarize-image-security.py
+      - name: Save image report
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
+        with:
+          name: image-security-${{ matrix.service }}-${{ matrix.arch }}
+          path: ${{ runner.temp }}/image-security.json
+          retention-days: 14
+          if-no-files-found: error
+
+  # ── 5. Deploy via Portainer ──────────────────────────────────────────
+  deploy:
+    name: Deploy to Preprod
+    runs-on: ubuntu-latest
+    needs: [build-backend, build-frontend, build-log-exporter, image-security]
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Publish scanned preprod images
+        env:
+          BACKEND_DIGEST: ${{ needs.build-backend.outputs.digest }}
+          FRONTEND_DIGEST: ${{ needs.build-frontend.outputs.digest }}
+          LOG_EXPORTER_DIGEST: ${{ needs.build-log-exporter.outputs.digest }}
+        run: |
+          for service in backend frontend log-exporter; do
+            case "$service" in
+              backend) digest="$BACKEND_DIGEST" ;;
+              frontend) digest="$FRONTEND_DIGEST" ;;
+              log-exporter) digest="$LOG_EXPORTER_DIGEST" ;;
+            esac
+            docker buildx imagetools create \
+              --tag "$REGISTRY/xpeditis-$service:preprod" \
+              "$REGISTRY/xpeditis-$service@$digest"
+          done
+      - name: Deploy backend
+        run: |
+          HTTP_CODE=$(curl --connect-timeout 10 --max-time 30 -s -o /dev/null -w "%{http_code}" -X POST "${{ secrets.PORTAINER_WEBHOOK_BACKEND }}")
+          echo "Portainer response: HTTP $HTTP_CODE"
+          if [[ "$HTTP_CODE" != "2"* ]]; then
+            echo "ERROR: Portainer webhook failed with HTTP $HTTP_CODE"
+            exit 1
+          fi
+          echo "Backend webhook triggered."
+      - name: Wait for backend startup
+        run: sleep 20
+      - name: Deploy frontend
+        run: |
+          HTTP_CODE=$(curl --connect-timeout 10 --max-time 30 -s -o /dev/null -w "%{http_code}" -X POST "${{ secrets.PORTAINER_WEBHOOK_FRONTEND }}")
+          echo "Portainer response: HTTP $HTTP_CODE"
+          if [[ "$HTTP_CODE" != "2"* ]]; then
+            echo "ERROR: Portainer webhook failed with HTTP $HTTP_CODE"
+            exit 1
+          fi
+          echo "Frontend webhook triggered."
+
+      - name: Verify backend health
+        env:
+          BASE_URL: ${{ secrets.PREPROD_BACKEND_URL || vars.PREPROD_BACKEND_URL || 'https://api.preprod.xpeditis.com' }}
+        run: bash scripts/ci/health-check.sh "${BASE_URL%/}/api/v1/health"
+      - name: Verify frontend health
+        env:
+          BASE_URL: ${{ secrets.PREPROD_FRONTEND_URL || vars.PREPROD_FRONTEND_URL || 'https://app.preprod.xpeditis.com' }}
+        run: bash scripts/ci/health-check.sh "${BASE_URL%/}/api/health"
+
+      - name: Mark successfully deployed preprod images
+        env:
+          BACKEND_DIGEST: ${{ needs.build-backend.outputs.digest }}
+          LOG_EXPORTER_DIGEST: ${{ needs.build-log-exporter.outputs.digest }}
+        run: |
+          docker buildx imagetools create \
+            --tag "$REGISTRY/xpeditis-backend:validated-preprod-$GITHUB_SHA" \
+            "$REGISTRY/xpeditis-backend@$BACKEND_DIGEST"
+          docker buildx imagetools create \
+            --tag "$REGISTRY/xpeditis-log-exporter:validated-preprod-$GITHUB_SHA" \
+            "$REGISTRY/xpeditis-log-exporter@$LOG_EXPORTER_DIGEST"
+
+  # ── Notifications ────────────────────────────────────────────────────
+  notify-success:
+    name: Notify Success
+    runs-on: ubuntu-latest
+    needs: [build-backend, build-frontend, deploy]
+    if: success()
+    steps:
+      - run: |
+          curl -s -H "Content-Type: application/json" -d '{
+            "embeds": [{
+              "title": "✅ Preprod Deployed & Healthy",
+              "color": 3066993,
+              "fields": [
+                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
+                {"name": "SHA", "value": "`${{ needs.build-backend.outputs.sha }}`", "inline": true},
+                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
+              ],
+              "footer": {"text": "Xpeditis CI/CD • Preprod"}
+            }]
+          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
+
+  notify-failure:
+    name: Notify Failure
+    runs-on: ubuntu-latest
+    needs: [security, backend-quality, frontend-quality, backend-tests, frontend-tests, integration-tests, build-backend, build-frontend, build-log-exporter, image-security, deploy]
+    if: failure()
+    steps:
+      - run: |
+          curl -s -H "Content-Type: application/json" -d '{
+            "embeds": [{
+              "title": "❌ Preprod Pipeline Failed",
+              "description": "Pipeline en échec. Vérifiez les rapports et l état réel des services avant de relancer.",
+              "color": 15158332,
+              "fields": [
+                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
+                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
+              ],
+              "footer": {"text": "Xpeditis CI/CD • Preprod"}
+            }]
+          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.gitea/workflows/ci.yml

@@ -0,0 +1,122 @@
+name: Dev CI
+
+on:
+  push:
+    branches: [dev]
+  pull_request:
+    branches: [dev]
+
+jobs:
+  security:
+    name: Security gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - name: Install Trivy
+        shell: bash
+        run: |
+          trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
+          "$trivy_bin" --version
+      - name: Validate workflows and deployment checks
+        shell: bash
+        run: |
+          actionlint_bin=$(bash scripts/ci/install-tool.sh actionlint)
+          ACTIONLINT_BIN="$actionlint_bin" bash scripts/ci/validate-workflows.sh
+      - name: Audit dependencies, secrets and infrastructure
+        shell: bash
+        run: bash scripts/ci/security-audit.sh
+      - name: Show security results
+        if: always()
+        shell: bash
+        run: python3 scripts/ci/summarize-security.py
+      - name: Save security reports on Gitea
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
+        with:
+          name: security-reports
+          path: ${{ runner.temp }}/security-reports/*.json
+          retention-days: 7
+          if-no-files-found: error
+
+  backend-quality:
+    name: Backend — Lint
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint -- --no-fix
+
+  frontend-quality:
+    name: Frontend — Lint & Type-check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint
+      - run: npm run type-check
+
+  backend-tests:
+    name: Backend — Unit Tests
+    runs-on: ubuntu-latest
+    needs: backend-quality
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  frontend-tests:
+    name: Frontend — Unit Tests
+    runs-on: ubuntu-latest
+    needs: frontend-quality
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  notify-failure:
+    name: Notify Failure
+    runs-on: ubuntu-latest
+    needs: [security, backend-quality, frontend-quality, backend-tests, frontend-tests]
+    if: failure()
+    steps:
+      - name: Discord
+        run: |
+          curl -s -H "Content-Type: application/json" -d '{
+            "embeds": [{
+              "title": "❌ Dev CI Failed",
+              "color": 15158332,
+              "fields": [
+                {"name": "Branch", "value": "`${{ github.ref_name }}`", "inline": true},
+                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
+                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
+              ],
+              "footer": {"text": "Xpeditis CI • Dev"}
+            }]
+          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.gitea/workflows/pr-checks.yml

@@ -0,0 +1,161 @@
+name: PR Checks
+
+# Required status checks — configure these in branch protection rules.
+# PRs to preprod : lint + type-check + unit tests + integration tests
+# PRs to main    : same checks, including integration and security
+
+on:
+  pull_request:
+    branches: [preprod, main]
+
+jobs:
+  security:
+    name: Security gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - name: Install Trivy
+        shell: bash
+        run: |
+          trivy_bin=$(bash scripts/ci/install-tool.sh trivy)
+          "$trivy_bin" --version
+      - name: Validate workflows and deployment checks
+        shell: bash
+        run: |
+          actionlint_bin=$(bash scripts/ci/install-tool.sh actionlint)
+          ACTIONLINT_BIN="$actionlint_bin" bash scripts/ci/validate-workflows.sh
+      - name: Audit dependencies, secrets and infrastructure
+        shell: bash
+        run: bash scripts/ci/security-audit.sh
+      - name: Show security results
+        if: always()
+        shell: bash
+        run: python3 scripts/ci/summarize-security.py
+      - name: Save security reports on Gitea
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
+        with:
+          name: security-reports
+          path: ${{ runner.temp }}/security-reports/*.json
+          retention-days: 7
+          if-no-files-found: error
+
+  backend-quality:
+    name: Backend — Lint
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint -- --no-fix
+
+  frontend-quality:
+    name: Frontend — Lint & Type-check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm run lint
+      - run: npm run type-check
+
+  backend-tests:
+    name: Backend — Unit Tests
+    runs-on: ubuntu-latest
+    needs: backend-quality
+    defaults:
+      run:
+        working-directory: apps/backend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  frontend-tests:
+    name: Frontend — Unit Tests
+    runs-on: ubuntu-latest
+    needs: frontend-quality
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - run: npm test -- --ci --runInBand
+
+  # Integration tests validate the actual merge candidate for both branches.
+  integration-tests:
+    name: Backend — Integration Tests
+    runs-on: ubuntu-latest
+    needs: backend-tests
+    defaults:
+      run:
+        working-directory: apps/backend
+
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_USER: xpeditis_test
+          POSTGRES_PASSWORD: xpeditis_test_password
+          POSTGRES_DB: xpeditis_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:7-alpine
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    steps:
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.gitea/actions/setup-node
+      - run: npm ci --legacy-peer-deps
+      - name: Run integration tests
+        env:
+          NODE_ENV: test
+          TEST_DB_HOST: postgres
+          TEST_DB_PORT: 5432
+          TEST_DB_USER: xpeditis_test
+          TEST_DB_PASSWORD: xpeditis_test_password
+          TEST_DB_NAME: xpeditis_test
+          DATABASE_HOST: postgres
+          DATABASE_PORT: 5432
+          DATABASE_USER: xpeditis_test
+          DATABASE_PASSWORD: xpeditis_test_password
+          DATABASE_NAME: xpeditis_test
+          DATABASE_SYNCHRONIZE: 'false'
+          REDIS_HOST: redis
+          REDIS_PORT: 6379
+          REDIS_PASSWORD: ''
+          JWT_SECRET: test-secret-key-ci
+          SMTP_HOST: localhost
+          SMTP_PORT: 1025
+          SMTP_FROM: test@xpeditis.com
+        run: npm run test:integration -- --ci --runInBand

.github/workflows/cd-main.yml

@@ -1,276 +0,0 @@
-name: CD Production
-
-# Production pipeline — Hetzner k3s.
-#
-# SECURITY: Two mandatory gates before any production deployment:
-#   1. quality-gate  — lint + unit tests on the exact commit being deployed
-#   2. verify-image  — confirms preprod-SHA image EXISTS in registry,
-#                      which proves this commit passed the full preprod
-#                      pipeline (lint + unit + integration + docker build).
-#                      If someone merges to main without going through preprod,
-#                      this step fails and the deployment is blocked.
-#
-# Flow: quality-gate → verify-image → promote → deploy → notify
-#
-# Secrets required:
-#   REGISTRY_TOKEN          — Scaleway registry (read/write)
-#   HETZNER_KUBECONFIG      — base64: cat ~/.kube/kubeconfig-xpeditis-prod | base64 -w 0
-#   PROD_BACKEND_URL        — https://api.xpeditis.com
-#   PROD_FRONTEND_URL       — https://app.xpeditis.com
-#   DISCORD_WEBHOOK_URL
-
-on:
-  push:
-    branches: [main]
-
-concurrency:
-  group: cd-production
-  cancel-in-progress: false
-
-env:
-  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
-  NODE_VERSION: '20'
-  K8S_NAMESPACE: xpeditis-prod
-
-jobs:
-  # ── 1. Quality Gate ──────────────────────────────────────────────────
-  # Runs on every prod deployment regardless of what happened in preprod.
-  backend-quality:
-    name: Backend — Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
-
-  frontend-quality:
-    name: Frontend — Lint & Type-check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
-
-  backend-tests:
-    name: Backend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: backend-quality
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  frontend-tests:
-    name: Frontend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  # ── 2. Image Verification ────────────────────────────────────────────
-  # Checks that preprod-SHA tags exist for this EXACT commit.
-  # This is the security gate: if the preprod pipeline never ran for this
-  # commit (or failed before the docker build step), this job fails and
-  # the deployment is fully blocked.
-  verify-image:
-    name: Verify Preprod Image Exists
-    runs-on: ubuntu-latest
-    needs: [backend-tests, frontend-tests]
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Check backend image preprod-SHA
-        run: |
-          TAG="${{ env.REGISTRY }}/xpeditis-backend:preprod-${{ steps.sha.outputs.short }}"
-          echo "Verifying: $TAG"
-          docker buildx imagetools inspect "$TAG" || {
-            echo ""
-            echo "BLOCKED: Image $TAG not found in registry."
-            echo "This commit was not built by the preprod pipeline."
-            echo "Merge to preprod first and wait for the full pipeline to succeed."
-            exit 1
-          }
-
-      - name: Check frontend image preprod-SHA
-        run: |
-          TAG="${{ env.REGISTRY }}/xpeditis-frontend:preprod-${{ steps.sha.outputs.short }}"
-          echo "Verifying: $TAG"
-          docker buildx imagetools inspect "$TAG" || {
-            echo ""
-            echo "BLOCKED: Image $TAG not found in registry."
-            echo "This commit was not built by the preprod pipeline."
-            echo "Merge to preprod first and wait for the full pipeline to succeed."
-            exit 1
-          }
-
-  # ── 3. Promote Images ────────────────────────────────────────────────
-  # Re-tags preprod-SHA → latest + prod-SHA within Scaleway.
-  # No rebuild. No layer transfer. Manifest-level operation only.
-  promote-images:
-    name: Promote Images (preprod-SHA → prod)
-    runs-on: ubuntu-latest
-    needs: verify-image
-    steps:
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Promote backend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          docker buildx imagetools create \
-            --tag ${{ env.REGISTRY }}/xpeditis-backend:latest \
-            --tag ${{ env.REGISTRY }}/xpeditis-backend:prod-${SHA} \
-            ${{ env.REGISTRY }}/xpeditis-backend:preprod-${SHA}
-          echo "Backend promoted: preprod-${SHA} → latest + prod-${SHA}"
-
-      - name: Promote frontend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          docker buildx imagetools create \
-            --tag ${{ env.REGISTRY }}/xpeditis-frontend:latest \
-            --tag ${{ env.REGISTRY }}/xpeditis-frontend:prod-${SHA} \
-            ${{ env.REGISTRY }}/xpeditis-frontend:preprod-${SHA}
-          echo "Frontend promoted: preprod-${SHA} → latest + prod-${SHA}"
-
-  # ── 4. Deploy to k3s ─────────────────────────────────────────────────
-  deploy:
-    name: Deploy to Production (k3s)
-    runs-on: ubuntu-latest
-    needs: [verify-image, promote-images]
-    environment:
-      name: production
-      url: https://app.xpeditis.com
-    steps:
-      - name: Configure kubectl
-        run: |
-          mkdir -p ~/.kube
-          echo "${{ secrets.HETZNER_KUBECONFIG }}" | base64 -d > ~/.kube/config
-          chmod 600 ~/.kube/config
-          kubectl cluster-info
-          kubectl get nodes -o wide
-
-      - name: Deploy backend
-        id: deploy-backend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          IMAGE="${{ env.REGISTRY }}/xpeditis-backend:prod-${SHA}"
-          echo "Deploying: $IMAGE"
-          kubectl set image deployment/xpeditis-backend backend="$IMAGE" -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=300s
-          echo "Backend rollout complete."
-
-      - name: Deploy frontend
-        id: deploy-frontend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          IMAGE="${{ env.REGISTRY }}/xpeditis-frontend:prod-${SHA}"
-          echo "Deploying: $IMAGE"
-          kubectl set image deployment/xpeditis-frontend frontend="$IMAGE" -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=300s
-          echo "Frontend rollout complete."
-
-      - name: Auto-rollback on deployment failure
-        if: failure()
-        run: |
-          echo "Deployment failed — initiating rollback..."
-          kubectl rollout undo deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout undo deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=120s
-          kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=120s
-          echo "Rollback complete. Previous version is live."
-
-  # ── Notifications ────────────────────────────────────────────────────
-  notify-success:
-    name: Notify Success
-    runs-on: ubuntu-latest
-    needs: [verify-image, deploy]
-    if: success()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "🚀 Production Deployed & Healthy",
-              "color": 3066993,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Version", "value": "`prod-${{ needs.verify-image.outputs.sha }}`", "inline": true},
-                {"name": "Cluster", "value": "Hetzner k3s — `xpeditis-prod`", "inline": false},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Production"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
-
-  notify-failure:
-    name: Notify Failure
-    runs-on: ubuntu-latest
-    needs: [backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, promote-images, deploy]
-    if: failure()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "content": "@here PRODUCTION PIPELINE FAILED",
-            "embeds": [{
-              "title": "🔴 Production Pipeline Failed",
-              "description": "Check the workflow for details. Auto-rollback was triggered if the failure was during deploy.",
-              "color": 15158332,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false},
-                {"name": "Rollback", "value": "[Run rollback workflow](${{ github.server_url }}/${{ github.repository }}/actions/workflows/rollback.yml)", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Production"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.github/workflows/cd-preprod.yml

@@ -1,316 +0,0 @@
-name: CD Preprod
-
-# Full pipeline triggered on every push to preprod.
-# Flow: lint → unit tests → integration tests → docker build → deploy → notify
-#
-# Secrets required:
-#   REGISTRY_TOKEN            — Scaleway registry (read/write)
-#   NEXT_PUBLIC_API_URL       — https://api.preprod.xpeditis.com
-#   NEXT_PUBLIC_APP_URL       — https://preprod.xpeditis.com
-#   PORTAINER_WEBHOOK_BACKEND — Portainer webhook (preprod backend)
-#   PORTAINER_WEBHOOK_FRONTEND— Portainer webhook (preprod frontend)
-#   PREPROD_BACKEND_URL       — https://api.preprod.xpeditis.com
-#   PREPROD_FRONTEND_URL      — https://preprod.xpeditis.com
-#   DISCORD_WEBHOOK_URL
-
-on:
-  push:
-    branches: [preprod]
-
-concurrency:
-  group: cd-preprod
-  cancel-in-progress: false
-
-env:
-  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
-  NODE_VERSION: '20'
-
-jobs:
-  # ── 1. Lint ─────────────────────────────────────────────────────────
-  backend-quality:
-    name: Backend — Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
-
-  frontend-quality:
-    name: Frontend — Lint & Type-check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
-
-  # ── 2. Unit Tests ────────────────────────────────────────────────────
-  backend-tests:
-    name: Backend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: backend-quality
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  frontend-tests:
-    name: Frontend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  # ── 3. Integration Tests ─────────────────────────────────────────────
-  integration-tests:
-    name: Backend — Integration Tests
-    runs-on: ubuntu-latest
-    needs: [backend-tests, frontend-tests]
-    defaults:
-      run:
-        working-directory: apps/backend
-
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: xpeditis_test
-          POSTGRES_PASSWORD: xpeditis_test_password
-          POSTGRES_DB: xpeditis_test
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 5432:5432
-      redis:
-        image: redis:7-alpine
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 6379:6379
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - name: Run integration tests
-        env:
-          NODE_ENV: test
-          DATABASE_HOST: localhost
-          DATABASE_PORT: 5432
-          DATABASE_USER: xpeditis_test
-          DATABASE_PASSWORD: xpeditis_test_password
-          DATABASE_NAME: xpeditis_test
-          DATABASE_SYNCHRONIZE: 'false'
-          REDIS_HOST: localhost
-          REDIS_PORT: 6379
-          REDIS_PASSWORD: ''
-          JWT_SECRET: test-secret-key-ci
-          SMTP_HOST: localhost
-          SMTP_PORT: 1025
-          SMTP_FROM: test@xpeditis.com
-        run: npm run test:integration -- --passWithNoTests
-
-  # ── 4. Docker Build & Push ───────────────────────────────────────────
-  # Tags: preprod (latest for this env) + preprod-SHA (used by prod for exact promotion)
-  build-backend:
-    name: Build Backend
-    runs-on: ubuntu-latest
-    needs: integration-tests
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v5
-        with:
-          context: ./apps/backend
-          file: ./apps/backend/Dockerfile
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/xpeditis-backend:preprod
-            ${{ env.REGISTRY }}/xpeditis-backend:preprod-${{ steps.sha.outputs.short }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache,mode=max
-          platforms: linux/amd64,linux/arm64
-
-  build-frontend:
-    name: Build Frontend
-    runs-on: ubuntu-latest
-    needs: integration-tests
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v5
-        with:
-          context: ./apps/frontend
-          file: ./apps/frontend/Dockerfile
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/xpeditis-frontend:preprod
-            ${{ env.REGISTRY }}/xpeditis-frontend:preprod-${{ steps.sha.outputs.short }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache,mode=max
-          platforms: linux/amd64,linux/arm64
-          build-args: |
-            NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL }}
-            NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL }}
-
-  build-log-exporter:
-    name: Build Log Exporter
-    runs-on: ubuntu-latest
-    needs: integration-tests
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v5
-        with:
-          context: ./apps/log-exporter
-          file: ./apps/log-exporter/Dockerfile
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/xpeditis-log-exporter:preprod
-            ${{ env.REGISTRY }}/xpeditis-log-exporter:preprod-${{ steps.sha.outputs.short }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-log-exporter:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-log-exporter:buildcache,mode=max
-          platforms: linux/amd64,linux/arm64
-
-  # ── 5. Deploy via Portainer ──────────────────────────────────────────
-  deploy:
-    name: Deploy to Preprod
-    runs-on: ubuntu-latest
-    needs: [build-backend, build-frontend, build-log-exporter]
-    environment: preprod
-    steps:
-      - name: Deploy backend
-        run: |
-          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${{ secrets.PORTAINER_WEBHOOK_BACKEND }}")
-          echo "Portainer response: HTTP $HTTP_CODE"
-          if [[ "$HTTP_CODE" != "2"* ]]; then
-            echo "ERROR: Portainer webhook failed with HTTP $HTTP_CODE"
-            exit 1
-          fi
-          echo "Backend webhook triggered."
-      - name: Wait for backend startup
-        run: sleep 20
-      - name: Deploy frontend
-        run: |
-          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${{ secrets.PORTAINER_WEBHOOK_FRONTEND }}")
-          echo "Portainer response: HTTP $HTTP_CODE"
-          if [[ "$HTTP_CODE" != "2"* ]]; then
-            echo "ERROR: Portainer webhook failed with HTTP $HTTP_CODE"
-            exit 1
-          fi
-          echo "Frontend webhook triggered."
-
-  # ── Notifications ────────────────────────────────────────────────────
-  notify-success:
-    name: Notify Success
-    runs-on: ubuntu-latest
-    needs: [build-backend, build-frontend, deploy]
-    if: success()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "✅ Preprod Deployed & Healthy",
-              "color": 3066993,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "SHA", "value": "`${{ needs.build-backend.outputs.sha }}`", "inline": true},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Preprod"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
-
-  notify-failure:
-    name: Notify Failure
-    runs-on: ubuntu-latest
-    needs: [backend-quality, frontend-quality, backend-tests, frontend-tests, integration-tests, build-backend, build-frontend, deploy]
-    if: failure()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "❌ Preprod Pipeline Failed",
-              "description": "Preprod was NOT deployed.",
-              "color": 15158332,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Preprod"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.github/workflows/ci.yml

@@ -1,103 +0,0 @@
-name: Dev CI
-
-on:
-  push:
-    branches: [dev]
-  pull_request:
-    branches: [dev]
-
-concurrency:
-  group: dev-ci-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  NODE_VERSION: '20'
-
-jobs:
-  backend-quality:
-    name: Backend — Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
-
-  frontend-quality:
-    name: Frontend — Lint & Type-check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
-
-  backend-tests:
-    name: Backend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: backend-quality
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  frontend-tests:
-    name: Frontend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  notify-failure:
-    name: Notify Failure
-    runs-on: ubuntu-latest
-    needs: [backend-quality, frontend-quality, backend-tests, frontend-tests]
-    if: failure()
-    steps:
-      - name: Discord
-        run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "❌ Dev CI Failed",
-              "color": 15158332,
-              "fields": [
-                {"name": "Branch", "value": "`${{ github.ref_name }}`", "inline": true},
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI • Dev"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.github/workflows/pr-checks.yml

@@ -1,145 +0,0 @@
-name: PR Checks
-
-# Required status checks — configure these in branch protection rules.
-# PRs to preprod : lint + type-check + unit tests + integration tests
-# PRs to main    : lint + type-check + unit tests only
-
-on:
-  pull_request:
-    branches: [preprod, main]
-
-concurrency:
-  group: pr-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-env:
-  NODE_VERSION: '20'
-
-jobs:
-  backend-quality:
-    name: Backend — Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
-
-  frontend-quality:
-    name: Frontend — Lint & Type-check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
-
-  backend-tests:
-    name: Backend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: backend-quality
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  frontend-tests:
-    name: Frontend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  # Integration tests — PRs to preprod only
-  # Code going to main was already integration-tested when it passed through preprod
-  integration-tests:
-    name: Backend — Integration Tests
-    runs-on: ubuntu-latest
-    needs: backend-tests
-    if: github.base_ref == 'preprod'
-    defaults:
-      run:
-        working-directory: apps/backend
-
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: xpeditis_test
-          POSTGRES_PASSWORD: xpeditis_test_password
-          POSTGRES_DB: xpeditis_test
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 5432:5432
-      redis:
-        image: redis:7-alpine
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 6379:6379
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - name: Run integration tests
-        env:
-          NODE_ENV: test
-          DATABASE_HOST: localhost
-          DATABASE_PORT: 5432
-          DATABASE_USER: xpeditis_test
-          DATABASE_PASSWORD: xpeditis_test_password
-          DATABASE_NAME: xpeditis_test
-          DATABASE_SYNCHRONIZE: 'false'
-          REDIS_HOST: localhost
-          REDIS_PORT: 6379
-          REDIS_PASSWORD: ''
-          JWT_SECRET: test-secret-key-ci
-          SMTP_HOST: localhost
-          SMTP_PORT: 1025
-          SMTP_FROM: test@xpeditis.com
-        run: npm run test:integration -- --passWithNoTests

.gitignore

@@ -46,6 +46,7 @@ lerna-debug.log*
 docker-compose.override.yml
 stack-portainer.yaml
 tmp.stack-portainer.yaml
+stack-portainer-preprod.yaml
 
 # Uploads
 uploads/

.trivyignore.yaml

@@ -0,0 +1,22 @@
+# Approved monitoring exceptions, reviewed 2026-09-24. No dependency/secret exclusions.
+misconfigurations:
+  - id: AVD-KSV-0047
+    paths: [infra/prod/k8s/monitoring/03-prometheus.yaml]
+    expired_at: 2026-10-24
+    statement: Prometheus scrapes kubelet cAdvisor through the API server node proxy; retain until direct authenticated kubelet scraping is validated.
+  - id: AVD-KSV-0009
+    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
+    expired_at: 2026-10-24
+    statement: Node exporter observes host network metrics; isolated to the monitoring DaemonSet.
+  - id: AVD-KSV-0010
+    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
+    expired_at: 2026-10-24
+    statement: Node exporter observes host processes; runs as non-root with all capabilities dropped.
+  - id: AVD-KSV-0024
+    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
+    expired_at: 2026-10-24
+    statement: Existing host-network exporter listens on port 9101; access remains constrained by infrastructure firewall rules.
+  - id: AVD-KSV-0121
+    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
+    expired_at: 2026-10-24
+    statement: Host proc/sys/root mounts provide disk and system metrics and are read-only; required for disk-full alerts.

AGENTS.md

@@ -0,0 +1,277 @@
+# AGENTS.md
+
+This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
+
+## Project Overview
+
+**Xpeditis** is a B2B SaaS maritime freight booking platform. Freight forwarders search and compare real-time shipping rates, book containers, and manage shipments. Monorepo with NestJS 10 backend (Hexagonal Architecture) and Next.js 14 frontend.
+
+## Development Commands
+
+All commands run from repo root unless noted otherwise.
+
+```bash
+# Infrastructure (PostgreSQL 15 + Redis 7 + MinIO)
+docker-compose up -d
+
+# Install all dependencies
+npm run install:all
+
+# Environment setup (required on first run)
+cp apps/backend/.env.example apps/backend/.env
+cp apps/frontend/.env.example apps/frontend/.env
+
+# Database migrations (from apps/backend/)
+cd apps/backend && npm run migration:run
+
+# Development servers
+npm run backend:dev    # http://localhost:4000, Swagger: /api/docs
+npm run frontend:dev   # http://localhost:3000
+```
+
+### Testing
+
+```bash
+# Backend (from apps/backend/)
+npm test                                           # Unit tests (Jest)
+npm test -- booking.entity.spec.ts                 # Single file
+npm test -- --testNamePattern="should create"      # Filter by test name
+npm run test:cov                                   # With coverage
+npm run test:integration              # Integration tests (needs DB/Redis, 30s timeout)
+npm run test:e2e                      # E2E tests
+
+# Frontend (from apps/frontend/)
+npm test
+npm run test:e2e                      # Playwright (chromium, firefox, webkit + mobile)
+
+# From root
+npm run backend:test
+npm run frontend:test
+```
+
+Backend test config is in `apps/backend/package.json` (Jest). Integration test config: `apps/backend/jest-integration.json` (covers infrastructure layer, setup in `test/setup-integration.ts`). Frontend E2E config: `apps/frontend/playwright.config.ts`.
+
+### Linting, Formatting & Type Checking
+
+```bash
+npm run backend:lint       # ESLint backend
+npm run frontend:lint      # ESLint frontend
+npm run format             # Prettier (all files)
+npm run format:check       # Check formatting
+# From apps/frontend/
+npm run type-check         # TypeScript checking (frontend only)
+```
+
+### Database Migrations
+
+```bash
+cd apps/backend
+npm run migration:generate -- src/infrastructure/persistence/typeorm/migrations/MigrationName
+npm run migration:run
+npm run migration:revert
+```
+
+### Build
+
+```bash
+npm run backend:build    # NestJS build with tsc-alias for path resolution
+npm run frontend:build   # Next.js production build (standalone output)
+npm run clean            # Remove all node_modules, dist, .next directories
+```
+
+## Local Infrastructure
+
+Docker-compose defaults (no `.env` changes needed for local dev):
+- **PostgreSQL**: `xpeditis:xpeditis_dev_password@localhost:5432/xpeditis_dev`
+- **Redis**: password `xpeditis_redis_password`, port 6379
+- **MinIO** (S3-compatible storage): `minioadmin:minioadmin`, API port 9000, console port 9001
+
+Frontend env var: `NEXT_PUBLIC_API_URL` (defaults to `http://localhost:4000`) — configured in `next.config.js`.
+
+## Architecture
+
+### Hexagonal Architecture (Backend)
+
+```
+apps/backend/src/
+├── domain/           # CORE - Pure TypeScript, NO framework imports
+│   ├── entities/     # Booking, RateQuote, Carrier, Port, Container, Notification, Webhook,
+│   │                 # AuditLog, User, Organization, Subscription, License, CsvBooking,
+│   │                 # CsvRate, InvitationToken
+│   ├── value-objects/ # Money, Email, BookingNumber, BookingStatus, PortCode, ContainerType,
+│   │                  # Volume, DateRange, Surcharge
+│   ├── services/     # Pure domain services (csv-rate-price-calculator)
+│   ├── ports/
+│   │   ├── in/       # Use case interfaces with execute() method
+│   │   └── out/      # Repository/SPI interfaces (token constants like BOOKING_REPOSITORY = 'BookingRepository')
+│   └── exceptions/   # Domain-specific exceptions
+├── application/      # Controllers, DTOs (class-validator), Guards, Decorators, Mappers
+│   ├── [feature]/    # Feature modules: auth/, bookings/, csv-bookings, rates/, ports/,
+│   │                 # organizations/, users/, dashboard/, audit/, notifications/, webhooks/,
+│   │                 # gdpr/, admin/, subscriptions/
+│   ├── controllers/  # REST controllers (also nested under feature folders)
+│   ├── services/     # Application services: audit, notification, webhook,
+│   │                 # booking-automation, export, fuzzy-search, brute-force-protection
+│   ├── gateways/     # WebSocket gateways (notifications.gateway.ts via Socket.IO)
+│   ├── guards/       # JwtAuthGuard, RolesGuard, CustomThrottlerGuard
+│   ├── decorators/   # @Public(), @Roles(), @CurrentUser()
+│   ├── dto/          # Request/response DTOs with class-validator
+│   ├── mappers/      # Domain ↔ DTO mappers
+│   └── interceptors/ # PerformanceMonitoringInterceptor
+└── infrastructure/   # TypeORM entities/repos/mappers, Redis cache, carrier APIs,
+                      # MinIO/S3, email (MJML+Nodemailer), Stripe, Sentry,
+                      # Pappers (French SIRET registry), PDF generation
+```
+
+**Critical dependency rules**:
+- Domain layer: zero imports from NestJS, TypeORM, Redis, or any framework
+- Dependencies flow inward only: Infrastructure → Application → Domain
+- Path aliases: `@domain/*`, `@application/*`, `@infrastructure/*` (defined in `apps/backend/tsconfig.json`)
+- Domain tests run without NestJS TestingModule
+- Backend has strict TypeScript: `strict: true`, `strictNullChecks: true` (but `strictPropertyInitialization: false`)
+- Env vars validated at startup via Joi schema in `app.module.ts` — required vars include DATABASE_*, REDIS_*, JWT_SECRET, SMTP_*
+
+### NestJS Modules (app.module.ts)
+
+Global guards: JwtAuthGuard (all routes protected by default), CustomThrottlerGuard.
+
+Feature modules: Auth, Rates, Ports, Bookings, CsvBookings, Organizations, Users, Dashboard, Audit, Notifications, Webhooks, GDPR, Admin, Subscriptions.
+
+Infrastructure modules: CacheModule, CarrierModule, SecurityModule, CsvRateModule, StripeModule, PdfModule, StorageModule, EmailModule.
+
+Swagger plugin enabled in `nest-cli.json` — DTOs auto-documented. Logging via `nestjs-pino` (pino-pretty in dev).
+
+### Frontend (Next.js 14 App Router)
+
+```
+apps/frontend/
+├── app/              # App Router pages (root-level)
+│   ├── dashboard/    # Protected routes (bookings, admin, settings, wiki, search)
+│   ├── carrier/      # Carrier portal (magic link auth — accept/reject/documents)
+│   ├── booking/      # Booking confirmation/rejection flows
+│   └── [auth pages]  # login, register, forgot-password, verify-email
+└── src/
+    ├── app/          # Additional app pages (e.g. rates/csv-search)
+    ├── components/   # React components (ui/, layout/, bookings/, admin/, rate-search/, organization/)
+    ├── hooks/        # useBookings, useNotifications, useCsvRateSearch, useCompanies, useFilterOptions
+    ├── lib/
+    │   ├── api/      # Fetch-based API client with auto token refresh (client.ts + per-module files)
+    │   ├── context/  # Auth context, cookie context
+    │   ├── providers/ # QueryProvider (TanStack Query / React Query)
+    │   └── fonts.ts  # Manrope (headings) + Montserrat (body)
+    ├── types/        # TypeScript type definitions
+    ├── utils/        # Export utilities (Excel, PDF)
+    └── legacy-pages/ # Archived page components (BookingsManagement, CarrierManagement, CarrierMonitoring)
+```
+
+Path aliases: `@/*` → `./src/*`, `@/components/*`, `@/lib/*`, `@/app/*` → `./app/*`, `@/types/*`, `@/hooks/*`, `@/utils/*`
+
+**Note**: Frontend tsconfig has `strict: false`, `noImplicitAny: false`, `strictNullChecks: false` (unlike backend which is strict). Uses TanStack Query (React Query) for server state — wrap new data fetching in hooks, not bare `fetch` calls.
+
+### Brand Design
+
+Colors: Navy `#10183A` (primary), Turquoise `#34CCCD` (accent), Green `#067224` (success), Gray `#F2F2F2`.
+Fonts: Manrope (headings), Montserrat (body).
+Landing page is in French.
+
+## Key Patterns
+
+### Entity Pattern (Domain)
+Private constructor + static `create()` factory. Immutable — mutation methods return new instances. Some entities also have `fromPersistence()` for reconstitution and `toObject()` for serialization.
+```typescript
+export class Booking {
+  private readonly props: BookingProps;
+  static create(props: Omit<BookingProps, 'bookingNumber' | 'status'>): Booking { ... }
+  updateStatus(newStatus: BookingStatus): Booking { // Returns new instance
+    return new Booking({ ...this.props, status: newStatus });
+  }
+}
+```
+
+### Value Object Pattern
+Immutable, self-validating via static `create()`. E.g. `Money` supports USD, EUR, GBP, CNY, JPY with arithmetic and formatting methods.
+
+### Repository Pattern
+- Interface in `domain/ports/out/` with token constant (e.g. `BOOKING_REPOSITORY = 'BookingRepository'`)
+- Implementation in `infrastructure/persistence/typeorm/repositories/`
+- ORM entities: `infrastructure/persistence/typeorm/entities/*.orm-entity.ts`
+- Separate mapper classes (`infrastructure/persistence/typeorm/mappers/`) with static `toOrm()`, `toDomain()`, `toDomainMany()` methods
+
+### Frontend API Client
+Custom Fetch wrapper in `src/lib/api/client.ts` — exports `get()`, `post()`, `patch()`, `del()`, `upload()`, `download()`. Auto-refreshes JWT on 401. Tokens stored in localStorage **and synced to cookies** (`accessToken` cookie) so Next.js middleware can read them server-side. Per-module files (auth.ts, bookings.ts, rates.ts, etc.) import from client.
+
+### Route Protection (Middleware)
+`apps/frontend/middleware.ts` checks the `accessToken` cookie to protect routes. Public paths are defined in two lists:
+- `exactPublicPaths`: exact matches (e.g. `/`)
+- `prefixPublicPaths`: prefix matches including sub-paths (e.g. `/login`, `/carrier`, `/about`, etc.)
+
+All other routes redirect to `/login?redirect=<pathname>` when the cookie is absent.
+
+### Application Decorators
+- `@Public()` — skip JWT auth
+- `@Roles()` — role-based access control
+- `@CurrentUser()` — inject authenticated user
+
+### API Key Authentication
+A second auth mechanism alongside JWT. `ApiKey` domain entity (`domain/entities/api-key.entity.ts`) — keys are hashed with Argon2. `ApiKeyGuard` in `application/guards/` checks the `x-api-key` header. Routes can accept either JWT or API key; see `admin.controller.ts` for examples.
+
+### WebSocket (Real-time Notifications)
+Socket.IO gateway at `application/gateways/notifications.gateway.ts`. Clients connect to `/` namespace with a JWT bearer token in the handshake auth. Server emits `notification` events. The frontend `useNotifications` hook handles subscriptions.
+
+### Carrier Connectors
+Five carrier connectors (Maersk, MSC, CMA CGM, Hapag-Lloyd, ONE) extending `base-carrier.connector.ts`, each with request/response mappers. Circuit breaker via `opossum` (5s timeout).
+
+### Caching
+Redis with 15-min TTL for rate quotes. Key format: `rate:{origin}:{destination}:{containerType}`.
+
+## Business Rules
+
+- Booking number format: `WCM-YYYY-XXXXXX`
+- Booking status flow: draft → confirmed → shipped → delivered
+- Rate quotes expire after 15 minutes
+- Multi-currency: USD, EUR, GBP, CNY, JPY
+- RBAC Roles: ADMIN, MANAGER, USER, VIEWER, CARRIER
+- JWT: access token 15min, refresh token 7d
+- Password hashing: Argon2
+- OAuth providers: Google, Microsoft (configured via passport strategies)
+- Organizations can be validated via Pappers API (French SIRET/company registry) at `infrastructure/external/pappers-siret.adapter.ts`
+
+### Carrier Portal Workflow
+1. Admin creates CSV booking → assigns carrier
+2. Email with magic link sent (1-hour expiry)
+3. Carrier auto-login → accept/reject booking
+4. Activity logged in `carrier_activities` table (via `CarrierProfile` + `CarrierActivity` ORM entities)
+
+## Common Pitfalls
+
+- Never import NestJS/TypeORM in domain layer
+- Never use `any` type in backend (strict mode enabled)
+- Never modify applied migrations — create new ones
+- Always validate DTOs with `class-validator` decorators
+- Always create separate mappers for Domain ↔ ORM conversions
+- ORM entity files must match pattern `*.orm-entity.{ts,js}` (auto-discovered by data-source)
+- Migration files must be in `infrastructure/persistence/typeorm/migrations/`
+- Database synchronize is hard-coded to `false` — always use migrations
+
+## Adding a New Feature
+
+1. **Domain Entity** → `domain/entities/*.entity.ts` (pure TS, unit tests)
+2. **Value Objects** → `domain/value-objects/*.vo.ts` (immutable)
+3. **In Port (Use Case)** → `domain/ports/in/*.use-case.ts` (interface with `execute()`)
+4. **Out Port (Repository)** → `domain/ports/out/*.repository.ts` (with token constant)
+5. **ORM Entity** → `infrastructure/persistence/typeorm/entities/*.orm-entity.ts`
+6. **Migration** → `npm run migration:generate -- src/infrastructure/persistence/typeorm/migrations/MigrationName`
+7. **Repository Impl** → `infrastructure/persistence/typeorm/repositories/`
+8. **Mapper** → `infrastructure/persistence/typeorm/mappers/` (static toOrm/toDomain/toDomainMany)
+9. **DTOs** → `application/dto/` (with class-validator decorators)
+10. **Controller** → `application/controllers/` (with Swagger decorators)
+11. **Module** → Register repository + use-case providers, import in `app.module.ts`
+
+## Documentation
+
+- API Docs: http://localhost:4000/api/docs (Swagger, when running)
+- Setup guide: `docs/installation/START-HERE.md`
+- Carrier Portal API: `apps/backend/docs/CARRIER_PORTAL_API.md`
+- Full docs index: `docs/README.md`
+- Development roadmap: `TODO.md`
+- Infrastructure configs (CI/CD, Docker): `infra/`

INDEX.md

@@ -1,348 +1,81 @@
-# 📑 Xpeditis Documentation Index
-
-Complete guide to all documentation files in the Xpeditis project.
+# Index de documentation — Xpeditis
 
 ---
 
-## 🚀 Getting Started (Read First)
+## Démarrage
 
-Start here if you're new to the project:
-
-1. **[README.md](README.md)** - Project overview and quick start
-2. **[QUICK-START.md](QUICK-START.md)** ⚡ - Get running in 5 minutes
-3. **[INSTALLATION-STEPS.md](INSTALLATION-STEPS.md)** - Detailed installation guide
-4. **[NEXT-STEPS.md](NEXT-STEPS.md)** - What to do after setup
+| Fichier | Description |
+|---------|-------------|
+| [README.md](README.md) | Vue d'ensemble du projet |
+| [QUICK-START.md](QUICK-START.md) | Démarrage en 5 minutes |
+| [CLAUDE.md](CLAUDE.md) | Architecture hexagonale, conventions, règles |
+| [docs/README.md](docs/README.md) | Index complet de la documentation |
 
 ---
 
-## 📊 Project Status & Planning
+## Documentation complète
 
-### Sprint 0 (Complete ✅)
+Toute la documentation est organisée dans [docs/](docs/) :
 
-- **[SPRINT-0-FINAL.md](SPRINT-0-FINAL.md)** - Complete Sprint 0 report
-  - All deliverables
-  - Architecture details
-  - How to use
-  - Success criteria
-
-- **[SPRINT-0-SUMMARY.md](SPRINT-0-SUMMARY.md)** - Executive summary
-  - Objectives achieved
-  - Metrics
-  - Key features
-  - Next steps
-
-- **[SPRINT-0-COMPLETE.md](SPRINT-0-COMPLETE.md)** - Technical completion checklist
-  - Week-by-week breakdown
-  - Files created
-  - Remaining tasks
-
-### Project Roadmap
-
-- **[TODO.md](TODO.md)** 📅 - 30-week MVP development roadmap
-  - Sprint-by-sprint breakdown
-  - Detailed tasks with checkboxes
-  - Phase 1-4 planning
-  - Go-to-market strategy
-
-- **[PRD.md](PRD.md)** 📋 - Product Requirements Document
-  - Business context
-  - Functional specifications
-  - Technical requirements
-  - Success metrics
+```
+docs/
+├── README.md                    # Index principal
+├── getting-started/             # Installation et démarrage
+│   ├── quick-start.md           # Guide rapide mis à jour
+│   ├── installation.md          # Installation détaillée
+│   └── windows.md               # Spécifique Windows
+│
+├── architecture/                # Documentation technique
+│   ├── overview.md              # Vue d'ensemble système
+│   ├── database.md              # Schéma BDD complet (21 tables)
+│   ├── backend.md               # NestJS hexagonal, patterns
+│   └── frontend.md              # Next.js 14, App Router, i18n
+│
+├── features/                    # Documentation par fonctionnalité
+│   ├── auth.md                  # Auth JWT/OAuth/API Keys + RBAC
+│   ├── bookings.md              # Réservations standard
+│   ├── csv-bookings.md          # CSV bookings + portail carrier
+│   ├── rate-search.md           # Recherche tarifs FCL + CSV
+│   ├── subscriptions.md         # Stripe + abonnements
+│   ├── notifications.md         # WebSocket + webhooks
+│   └── api-access.md            # Clés API
+│
+├── deployment/                  # Déploiement
+│   ├── portainer.md             # Portainer / Docker Swarm (consolidé)
+│   ├── hetzner/                 # Kubernetes Hetzner (15 fichiers numérotés)
+│   └── STRIPE_SETUP.md          # Configuration Stripe
+│
+├── testing/                     # Tests
+├── csv-system/                  # Système CSV (format, calcul prix)
+├── carrier-portal/              # Portail carrier (recherche API)
+├── api-access/                  # Documentation accès API
+├── backend/                     # Notes backend (cleanup, MinIO)
+└── archive/                     # Rapports de sprint archivés
+    ├── phases/                  # Historique phases 1-4
+    └── debug/                   # Notes de debug résolues
+```
 
 ---
 
-## 🏗️ Architecture & Development Guidelines
+## Commandes essentielles
 
-### Core Architecture
+```bash
+# Démarrer
+docker-compose up -d
+npm run install:all
+cd apps/backend && npm run migration:run && cd ../..
+npm run backend:dev    # http://localhost:4000
+npm run frontend:dev   # http://localhost:3000
 
-- **[CLAUDE.md](CLAUDE.md)** 🏗️ - **START HERE FOR ARCHITECTURE**
-  - Complete hexagonal architecture guide
-  - Domain/Application/Infrastructure layers
-  - Ports & Adapters pattern
-  - Naming conventions
-  - Testing strategy
-  - Common pitfalls
-  - Complete examples (476 lines)
+# Tests
+npm run backend:test
+npm run frontend:test
 
-### Component-Specific Documentation
-
-- **[apps/backend/README.md](apps/backend/README.md)** - Backend (NestJS + Hexagonal)
-  - Architecture details
-  - Available scripts
-  - API endpoints
-  - Testing guide
-  - Hexagonal architecture DOs and DON'Ts
-
-- **[apps/frontend/README.md](apps/frontend/README.md)** - Frontend (Next.js 14)
-  - Tech stack
-  - Project structure
-  - API integration
-  - Forms & validation
-  - Testing guide
+# Qualité
+npm run format
+npm run backend:lint && npm run frontend:lint
+```
 
 ---
 
-## 🛠️ Technical Documentation
-
-### Configuration Files
-
-**Root Level**:
-- `package.json` - Workspace configuration
-- `.gitignore` - Git ignore rules
-- `.prettierrc` - Code formatting
-- `docker-compose.yml` - PostgreSQL + Redis
-- `tsconfig.json` - TypeScript configuration (per app)
-
-**Backend** (`apps/backend/`):
-- `package.json` - Backend dependencies
-- `tsconfig.json` - TypeScript strict mode + path aliases
-- `nest-cli.json` - NestJS CLI configuration
-- `.eslintrc.js` - ESLint rules
-- `.env.example` - Environment variables template
-
-**Frontend** (`apps/frontend/`):
-- `package.json` - Frontend dependencies
-- `tsconfig.json` - TypeScript configuration
-- `next.config.js` - Next.js configuration
-- `tailwind.config.ts` - Tailwind CSS theme
-- `postcss.config.js` - PostCSS configuration
-- `.env.example` - Environment variables template
-
-### CI/CD
-
-**GitHub Actions** (`.github/workflows/`):
-- `ci.yml` - Continuous Integration
-  - Lint & format check
-  - Unit tests (backend + frontend)
-  - E2E tests
-  - Build verification
-
-- `security.yml` - Security Audit
-  - npm audit
-  - Dependency review
-
-**Templates**:
-- `.github/pull_request_template.md` - PR template with hexagonal architecture checklist
-
----
-
-## 📚 Documentation by Use Case
-
-### I want to...
-
-**...get started quickly**
-1. [QUICK-START.md](QUICK-START.md) - 5-minute setup
-2. [INSTALLATION-STEPS.md](INSTALLATION-STEPS.md) - Detailed steps
-3. [NEXT-STEPS.md](NEXT-STEPS.md) - Begin development
-
-**...understand the architecture**
-1. [CLAUDE.md](CLAUDE.md) - Complete hexagonal architecture guide
-2. [apps/backend/README.md](apps/backend/README.md) - Backend specifics
-3. [SPRINT-0-FINAL.md](SPRINT-0-FINAL.md) - See what's implemented
-
-**...know what to build next**
-1. [TODO.md](TODO.md) - Full roadmap
-2. [NEXT-STEPS.md](NEXT-STEPS.md) - Immediate next tasks
-3. [PRD.md](PRD.md) - Business requirements
-
-**...understand the business context**
-1. [PRD.md](PRD.md) - Product requirements
-2. [README.md](README.md) - Project overview
-3. [SPRINT-0-SUMMARY.md](SPRINT-0-SUMMARY.md) - Executive summary
-
-**...fix an installation issue**
-1. [INSTALLATION-STEPS.md](INSTALLATION-STEPS.md) - Troubleshooting section
-2. [QUICK-START.md](QUICK-START.md) - Common issues
-3. [README.md](README.md) - Basic setup
-
-**...write code following best practices**
-1. [CLAUDE.md](CLAUDE.md) - Architecture guidelines (READ THIS FIRST)
-2. [apps/backend/README.md](apps/backend/README.md) - Backend DOs and DON'Ts
-3. [TODO.md](TODO.md) - Task specifications and acceptance criteria
-
-**...run tests**
-1. [apps/backend/README.md](apps/backend/README.md) - Testing section
-2. [apps/frontend/README.md](apps/frontend/README.md) - Testing section
-3. [CLAUDE.md](CLAUDE.md) - Testing strategy
-
-**...deploy to production**
-1. [SPRINT-0-FINAL.md](SPRINT-0-FINAL.md) - Security checklist
-2. [apps/backend/.env.example](apps/backend/.env.example) - All required variables
-3. `.github/workflows/ci.yml` - CI/CD pipeline
-
----
-
-## 📖 Documentation by Role
-
-### For Developers
-
-**Must Read**:
-1. [CLAUDE.md](CLAUDE.md) - Architecture principles
-2. [apps/backend/README.md](apps/backend/README.md) OR [apps/frontend/README.md](apps/frontend/README.md)
-3. [TODO.md](TODO.md) - Current sprint tasks
-
-**Reference**:
-- [INSTALLATION-STEPS.md](INSTALLATION-STEPS.md) - Setup issues
-- [PRD.md](PRD.md) - Business context
-
-### For Architects
-
-**Must Read**:
-1. [CLAUDE.md](CLAUDE.md) - Complete architecture
-2. [SPRINT-0-FINAL.md](SPRINT-0-FINAL.md) - Implementation details
-3. [PRD.md](PRD.md) - Technical requirements
-
-**Reference**:
-- [TODO.md](TODO.md) - Technical roadmap
-- [apps/backend/README.md](apps/backend/README.md) - Backend architecture
-
-### For Project Managers
-
-**Must Read**:
-1. [SPRINT-0-SUMMARY.md](SPRINT-0-SUMMARY.md) - Status overview
-2. [TODO.md](TODO.md) - Complete roadmap
-3. [PRD.md](PRD.md) - Requirements & KPIs
-
-**Reference**:
-- [SPRINT-0-FINAL.md](SPRINT-0-FINAL.md) - Detailed completion report
-- [README.md](README.md) - Project overview
-
-### For DevOps
-
-**Must Read**:
-1. [INSTALLATION-STEPS.md](INSTALLATION-STEPS.md) - Setup guide
-2. [docker-compose.yml](docker-compose.yml) - Infrastructure
-3. `.github/workflows/` - CI/CD pipelines
-
-**Reference**:
-- [apps/backend/.env.example](apps/backend/.env.example) - Environment variables
-- [SPRINT-0-FINAL.md](SPRINT-0-FINAL.md) - Security checklist
-
----
-
-## 🗂️ Complete File List
-
-### Documentation (11 files)
-
-| File | Purpose | Length |
-|------|---------|--------|
-| [README.md](README.md) | Project overview | Medium |
-| [CLAUDE.md](CLAUDE.md) | Architecture guide | Long (476 lines) |
-| [PRD.md](PRD.md) | Product requirements | Long (352 lines) |
-| [TODO.md](TODO.md) | 30-week roadmap | Very Long (1000+ lines) |
-| [QUICK-START.md](QUICK-START.md) | 5-minute setup | Short |
-| [INSTALLATION-STEPS.md](INSTALLATION-STEPS.md) | Detailed setup | Medium |
-| [NEXT-STEPS.md](NEXT-STEPS.md) | What's next | Medium |
-| [SPRINT-0-FINAL.md](SPRINT-0-FINAL.md) | Sprint 0 report | Long |
-| [SPRINT-0-SUMMARY.md](SPRINT-0-SUMMARY.md) | Executive summary | Medium |
-| [SPRINT-0-COMPLETE.md](SPRINT-0-COMPLETE.md) | Technical checklist | Short |
-| [INDEX.md](INDEX.md) | This file | Medium |
-
-### App-Specific (2 files)
-
-| File | Purpose |
-|------|---------|
-| [apps/backend/README.md](apps/backend/README.md) | Backend guide |
-| [apps/frontend/README.md](apps/frontend/README.md) | Frontend guide |
-
-### Configuration (10+ files)
-
-Root, backend, and frontend configuration files (package.json, tsconfig.json, etc.)
-
----
-
-## 📊 Documentation Statistics
-
-- **Total Documentation Files**: 13
-- **Total Lines**: ~4,000+
-- **Coverage**: Setup, Architecture, Development, Testing, Deployment
-- **Last Updated**: October 7, 2025
-
----
-
-## 🎯 Recommended Reading Path
-
-### For New Team Members (Day 1)
-
-**Morning** (2 hours):
-1. [README.md](README.md) - 10 min
-2. [QUICK-START.md](QUICK-START.md) - 30 min (includes setup)
-3. [CLAUDE.md](CLAUDE.md) - 60 min (comprehensive architecture)
-4. [PRD.md](PRD.md) - 20 min (business context)
-
-**Afternoon** (2 hours):
-5. [apps/backend/README.md](apps/backend/README.md) OR [apps/frontend/README.md](apps/frontend/README.md) - 30 min
-6. [TODO.md](TODO.md) - Current sprint section - 30 min
-7. [NEXT-STEPS.md](NEXT-STEPS.md) - 30 min
-8. Start coding! 🚀
-
-### For Code Review (30 minutes)
-
-1. [CLAUDE.md](CLAUDE.md) - Hexagonal architecture section
-2. [apps/backend/README.md](apps/backend/README.md) - DOs and DON'Ts
-3. [TODO.md](TODO.md) - Acceptance criteria for the feature
-
-### For Sprint Planning (1 hour)
-
-1. [TODO.md](TODO.md) - Next sprint tasks
-2. [PRD.md](PRD.md) - Requirements for the module
-3. [SPRINT-0-SUMMARY.md](SPRINT-0-SUMMARY.md) - Current status
-
----
-
-## 🔍 Quick Reference
-
-### Common Questions
-
-**Q: How do I get started?**
-A: [QUICK-START.md](QUICK-START.md)
-
-**Q: What is hexagonal architecture?**
-A: [CLAUDE.md](CLAUDE.md) - Complete guide with examples
-
-**Q: What should I build next?**
-A: [NEXT-STEPS.md](NEXT-STEPS.md) then [TODO.md](TODO.md)
-
-**Q: How do I run tests?**
-A: [apps/backend/README.md](apps/backend/README.md) or [apps/frontend/README.md](apps/frontend/README.md)
-
-**Q: Where are the business requirements?**
-A: [PRD.md](PRD.md)
-
-**Q: What's the project status?**
-A: [SPRINT-0-SUMMARY.md](SPRINT-0-SUMMARY.md)
-
-**Q: Installation failed, what do I do?**
-A: [INSTALLATION-STEPS.md](INSTALLATION-STEPS.md) - Troubleshooting section
-
-**Q: Can I change the database/framework?**
-A: Yes! That's the point of hexagonal architecture. See [CLAUDE.md](CLAUDE.md)
-
----
-
-## 📞 Getting Help
-
-If you can't find what you need:
-
-1. **Check this index** - Use Ctrl+F to search
-2. **Read CLAUDE.md** - Covers 90% of architecture questions
-3. **Check TODO.md** - Has detailed task specifications
-4. **Open an issue** - If documentation is unclear or missing
-
----
-
-## 🎉 Happy Reading!
-
-All documentation is up-to-date as of Sprint 0 completion.
-
-**Quick Links**:
-- 🚀 [Get Started](QUICK-START.md)
-- 🏗️ [Architecture](CLAUDE.md)
-- 📅 [Roadmap](TODO.md)
-- 📋 [Requirements](PRD.md)
-
----
-
-*Xpeditis MVP - Maritime Freight Booking Platform*
-*Documentation Index - October 7, 2025*
+*Dernière mise à jour : Mai 2026*

README.md

@@ -1,206 +1,151 @@
-# Xpeditis - Maritime Freight Booking Platform
+# Xpeditis — Maritime Freight Booking Platform
 
-**Xpeditis** is a B2B SaaS platform for freight forwarders to search, compare, and book maritime freight in real-time.
+Plateforme B2B SaaS permettant aux transitaires de rechercher, comparer et réserver du fret maritime en temps réel.
 
 ---
 
-## ⭐ **[START HERE](START-HERE.md)** ⭐
-
-**New to the project?** Read **[START-HERE.md](START-HERE.md)** - Get running in 10 minutes!
-
----
-
-## 🚀 Quick Start
-
-### Prerequisites
-
-- Node.js >= 20.0.0
-- npm >= 10.0.0
-- Docker & Docker Compose
-- PostgreSQL 15+
-- Redis 7+
-
-### Installation
+## Démarrage rapide
 
 ```bash
-# Install dependencies
-npm install
+# 1. Installer les dépendances
+npm run install:all
 
-# Start infrastructure (PostgreSQL + Redis)
+# 2. Démarrer l'infrastructure (PostgreSQL + Redis + MinIO)
 docker-compose up -d
 
-# Setup environment variables
+# 3. Configurer l'environnement
 cp apps/backend/.env.example apps/backend/.env
-cp apps/frontend/.env.example apps/frontend/.env
+cp apps/frontend/.env.example apps/frontend/.env.local
 
-# Run database migrations
-npm run backend:migrate
+# 4. Exécuter les migrations
+cd apps/backend && npm run migration:run && cd ../..
 
-# Start backend (development)
-npm run backend:dev
-
-# Start frontend (development)
-npm run frontend:dev
+# 5. Démarrer les serveurs
+npm run backend:dev    # http://localhost:4000 · Swagger: /api/docs
+npm run frontend:dev   # http://localhost:3000
 ```
 
-### Access Points
+---
 
-- **Frontend**: http://localhost:3000
-- **Backend API**: http://localhost:4000
-- **API Documentation**: http://localhost:4000/api/docs
-
-## 📁 Project Structure
+## Structure du projet
 
 ```
 xpeditis/
 ├── apps/
-│   ├── backend/          # NestJS API (Hexagonal Architecture)
+│   ├── backend/          # NestJS 10 — Architecture hexagonale
 │   │   └── src/
-│   │       ├── domain/          # Pure business logic
-│   │       ├── application/     # Controllers & DTOs
-│   │       └── infrastructure/  # External adapters
+│   │       ├── domain/          # Logique métier pure (TypeScript)
+│   │       ├── application/     # Controllers, DTOs, Guards
+│   │       └── infrastructure/  # TypeORM, Redis, S3, Email, Stripe
 │   └── frontend/         # Next.js 14 App Router
-├── packages/
-│   ├── shared-types/     # Shared TypeScript types
-│   └── domain/           # Shared domain logic
-└── infra/                # Infrastructure configs
+│       ├── app/[locale]/        # Routing i18n (fr, en)
+│       └── src/                 # Components, hooks, lib/api
+├── docker-compose.yml    # PostgreSQL 15 + Redis 7 + MinIO
+└── docs/                 # Documentation complète
 ```
 
-## 🏗️ Architecture
-
-This project follows **Hexagonal Architecture** (Ports & Adapters) principles:
-
-- **Domain Layer**: Pure business logic, no external dependencies
-- **Application Layer**: Use cases, controllers, DTOs
-- **Infrastructure Layer**: Database, external APIs, cache, email, storage
-
-See [CLAUDE.md](CLAUDE.md) for detailed architecture guidelines.
-
-## 🛠️ Development
-
-### Backend
-
-```bash
-npm run backend:dev          # Start dev server
-npm run backend:test         # Run tests
-npm run backend:test:watch   # Run tests in watch mode
-npm run backend:test:cov     # Generate coverage report
-npm run backend:lint         # Lint code
-npm run backend:build        # Build for production
-```
-
-### Frontend
-
-```bash
-npm run frontend:dev         # Start dev server
-npm run frontend:build       # Build for production
-npm run frontend:test        # Run tests
-npm run frontend:lint        # Lint code
-```
-
-## 📚 Documentation
-
-### Getting Started
-- **[QUICK-START.md](QUICK-START.md)** ⚡ - Get running in 5 minutes
-- **[INSTALLATION-STEPS.md](INSTALLATION-STEPS.md)** 📦 - Detailed installation guide
-- **[NEXT-STEPS.md](NEXT-STEPS.md)** 🚀 - What to do after setup
-
-### Architecture & Guidelines
-- **[CLAUDE.md](CLAUDE.md)** 🏗️ - Hexagonal architecture guidelines (complete)
-- **[apps/backend/README.md](apps/backend/README.md)** - Backend documentation
-- **[apps/frontend/README.md](apps/frontend/README.md)** - Frontend documentation
-
-### Project Planning
-- **[PRD.md](PRD.md)** 📋 - Product Requirements Document
-- **[TODO.md](TODO.md)** 📅 - 30-week development roadmap
-- **[SPRINT-0-FINAL.md](SPRINT-0-FINAL.md)** ✅ - Sprint 0 completion report
-- **[SPRINT-0-SUMMARY.md](SPRINT-0-SUMMARY.md)** 📊 - Executive summary
-
-### API Documentation
-- **[API Docs](http://localhost:4000/api/docs)** 📖 - OpenAPI/Swagger (when running)
-
-## 🧪 Testing
-
-```bash
-# Run all tests
-npm run test:all
-
-# Run backend tests
-npm run backend:test
-
-# Run frontend tests
-npm run frontend:test
-
-# E2E tests (after implementation)
-npm run test:e2e
-```
-
-## 🔒 Security
-
-- All passwords hashed with bcrypt (12 rounds minimum)
-- JWT tokens (access: 15min, refresh: 7 days)
-- HTTPS/TLS 1.2+ enforced
-- OWASP Top 10 protection
-- Rate limiting on all endpoints
-- CSRF protection
-
-## 📊 Tech Stack
-
-### Backend
-- **Framework**: NestJS 10+
-- **Language**: TypeScript 5+
-- **Database**: PostgreSQL 15+
-- **Cache**: Redis 7+
-- **ORM**: TypeORM
-- **Testing**: Jest, Supertest
-- **API Docs**: Swagger/OpenAPI
-
-### Frontend
-- **Framework**: Next.js 14+ (App Router)
-- **Language**: TypeScript 5+
-- **Styling**: Tailwind CSS
-- **UI Components**: shadcn/ui
-- **State**: React Query (TanStack Query)
-- **Forms**: React Hook Form + Zod
-- **Testing**: Jest, React Testing Library, Playwright
-
-## 🚢 Carrier Integrations
-
-MVP supports the following maritime carriers:
-
-- ✅ Maersk
-- ✅ MSC
-- ✅ CMA CGM
-- ✅ Hapag-Lloyd
-- ✅ ONE (Ocean Network Express)
-
-## 📈 Monitoring & Logging
-
-- **Logging**: Winston / Pino
-- **Error Tracking**: Sentry
-- **APM**: Application Performance Monitoring
-- **Metrics**: Prometheus (planned)
-
-## 🔧 Environment Variables
-
-See `.env.example` files in each app for required environment variables.
-
-## 🤝 Contributing
-
-1. Create a feature branch
-2. Make your changes
-3. Write tests
-4. Run linting and formatting
-5. Submit a pull request
-
-## 📝 License
-
-Proprietary - All rights reserved
-
-## 👥 Team
-
-Built with ❤️ by the Xpeditis team
-
 ---
 
-For detailed implementation guidelines, see [CLAUDE.md](CLAUDE.md).
+## Documentation
+
+| Sujet | Fichier |
+|-------|---------|
+| Index complet | [docs/README.md](docs/README.md) |
+| Architecture hexagonale + conventions | [CLAUDE.md](CLAUDE.md) |
+| Vue d'ensemble système | [docs/architecture/overview.md](docs/architecture/overview.md) |
+| Schéma BDD (21 tables) | [docs/architecture/database.md](docs/architecture/database.md) |
+| Démarrage rapide | [docs/getting-started/quick-start.md](docs/getting-started/quick-start.md) |
+
+---
+
+## Commandes de développement
+
+```bash
+# Backend
+npm run backend:dev       # Serveur avec hot-reload
+npm run backend:test      # Tests unitaires Jest
+npm run backend:lint      # ESLint
+npm run backend:build     # Build production
+
+# Frontend
+npm run frontend:dev      # Serveur avec hot-reload
+npm run frontend:test     # Tests unitaires Jest
+npm run frontend:lint     # ESLint
+cd apps/frontend && npm run test:e2e  # Playwright E2E
+
+# Qualité
+npm run format            # Prettier (tous les fichiers)
+
+# Base de données
+cd apps/backend
+npm run migration:generate -- src/infrastructure/persistence/typeorm/migrations/NomMigration
+npm run migration:run
+npm run migration:revert
+```
+
+---
+
+## Stack technique
+
+### Backend
+
+| Composant | Technologie |
+|-----------|-------------|
+| Framework | NestJS 10 + TypeScript 5 (strict) |
+| Base de données | PostgreSQL 15 + TypeORM |
+| Cache | Redis 7 (ioredis) |
+| Auth | JWT (15min) + Refresh + OAuth2 + API Keys (Argon2) |
+| Temps réel | Socket.IO |
+| Email | Nodemailer + MJML |
+| Paiements | Stripe |
+| Stockage | S3/MinIO |
+| Logging | nestjs-pino |
+| Monitoring | Sentry |
+
+### Frontend
+
+| Composant | Technologie |
+|-----------|-------------|
+| Framework | Next.js 14 App Router + TypeScript |
+| Styling | Tailwind CSS + shadcn/ui (Radix UI) |
+| State serveur | TanStack Query v5 |
+| Tables | TanStack Table v8 + Virtual |
+| Formulaires | react-hook-form + zod |
+| Temps réel | Socket.IO client |
+| i18n | next-intl (fr, en) |
+| Graphiques | recharts |
+
+---
+
+## Carriers intégrés
+
+| Carrier | Code | Statut |
+|---------|------|--------|
+| Maersk | MAEU | Connecteur API |
+| MSC | MSCU | Connecteur API |
+| CMA CGM | CMDU | Connecteur API |
+| Hapag-Lloyd | HLCU | Connecteur API |
+| ONE | ONEY | Connecteur API |
+| SSC Consolidation | — | CSV |
+| ECU Worldwide | — | CSV + API |
+| TCC Logistics | — | CSV |
+| NVO Consolidation | — | CSV |
+
+---
+
+## Fonctionnalités principales
+
+- **Recherche tarifs** : FCL (carriers API + cache Redis 15min) + LCL CSV
+- **Réservation standard** : workflow 4 étapes, numéro WCM-YYYY-XXXXXX
+- **Réservation CSV + Portail Carrier** : magic link, accept/reject
+- **Dashboard** : KPI, graphiques, table interactive virtuelle
+- **Auth** : JWT, OAuth2 (Google/Microsoft), API Keys, RBAC (5 rôles)
+- **Abonnements** : Stripe (FREE/BRONZE/SILVER/GOLD/PLATINIUM)
+- **Notifications** : WebSocket temps réel + webhooks tiers
+- **GDPR** : export/suppression des données utilisateur
+- **Blog** : gestion de contenu bilingue (fr/en)
+- **Audit** : journal d'audit de toutes les actions
+
+---
+
+*Architecture hexagonale — NestJS 10 + Next.js 14 — PostgreSQL 15 + Redis 7*

apps/backend/.dockerignore

@@ -24,6 +24,7 @@ e2e
 
 # Environment files
 .env
+.env.*
 .env.local
 .env.development
 .env.test

apps/backend/.env.example

@@ -18,11 +18,19 @@ REDIS_PORT=6379
 REDIS_PASSWORD=xpeditis_redis_password
 REDIS_DB=0
 
-# JWT
+# JWT (JWT_SECRET must be at least 32 characters)
 JWT_SECRET=your-super-secret-jwt-key-change-this-in-production
 JWT_ACCESS_EXPIRATION=15m
 JWT_REFRESH_EXPIRATION=7d
 
+# Auth cookies — domain shared between frontend and API in production
+# (e.g. .xpeditis.com). Leave unset for localhost development.
+# COOKIE_DOMAIN=.xpeditis.com
+
+# Secret used to derive carrier document passwords (min 16 chars).
+# Falls back to JWT_SECRET when unset.
+# DOCUMENT_PASSWORD_SECRET=your-document-password-secret
+
 # OAuth2 - Google
 GOOGLE_CLIENT_ID=your-google-client-id
 GOOGLE_CLIENT_SECRET=your-google-client-secret
@@ -35,51 +43,27 @@ MICROSOFT_CALLBACK_URL=http://localhost:4000/api/v1/auth/microsoft/callback
 
 # Application URL
 APP_URL=http://localhost:3000
+FRONTEND_URL=http://localhost:3000
 
 # Email (SMTP)
-  SMTP_HOST=smtp-relay.brevo.com
-  SMTP_PORT=587
-  SMTP_USER=ton-email@brevo.com
-  SMTP_PASS=ta-cle-smtp-brevo
-  SMTP_SECURE=false
-
-# SMTP_FROM devient le fallback uniquement (chaque méthode a son propre from maintenant)
-  SMTP_FROM=noreply@xpeditis.com
+SMTP_HOST=smtp-relay.brevo.com
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+SMTP_SECURE=false
+SMTP_FROM=noreply@xpeditis.com
 
 # AWS S3 / Storage (or MinIO for development)
-AWS_ACCESS_KEY_ID=your-aws-access-key
-AWS_SECRET_ACCESS_KEY=your-aws-secret-key
+AWS_ACCESS_KEY_ID=minioadmin
+AWS_SECRET_ACCESS_KEY=minioadmin
 AWS_REGION=us-east-1
 AWS_S3_ENDPOINT=http://localhost:9000
 # AWS_S3_ENDPOINT=  # Leave empty for AWS S3
 
-# Carrier APIs
-# Maersk
-MAERSK_API_KEY=your-maersk-api-key
-MAERSK_API_URL=https://api.maersk.com/v1
 
-# MSC
-MSC_API_KEY=your-msc-api-key
-MSC_API_URL=https://api.msc.com/v1
-
-# CMA CGM
-CMACGM_API_URL=https://api.cma-cgm.com/v1
-CMACGM_CLIENT_ID=your-cmacgm-client-id
-CMACGM_CLIENT_SECRET=your-cmacgm-client-secret
-
-# Hapag-Lloyd
-HAPAG_API_URL=https://api.hapag-lloyd.com/v1
-HAPAG_API_KEY=your-hapag-api-key
-
-# ONE (Ocean Network Express)
-ONE_API_URL=https://api.one-line.com/v1
-ONE_USERNAME=your-one-username
-ONE_PASSWORD=your-one-password
-
-# Swagger Documentation Access (HTTP Basic Auth)
-# Leave empty to disable Swagger in production, or set both to protect with a password
-SWAGGER_USERNAME=admin
-SWAGGER_PASSWORD=change-this-strong-password
+# Swagger Documentation Access (HTTP Basic Auth — only you can access /api/docs)
+SWAGGER_USERNAME=
+SWAGGER_PASSWORD=
 
 # Security
 BCRYPT_ROUNDS=12
@@ -92,17 +76,42 @@ RATE_LIMIT_MAX=100
 # Monitoring
 SENTRY_DSN=your-sentry-dsn
 
+
 # Frontend URL (for redirects)
 FRONTEND_URL=http://localhost:3000
 
 # Stripe (Subscriptions & Payments)
-STRIPE_SECRET_KEY=sk_test_your_stripe_secret_key
-STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
 
-# Stripe Price IDs (create these in Stripe Dashboard)
-STRIPE_SILVER_MONTHLY_PRICE_ID=price_silver_monthly
-STRIPE_SILVER_YEARLY_PRICE_ID=price_silver_yearly
-STRIPE_GOLD_MONTHLY_PRICE_ID=price_gold_monthly
-STRIPE_GOLD_YEARLY_PRICE_ID=price_gold_yearly
-STRIPE_PLATINIUM_MONTHLY_PRICE_ID=price_platinium_monthly
-STRIPE_PLATINIUM_YEARLY_PRICE_ID=price_platinium_yearly
+# Stripe Price IDs (from Stripe Dashboard)
+STRIPE_SILVER_MONTHLY_PRICE_ID=
+STRIPE_SILVER_YEARLY_PRICE_ID=
+STRIPE_GOLD_MONTHLY_PRICE_ID=
+STRIPE_GOLD_YEARLY_PRICE_ID=
+STRIPE_PLATINIUM_MONTHLY_PRICE_ID=
+STRIPE_PLATINIUM_YEARLY_PRICE_ID=
+
+# Premier administrateur (amorcage) - migration BootstrapAdminFromEnv
+# En developpement, laissez vide : SeedTestUsers cree deja admin@xpeditis.com.
+# En production, renseignez une adresse RELEVABLE : le compte est cree sans
+# mot de passe utilisable et vous definissez le votre via "mot de passe oublie".
+# BOOTSTRAP_ADMIN_EMAIL=
+# BOOTSTRAP_ADMIN_FIRST_NAME=Admin
+# BOOTSTRAP_ADMIN_LAST_NAME=Xpeditis
+# BOOTSTRAP_ADMIN_ORG_NAME=Xpeditis
+# BOOTSTRAP_ADMIN_ORG_STREET=A completer
+# BOOTSTRAP_ADMIN_ORG_CITY=A completer
+# BOOTSTRAP_ADMIN_ORG_POSTAL_CODE=00000
+# BOOTSTRAP_ADMIN_ORG_COUNTRY=FR
+# Facultatif : hash Argon2id, si SMTP n'est pas encore operationnel.
+# Generer avec : node scripts/setup/generate-admin-hash.js
+# Jamais un mot de passe en clair - la migration le refuse.
+# BOOTSTRAP_ADMIN_PASSWORD_HASH=
+
+# Force la neutralisation des comptes de demonstration hors production.
+# FORCE_NEUTRALIZE_SEED_ACCOUNTS=true
+
+# Trade assistant — server only. Empty key enables guided help only.
+OPENAI_API_KEY=
+OPENAI_MODEL=gpt-4.1-mini

apps/backend/CARRIER_ACCEPT_REJECT_FIX.md

@@ -1,328 +0,0 @@
-# ✅ FIX: Redirection Transporteur après Accept/Reject
-
-**Date**: 5 décembre 2025
-**Statut**: ✅ **CORRIGÉ ET TESTÉ**
-
----
-
-## 🎯 Problème Identifié
-
-**Symptôme**: Quand un transporteur clique sur "Accepter" ou "Refuser" dans l'email:
-- ❌ Pas de redirection vers le dashboard transporteur
-- ❌ Le status du booking ne change pas
-- ❌ Erreur 404 ou pas de réponse
-
-**URL problématique**:
-```
-http://localhost:3000/api/v1/csv-bookings/{token}/accept
-```
-
-**Cause Racine**: Les URLs dans l'email pointaient vers le **frontend** (port 3000) au lieu du **backend** (port 4000).
-
----
-
-## 🔍 Analyse du Problème
-
-### Ce qui se passait AVANT (❌ Cassé)
-
-1. **Email envoyé** avec URL: `http://localhost:3000/api/v1/csv-bookings/{token}/accept`
-2. **Transporteur clique** sur le lien
-3. **Frontend** (port 3000) reçoit la requête
-4. **Erreur 404** car `/api/v1/*` n'existe pas sur le frontend
-5. **Aucune redirection**, aucun traitement
-
-### Workflow Attendu (✅ Correct)
-
-1. **Email envoyé** avec URL: `http://localhost:4000/api/v1/csv-bookings/{token}/accept`
-2. **Transporteur clique** sur le lien
-3. **Backend** (port 4000) reçoit la requête
-4. **Backend traite**:
-   - Accepte le booking
-   - Crée un compte transporteur si nécessaire
-   - Génère un token d'auto-login
-5. **Backend redirige** vers: `http://localhost:3000/carrier/confirmed?token={autoLoginToken}&action=accepted&bookingId={id}&new={isNew}`
-6. **Frontend** affiche la page de confirmation
-7. **Transporteur** est auto-connecté et voit son dashboard
-
----
-
-## ✅ Correction Appliquée
-
-### Fichier 1: `email.adapter.ts` (lignes 259-264)
-
-**AVANT** (❌):
-```typescript
-const baseUrl = this.configService.get('APP_URL', 'http://localhost:3000'); // Frontend!
-const acceptUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/accept`;
-const rejectUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/reject`;
-```
-
-**APRÈS** (✅):
-```typescript
-// Use BACKEND_URL if available, otherwise construct from PORT
-// The accept/reject endpoints are on the BACKEND, not the frontend
-const port = this.configService.get('PORT', '4000');
-const backendUrl = this.configService.get('BACKEND_URL', `http://localhost:${port}`);
-const acceptUrl = `${backendUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/accept`;
-const rejectUrl = `${backendUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/reject`;
-```
-
-**Changements**:
-- ✅ Utilise `BACKEND_URL` ou construit à partir de `PORT`
-- ✅ URLs pointent maintenant vers `http://localhost:4000/api/v1/...`
-- ✅ Commentaires ajoutés pour clarifier
-
-### Fichier 2: `app.module.ts` (lignes 39-40)
-
-Ajout des variables `APP_URL` et `BACKEND_URL` au schéma de validation:
-
-```typescript
-validationSchema: Joi.object({
-  // ...
-  APP_URL: Joi.string().uri().default('http://localhost:3000'),
-  BACKEND_URL: Joi.string().uri().optional(),
-  // ...
-}),
-```
-
-**Pourquoi**: Pour éviter que ces variables soient supprimées par la validation Joi.
-
----
-
-## 🧪 Test du Workflow Complet
-
-### Prérequis
-
-- ✅ Backend en cours d'exécution (port 4000)
-- ✅ Frontend en cours d'exécution (port 3000)
-- ✅ MinIO en cours d'exécution
-- ✅ Email adapter initialisé
-
-### Étape 1: Créer un Booking CSV
-
-1. **Se connecter** au frontend: http://localhost:3000
-2. **Aller sur** la page de recherche avancée
-3. **Rechercher un tarif** et cliquer sur "Réserver"
-4. **Remplir le formulaire**:
-   - Carrier email: Votre email de test (ou Mailtrap)
-   - Ajouter au moins 1 document
-5. **Cliquer sur "Envoyer la demande"**
-
-### Étape 2: Vérifier l'Email Reçu
-
-1. **Ouvrir Mailtrap**: https://mailtrap.io/inboxes
-2. **Trouver l'email**: "Nouvelle demande de réservation - {origin} → {destination}"
-3. **Vérifier les URLs** des boutons:
-   - ✅ Accepter: `http://localhost:4000/api/v1/csv-bookings/{token}/accept`
-   - ✅ Refuser: `http://localhost:4000/api/v1/csv-bookings/{token}/reject`
-
-**IMPORTANT**: Les URLs doivent pointer vers **port 4000** (backend), PAS port 3000!
-
-### Étape 3: Tester l'Acceptation
-
-1. **Copier l'URL** du bouton "Accepter" depuis l'email
-2. **Ouvrir dans le navigateur** (ou cliquer sur le bouton)
-3. **Observer**:
-   - ✅ Le navigateur va d'abord vers `localhost:4000`
-   - ✅ Puis redirige automatiquement vers `localhost:3000/carrier/confirmed?...`
-   - ✅ Page de confirmation affichée
-   - ✅ Transporteur auto-connecté
-
-### Étape 4: Vérifier le Dashboard Transporteur
-
-Après la redirection:
-
-1. **URL attendue**:
-   ```
-   http://localhost:3000/carrier/confirmed?token={autoLoginToken}&action=accepted&bookingId={id}&new=true
-   ```
-
-2. **Page affichée**:
-   - ✅ Message de confirmation: "Réservation acceptée avec succès!"
-   - ✅ Lien vers le dashboard transporteur
-   - ✅ Si nouveau compte: Message avec credentials
-
-3. **Vérifier le status**:
-   - Le booking doit maintenant avoir le status `ACCEPTED`
-   - Visible dans le dashboard utilisateur (celui qui a créé le booking)
-
-### Étape 5: Tester le Rejet
-
-Répéter avec le bouton "Refuser":
-
-1. **Créer un nouveau booking** (étape 1)
-2. **Cliquer sur "Refuser"** dans l'email
-3. **Vérifier**:
-   - ✅ Redirection vers `/carrier/confirmed?...&action=rejected`
-   - ✅ Message: "Réservation refusée"
-   - ✅ Status du booking: `REJECTED`
-
----
-
-## 📊 Vérifications Backend
-
-### Logs Attendus lors de l'Acceptation
-
-```bash
-# Monitorer les logs
-tail -f /tmp/backend-restart.log | grep -i "accept\|carrier\|booking"
-```
-
-**Logs attendus**:
-```
-[CsvBookingService] Accepting booking with token: {token}
-[CarrierAuthService] Creating carrier account for email: carrier@test.com
-[CarrierAuthService] Carrier account created with ID: {carrierId}
-[CsvBookingService] Successfully linked booking {bookingId} to carrier {carrierId}
-```
-
----
-
-## 🔧 Variables d'Environnement
-
-### `.env` Backend
-
-**Variables requises**:
-```bash
-PORT=4000                                 # Port du backend
-APP_URL=http://localhost:3000            # URL du frontend
-BACKEND_URL=http://localhost:4000        # URL du backend (optionnel, auto-construit si absent)
-```
-
-**En production**:
-```bash
-PORT=4000
-APP_URL=https://xpeditis.com
-BACKEND_URL=https://api.xpeditis.com
-```
-
----
-
-## 🐛 Dépannage
-
-### Problème 1: Toujours redirigé vers port 3000
-
-**Cause**: Email envoyé AVANT la correction
-
-**Solution**:
-1. Backend a été redémarré après la correction ✅
-2. Créer un **NOUVEAU booking** pour recevoir un email avec les bonnes URLs
-3. Les anciens bookings ont encore les anciennes URLs (port 3000)
-
----
-
-### Problème 2: 404 Not Found sur /accept
-
-**Cause**: Backend pas démarré ou route mal configurée
-
-**Solution**:
-```bash
-# Vérifier que le backend tourne
-curl http://localhost:4000/api/v1/health || echo "Backend not responding"
-
-# Vérifier les logs backend
-tail -50 /tmp/backend-restart.log | grep -i "csv-bookings"
-
-# Redémarrer le backend
-cd apps/backend
-npm run dev
-```
-
----
-
-### Problème 3: Token Invalid
-
-**Cause**: Token expiré ou booking déjà accepté/refusé
-
-**Solution**:
-- Les bookings ne peuvent être acceptés/refusés qu'une seule fois
-- Si token invalide, créer un nouveau booking
-- Vérifier dans la base de données le status du booking
-
----
-
-### Problème 4: Pas de redirection vers /carrier/confirmed
-
-**Cause**: Frontend route manquante ou token d'auto-login invalide
-
-**Vérification**:
-1. Vérifier que la route `/carrier/confirmed` existe dans le frontend
-2. Vérifier les logs backend pour voir si le token est généré
-3. Vérifier que le frontend affiche bien la page
-
----
-
-## 📝 Checklist de Validation
-
-- [x] Backend redémarré avec la correction
-- [x] Email adapter initialisé correctement
-- [x] Variables `APP_URL` et `BACKEND_URL` dans le schéma Joi
-- [ ] Nouveau booking créé (APRÈS la correction)
-- [ ] Email reçu avec URLs correctes (port 4000)
-- [ ] Clic sur "Accepter" → Redirection vers /carrier/confirmed
-- [ ] Status du booking changé en `ACCEPTED`
-- [ ] Dashboard transporteur accessible
-- [ ] Test "Refuser" fonctionne aussi
-
----
-
-## 🎯 Résumé des Corrections
-
-| Aspect | Avant (❌) | Après (✅) |
-|--------|-----------|-----------|
-| **Email URL Accept** | `localhost:3000/api/v1/...` | `localhost:4000/api/v1/...` |
-| **Email URL Reject** | `localhost:3000/api/v1/...` | `localhost:4000/api/v1/...` |
-| **Redirection** | Aucune (404) | Vers `/carrier/confirmed` |
-| **Status booking** | Ne change pas | `ACCEPTED` ou `REJECTED` |
-| **Dashboard transporteur** | Inaccessible | Accessible avec auto-login |
-
----
-
-## ✅ Workflow Complet Corrigé
-
-```
-1. Utilisateur crée booking
-   └─> Backend sauvegarde booking (status: PENDING)
-   └─> Backend envoie email avec URLs backend (port 4000) ✅
-
-2. Transporteur clique "Accepter" dans email
-   └─> Ouvre: http://localhost:4000/api/v1/csv-bookings/{token}/accept ✅
-   └─> Backend traite la requête:
-       ├─> Change status → ACCEPTED ✅
-       ├─> Crée compte transporteur si nécessaire ✅
-       ├─> Génère token auto-login ✅
-       └─> Redirige vers frontend: localhost:3000/carrier/confirmed?... ✅
-
-3. Frontend affiche page confirmation
-   └─> Message de succès ✅
-   └─> Auto-login du transporteur ✅
-   └─> Lien vers dashboard ✅
-
-4. Transporteur accède à son dashboard
-   └─> Voir la liste de ses bookings ✅
-   └─> Gérer ses réservations ✅
-```
-
----
-
-## 🚀 Prochaines Étapes
-
-1. **Tester immédiatement**:
-   - Créer un nouveau booking (important: APRÈS le redémarrage)
-   - Vérifier l'email reçu
-   - Tester Accept/Reject
-
-2. **Vérifier en production**:
-   - Mettre à jour la variable `BACKEND_URL` dans le .env production
-   - Redéployer le backend
-   - Tester le workflow complet
-
-3. **Documentation**:
-   - Mettre à jour le guide utilisateur
-   - Documenter le workflow transporteur
-
----
-
-**Correction effectuée le 5 décembre 2025 par Claude Code** ✅
-
-_Le système d'acceptation/rejet transporteur est maintenant 100% fonctionnel!_ 🚢✨

apps/backend/CSV_BOOKING_DIAGNOSTIC.md

@@ -1,282 +0,0 @@
-# 🔍 Diagnostic Complet - Workflow CSV Booking
-
-**Date**: 5 décembre 2025
-**Problème**: Le workflow d'envoi de demande de booking ne fonctionne pas
-
----
-
-## ✅ Vérifications Effectuées
-
-### 1. Backend ✅
-- ✅ Backend en cours d'exécution (port 4000)
-- ✅ Configuration SMTP corrigée (variables ajoutées au schéma Joi)
-- ✅ Email adapter initialisé correctement avec DNS bypass
-- ✅ Module CsvBookingsModule importé dans app.module.ts
-- ✅ Controller CsvBookingsController bien configuré
-- ✅ Service CsvBookingService bien configuré
-- ✅ MinIO container en cours d'exécution
-- ✅ Bucket 'xpeditis-documents' existe dans MinIO
-
-### 2. Frontend ✅
-- ✅ Page `/dashboard/booking/new` existe
-- ✅ Fonction `handleSubmit` bien configurée
-- ✅ FormData correctement construit avec tous les champs
-- ✅ Documents ajoutés avec le nom 'documents' (pluriel)
-- ✅ Appel API via `createCsvBooking()` qui utilise `upload()`
-- ✅ Gestion d'erreurs présente (affiche message si échec)
-
----
-
-## 🔍 Points de Défaillance Possibles
-
-### Scénario 1: Erreur Frontend (Browser Console)
-**Symptômes**: Le bouton "Envoyer la demande" ne fait rien, ou affiche un message d'erreur
-
-**Vérification**:
-1. Ouvrir les DevTools du navigateur (F12)
-2. Aller dans l'onglet Console
-3. Cliquer sur "Envoyer la demande"
-4. Regarder les erreurs affichées
-
-**Erreurs Possibles**:
-- `Failed to fetch` → Problème de connexion au backend
-- `401 Unauthorized` → Token JWT expiré
-- `400 Bad Request` → Données invalides
-- `500 Internal Server Error` → Erreur backend (voir logs)
-
----
-
-### Scénario 2: Erreur Backend (Logs)
-**Symptômes**: La requête arrive au backend mais échoue
-
-**Vérification**:
-```bash
-# Voir les logs backend en temps réel
-tail -f /tmp/backend-startup.log
-
-# Puis créer un booking via le frontend
-```
-
-**Erreurs Possibles**:
-- **Pas de logs `=== CSV Booking Request Debug ===`** → La requête n'arrive pas au controller
-- **`At least one document is required`** → Aucun fichier uploadé
-- **`User authentication failed`** → Problème de JWT
-- **`Organization ID is required`** → User sans organizationId
-- **Erreur S3/MinIO** → Upload de fichiers échoué
-- **Erreur Email** → Envoi email échoué (ne devrait plus arriver après le fix)
-
----
-
-### Scénario 3: Validation Échouée
-**Symptômes**: Erreur 400 Bad Request
-
-**Causes Possibles**:
-- **Port codes invalides** (origin/destination): Doivent être exactement 5 caractères (ex: NLRTM, USNYC)
-- **Email invalide** (carrierEmail): Doit être un email valide
-- **Champs numériques** (volumeCBM, weightKG, etc.): Doivent être > 0
-- **Currency invalide**: Doit être 'USD' ou 'EUR'
-- **Pas de documents**: Au moins 1 fichier requis
-
----
-
-### Scénario 4: CORS ou Network
-**Symptômes**: Erreur CORS ou network error
-
-**Vérification**:
-1. Ouvrir DevTools → Network tab
-2. Créer un booking
-3. Regarder la requête POST vers `/api/v1/csv-bookings`
-4. Vérifier:
-   - Status code (200/201 = OK, 4xx/5xx = erreur)
-   - Response body (message d'erreur)
-   - Request headers (Authorization token présent?)
-
-**Solutions**:
-- Backend et frontend doivent tourner simultanément
-- Frontend: `http://localhost:3000`
-- Backend: `http://localhost:4000`
-
----
-
-## 🧪 Tests à Effectuer
-
-### Test 1: Vérifier que le Backend Reçoit la Requête
-
-1. **Ouvrir un terminal et monitorer les logs**:
-   ```bash
-   tail -f /tmp/backend-startup.log | grep -i "csv\|booking\|error"
-   ```
-
-2. **Dans le navigateur**:
-   - Aller sur: http://localhost:3000/dashboard/booking/new?rateData=%7B%22companyName%22%3A%22Test%20Carrier%22%2C%22companyEmail%22%3A%22carrier%40test.com%22%2C%22origin%22%3A%22NLRTM%22%2C%22destination%22%3A%22USNYC%22%2C%22containerType%22%3A%22LCL%22%2C%22priceUSD%22%3A1000%2C%22priceEUR%22%3A900%2C%22primaryCurrency%22%3A%22USD%22%2C%22transitDays%22%3A22%7D&volumeCBM=2.88&weightKG=1500&palletCount=3
-   - Ajouter au moins 1 document
-   - Cliquer sur "Envoyer la demande"
-
-3. **Dans les logs, vous devriez voir**:
-   ```
-   === CSV Booking Request Debug ===
-   req.user: { id: '...', organizationId: '...' }
-   req.body: { carrierName: 'Test Carrier', ... }
-   files: 1
-   ================================
-   Creating CSV booking for user ...
-   Uploaded 1 documents for booking ...
-   CSV booking created with ID: ...
-   Email sent to carrier: carrier@test.com
-   Notification created for user ...
-   ```
-
-4. **Si vous NE voyez PAS ces logs** → La requête n'arrive pas au backend. Vérifier:
-   - Frontend connecté et JWT valide
-   - Backend en cours d'exécution
-   - Network tab du navigateur pour voir l'erreur exacte
-
----
-
-### Test 2: Vérifier le Browser Console
-
-1. **Ouvrir DevTools** (F12)
-2. **Aller dans Console**
-3. **Créer un booking**
-4. **Regarder les erreurs**:
-   - Si erreur affichée → noter le message exact
-   - Si aucune erreur → le problème est silencieux (voir Network tab)
-
----
-
-### Test 3: Vérifier Network Tab
-
-1. **Ouvrir DevTools** (F12)
-2. **Aller dans Network**
-3. **Créer un booking**
-4. **Trouver la requête** `POST /api/v1/csv-bookings`
-5. **Vérifier**:
-   - Status: Doit être 200 ou 201
-   - Request Payload: Tous les champs présents?
-   - Response: Message d'erreur?
-
----
-
-## 🔧 Solutions par Erreur
-
-### Erreur: "At least one document is required"
-**Cause**: Aucun fichier n'a été uploadé
-
-**Solution**:
-- Vérifier que vous avez bien sélectionné au moins 1 fichier
-- Vérifier que le fichier est dans les formats acceptés (PDF, DOC, DOCX, JPG, PNG)
-- Vérifier que le fichier fait moins de 5MB
-
----
-
-### Erreur: "User authentication failed"
-**Cause**: Token JWT invalide ou expiré
-
-**Solution**:
-1. Se déconnecter
-2. Se reconnecter
-3. Réessayer
-
----
-
-### Erreur: "Organization ID is required"
-**Cause**: L'utilisateur n'a pas d'organizationId
-
-**Solution**:
-1. Vérifier dans la base de données que l'utilisateur a bien un `organizationId`
-2. Si non, assigner une organization à l'utilisateur
-
----
-
-### Erreur: S3/MinIO Upload Failed
-**Cause**: Impossible d'uploader vers MinIO
-
-**Solution**:
-```bash
-# Vérifier que MinIO tourne
-docker ps | grep minio
-
-# Si non, le démarrer
-docker-compose up -d
-
-# Vérifier que le bucket existe
-cd apps/backend
-node setup-minio-bucket.js
-```
-
----
-
-### Erreur: Email Failed (ne devrait plus arriver)
-**Cause**: Envoi email échoué
-
-**Solution**:
-- Vérifier que les variables SMTP sont dans le schéma Joi (déjà corrigé ✅)
-- Tester l'envoi d'email: `node test-smtp-simple.js`
-
----
-
-## 📊 Checklist de Diagnostic
-
-Cocher au fur et à mesure:
-
-- [ ] Backend en cours d'exécution (port 4000)
-- [ ] Frontend en cours d'exécution (port 3000)
-- [ ] MinIO en cours d'exécution (port 9000)
-- [ ] Bucket 'xpeditis-documents' existe
-- [ ] Variables SMTP configurées
-- [ ] Email adapter initialisé (logs backend)
-- [ ] Utilisateur connecté au frontend
-- [ ] Token JWT valide (pas expiré)
-- [ ] Browser console sans erreurs
-- [ ] Network tab montre requête POST envoyée
-- [ ] Logs backend montrent "CSV Booking Request Debug"
-- [ ] Documents uploadés (au moins 1)
-- [ ] Port codes valides (5 caractères exactement)
-- [ ] Email transporteur valide
-
----
-
-## 🚀 Commandes Utiles
-
-```bash
-# Redémarrer backend
-cd apps/backend
-npm run dev
-
-# Vérifier logs backend
-tail -f /tmp/backend-startup.log | grep -i "csv\|booking\|error"
-
-# Tester email
-cd apps/backend
-node test-smtp-simple.js
-
-# Vérifier MinIO
-docker ps | grep minio
-node setup-minio-bucket.js
-
-# Voir tous les endpoints
-curl http://localhost:4000/api/docs
-```
-
----
-
-## 📝 Prochaines Étapes
-
-1. **Effectuer les tests** ci-dessus dans l'ordre
-2. **Noter l'erreur exacte** qui apparaît (console, network, logs)
-3. **Appliquer la solution** correspondante
-4. **Réessayer**
-
-Si après tous ces tests le problème persiste, partager:
-- Le message d'erreur exact (browser console)
-- Les logs backend au moment de l'erreur
-- Le status code HTTP de la requête (network tab)
-
----
-
-**Dernière mise à jour**: 5 décembre 2025
-**Statut**:
-- ✅ Email fix appliqué
-- ✅ MinIO bucket vérifié
-- ✅ Code analysé
-- ⏳ En attente de tests utilisateur

apps/backend/Dockerfile

@@ -1,7 +1,7 @@
 # ===============================================
 # Stage 1: Dependencies Installation
 # ===============================================
-FROM node:20-alpine AS dependencies
+FROM node:22-alpine AS dependencies
 
 # Install build dependencies
 RUN apk add --no-cache python3 make g++ libc6-compat
@@ -19,7 +19,7 @@ RUN npm ci --legacy-peer-deps
 # ===============================================
 # Stage 2: Build Application
 # ===============================================
-FROM node:20-alpine AS builder
+FROM node:22-alpine AS builder
 
 WORKDIR /app
 
@@ -38,7 +38,11 @@ RUN npm prune --production --legacy-peer-deps
 # ===============================================
 # Stage 3: Production Image
 # ===============================================
-FROM node:20-alpine AS production
+FROM node:22-alpine AS production
+
+# Runtime starts with node; remove the base image package manager and its dependencies.
+# npm remains available in the dependency and build stages.
+RUN npm uninstall --global npm
 
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
@@ -59,7 +63,11 @@ COPY --from=builder --chown=nestjs:nodejs /app/package*.json ./
 COPY --from=builder --chown=nestjs:nodejs /app/src ./src
 
 # Copy startup script (includes migrations)
-COPY --chown=nestjs:nodejs startup.js ./startup.js
+COPY --chown=nestjs:nodejs scripts/setup/startup.js ./startup.js
+
+# Recovery command: set an admin password without SMTP
+#   docker exec -it <backend-container> node admin-password.js <email>
+COPY --chown=nestjs:nodejs scripts/setup/admin-password.js ./admin-password.js
 
 # Create logs and uploads directories
 RUN mkdir -p /app/logs && \
@@ -74,7 +82,7 @@ EXPOSE 4000
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:4000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
+  CMD node -e "require('http').get('http://localhost:4000/api/v1/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
 
 # Set environment variables
 ENV NODE_ENV=production \

apps/backend/EMAIL_CARRIER_FIX_COMPLETE.md

@@ -1,386 +0,0 @@
-# ✅ CORRECTION COMPLÈTE - Envoi d'Email aux Transporteurs
-
-**Date**: 5 décembre 2025
-**Statut**: ✅ **CORRIGÉ**
-
----
-
-## 🔍 Problème Identifié
-
-**Symptôme**: Les emails ne sont plus envoyés aux transporteurs lors de la création de bookings CSV.
-
-**Cause Racine**:
-Le fix DNS implémenté dans `EMAIL_FIX_SUMMARY.md` n'était **PAS appliqué** dans le code actuel de `email.adapter.ts`. Le code utilisait la configuration standard sans contournement DNS, ce qui causait des timeouts sur certains réseaux.
-
-```typescript
-// ❌ CODE PROBLÉMATIQUE (avant correction)
-this.transporter = nodemailer.createTransport({
-  host,  // ← utilisait directement 'sandbox.smtp.mailtrap.io' sans contournement DNS
-  port,
-  secure,
-  auth: { user, pass },
-});
-```
-
----
-
-## ✅ Solution Implémentée
-
-### 1. **Correction de `email.adapter.ts`** (Lignes 25-63)
-
-**Fichier modifié**: `src/infrastructure/email/email.adapter.ts`
-
-```typescript
-private initializeTransporter(): void {
-  const host = this.configService.get<string>('SMTP_HOST', 'localhost');
-  const port = this.configService.get<number>('SMTP_PORT', 2525);
-  const user = this.configService.get<string>('SMTP_USER');
-  const pass = this.configService.get<string>('SMTP_PASS');
-  const secure = this.configService.get<boolean>('SMTP_SECURE', false);
-
-  // 🔧 FIX: Contournement DNS pour Mailtrap
-  // Utilise automatiquement l'IP directe quand 'mailtrap.io' est détecté
-  const useDirectIP = host.includes('mailtrap.io');
-  const actualHost = useDirectIP ? '3.209.246.195' : host;
-  const serverName = useDirectIP ? 'smtp.mailtrap.io' : host; // Pour TLS
-
-  this.transporter = nodemailer.createTransport({
-    host: actualHost,  // ← Utilise IP directe pour Mailtrap
-    port,
-    secure,
-    auth: { user, pass },
-    tls: {
-      rejectUnauthorized: false,
-      servername: serverName, // ⚠️ CRITIQUE pour TLS avec IP directe
-    },
-    connectionTimeout: 10000,
-    greetingTimeout: 10000,
-    socketTimeout: 30000,
-    dnsTimeout: 10000,
-  });
-
-  this.logger.log(
-    `Email adapter initialized with SMTP host: ${host}:${port} (secure: ${secure})` +
-      (useDirectIP ? ` [Using direct IP: ${actualHost} with servername: ${serverName}]` : '')
-  );
-}
-```
-
-**Changements clés**:
-- ✅ Détection automatique de `mailtrap.io` dans le hostname
-- ✅ Utilisation de l'IP directe `3.209.246.195` au lieu du DNS
-- ✅ Configuration TLS avec `servername` pour validation du certificat
-- ✅ Timeouts optimisés (10s connection, 30s socket)
-- ✅ Logs détaillés pour debug
-
-### 2. **Vérification du comportement synchrone**
-
-**Fichier vérifié**: `src/application/services/csv-booking.service.ts` (Lignes 111-136)
-
-Le code utilise **déjà** le comportement synchrone correct avec `await`:
-
-```typescript
-// ✅ CODE CORRECT (comportement synchrone)
-try {
-  await this.emailAdapter.sendCsvBookingRequest(dto.carrierEmail, {
-    bookingId,
-    origin: dto.origin,
-    destination: dto.destination,
-    // ... autres données
-    confirmationToken,
-  });
-  this.logger.log(`Email sent to carrier: ${dto.carrierEmail}`);
-} catch (error: any) {
-  this.logger.error(`Failed to send email to carrier: ${error?.message}`, error?.stack);
-  // Continue even if email fails - booking is already saved
-}
-```
-
-**Important**: L'email est envoyé de manière **synchrone** - le bouton attend la confirmation d'envoi avant de répondre.
-
----
-
-## 🧪 Tests de Validation
-
-### Test 1: Script de Test Nodemailer
-
-Un script de test complet a été créé pour valider les 3 configurations :
-
-```bash
-cd apps/backend
-node test-carrier-email-fix.js
-```
-
-**Ce script teste**:
-1. ❌ **Test 1**: Configuration standard (peut échouer avec timeout DNS)
-2. ✅ **Test 2**: Configuration avec IP directe (doit réussir)
-3. ✅ **Test 3**: Email complet avec template HTML (doit réussir)
-
-**Résultat attendu**:
-```bash
-✅ Test 2 RÉUSSI - Configuration IP directe OK
-   Message ID: <unique-id>
-   Response: 250 2.0.0 Ok: queued
-
-✅ Test 3 RÉUSSI - Email complet avec template envoyé
-   Message ID: <unique-id>
-   Response: 250 2.0.0 Ok: queued
-```
-
-### Test 2: Redémarrage du Backend
-
-**IMPORTANT**: Le backend DOIT être redémarré pour appliquer les changements.
-
-```bash
-# 1. Tuer tous les processus backend
-lsof -ti:4000 | xargs -r kill -9
-
-# 2. Redémarrer proprement
-cd apps/backend
-npm run dev
-```
-
-**Logs attendus au démarrage**:
-```bash
-✅ Email adapter initialized with SMTP host: sandbox.smtp.mailtrap.io:2525 (secure: false) [Using direct IP: 3.209.246.195 with servername: smtp.mailtrap.io]
-```
-
-### Test 3: Test End-to-End avec API
-
-**Prérequis**:
-- Backend démarré
-- Frontend démarré (optionnel)
-- Compte Mailtrap configuré
-
-**Scénario de test**:
-
-1. **Créer un booking CSV** via API ou Frontend
-
-```bash
-# Via API (Postman/cURL)
-POST http://localhost:4000/api/v1/csv-bookings
-Authorization: Bearer <votre-token-jwt>
-Content-Type: multipart/form-data
-
-Données:
-- carrierName: "Test Carrier"
-- carrierEmail: "carrier@test.com"
-- origin: "FRPAR"
-- destination: "USNYC"
-- volumeCBM: 10
-- weightKG: 500
-- palletCount: 2
-- priceUSD: 1500
-- priceEUR: 1350
-- primaryCurrency: "USD"
-- transitDays: 15
-- containerType: "20FT"
-- notes: "Test booking"
-- files: [bill_of_lading.pdf, packing_list.pdf]
-```
-
-2. **Vérifier les logs backend**:
-
-```bash
-# Succès attendu
-✅ [CsvBookingService] Creating CSV booking for user <userId>
-✅ [CsvBookingService] Uploaded 2 documents for booking <bookingId>
-✅ [CsvBookingService] CSV booking created with ID: <bookingId>
-✅ [EmailAdapter] Email sent to carrier@test.com: Nouvelle demande de réservation - FRPAR → USNYC
-✅ [CsvBookingService] Email sent to carrier: carrier@test.com
-✅ [CsvBookingService] Notification created for user <userId>
-```
-
-3. **Vérifier Mailtrap Inbox**:
-   - Connexion: https://mailtrap.io/inboxes
-   - Rechercher: "Nouvelle demande de réservation - FRPAR → USNYC"
-   - Vérifier: Email avec template HTML complet, boutons Accepter/Refuser
-
----
-
-## 📊 Comparaison Avant/Après
-
-| Critère | ❌ Avant (Cassé) | ✅ Après (Corrigé) |
-|---------|------------------|-------------------|
-| **Envoi d'emails** | 0% (timeout DNS) | 100% (IP directe) |
-| **Temps de réponse API** | ~10s (timeout) | ~2s (normal) |
-| **Logs d'erreur** | `queryA ETIMEOUT` | Aucune erreur |
-| **Configuration requise** | DNS fonctionnel | Fonctionne partout |
-| **Messages reçus** | Aucun | Tous les emails |
-
----
-
-## 🔧 Configuration Environnement
-
-### Développement (`.env` actuel)
-
-```bash
-SMTP_HOST=sandbox.smtp.mailtrap.io  # ← Détecté automatiquement
-SMTP_PORT=2525
-SMTP_SECURE=false
-SMTP_USER=2597bd31d265eb
-SMTP_PASS=cd126234193c89
-SMTP_FROM=noreply@xpeditis.com
-```
-
-**Note**: Le code détecte automatiquement `mailtrap.io` et utilise l'IP directe.
-
-### Production (Recommandations)
-
-#### Option 1: Mailtrap Production
-
-```bash
-SMTP_HOST=smtp.mailtrap.io  # ← Le code utilisera l'IP directe automatiquement
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=<votre-user-production>
-SMTP_PASS=<votre-pass-production>
-```
-
-#### Option 2: SendGrid
-
-```bash
-SMTP_HOST=smtp.sendgrid.net  # ← Pas de contournement DNS nécessaire
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=apikey
-SMTP_PASS=<votre-clé-API-SendGrid>
-```
-
-#### Option 3: AWS SES
-
-```bash
-SMTP_HOST=email-smtp.us-east-1.amazonaws.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=<votre-access-key-id>
-SMTP_PASS=<votre-secret-access-key>
-```
-
----
-
-## 🐛 Dépannage
-
-### Problème 1: "Email sent" dans les logs mais rien dans Mailtrap
-
-**Cause**: Credentials incorrects ou mauvaise inbox
-**Solution**:
-1. Vérifier `SMTP_USER` et `SMTP_PASS` dans `.env`
-2. Régénérer les credentials sur https://mailtrap.io
-3. Vérifier la bonne inbox (Development, Staging, Production)
-
-### Problème 2: "queryA ETIMEOUT" persiste après correction
-
-**Cause**: Backend pas redémarré ou code pas compilé
-**Solution**:
-```bash
-# Tuer tous les backends
-lsof -ti:4000 | xargs -r kill -9
-
-# Nettoyer et redémarrer
-cd apps/backend
-rm -rf dist/
-npm run build
-npm run dev
-```
-
-### Problème 3: "EAUTH" authentication failed
-
-**Cause**: Credentials Mailtrap invalides ou expirés
-**Solution**:
-1. Se connecter à https://mailtrap.io
-2. Aller dans Email Testing > Inboxes > <votre-inbox>
-3. Copier les nouveaux credentials (SMTP Settings)
-4. Mettre à jour `.env` et redémarrer
-
-### Problème 4: Email reçu mais template cassé
-
-**Cause**: Template HTML mal formaté ou variables manquantes
-**Solution**:
-1. Vérifier les logs pour les données envoyées
-2. Vérifier que toutes les variables sont présentes dans `bookingData`
-3. Tester le template avec `test-carrier-email-fix.js`
-
----
-
-## ✅ Checklist de Validation Finale
-
-Avant de déclarer le problème résolu, vérifier:
-
-- [x] `email.adapter.ts` corrigé avec contournement DNS
-- [x] Script de test `test-carrier-email-fix.js` créé
-- [x] Configuration `.env` vérifiée (SMTP_HOST, USER, PASS)
-- [ ] Backend redémarré avec logs confirmant IP directe
-- [ ] Test nodemailer réussi (Test 2 et 3)
-- [ ] Test end-to-end: création de booking CSV
-- [ ] Email reçu dans Mailtrap inbox
-- [ ] Template HTML complet et boutons fonctionnels
-- [ ] Logs backend sans erreur `ETIMEOUT`
-- [ ] Notification créée pour l'utilisateur
-
----
-
-## 📝 Fichiers Modifiés
-
-| Fichier | Lignes | Description |
-|---------|--------|-------------|
-| `src/infrastructure/email/email.adapter.ts` | 25-63 | ✅ Contournement DNS avec IP directe |
-| `test-carrier-email-fix.js` | 1-285 | 🧪 Script de test email (nouveau) |
-| `EMAIL_CARRIER_FIX_COMPLETE.md` | 1-xxx | 📄 Documentation correction (ce fichier) |
-
-**Fichiers vérifiés** (code correct):
-- ✅ `src/application/services/csv-booking.service.ts` (comportement synchrone avec `await`)
-- ✅ `src/infrastructure/email/templates/email-templates.ts` (template `renderCsvBookingRequest` existe)
-- ✅ `src/infrastructure/email/email.module.ts` (module correctement configuré)
-- ✅ `src/domain/ports/out/email.port.ts` (méthode `sendCsvBookingRequest` définie)
-
----
-
-## 🎉 Résultat Final
-
-### ✅ Problème RÉSOLU à 100%
-
-**Ce qui fonctionne maintenant**:
-1. ✅ Emails aux transporteurs envoyés sans timeout DNS
-2. ✅ Template HTML complet avec boutons Accepter/Refuser
-3. ✅ Logs détaillés pour debugging
-4. ✅ Configuration robuste (fonctionne même si DNS lent)
-5. ✅ Compatible avec n'importe quel fournisseur SMTP
-6. ✅ Notifications utilisateur créées
-7. ✅ Comportement synchrone (le bouton attend l'email)
-
-**Performance**:
-- Temps d'envoi: **< 2s** (au lieu de 10s timeout)
-- Taux de succès: **100%** (au lieu de 0%)
-- Compatibilité: **Tous réseaux** (même avec DNS lent)
-
----
-
-## 🚀 Prochaines Étapes
-
-1. **Tester immédiatement**:
-   ```bash
-   # 1. Test nodemailer
-   node apps/backend/test-carrier-email-fix.js
-
-   # 2. Redémarrer backend
-   lsof -ti:4000 | xargs -r kill -9
-   cd apps/backend && npm run dev
-
-   # 3. Créer un booking CSV via frontend ou API
-   ```
-
-2. **Vérifier Mailtrap**: https://mailtrap.io/inboxes
-
-3. **Si tout fonctionne**: ✅ Fermer le ticket
-
-4. **Si problème persiste**:
-   - Copier les logs complets
-   - Exécuter `test-carrier-email-fix.js` et copier la sortie
-   - Partager pour debug supplémentaire
-
----
-
-**Prêt pour la production** 🚢✨
-
-_Correction effectuée le 5 décembre 2025 par Claude Code_

apps/backend/EMAIL_FIX_FINAL.md

@@ -1,275 +0,0 @@
-# ✅ EMAIL FIX COMPLETE - ROOT CAUSE RESOLVED
-
-**Date**: 5 décembre 2025
-**Statut**: ✅ **RÉSOLU ET TESTÉ**
-
----
-
-## 🎯 ROOT CAUSE IDENTIFIÉE
-
-**Problème**: Les emails aux transporteurs ne s'envoyaient plus après l'implémentation du Carrier Portal.
-
-**Cause Racine**: Les variables d'environnement SMTP n'étaient **PAS déclarées** dans le schéma de validation Joi de ConfigModule (`app.module.ts`).
-
-### Pourquoi c'était cassé?
-
-NestJS ConfigModule avec un `validationSchema` Joi **supprime automatiquement** toutes les variables d'environnement qui ne sont pas explicitement déclarées dans le schéma. Le schéma original (lignes 36-50 de `app.module.ts`) ne contenait que:
-
-```typescript
-validationSchema: Joi.object({
-  NODE_ENV: Joi.string()...
-  PORT: Joi.number()...
-  DATABASE_HOST: Joi.string()...
-  REDIS_HOST: Joi.string()...
-  JWT_SECRET: Joi.string()...
-  // ❌ AUCUNE VARIABLE SMTP DÉCLARÉE!
-})
-```
-
-Résultat:
-- `SMTP_HOST` → undefined
-- `SMTP_PORT` → undefined
-- `SMTP_USER` → undefined
-- `SMTP_PASS` → undefined
-- `SMTP_FROM` → undefined
-- `SMTP_SECURE` → undefined
-
-L'email adapter tentait alors de se connecter à `localhost:2525` au lieu de Mailtrap, causant des erreurs `ECONNREFUSED`.
-
----
-
-## ✅ SOLUTION IMPLÉMENTÉE
-
-### 1. Ajout des variables SMTP au schéma de validation
-
-**Fichier modifié**: `apps/backend/src/app.module.ts` (lignes 50-56)
-
-```typescript
-ConfigModule.forRoot({
-  isGlobal: true,
-  validationSchema: Joi.object({
-    // ... variables existantes ...
-
-    // ✅ NOUVEAU: SMTP Configuration
-    SMTP_HOST: Joi.string().required(),
-    SMTP_PORT: Joi.number().default(2525),
-    SMTP_USER: Joi.string().required(),
-    SMTP_PASS: Joi.string().required(),
-    SMTP_FROM: Joi.string().email().default('noreply@xpeditis.com'),
-    SMTP_SECURE: Joi.boolean().default(false),
-  }),
-}),
-```
-
-**Changements**:
-- ✅ Ajout de 6 variables SMTP au schéma Joi
-- ✅ `SMTP_HOST`, `SMTP_USER`, `SMTP_PASS` requis
-- ✅ `SMTP_PORT` avec default 2525
-- ✅ `SMTP_FROM` avec validation email
-- ✅ `SMTP_SECURE` avec default false
-
-### 2. DNS Fix (Déjà présent)
-
-Le DNS fix dans `email.adapter.ts` (lignes 42-45) était déjà correct depuis la correction précédente:
-
-```typescript
-const useDirectIP = host.includes('mailtrap.io');
-const actualHost = useDirectIP ? '3.209.246.195' : host;
-const serverName = useDirectIP ? 'smtp.mailtrap.io' : host;
-```
-
----
-
-## 🧪 TESTS DE VALIDATION
-
-### Test 1: Backend Logs ✅
-
-```bash
-[2025-12-05 13:24:59.567] INFO: Email adapter initialized with SMTP host: sandbox.smtp.mailtrap.io:2525 (secure: false) [Using direct IP: 3.209.246.195 with servername: smtp.mailtrap.io]
-```
-
-**Vérification**:
-- ✅ Host: sandbox.smtp.mailtrap.io:2525
-- ✅ Using direct IP: 3.209.246.195
-- ✅ Servername: smtp.mailtrap.io
-- ✅ Secure: false
-
-### Test 2: SMTP Simple Test ✅
-
-```bash
-$ node test-smtp-simple.js
-
-Configuration:
-  SMTP_HOST: sandbox.smtp.mailtrap.io ✅
-  SMTP_PORT: 2525 ✅
-  SMTP_USER: 2597bd31d265eb ✅
-  SMTP_PASS: *** ✅
-
-Test 1: Vérification de la connexion...
-✅ Connexion SMTP OK
-
-Test 2: Envoi d'un email...
-✅ Email envoyé avec succès!
-   Message ID: <f21d412a-3739-b5c9-62cc-b00db514d9db@xpeditis.com>
-   Response: 250 2.0.0 Ok: queued
-
-✅ TOUS LES TESTS RÉUSSIS - Le SMTP fonctionne!
-```
-
-### Test 3: Email Flow Complet ✅
-
-```bash
-$ node debug-email-flow.js
-
-📊 RÉSUMÉ DES TESTS:
-Connexion SMTP: ✅ OK
-Email simple: ✅ OK
-Email transporteur: ✅ OK
-
-✅ TOUS LES TESTS ONT RÉUSSI!
-   Le système d'envoi d'email fonctionne correctement.
-```
-
----
-
-## 📊 Avant/Après
-
-| Critère | ❌ Avant | ✅ Après |
-|---------|----------|----------|
-| **Variables SMTP** | undefined | Chargées correctement |
-| **Connexion SMTP** | ECONNREFUSED ::1:2525 | Connecté à 3.209.246.195:2525 |
-| **Envoi email** | 0% (échec) | 100% (succès) |
-| **Backend logs** | Pas d'init SMTP | "Email adapter initialized" |
-| **Test scripts** | Tous échouent | Tous réussissent |
-
----
-
-## 🚀 VÉRIFICATION END-TO-END
-
-Le backend est déjà démarré et fonctionnel. Pour tester le flux complet de création de booking avec envoi d'email:
-
-### Option 1: Via l'interface web
-
-1. Ouvrir http://localhost:3000
-2. Se connecter
-3. Créer un CSV booking avec l'email d'un transporteur
-4. Vérifier les logs backend:
-   ```
-   ✅ [CsvBookingService] Email sent to carrier: carrier@example.com
-   ```
-5. Vérifier Mailtrap: https://mailtrap.io/inboxes
-
-### Option 2: Via API (cURL/Postman)
-
-```bash
-POST http://localhost:4000/api/v1/csv-bookings
-Authorization: Bearer <your-jwt-token>
-Content-Type: multipart/form-data
-
-{
-  "carrierName": "Test Carrier",
-  "carrierEmail": "carrier@test.com",
-  "origin": "FRPAR",
-  "destination": "USNYC",
-  "volumeCBM": 10,
-  "weightKG": 500,
-  "palletCount": 2,
-  "priceUSD": 1500,
-  "primaryCurrency": "USD",
-  "transitDays": 15,
-  "containerType": "20FT",
-  "files": [attachment]
-}
-```
-
-**Logs attendus**:
-```
-✅ [CsvBookingService] Creating CSV booking for user <userId>
-✅ [CsvBookingService] Uploaded 2 documents for booking <bookingId>
-✅ [CsvBookingService] CSV booking created with ID: <bookingId>
-✅ [EmailAdapter] Email sent to carrier@test.com
-✅ [CsvBookingService] Email sent to carrier: carrier@test.com
-```
-
----
-
-## 📝 Fichiers Modifiés
-
-| Fichier | Lignes | Changement |
-|---------|--------|------------|
-| `apps/backend/src/app.module.ts` | 50-56 | ✅ Ajout variables SMTP au schéma Joi |
-| `apps/backend/src/infrastructure/email/email.adapter.ts` | 42-65 | ✅ DNS fix (déjà présent) |
-
----
-
-## 🎉 RÉSULTAT FINAL
-
-### ✅ Problème RÉSOLU à 100%
-
-**Ce qui fonctionne**:
-1. ✅ Variables SMTP chargées depuis `.env`
-2. ✅ Email adapter s'initialise correctement
-3. ✅ Connexion SMTP avec DNS bypass (IP directe)
-4. ✅ Envoi d'emails simples réussi
-5. ✅ Envoi d'emails avec template HTML réussi
-6. ✅ Backend démarre sans erreur
-7. ✅ Tous les tests passent
-
-**Performance**:
-- Temps d'envoi: **< 2s**
-- Taux de succès: **100%**
-- Compatibilité: **Tous réseaux**
-
----
-
-## 🔧 Commandes Utiles
-
-### Vérifier le backend
-
-```bash
-# Voir les logs en temps réel
-tail -f /tmp/backend-startup.log
-
-# Vérifier que le backend tourne
-lsof -i:4000
-
-# Redémarrer le backend
-lsof -ti:4000 | xargs -r kill -9
-cd apps/backend && npm run dev
-```
-
-### Tester l'envoi d'emails
-
-```bash
-# Test SMTP simple
-cd apps/backend
-node test-smtp-simple.js
-
-# Test complet avec template
-node debug-email-flow.js
-```
-
----
-
-## ✅ Checklist de Validation
-
-- [x] ConfigModule validation schema updated
-- [x] SMTP variables added to Joi schema
-- [x] Backend redémarré avec succès
-- [x] Backend logs show "Email adapter initialized"
-- [x] Test SMTP simple réussi
-- [x] Test email flow complet réussi
-- [x] Environment variables loading correctly
-- [x] DNS bypass actif (direct IP)
-- [ ] Test end-to-end via création de booking (à faire par l'utilisateur)
-- [ ] Email reçu dans Mailtrap (à vérifier par l'utilisateur)
-
----
-
-**Prêt pour la production** 🚢✨
-
-_Correction effectuée le 5 décembre 2025 par Claude Code_
-
-**Backend Status**: ✅ Running on port 4000
-**Email System**: ✅ Fully functional
-**Next Step**: Create a CSV booking to test the complete workflow

apps/backend/EMAIL_FIX_SUMMARY.md

@@ -1,295 +0,0 @@
-# 📧 Résolution Complète du Problème d'Envoi d'Emails
-
-## 🔍 Problème Identifié
-
-**Symptôme**: Les emails n'étaient plus envoyés aux transporteurs lors de la création de réservations CSV.
-
-**Cause Racine**: Changement du comportement d'envoi d'email de SYNCHRONE à ASYNCHRONE
-- Le code original utilisait `await` pour attendre l'envoi de l'email avant de répondre
-- J'ai tenté d'optimiser avec `setImmediate()` et `void` operator (fire-and-forget)
-- **ERREUR**: L'utilisateur VOULAIT le comportement synchrone où le bouton attend la confirmation d'envoi
-- Les emails n'étaient plus envoyés car le contexte d'exécution était perdu avec les appels asynchrones
-
-## ✅ Solution Implémentée
-
-### **Restauration du comportement SYNCHRONE** ✨ SOLUTION FINALE
-**Fichiers modifiés**:
-- `src/application/services/csv-booking.service.ts` (lignes 111-136)
-- `src/application/services/carrier-auth.service.ts` (lignes 110-117, 287-294)
-- `src/infrastructure/email/email.adapter.ts` (configuration simplifiée)
-
-```typescript
-// Utilise automatiquement l'IP 3.209.246.195 quand 'mailtrap.io' est détecté
-const useDirectIP = host.includes('mailtrap.io');
-const actualHost = useDirectIP ? '3.209.246.195' : host;
-const serverName = useDirectIP ? 'smtp.mailtrap.io' : host; // Pour TLS
-
-// Configuration avec IP directe + servername pour TLS
-this.transporter = nodemailer.createTransport({
-  host: actualHost,
-  port,
-  secure: false,
-  auth: { user, pass },
-  tls: {
-    rejectUnauthorized: false,
-    servername: serverName, // ⚠️ CRITIQUE pour TLS
-  },
-  connectionTimeout: 10000,
-  greetingTimeout: 10000,
-  socketTimeout: 30000,
-  dnsTimeout: 10000,
-});
-```
-
-**Résultat**: ✅ Test réussi - Email envoyé avec succès (Message ID: `576597e7-1a81-165d-2a46-d97c57d21daa`)
-
----
-
-### 2. **Remplacement de `setImmediate()` par `void` operator**
-**Fichiers Modifiés**:
-- `src/application/services/csv-booking.service.ts` (ligne 114)
-- `src/application/services/carrier-auth.service.ts` (lignes 112, 290)
-
-**Avant** (bloquant):
-```typescript
-setImmediate(() => {
-  this.emailAdapter.sendCsvBookingRequest(...)
-    .then(() => { ... })
-    .catch(() => { ... });
-});
-```
-
-**Après** (non-bloquant mais avec contexte):
-```typescript
-void this.emailAdapter.sendCsvBookingRequest(...)
-  .then(() => {
-    this.logger.log(`Email sent to carrier: ${dto.carrierEmail}`);
-  })
-  .catch((error: any) => {
-    this.logger.error(`Failed to send email to carrier: ${error?.message}`, error?.stack);
-  });
-```
-
-**Bénéfices**:
-- ✅ Réponse API ~50% plus rapide (pas d'attente d'envoi)
-- ✅ Logs des erreurs d'envoi préservés
-- ✅ Contexte NestJS maintenu (pas de perte de dépendances)
-
----
-
-### 3. **Configuration `.env` Mise à Jour**
-**Fichier**: `.env`
-
-```bash
-# Email (SMTP)
-# Using smtp.mailtrap.io instead of sandbox.smtp.mailtrap.io to avoid DNS timeout
-SMTP_HOST=smtp.mailtrap.io  # ← Changé
-SMTP_PORT=2525
-SMTP_SECURE=false
-SMTP_USER=2597bd31d265eb
-SMTP_PASS=cd126234193c89
-SMTP_FROM=noreply@xpeditis.com
-```
-
----
-
-### 4. **Ajout des Méthodes d'Email Transporteur**
-**Fichier**: `src/domain/ports/out/email.port.ts`
-
-Ajout de 2 nouvelles méthodes à l'interface:
-- `sendCarrierAccountCreated()` - Email de création de compte avec mot de passe temporaire
-- `sendCarrierPasswordReset()` - Email de réinitialisation de mot de passe
-
-**Implémentation**: `src/infrastructure/email/email.adapter.ts` (lignes 269-413)
-- Templates HTML en français
-- Boutons d'action stylisés
-- Warnings de sécurité
-- Instructions de connexion
-
----
-
-## 📋 Fichiers Modifiés (Récapitulatif)
-
-| Fichier | Lignes | Description |
-|---------|--------|-------------|
-| `infrastructure/email/email.adapter.ts` | 25-63 | ✨ Contournement DNS avec IP directe |
-| `infrastructure/email/email.adapter.ts` | 269-413 | Méthodes emails transporteur |
-| `application/services/csv-booking.service.ts` | 114-137 | `void` operator pour emails async |
-| `application/services/carrier-auth.service.ts` | 112-118 | `void` operator (création compte) |
-| `application/services/carrier-auth.service.ts` | 290-296 | `void` operator (reset password) |
-| `domain/ports/out/email.port.ts` | 107-123 | Interface méthodes transporteur |
-| `.env` | 42 | Changement SMTP_HOST |
-
----
-
-## 🧪 Tests de Validation
-
-### Test 1: Backend Redémarré avec Succès ✅ **RÉUSSI**
-```bash
-# Tuer tous les processus sur port 4000
-lsof -ti:4000 | xargs kill -9
-
-# Démarrer le backend proprement
-npm run dev
-```
-
-**Résultat**:
-```
-✅ Email adapter initialized with SMTP host: sandbox.smtp.mailtrap.io:2525 (secure: false)
-✅ Nest application successfully started
-✅ Connected to Redis at localhost:6379
-🚢 Xpeditis API Server Running on http://localhost:4000
-```
-
-### Test 2: Test d'Envoi d'Email (À faire par l'utilisateur)
-1. ✅ Backend démarré avec configuration correcte
-2. Créer une réservation CSV avec transporteur via API
-3. Vérifier les logs pour: `Email sent to carrier: [email]`
-4. Vérifier Mailtrap inbox: https://mailtrap.io/inboxes
-
----
-
-## 🎯 Comment Tester en Production
-
-### Étape 1: Créer une Réservation CSV
-```bash
-POST http://localhost:4000/api/v1/csv-bookings
-Content-Type: multipart/form-data
-
-{
-  "carrierName": "Test Carrier",
-  "carrierEmail": "test@example.com",
-  "origin": "FRPAR",
-  "destination": "USNYC",
-  "volumeCBM": 10,
-  "weightKG": 500,
-  "palletCount": 2,
-  "priceUSD": 1500,
-  "priceEUR": 1300,
-  "primaryCurrency": "USD",
-  "transitDays": 15,
-  "containerType": "20FT",
-  "notes": "Test booking"
-}
-```
-
-### Étape 2: Vérifier les Logs
-Rechercher dans les logs backend:
-```bash
-# Succès
-✅ "Email sent to carrier: test@example.com"
-✅ "CSV booking request sent to test@example.com for booking <ID>"
-
-# Échec (ne devrait plus arriver)
-❌ "Failed to send email to carrier: queryA ETIMEOUT"
-```
-
-### Étape 3: Vérifier Mailtrap
-1. Connexion: https://mailtrap.io
-2. Inbox: "Xpeditis Development"
-3. Email: "Nouvelle demande de réservation - FRPAR → USNYC"
-
----
-
-## 📊 Performance
-
-### Avant (Problème)
-- ❌ Emails: **0% envoyés** (timeout DNS)
-- ⏱️ Temps réponse API: ~500ms + timeout (10s)
-- ❌ Logs: Erreurs `queryA ETIMEOUT`
-
-### Après (Corrigé)
-- ✅ Emails: **100% envoyés** (IP directe)
-- ⏱️ Temps réponse API: ~200-300ms (async fire-and-forget)
-- ✅ Logs: `Email sent to carrier:`
-- 📧 Latence email: <2s (Mailtrap)
-
----
-
-## 🔧 Configuration Production
-
-Pour le déploiement production, mettre à jour `.env`:
-
-```bash
-# Option 1: Utiliser smtp.mailtrap.io (IP auto)
-SMTP_HOST=smtp.mailtrap.io
-SMTP_PORT=2525
-SMTP_SECURE=false
-
-# Option 2: Autre fournisseur SMTP (ex: SendGrid)
-SMTP_HOST=smtp.sendgrid.net
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=apikey
-SMTP_PASS=<votre-clé-API-SendGrid>
-```
-
-**Note**: Le code détecte automatiquement `mailtrap.io` et utilise l'IP. Pour d'autres fournisseurs, le DNS standard sera utilisé.
-
----
-
-## 🐛 Dépannage
-
-### Problème: "Email sent" dans les logs mais rien dans Mailtrap
-**Cause**: Mauvais credentials ou inbox
-**Solution**: Vérifier `SMTP_USER` et `SMTP_PASS` dans `.env`
-
-### Problème: "queryA ETIMEOUT" persiste
-**Cause**: Backend pas redémarré ou code pas compilé
-**Solution**:
-```bash
-# 1. Tuer tous les backends
-lsof -ti:4000 | xargs kill -9
-
-# 2. Redémarrer proprement
-cd apps/backend
-npm run dev
-```
-
-### Problème: "EAUTH" authentication failed
-**Cause**: Credentials Mailtrap invalides
-**Solution**: Régénérer les credentials sur https://mailtrap.io
-
----
-
-## ✅ Checklist de Validation
-
-- [x] Méthodes `sendCarrierAccountCreated` et `sendCarrierPasswordReset` implémentées
-- [x] Comportement SYNCHRONE restauré avec `await` (au lieu de setImmediate/void)
-- [x] Configuration SMTP simplifiée (pas de contournement DNS nécessaire)
-- [x] `.env` mis à jour avec `sandbox.smtp.mailtrap.io`
-- [x] Backend redémarré proprement
-- [x] Email adapter initialisé avec bonne configuration
-- [x] Server écoute sur port 4000
-- [x] Redis connecté
-- [ ] Test end-to-end avec création CSV booking ← **À TESTER PAR L'UTILISATEUR**
-- [ ] Email reçu dans Mailtrap inbox ← **À VALIDER PAR L'UTILISATEUR**
-
----
-
-## 📝 Notes Techniques
-
-### Pourquoi l'IP Directe Fonctionne ?
-Node.js utilise `dns.resolve()` qui peut timeout même si le système DNS fonctionne. En utilisant l'IP directe, on contourne complètement la résolution DNS.
-
-### Pourquoi `servername` dans TLS ?
-Quand on utilise une IP directe, TLS ne peut pas vérifier le certificat sans le `servername`. On spécifie donc `smtp.mailtrap.io` manuellement.
-
-### Alternative (Non Implémentée)
-Configurer Node.js pour utiliser Google DNS:
-```javascript
-const dns = require('dns');
-dns.setServers(['8.8.8.8', '8.8.4.4']);
-```
-
----
-
-## 🎉 Résultat Final
-
-✅ **Problème résolu à 100%**
-- Emails aux transporteurs fonctionnent
-- Performance améliorée (~50% plus rapide)
-- Logs clairs et précis
-- Code robuste avec gestion d'erreurs
-
-**Prêt pour la production** 🚀

apps/backend/debug-email-flow.js

@@ -1,321 +0,0 @@
-/**
- * Script de debug pour tester le flux complet d'envoi d'email
- *
- * Ce script teste:
- * 1. Connexion SMTP
- * 2. Envoi d'un email simple
- * 3. Envoi avec le template complet
- */
-
-require('dotenv').config();
-const nodemailer = require('nodemailer');
-
-console.log('\n🔍 DEBUG - Flux d\'envoi d\'email transporteur\n');
-console.log('='.repeat(60));
-
-// 1. Afficher la configuration
-console.log('\n📋 CONFIGURATION ACTUELLE:');
-console.log('----------------------------');
-console.log('SMTP_HOST:', process.env.SMTP_HOST);
-console.log('SMTP_PORT:', process.env.SMTP_PORT);
-console.log('SMTP_SECURE:', process.env.SMTP_SECURE);
-console.log('SMTP_USER:', process.env.SMTP_USER);
-console.log('SMTP_PASS:', process.env.SMTP_PASS ? '***' + process.env.SMTP_PASS.slice(-4) : 'NON DÉFINI');
-console.log('SMTP_FROM:', process.env.SMTP_FROM);
-console.log('APP_URL:', process.env.APP_URL);
-
-// 2. Vérifier les variables requises
-console.log('\n✅ VÉRIFICATION DES VARIABLES:');
-console.log('--------------------------------');
-const requiredVars = ['SMTP_HOST', 'SMTP_PORT', 'SMTP_USER', 'SMTP_PASS'];
-const missing = requiredVars.filter(v => !process.env[v]);
-if (missing.length > 0) {
-  console.error('❌ Variables manquantes:', missing.join(', '));
-  process.exit(1);
-} else {
-  console.log('✅ Toutes les variables requises sont présentes');
-}
-
-// 3. Créer le transporter avec la même configuration que le backend
-console.log('\n🔧 CRÉATION DU TRANSPORTER:');
-console.log('----------------------------');
-
-const host = process.env.SMTP_HOST;
-const port = parseInt(process.env.SMTP_PORT);
-const user = process.env.SMTP_USER;
-const pass = process.env.SMTP_PASS;
-const secure = process.env.SMTP_SECURE === 'true';
-
-// Même logique que dans email.adapter.ts
-const useDirectIP = host.includes('mailtrap.io');
-const actualHost = useDirectIP ? '3.209.246.195' : host;
-const serverName = useDirectIP ? 'smtp.mailtrap.io' : host;
-
-console.log('Configuration détectée:');
-console.log('  Host original:', host);
-console.log('  Utilise IP directe:', useDirectIP);
-console.log('  Host réel:', actualHost);
-console.log('  Server name (TLS):', serverName);
-console.log('  Port:', port);
-console.log('  Secure:', secure);
-
-const transporter = nodemailer.createTransport({
-  host: actualHost,
-  port,
-  secure,
-  auth: {
-    user,
-    pass,
-  },
-  tls: {
-    rejectUnauthorized: false,
-    servername: serverName,
-  },
-  connectionTimeout: 10000,
-  greetingTimeout: 10000,
-  socketTimeout: 30000,
-  dnsTimeout: 10000,
-});
-
-// 4. Tester la connexion
-console.log('\n🔌 TEST DE CONNEXION SMTP:');
-console.log('---------------------------');
-
-async function testConnection() {
-  try {
-    console.log('Vérification de la connexion...');
-    await transporter.verify();
-    console.log('✅ Connexion SMTP réussie!');
-    return true;
-  } catch (error) {
-    console.error('❌ Échec de la connexion SMTP:');
-    console.error('   Message:', error.message);
-    console.error('   Code:', error.code);
-    console.error('   Command:', error.command);
-    if (error.stack) {
-      console.error('   Stack:', error.stack.substring(0, 200) + '...');
-    }
-    return false;
-  }
-}
-
-// 5. Envoyer un email de test simple
-async function sendSimpleEmail() {
-  console.log('\n📧 TEST 1: Email simple');
-  console.log('------------------------');
-
-  try {
-    const info = await transporter.sendMail({
-      from: process.env.SMTP_FROM || 'noreply@xpeditis.com',
-      to: 'test@example.com',
-      subject: 'Test Simple - ' + new Date().toISOString(),
-      text: 'Ceci est un test simple',
-      html: '<h1>Test Simple</h1><p>Ceci est un test simple</p>',
-    });
-
-    console.log('✅ Email simple envoyé avec succès!');
-    console.log('   Message ID:', info.messageId);
-    console.log('   Response:', info.response);
-    console.log('   Accepted:', info.accepted);
-    console.log('   Rejected:', info.rejected);
-    return true;
-  } catch (error) {
-    console.error('❌ Échec d\'envoi email simple:');
-    console.error('   Message:', error.message);
-    console.error('   Code:', error.code);
-    return false;
-  }
-}
-
-// 6. Envoyer un email avec le template transporteur complet
-async function sendCarrierEmail() {
-  console.log('\n📧 TEST 2: Email transporteur avec template');
-  console.log('--------------------------------------------');
-
-  const bookingData = {
-    bookingId: 'TEST-' + Date.now(),
-    origin: 'FRPAR',
-    destination: 'USNYC',
-    volumeCBM: 15.5,
-    weightKG: 1200,
-    palletCount: 6,
-    priceUSD: 2500,
-    priceEUR: 2250,
-    primaryCurrency: 'USD',
-    transitDays: 18,
-    containerType: '40FT',
-    documents: [
-      { type: 'Bill of Lading', fileName: 'bol-test.pdf' },
-      { type: 'Packing List', fileName: 'packing-test.pdf' },
-      { type: 'Commercial Invoice', fileName: 'invoice-test.pdf' },
-    ],
-  };
-
-  const baseUrl = process.env.APP_URL || 'http://localhost:3000';
-  const acceptUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.bookingId}/accept`;
-  const rejectUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.bookingId}/reject`;
-
-  // Template HTML (version simplifiée pour le test)
-  const htmlTemplate = `
-    <!DOCTYPE html>
-    <html lang="fr">
-    <head>
-      <meta charset="UTF-8">
-      <meta name="viewport" content="width=device-width, initial-scale=1.0">
-      <title>Nouvelle demande de réservation</title>
-    </head>
-    <body style="margin: 0; padding: 0; font-family: Arial, sans-serif; background-color: #f4f6f8;">
-      <div style="max-width: 600px; margin: 20px auto; background-color: #ffffff; border-radius: 8px; overflow: hidden; box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);">
-        <div style="background: linear-gradient(135deg, #045a8d, #00bcd4); color: #ffffff; padding: 30px 20px; text-align: center;">
-          <h1 style="margin: 0; font-size: 28px;">🚢 Nouvelle demande de réservation</h1>
-          <p style="margin: 5px 0 0; font-size: 14px;">Xpeditis</p>
-        </div>
-        <div style="padding: 30px 20px;">
-          <p style="font-size: 16px;">Bonjour,</p>
-          <p>Vous avez reçu une nouvelle demande de réservation via Xpeditis.</p>
-
-          <h2 style="color: #045a8d; border-bottom: 2px solid #00bcd4; padding-bottom: 8px;">📋 Détails du transport</h2>
-          <table style="width: 100%; border-collapse: collapse;">
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Route</td>
-              <td style="padding: 12px;">${bookingData.origin} → ${bookingData.destination}</td>
-            </tr>
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Volume</td>
-              <td style="padding: 12px;">${bookingData.volumeCBM} CBM</td>
-            </tr>
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Poids</td>
-              <td style="padding: 12px;">${bookingData.weightKG} kg</td>
-            </tr>
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Prix</td>
-              <td style="padding: 12px; font-size: 24px; font-weight: bold; color: #00aa00;">
-                ${bookingData.priceUSD} USD
-              </td>
-            </tr>
-          </table>
-
-          <div style="background-color: #f9f9f9; padding: 20px; border-radius: 6px; margin: 20px 0;">
-            <h3 style="margin-top: 0; color: #045a8d;">📄 Documents fournis</h3>
-            <ul style="list-style: none; padding: 0; margin: 10px 0 0;">
-              ${bookingData.documents.map(doc => `<li style="padding: 8px 0;">📄 <strong>${doc.type}:</strong> ${doc.fileName}</li>`).join('')}
-            </ul>
-          </div>
-
-          <div style="text-align: center; margin: 30px 0;">
-            <p style="font-weight: bold; font-size: 16px;">Veuillez confirmer votre décision :</p>
-            <div style="margin: 15px 0;">
-              <a href="${acceptUrl}" style="display: inline-block; padding: 15px 30px; background-color: #00aa00; color: #ffffff; text-decoration: none; border-radius: 6px; margin: 0 5px; min-width: 200px;">✓ Accepter la demande</a>
-              <a href="${rejectUrl}" style="display: inline-block; padding: 15px 30px; background-color: #cc0000; color: #ffffff; text-decoration: none; border-radius: 6px; margin: 0 5px; min-width: 200px;">✗ Refuser la demande</a>
-            </div>
-          </div>
-
-          <div style="background-color: #fff8e1; border-left: 4px solid #f57c00; padding: 15px; margin: 20px 0; border-radius: 4px;">
-            <p style="margin: 0; font-size: 14px; color: #666;">
-              <strong style="color: #f57c00;">⚠️ Important</strong><br>
-              Cette demande expire automatiquement dans <strong>7 jours</strong> si aucune action n'est prise.
-            </p>
-          </div>
-        </div>
-        <div style="background-color: #f4f6f8; padding: 20px; text-align: center; font-size: 12px; color: #666;">
-          <p style="margin: 5px 0; font-weight: bold; color: #045a8d;">Référence de réservation : ${bookingData.bookingId}</p>
-          <p style="margin: 5px 0;">© 2025 Xpeditis. Tous droits réservés.</p>
-          <p style="margin: 5px 0;">Cet email a été envoyé automatiquement. Merci de ne pas y répondre directement.</p>
-        </div>
-      </div>
-    </body>
-    </html>
-  `;
-
-  try {
-    console.log('Données du booking:');
-    console.log('  Booking ID:', bookingData.bookingId);
-    console.log('  Route:', bookingData.origin, '→', bookingData.destination);
-    console.log('  Prix:', bookingData.priceUSD, 'USD');
-    console.log('  Accept URL:', acceptUrl);
-    console.log('  Reject URL:', rejectUrl);
-    console.log('\nEnvoi en cours...');
-
-    const info = await transporter.sendMail({
-      from: process.env.SMTP_FROM || 'noreply@xpeditis.com',
-      to: 'carrier@test.com',
-      subject: `Nouvelle demande de réservation - ${bookingData.origin} → ${bookingData.destination}`,
-      html: htmlTemplate,
-    });
-
-    console.log('\n✅ Email transporteur envoyé avec succès!');
-    console.log('   Message ID:', info.messageId);
-    console.log('   Response:', info.response);
-    console.log('   Accepted:', info.accepted);
-    console.log('   Rejected:', info.rejected);
-    console.log('\n📬 Vérifiez votre inbox Mailtrap:');
-    console.log('   URL: https://mailtrap.io/inboxes');
-    console.log('   Sujet: Nouvelle demande de réservation - FRPAR → USNYC');
-    return true;
-  } catch (error) {
-    console.error('\n❌ Échec d\'envoi email transporteur:');
-    console.error('   Message:', error.message);
-    console.error('   Code:', error.code);
-    console.error('   ResponseCode:', error.responseCode);
-    console.error('   Response:', error.response);
-    if (error.stack) {
-      console.error('   Stack:', error.stack.substring(0, 300));
-    }
-    return false;
-  }
-}
-
-// Exécuter tous les tests
-async function runAllTests() {
-  console.log('\n🚀 DÉMARRAGE DES TESTS');
-  console.log('='.repeat(60));
-
-  // Test 1: Connexion
-  const connectionOk = await testConnection();
-  if (!connectionOk) {
-    console.log('\n❌ ARRÊT: La connexion SMTP a échoué');
-    console.log('   Vérifiez vos credentials SMTP dans .env');
-    process.exit(1);
-  }
-
-  // Test 2: Email simple
-  const simpleEmailOk = await sendSimpleEmail();
-  if (!simpleEmailOk) {
-    console.log('\n⚠️  L\'email simple a échoué, mais on continue...');
-  }
-
-  // Test 3: Email transporteur
-  const carrierEmailOk = await sendCarrierEmail();
-
-  // Résumé
-  console.log('\n' + '='.repeat(60));
-  console.log('📊 RÉSUMÉ DES TESTS:');
-  console.log('='.repeat(60));
-  console.log('Connexion SMTP:', connectionOk ? '✅ OK' : '❌ ÉCHEC');
-  console.log('Email simple:', simpleEmailOk ? '✅ OK' : '❌ ÉCHEC');
-  console.log('Email transporteur:', carrierEmailOk ? '✅ OK' : '❌ ÉCHEC');
-
-  if (connectionOk && simpleEmailOk && carrierEmailOk) {
-    console.log('\n✅ TOUS LES TESTS ONT RÉUSSI!');
-    console.log('   Le système d\'envoi d\'email fonctionne correctement.');
-    console.log('   Si vous ne recevez pas les emails dans le backend,');
-    console.log('   le problème vient de l\'intégration NestJS.');
-  } else {
-    console.log('\n❌ CERTAINS TESTS ONT ÉCHOUÉ');
-    console.log('   Vérifiez les erreurs ci-dessus pour comprendre le problème.');
-  }
-
-  console.log('\n' + '='.repeat(60));
-}
-
-// Lancer les tests
-runAllTests()
-  .then(() => {
-    console.log('\n✅ Tests terminés\n');
-    process.exit(0);
-  })
-  .catch(error => {
-    console.error('\n❌ Erreur fatale:', error);
-    process.exit(1);
-  });

apps/backend/docker-compose.yaml

@@ -1,19 +0,0 @@
-services:
-  postgres:
-    image: postgres:latest
-    container_name: xpeditis-postgres
-    environment:
-      POSTGRES_USER: xpeditis
-      POSTGRES_PASSWORD: xpeditis_dev_password
-      POSTGRES_DB: xpeditis_dev
-    ports:
-      - "5432:5432"
-
-  redis:
-    image: redis:7
-    container_name: xpeditis-redis
-    command: redis-server --requirepass xpeditis_redis_password
-    environment:
-      REDIS_PASSWORD: xpeditis_redis_password
-    ports:
-      - "6379:6379"

apps/backend/docker-entrypoint.sh

@@ -4,7 +4,7 @@ echo "Waiting for PostgreSQL..."
 max_attempts=30
 attempt=0
 while [ $attempt -lt $max_attempts ]; do
-  if node -e "const { Client } = require('pg'); const client = new Client({ host: process.env.DATABASE_HOST, port: process.env.DATABASE_PORT, user: process.env.DATABASE_USER, password: process.env.DATABASE_PASSWORD, database: process.env.DATABASE_NAME }); client.connect().then(() => { client.end(); process.exit(0); }).catch(() => process.exit(1));" 2>/dev/null; then
+  if node -e "const { Client } = require('pg'); const { databaseTlsOptions } = require('/app/dist/infrastructure/persistence/typeorm/database-tls'); const client = new Client({ host: process.env.DATABASE_HOST, port: process.env.DATABASE_PORT, user: process.env.DATABASE_USER, password: process.env.DATABASE_PASSWORD, database: process.env.DATABASE_NAME, ssl: databaseTlsOptions(process.env.DATABASE_SSL, process.env.DATABASE_SSL_CA, process.env.DATABASE_HOST) }); client.connect().then(() => { client.end(); process.exit(0); }).catch(() => process.exit(1));" 2>/dev/null; then
     echo "PostgreSQL is ready"
     break
   fi

apps/backend/nest-cli.json

@@ -6,6 +6,11 @@
     "deleteOutDir": true,
     "builder": "tsc",
     "tsConfigPath": "tsconfig.build.json",
-    "plugins": ["@nestjs/swagger"]
+    "plugins": ["@nestjs/swagger"],
+    "assets": [
+      { "include": "i18n/**/*.json", "outDir": "dist" },
+      { "include": "infrastructure/ai/knowledge/*.json", "outDir": "dist" }
+    ],
+    "watchAssets": true
   }
 }

apps/backend/package.json

@@ -6,6 +6,7 @@
   "scripts": {
     "build": "nest build && tsc-alias -p tsconfig.build.json",
     "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "knowledge:build": "node scripts/setup/build-knowledge-corpus.js",
     "start": "nest start",
     "dev": "nest start --watch",
     "start:debug": "nest start --debug --watch",
@@ -28,21 +29,21 @@
     "@aws-sdk/lib-storage": "^3.906.0",
     "@aws-sdk/s3-request-presigner": "^3.906.0",
     "@nestjs/axios": "^4.0.1",
-    "@nestjs/common": "^10.2.10",
-    "@nestjs/config": "^3.1.1",
-    "@nestjs/core": "^10.2.10",
-    "@nestjs/jwt": "^10.2.0",
-    "@nestjs/passport": "^10.0.3",
-    "@nestjs/platform-express": "^10.2.10",
-    "@nestjs/platform-socket.io": "^10.4.20",
-    "@nestjs/swagger": "^7.1.16",
+    "@nestjs/common": "^11.2.6",
+    "@nestjs/config": "^4.0.4",
+    "@nestjs/core": "^11.2.6",
+    "@nestjs/jwt": "^11.0.2",
+    "@nestjs/passport": "^11.0.5",
+    "@nestjs/platform-express": "^11.2.6",
+    "@nestjs/platform-socket.io": "^11.2.6",
+    "@nestjs/schedule": "^6.1.3",
+    "@nestjs/swagger": "^11.4.7",
     "@nestjs/throttler": "^6.4.0",
-    "@nestjs/typeorm": "^10.0.1",
-    "@nestjs/websockets": "^10.4.20",
+    "@nestjs/typeorm": "^11.0.3",
+    "@nestjs/websockets": "^11.2.6",
     "@sentry/node": "^10.19.0",
     "@sentry/profiling-node": "^10.19.0",
     "@types/leaflet": "^1.9.21",
-    "@types/mjml": "^4.7.4",
     "@types/nodemailer": "^7.0.2",
     "@types/opossum": "^8.1.9",
     "@types/pdfkit": "^0.17.3",
@@ -51,6 +52,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.2",
     "compression": "^1.8.1",
+    "cookie-parser": "^1.4.7",
     "csv-parse": "^6.1.0",
     "exceljs": "^4.4.0",
     "handlebars": "^4.7.8",
@@ -58,9 +60,10 @@
     "ioredis": "^5.8.1",
     "joi": "^17.11.0",
     "leaflet": "^1.9.4",
-    "mjml": "^4.16.1",
+    "mjml": "^5.4.1",
+    "nestjs-i18n": "^10.6.5",
     "nestjs-pino": "^4.4.1",
-    "nodemailer": "^7.0.9",
+    "nodemailer": "^10.0.10",
     "opossum": "^8.1.3",
     "passport": "^0.7.0",
     "passport-google-oauth20": "^2.0.0",
@@ -74,6 +77,7 @@
     "react-leaflet": "^5.0.0",
     "reflect-metadata": "^0.1.14",
     "rxjs": "^7.8.1",
+    "sharp": "^0.35.3",
     "socket.io": "^4.8.1",
     "stripe": "^14.14.0",
     "typeorm": "^0.3.17",
@@ -81,13 +85,15 @@
   },
   "devDependencies": {
     "@faker-js/faker": "^10.0.0",
-    "@nestjs/cli": "^10.2.1",
-    "@nestjs/schematics": "^10.0.3",
-    "@nestjs/testing": "^10.2.10",
+    "@nestjs/cli": "^11.0.20",
+    "@nestjs/schematics": "^11.1.0",
+    "@nestjs/testing": "^11.2.6",
     "@types/bcrypt": "^5.0.2",
     "@types/compression": "^1.8.1",
-    "@types/express": "^4.17.21",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/express": "^5.0.6",
     "@types/jest": "^29.5.11",
+    "@types/mjml": "^5.0.0",
     "@types/multer": "^2.0.0",
     "@types/node": "^20.10.5",
     "@types/passport-google-oauth20": "^2.0.14",

apps/backend/scripts/maintenance/delete-test-documents.js

@@ -100,7 +100,7 @@ deleteTestDocuments()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/maintenance/fix-domain-imports.js

@@ -14,7 +14,7 @@ function fixImportsInFile(filePath) {
 
   // Replace relative imports to ../ports/ with @domain/ports/
   modified = modified.replace(/from ['"]\.\.\/ports\//g, "from '@domain/ports/");
-  modified = modified.replace(/import\s+(['"])\.\.\/ports\//g, "import $1@domain/ports/");
+  modified = modified.replace(/import\s+(['"])\.\.\/ports\//g, 'import $1@domain/ports/');
 
   if (modified !== content) {
     fs.writeFileSync(filePath, modified, 'utf8');

apps/backend/scripts/maintenance/fix-dummy-urls.js

@@ -37,7 +37,7 @@ async function fixDummyUrls() {
       const documents = row.documents;
 
       // Update each document URL
-      const updatedDocuments = documents.map((doc) => {
+      const updatedDocuments = documents.map(doc => {
         if (doc.filePath && doc.filePath.includes('dummy-storage')) {
           // Extract filename from dummy URL
           const fileName = doc.fileName || doc.filePath.split('/').pop();
@@ -58,10 +58,10 @@ async function fixDummyUrls() {
       });
 
       // Update the database
-      await client.query(
-        `UPDATE csv_bookings SET documents = $1 WHERE id = $2`,
-        [JSON.stringify(updatedDocuments), bookingId]
-      );
+      await client.query(`UPDATE csv_bookings SET documents = $1 WHERE id = $2`, [
+        JSON.stringify(updatedDocuments),
+        bookingId,
+      ]);
 
       updatedCount++;
       console.log(`✅ Updated booking ${bookingId}\n`);
@@ -84,7 +84,7 @@ fixDummyUrls()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/maintenance/fix-imports.js

@@ -24,10 +24,13 @@ function fixImportsInFile(filePath) {
   modified = modified.replace(/from ['"]\.\.\/domain\//g, "from '@domain/");
 
   // Also fix import statements (not just from)
-  modified = modified.replace(/import\s+(['"])\.\.\/\.\.\/\.\.\/\.\.\/domain\//g, "import $1@domain/");
-  modified = modified.replace(/import\s+(['"])\.\.\/\.\.\/\.\.\/domain\//g, "import $1@domain/");
-  modified = modified.replace(/import\s+(['"])\.\.\/\.\.\/domain\//g, "import $1@domain/");
-  modified = modified.replace(/import\s+(['"])\.\.\/domain\//g, "import $1@domain/");
+  modified = modified.replace(
+    /import\s+(['"])\.\.\/\.\.\/\.\.\/\.\.\/domain\//g,
+    'import $1@domain/'
+  );
+  modified = modified.replace(/import\s+(['"])\.\.\/\.\.\/\.\.\/domain\//g, 'import $1@domain/');
+  modified = modified.replace(/import\s+(['"])\.\.\/\.\.\/domain\//g, 'import $1@domain/');
+  modified = modified.replace(/import\s+(['"])\.\.\/domain\//g, 'import $1@domain/');
 
   if (modified !== content) {
     fs.writeFileSync(filePath, modified, 'utf8');

apps/backend/scripts/maintenance/fix-minio-hostname.js

@@ -34,7 +34,7 @@ async function fixMinioHostname() {
       const documents = row.documents;
 
       // Update each document URL
-      const updatedDocuments = documents.map((doc) => {
+      const updatedDocuments = documents.map(doc => {
         if (doc.filePath && doc.filePath.includes('http://minio:9000')) {
           const newUrl = doc.filePath.replace('http://minio:9000', 'http://localhost:9000');
 
@@ -51,10 +51,10 @@ async function fixMinioHostname() {
       });
 
       // Update the database
-      await client.query(
-        `UPDATE csv_bookings SET documents = $1 WHERE id = $2`,
-        [JSON.stringify(updatedDocuments), bookingId]
-      );
+      await client.query(`UPDATE csv_bookings SET documents = $1 WHERE id = $2`, [
+        JSON.stringify(updatedDocuments),
+        bookingId,
+      ]);
 
       updatedCount++;
       console.log(`✅ Updated booking ${bookingId}\n`);
@@ -75,7 +75,7 @@ fixMinioHostname()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/maintenance/restore-document-references.js

@@ -120,11 +120,17 @@ async function restoreDocumentReferences() {
 
         // Determine document type
         let docType = 'OTHER';
-        if (file.fileName.toLowerCase().includes('bill-of-lading') || file.fileName.toLowerCase().includes('bol')) {
+        if (
+          file.fileName.toLowerCase().includes('bill-of-lading') ||
+          file.fileName.toLowerCase().includes('bol')
+        ) {
           docType = 'BILL_OF_LADING';
         } else if (file.fileName.toLowerCase().includes('packing-list')) {
           docType = 'PACKING_LIST';
-        } else if (file.fileName.toLowerCase().includes('commercial-invoice') || file.fileName.toLowerCase().includes('invoice')) {
+        } else if (
+          file.fileName.toLowerCase().includes('commercial-invoice') ||
+          file.fileName.toLowerCase().includes('invoice')
+        ) {
           docType = 'COMMERCIAL_INVOICE';
         }
 
@@ -143,10 +149,10 @@ async function restoreDocumentReferences() {
       });
 
       // Update the booking with new document references
-      await pgClient.query(
-        'UPDATE csv_bookings SET documents = $1 WHERE id = $2',
-        [JSON.stringify(newDocuments), bookingId]
-      );
+      await pgClient.query('UPDATE csv_bookings SET documents = $1 WHERE id = $2', [
+        JSON.stringify(newDocuments),
+        bookingId,
+      ]);
 
       updatedCount++;
       createdDocsCount += newDocuments.length;
@@ -170,7 +176,7 @@ restoreDocumentReferences()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/maintenance/sync-database-with-minio.js

@@ -114,10 +114,10 @@ async function syncDatabase() {
         });
 
         // Update the database
-        await pgClient.query(
-          `UPDATE csv_bookings SET documents = $1 WHERE id = $2`,
-          [JSON.stringify(validDocuments), bookingId]
-        );
+        await pgClient.query(`UPDATE csv_bookings SET documents = $1 WHERE id = $2`, [
+          JSON.stringify(validDocuments),
+          bookingId,
+        ]);
 
         updatedCount++;
         removedDocsCount += missingDocuments.length;
@@ -148,7 +148,7 @@ syncDatabase()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/setup/admin-password.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+/**
+ * Commande de secours : définit le mot de passe d'un administrateur, sans SMTP.
+ *
+ * Dans le conteneur backend (le script est copié dans l'image) :
+ *   docker exec -it <conteneur-backend> node admin-password.js admin@xpeditis.com
+ * En local :
+ *   cd apps/backend && node scripts/setup/admin-password.js admin@xpeditis.com
+ *
+ * Le compte est créé s'il n'existe pas, sinon promu ADMIN et réactivé, puis son
+ * mot de passe est remplacé. Le mot de passe est saisi sans écho : ni argument
+ * de ligne de commande (visible dans `ps` et l'historique du shell), ni
+ * variable d'environnement. Il peut aussi être passé sur l'entrée standard
+ * pour une exécution scriptée.
+ *
+ * Connexion à la base : variables DATABASE_* déjà présentes dans le conteneur.
+ */
+
+'use strict';
+
+const readline = require('readline');
+const argon2 = require('argon2');
+const { Client } = require('pg');
+
+// Mêmes paramètres que auth.service.ts.
+const ARGON2_OPTIONS = { type: argon2.argon2id, memoryCost: 65536, timeCost: 3, parallelism: 4 };
+const MIN_LENGTH = 12;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+/** Saisie masquée sur un terminal ; lecture directe si l'entrée est redirigée. */
+function readSecret(prompt) {
+  return new Promise((resolve, reject) => {
+    if (!process.stdin.isTTY) {
+      let data = '';
+      process.stdin.setEncoding('utf8');
+      process.stdin.on('data', chunk => (data += chunk));
+      process.stdin.on('end', () => resolve(data.replace(/\r?\n$/, '')));
+      process.stdin.on('error', reject);
+      return;
+    }
+
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const onKeypress = () => {
+      readline.clearLine(process.stdout, 0);
+      readline.cursorTo(process.stdout, 0);
+      process.stdout.write(prompt);
+    };
+    process.stdout.write(prompt);
+    process.stdin.on('data', onKeypress);
+    rl.question('', answer => {
+      process.stdin.removeListener('data', onKeypress);
+      rl.close();
+      process.stdout.write('\n');
+      resolve(answer);
+    });
+  });
+}
+
+function strengthProblems(password) {
+  const problems = [];
+  if (password.length < MIN_LENGTH) problems.push(`au moins ${MIN_LENGTH} caractères`);
+  if (!/[a-z]/.test(password)) problems.push('une minuscule');
+  if (!/[A-Z]/.test(password)) problems.push('une majuscule');
+  if (!/[0-9]/.test(password)) problems.push('un chiffre');
+  return problems;
+}
+
+function env(name, fallback) {
+  const value = (process.env[name] || '').trim();
+  return value || fallback;
+}
+
+async function main() {
+  const email = (process.argv[2] || '').trim().toLowerCase();
+  if (!EMAIL_PATTERN.test(email)) {
+    console.error('Usage : node admin-password.js <email-administrateur>');
+    process.exit(1);
+  }
+
+  const password = await readSecret(`Nouveau mot de passe pour ${email} : `);
+  if (process.stdin.isTTY) {
+    const confirmation = await readSecret('Confirmation : ');
+    if (confirmation !== password) {
+      console.error('Les deux saisies diffèrent.');
+      process.exit(1);
+    }
+  }
+
+  const problems = strengthProblems(password);
+  if (problems.length > 0) {
+    console.error(`Mot de passe refusé. Il manque : ${problems.join(', ')}.`);
+    process.exit(1);
+  }
+
+  const passwordHash = await argon2.hash(password, ARGON2_OPTIONS);
+
+  const client = new Client({
+    host: env('DATABASE_HOST', 'localhost'),
+    port: Number(env('DATABASE_PORT', '5432')),
+    user: env('DATABASE_USER', 'xpeditis'),
+    password: process.env.DATABASE_PASSWORD,
+    database: env('DATABASE_NAME', 'xpeditis_dev'),
+    // Même règle que data-source.ts : en production, pg_hba n'accepte que SSL.
+    ssl: process.env.DATABASE_SSL === 'true' ? { rejectUnauthorized: false } : false,
+  });
+
+  await client.connect();
+  try {
+    await client.query('BEGIN');
+
+    const existing = await client.query('SELECT "id" FROM "users" WHERE "email" = $1', [email]);
+
+    if (existing.rows.length > 0) {
+      // Réactiver ou promouvoir n'est jamais bloqué par le déclencheur
+      // « au moins un administrateur actif ».
+      await client.query(
+        `UPDATE "users"
+            SET "password_hash" = $2, "role" = 'ADMIN', "is_active" = true, "updated_at" = NOW()
+          WHERE "id" = $1`,
+        [existing.rows[0].id, passwordHash]
+      );
+      console.log(`Compte ${email} : mot de passe défini, rôle ADMIN, compte actif.`);
+    } else {
+      const organization = await client.query(
+        `INSERT INTO "organizations"
+           ("name", "type", "address_street", "address_city", "address_postal_code", "address_country")
+         VALUES ($1, 'FREIGHT_FORWARDER', $2, $3, $4, $5)
+         ON CONFLICT ("name") DO UPDATE SET "updated_at" = NOW()
+         RETURNING "id"`,
+        [
+          env('BOOTSTRAP_ADMIN_ORG_NAME', 'Xpeditis'),
+          env('BOOTSTRAP_ADMIN_ORG_STREET', 'A completer'),
+          env('BOOTSTRAP_ADMIN_ORG_CITY', 'A completer'),
+          env('BOOTSTRAP_ADMIN_ORG_POSTAL_CODE', '00000'),
+          env('BOOTSTRAP_ADMIN_ORG_COUNTRY', 'FR').toUpperCase(),
+        ]
+      );
+      await client.query(
+        `INSERT INTO "users"
+           ("organization_id", "email", "password_hash", "role", "first_name", "last_name",
+            "is_email_verified", "is_active")
+         VALUES ($1, $2, $3, 'ADMIN', $4, $5, true, true)`,
+        [
+          organization.rows[0].id,
+          email,
+          passwordHash,
+          env('BOOTSTRAP_ADMIN_FIRST_NAME', 'Admin'),
+          env('BOOTSTRAP_ADMIN_LAST_NAME', 'Xpeditis'),
+        ]
+      );
+      console.log(`Administrateur ${email} créé et actif.`);
+    }
+
+    await client.query('COMMIT');
+    console.log('Vous pouvez vous connecter. Changez ce mot de passe depuis l’interface si besoin.');
+  } catch (error) {
+    await client.query('ROLLBACK').catch(() => undefined);
+    throw error;
+  } finally {
+    await client.end();
+  }
+}
+
+main().catch(error => {
+  console.error('Échec :', error.message);
+  process.exit(1);
+});

apps/backend/scripts/setup/build-knowledge-corpus.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+/**
+ * Construit le corpus de connaissances de l'assistant a partir du wiki du site.
+ *
+ * Le wiki n'est pas ecrit en dur dans des pages : son contenu vit dans les
+ * fichiers de traduction du frontend, sous `dashboard.wikiPages`. C'est donc la
+ * source de verite, et la meme que celle que lit l'utilisateur — une reponse de
+ * l'assistant et la page wiki citee ne peuvent pas diverger.
+ *
+ * Le corpus est ecrit dans le backend et versionne : l'image backend ne doit
+ * pas dependre des fichiers du frontend a l'execution.
+ *
+ * Usage : npm run knowledge:build
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '../../../..');
+const MESSAGES = path.join(ROOT, 'apps/frontend/messages');
+const OUT = path.resolve(__dirname, '../../src/infrastructure/ai/knowledge/wiki-corpus.json');
+
+const LOCALES = ['fr', 'en'];
+
+/** Les cles de mise en page ne portent aucune connaissance. */
+const LAYOUT_KEYS = /^(col[A-Z]|.*Title$|.*Label$|backToWiki)/;
+
+/** `documentsTransport` -> `documents-transport`, l'URL de la page wiki. */
+const toSlug = key => key.replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase();
+
+const humanize = key =>
+  key
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/^./, c => c.toUpperCase())
+    .trim();
+
+/**
+ * Nomme un champ d'objet dans la langue du wiki.
+ *
+ * Les cles de traduction sont en anglais (`code`, `name`, `description`) mais
+ * chaque sujet publie deja ses en-tetes de colonnes (`colCode`, `colName`...) :
+ * les reutiliser evite d'ecrire « Name: » au milieu d'un fragment francais.
+ */
+const labelFor = (topic, key) => topic[`col${key[0].toUpperCase()}${key.slice(1)}`] ?? humanize(key);
+
+/** Aplatit une valeur de traduction en lignes lisibles par un modele. */
+function toLines(value, topic) {
+  if (typeof value === 'string') return [value];
+  if (typeof value === 'number' || typeof value === 'boolean') return [String(value)];
+  if (Array.isArray(value)) return value.flatMap(item => toLines(item, topic));
+
+  if (value && typeof value === 'object') {
+    // Un objet de table se lit mieux sur une ligne qu'eclate en champs :
+    // « Code: 40 00 — Nom: Mise en Libre Pratique — Description: ... ».
+    const entries = Object.entries(value).filter(([, v]) => v !== null && v !== undefined);
+    const scalars = entries.filter(([, v]) => typeof v === 'string' || typeof v === 'number');
+    const rest = entries.filter(([, v]) => typeof v === 'object');
+
+    const head = scalars.map(([k, v]) => `${labelFor(topic, k)}: ${v}`).join(' — ');
+    return [
+      head,
+      ...rest.flatMap(([k, v]) => toLines(v, topic).map(line => `${labelFor(topic, k)}: ${line}`)),
+    ].filter(Boolean);
+  }
+
+  return [];
+}
+
+/**
+ * Un fragment par section du sujet. Une section = un champ de premier niveau,
+ * intitule par son `*Title` voisin quand il existe. Decouper plus finement
+ * casserait les tableaux (un Incoterm isole de sa colonne « risque ») ;
+ * decouper moins finement noierait la reponse sous 4 000 caracteres.
+ */
+function chunksForTopic(locale, topicKey, topic) {
+  const title = topic.title ?? humanize(topicKey);
+  const href = `/dashboard/wiki/${toSlug(topicKey)}`;
+  const chunks = [];
+
+  const header = [topic.title, topic.description].filter(Boolean).join('\n');
+  if (header) {
+    chunks.push({ section: title, text: header });
+  }
+
+  for (const [key, value] of Object.entries(topic)) {
+    if (key === 'title' || key === 'description') continue;
+    if (LAYOUT_KEYS.test(key)) continue;
+
+    const lines = toLines(value, topic).filter(Boolean);
+    if (!lines.length) continue;
+
+    const section = topic[`${key}Title`] ?? humanize(key);
+    chunks.push({ section, text: `${section}\n${lines.map(line => `- ${line}`).join('\n')}` });
+  }
+
+  return chunks.map((chunk, index) => ({
+    id: `${locale}:${topicKey}:${index}`,
+    locale,
+    topic: topicKey,
+    title,
+    section: chunk.section,
+    href,
+    text: chunk.text,
+  }));
+}
+
+const documents = [];
+
+for (const locale of LOCALES) {
+  const file = path.join(MESSAGES, `${locale}.json`);
+  const wiki = JSON.parse(fs.readFileSync(file, 'utf8')).dashboard?.wikiPages;
+  if (!wiki) throw new Error(`dashboard.wikiPages introuvable dans ${file}`);
+
+  for (const [topicKey, topic] of Object.entries(wiki)) {
+    // Les libelles partages (`responsibleLabel`...) sont des chaines, pas des sujets.
+    if (!topic || typeof topic !== 'object' || Array.isArray(topic)) continue;
+    documents.push(...chunksForTopic(locale, topicKey, topic));
+  }
+}
+
+fs.mkdirSync(path.dirname(OUT), { recursive: true });
+fs.writeFileSync(OUT, JSON.stringify({ documents }, null, 2) + '\n');
+
+const byLocale = LOCALES.map(l => `${l}: ${documents.filter(d => d.locale === l).length}`).join(', ');
+const chars = documents.reduce((sum, d) => sum + d.text.length, 0);
+console.log(`${documents.length} fragments (${byLocale}) — ${chars} caracteres`);
+console.log(`écrit dans ${path.relative(ROOT, OUT)}`);

apps/backend/scripts/setup/generate-admin-hash.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+/**
+ * Génère un hash Argon2id pour BOOTSTRAP_ADMIN_PASSWORD_HASH.
+ *
+ *   cd apps/backend && node scripts/setup/generate-admin-hash.js
+ *
+ * Le mot de passe est saisi sans écho et ne quitte jamais votre poste : ni
+ * argument de ligne de commande (visible dans `ps` et dans l'historique du
+ * shell), ni variable d'environnement, ni fichier temporaire.
+ *
+ * Le hash est appliqué à CHAQUE lancement du backend (AdminBootstrapService) :
+ *   - au compte BOOTSTRAP_ADMIN_EMAIL s'il ne s'est encore jamais connecté ;
+ *   - à tout compte si BOOTSTRAP_ADMIN_RESET_PASSWORD=true (retirez ensuite
+ *     les deux variables, sinon un mot de passe changé depuis l'interface
+ *     serait remplacé au lancement suivant).
+ *
+ * Sans hash, le compte est créé sans mot de passe utilisable : il faut alors
+ * « mot de passe oublié » (SMTP requis) ou, sans SMTP, la commande de secours :
+ *   docker exec -it <conteneur-backend> node admin-password.js <email>
+ */
+
+'use strict';
+
+const argon2 = require('argon2');
+const readline = require('readline');
+
+// Mêmes paramètres que auth.service.ts : un hash produit ici est vérifiable
+// par l'application sans aucune adaptation.
+const ARGON2_OPTIONS = {
+  type: argon2.argon2id,
+  memoryCost: 65536, // 64 Mo
+  timeCost: 3,
+  parallelism: 4,
+};
+
+const MIN_LENGTH = 16;
+
+/** Saisie masquée sur un terminal ; lecture directe si l'entrée est redirigée. */
+function readSecret(prompt) {
+  return new Promise((resolve, reject) => {
+    if (!process.stdin.isTTY) {
+      let data = '';
+      process.stdin.setEncoding('utf8');
+      process.stdin.on('data', chunk => (data += chunk));
+      process.stdin.on('end', () => resolve(data.replace(/\r?\n$/, '')));
+      process.stdin.on('error', reject);
+      return;
+    }
+
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const onKeypress = () => {
+      // Réécrit la ligne sans révéler la longueur de la saisie.
+      readline.clearLine(process.stdout, 0);
+      readline.cursorTo(process.stdout, 0);
+      process.stdout.write(prompt);
+    };
+
+    process.stdout.write(prompt);
+    process.stdin.on('data', onKeypress);
+
+    rl.question('', answer => {
+      process.stdin.removeListener('data', onKeypress);
+      rl.close();
+      process.stdout.write('\n');
+      resolve(answer);
+    });
+  });
+}
+
+function checkStrength(password) {
+  const problems = [];
+  if (password.length < MIN_LENGTH) {
+    problems.push(`au moins ${MIN_LENGTH} caractères (${password.length} fournis)`);
+  }
+  if (!/[a-z]/.test(password)) problems.push('une minuscule');
+  if (!/[A-Z]/.test(password)) problems.push('une majuscule');
+  if (!/[0-9]/.test(password)) problems.push('un chiffre');
+  if (!/[^A-Za-z0-9]/.test(password)) problems.push('un caractère spécial');
+  return problems;
+}
+
+async function main() {
+  console.log('');
+  console.log('Génération du hash Argon2id pour le premier administrateur.');
+  console.log('La saisie n’est pas affichée.');
+  console.log('');
+
+  const password = await readSecret('Mot de passe : ');
+  if (!password) {
+    console.error('Aucun mot de passe saisi.');
+    process.exit(1);
+  }
+
+  if (process.stdin.isTTY) {
+    const confirmation = await readSecret('Confirmation : ');
+    if (confirmation !== password) {
+      console.error('Les deux saisies diffèrent.');
+      process.exit(1);
+    }
+  }
+
+  const problems = checkStrength(password);
+  if (problems.length > 0) {
+    console.error('');
+    console.error('Mot de passe refusé. Il manque : ' + problems.join(', ') + '.');
+    console.error('Ce compte a tous les droits sur la plateforme : générez plutôt une');
+    console.error('phrase longue et aléatoire depuis votre gestionnaire de mots de passe.');
+    process.exit(1);
+  }
+
+  const hash = await argon2.hash(password, ARGON2_OPTIONS);
+
+  console.log('');
+  console.log('Hash à placer dans le Secret Kubernetes (jamais dans le ConfigMap) :');
+  console.log('');
+  console.log('  BOOTSTRAP_ADMIN_PASSWORD_HASH: ' + JSON.stringify(hash));
+  console.log('');
+  console.log('  cd infra/prod && sops k8s/base/03-secrets.sops.yaml');
+  console.log('');
+  console.log('Après votre première connexion :');
+  console.log('  1. changez le mot de passe depuis l’interface ;');
+  console.log('  2. retirez BOOTSTRAP_ADMIN_PASSWORD_HASH du Secret et réappliquez.');
+  console.log('');
+  console.log('Un hash reste attaquable hors ligne : il n’a plus aucune raison');
+  console.log('de rester stocké une fois le compte opérationnel.');
+  console.log('');
+}
+
+main().catch(error => {
+  console.error('Échec :', error.message);
+  process.exit(1);
+});

apps/backend/scripts/setup/generate-ports-seed.ts

@@ -210,10 +210,7 @@ function parseSeaPorts(filePath: string): ParsedPort[] {
 
     // Validate coordinates
     const [longitude, latitude] = port.coordinates;
-    if (
-      latitude < -90 || latitude > 90 ||
-      longitude < -180 || longitude > 180
-    ) {
+    if (latitude < -90 || latitude > 90 || longitude < -180 || longitude > 180) {
       skipped++;
       continue;
     }
@@ -244,7 +241,8 @@ function generateSQLInserts(ports: ParsedPort[]): string {
 
   for (let i = 0; i < ports.length; i += batchSize) {
     const batch = ports.slice(i, i + batchSize);
-    const values = batch.map(port => {
+    const values = batch
+      .map(port => {
         const name = port.name.replace(/'/g, "''");
         const city = port.city.replace(/'/g, "''");
         const countryName = port.countryName.replace(/'/g, "''");
@@ -261,7 +259,8 @@ function generateSQLInserts(ports: ParsedPort[]): string {
         ${timezone},
         ${port.isActive}
       )`;
-    }).join(',\n      ');
+      })
+      .join(',\n      ');
 
     batches.push(`
     // Batch ${Math.floor(i / batchSize) + 1}/${Math.ceil(ports.length / batchSize)} (${batch.length} ports)
@@ -321,7 +320,9 @@ async function main() {
   if (!fs.existsSync(seaPortsPath)) {
     console.error('❌ Error: /tmp/sea-ports.json not found!');
     console.log('Please download it first:');
-    console.log('curl -o /tmp/sea-ports.json https://raw.githubusercontent.com/marchah/sea-ports/master/lib/ports.json');
+    console.log(
+      'curl -o /tmp/sea-ports.json https://raw.githubusercontent.com/marchah/sea-ports/master/lib/ports.json'
+    );
     process.exit(1);
   }
 
@@ -342,7 +343,10 @@ async function main() {
   const migrationContent = generateMigration(ports);
 
   // Write migration file
-  const migrationsDir = path.join(__dirname, '../src/infrastructure/persistence/typeorm/migrations');
+  const migrationsDir = path.join(
+    __dirname,
+    '../src/infrastructure/persistence/typeorm/migrations'
+  );
   const timestamp = Date.now();
   const fileName = `${timestamp}-SeedPorts.ts`;
   const filePath = path.join(migrationsDir, fileName);

apps/backend/scripts/setup/list-minio-files.js

@@ -86,7 +86,7 @@ listFiles()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/setup/list-stripe-prices.js

@@ -5,7 +5,10 @@
 
 const Stripe = require('stripe');
 
-const stripe = new Stripe(process.env.STRIPE_SECRET_KEY || 'sk_test_51R8p8R4atifoBlu1U9sMJh3rkQbO1G1xeguwFMQYMIMeaLNrTX7YFO5Ovu3P1VfbwcOoEmiy6I0UWi4DThNNzHG100YF75TnJr');
+if (!process.env.STRIPE_SECRET_KEY) {
+  throw new Error('STRIPE_SECRET_KEY is required');
+}
+const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
 
 async function listPrices() {
   console.log('Fetching Stripe prices...\n');
@@ -46,7 +49,6 @@ async function listPrices() {
     console.log('STRIPE_PRO_YEARLY_PRICE_ID=price_xxxxx');
     console.log('STRIPE_ENTERPRISE_MONTHLY_PRICE_ID=price_xxxxx');
     console.log('STRIPE_ENTERPRISE_YEARLY_PRICE_ID=price_xxxxx');
-
   } catch (error) {
     console.error('Error fetching prices:', error.message);
   }

apps/backend/scripts/setup/run-migrations.js

@@ -1,5 +1,15 @@
 const { DataSource } = require('typeorm');
 const path = require('path');
+const { existsSync } = require('fs');
+const applicationRoot = existsSync(path.join(__dirname, 'dist'))
+  ? __dirname
+  : path.resolve(__dirname, '../..');
+const { databaseTlsOptions } = require(
+  path.join(applicationRoot, 'dist/infrastructure/persistence/typeorm/database-tls')
+);
+const { SafeDatabaseLogger } = require(
+  path.join(applicationRoot, 'dist/infrastructure/persistence/typeorm/safe-database-logger')
+);
 
 const AppDataSource = new DataSource({
   type: 'postgres',
@@ -8,10 +18,19 @@ const AppDataSource = new DataSource({
   username: process.env.DATABASE_USER,
   password: process.env.DATABASE_PASSWORD,
   database: process.env.DATABASE_NAME,
-  entities: [path.join(__dirname, 'dist/**/*.orm-entity.js')],
-  migrations: [path.join(__dirname, 'dist/infrastructure/persistence/typeorm/migrations/*.js')],
+  ssl: databaseTlsOptions(
+    process.env.DATABASE_SSL,
+    process.env.DATABASE_SSL_CA,
+    process.env.DATABASE_HOST
+  ),
+  entities: [path.join(applicationRoot, 'dist/**/*.orm-entity.js')],
+  migrations: [
+    path.join(applicationRoot, 'dist/infrastructure/persistence/typeorm/migrations/*.js'),
+  ],
   synchronize: false,
   logging: true,
+  logger: new SafeDatabaseLogger(true),
+  migrationsTransactionMode: 'all',
 });
 
 console.log('🚀 Starting Xpeditis Backend Migration Script...');
@@ -28,7 +47,7 @@ AppDataSource.initialize()
       console.log('✅ No pending migrations');
     } else {
       console.log(`✅ Successfully ran ${migrations.length} migration(s):`);
-      migrations.forEach((migration) => {
+      migrations.forEach(migration => {
         console.log(`   - ${migration.name}`);
       });
     }
@@ -37,8 +56,8 @@ AppDataSource.initialize()
     console.log('✅ Database migrations completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('❌ Error during migration:');
-    console.error(error);
+    console.error('Check migration prerequisites and database availability.');
     process.exit(1);
   });

apps/backend/scripts/setup/set-bucket-policy.js

@@ -73,7 +73,7 @@ setBucketPolicy()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/setup/startup.js

@@ -4,6 +4,17 @@ const { Client } = require('pg');
 const { DataSource } = require('typeorm');
 const path = require('path');
 const { spawn } = require('child_process');
+const { existsSync } = require('fs');
+// Docker copies this script to /app/startup.js; local copies stay in scripts/setup.
+const applicationRoot = existsSync(path.join(__dirname, 'dist'))
+  ? __dirname
+  : path.resolve(__dirname, '../..');
+const { databaseTlsOptions } = require(
+  path.join(applicationRoot, 'dist/infrastructure/persistence/typeorm/database-tls')
+);
+const { SafeDatabaseLogger } = require(
+  path.join(applicationRoot, 'dist/infrastructure/persistence/typeorm/safe-database-logger')
+);
 
 async function waitForPostgres(maxAttempts = 30) {
   console.log('⏳ Waiting for PostgreSQL to be ready...');
@@ -16,6 +27,11 @@ async function waitForPostgres(maxAttempts = 30) {
         user: process.env.DATABASE_USER,
         password: process.env.DATABASE_PASSWORD,
         database: process.env.DATABASE_NAME,
+        ssl: databaseTlsOptions(
+          process.env.DATABASE_SSL,
+          process.env.DATABASE_SSL_CA,
+          process.env.DATABASE_HOST
+        ),
       });
 
       await client.connect();
@@ -42,10 +58,19 @@ async function runMigrations() {
     username: process.env.DATABASE_USER,
     password: process.env.DATABASE_PASSWORD,
     database: process.env.DATABASE_NAME,
-    entities: [path.join(__dirname, 'dist/**/*.orm-entity.js')],
-    migrations: [path.join(__dirname, 'dist/infrastructure/persistence/typeorm/migrations/*.js')],
+    ssl: databaseTlsOptions(
+      process.env.DATABASE_SSL,
+      process.env.DATABASE_SSL_CA,
+      process.env.DATABASE_HOST
+    ),
+    entities: [path.join(applicationRoot, 'dist/**/*.orm-entity.js')],
+    migrations: [
+      path.join(applicationRoot, 'dist/infrastructure/persistence/typeorm/migrations/*.js'),
+    ],
     synchronize: false,
     logging: true,
+    logger: new SafeDatabaseLogger(true),
+    migrationsTransactionMode: 'all',
   });
 
   try {
@@ -58,7 +83,7 @@ async function runMigrations() {
       console.log('✅ No pending migrations');
     } else {
       console.log(`✅ Successfully ran ${migrations.length} migration(s):`);
-      migrations.forEach((migration) => {
+      migrations.forEach(migration => {
         console.log(`   - ${migration.name}`);
       });
     }
@@ -67,7 +92,7 @@ async function runMigrations() {
     console.log('✅ Database migrations completed');
     return true;
   } catch (error) {
-    console.error('❌ Error during migration:', error);
+    console.error('❌ Migration failed. Check migration prerequisites and database availability.');
     process.exit(1);
   }
 }
@@ -77,10 +102,11 @@ function startApplication() {
 
   const app = spawn('node', ['dist/main'], {
     stdio: 'inherit',
-    env: process.env
+    env: process.env,
+    cwd: applicationRoot,
   });
 
-  app.on('exit', (code) => {
+  app.on('exit', code => {
     process.exit(code);
   });
 
@@ -96,7 +122,11 @@ async function main() {
   startApplication();
 }
 
-main().catch((error) => {
-  console.error('❌ Startup failed:', error);
+if (require.main === module) {
+  main().catch(error => {
+    console.error('❌ Startup failed. Check migration prerequisites and database availability.');
     process.exit(1);
-});
+  });
+}
+
+module.exports = { waitForPostgres, runMigrations };

apps/backend/scripts/setup/upload-test-documents.js

@@ -179,7 +179,7 @@ uploadTestDocuments()
     console.log('\n✅ Script completed successfully');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ Script failed:', error);
     process.exit(1);
   });

apps/backend/scripts/test/create-test-booking.js

@@ -78,7 +78,7 @@ async function createTestBooking() {
       25.5, // volume_cbm
       3500, // weight_kg
       10, // pallet_count
-      1850.50, // price_usd
+      1850.5, // price_usd
       1665.45, // price_eur
       'USD', // primary_currency
       28, // transit_days
@@ -102,7 +102,6 @@ async function createTestBooking() {
     console.log('\n📧 URL API (pour curl):');
     console.log(`   curl http://localhost:4000/api/v1/csv-bookings/accept/${confirmationToken}`);
     console.log('\n✅ Ce booking est en statut PENDING et peut être accepté/refusé.\n');
-
   } catch (error) {
     console.error('❌ Erreur:', error.message);
     console.error(error);

apps/backend/scripts/test/login-and-test.js

@@ -9,18 +9,21 @@ async function loginAndTestEmail() {
     console.log('🔐 Connexion...');
     const loginResponse = await axios.post(`${API_URL}/auth/login`, {
       email: 'admin@xpeditis.com',
-      password: 'Admin123!@#'
+      password: 'Admin123!@#',
     });
 
     const token = loginResponse.data.accessToken;
     console.log('✅ Connecté avec succès\n');
 
     // 2. Créer un CSV booking pour tester l'envoi d'email
-    console.log('📧 Création d\'une CSV booking pour tester l\'envoi d\'email...');
+    console.log("📧 Création d'une CSV booking pour tester l'envoi d'email...");
 
     const form = new FormData();
     const testFile = Buffer.from('Test document PDF content');
-    form.append('documents', testFile, { filename: 'test-doc.pdf', contentType: 'application/pdf' });
+    form.append('documents', testFile, {
+      filename: 'test-doc.pdf',
+      contentType: 'application/pdf',
+    });
 
     form.append('carrierName', 'Test Carrier');
     form.append('carrierEmail', 'testcarrier@example.com');
@@ -39,8 +42,8 @@ async function loginAndTestEmail() {
     const bookingResponse = await axios.post(`${API_URL}/csv-bookings`, form, {
       headers: {
         ...form.getHeaders(),
-        'Authorization': `Bearer ${token}`
-      }
+        Authorization: `Bearer ${token}`,
+      },
     });
 
     console.log('✅ CSV Booking créé:', bookingResponse.data.id);
@@ -50,7 +53,6 @@ async function loginAndTestEmail() {
     console.log('2. Vérifier Mailtrap inbox: https://mailtrap.io/inboxes');
     console.log('3. Email devrait être envoyé à: testcarrier@example.com');
     console.log('\n⏳ Attendez quelques secondes puis vérifiez les logs du backend...');
-
   } catch (error) {
     console.error('❌ ERREUR:');
     if (error.response) {

apps/backend/scripts/test/test-booking-workflow.js

@@ -56,16 +56,12 @@ async function testWorkflow() {
       contentType: 'application/pdf',
     });
 
-    const bookingResponse = await axios.post(
-      `${API_BASE}/csv-bookings`,
-      form,
-      {
+    const bookingResponse = await axios.post(`${API_BASE}/csv-bookings`, form, {
       headers: {
         ...form.getHeaders(),
         Authorization: `Bearer ${token}`,
       },
-      }
-    );
+    });
 
     console.log('✅ Booking created successfully!');
     console.log('📦 Booking ID:', bookingResponse.data.id);
@@ -80,7 +76,9 @@ async function testWorkflow() {
     console.error('❌ Error:', error.response?.data || error.message);
 
     if (error.response?.status === 401) {
-      console.error('\n⚠️  Authentication failed. Please update TEST_USER credentials in the script.');
+      console.error(
+        '\n⚠️  Authentication failed. Please update TEST_USER credentials in the script.'
+      );
     }
 
     if (error.response?.status === 400) {

apps/backend/scripts/test/test-carrier-email-fix.js

@@ -213,7 +213,9 @@ async function testEmailConfig() {
   console.log('📊 Résumé des tests:');
   console.log('   ✓ Vérifiez Mailtrap inbox: https://mailtrap.io/inboxes');
   console.log('   ✓ Recherchez les emails de test ci-dessus');
-  console.log('   ✓ Si Test 2 et 3 réussissent, le backend doit être corrigé avec la configuration IP directe\n');
+  console.log(
+    '   ✓ Si Test 2 et 3 réussissent, le backend doit être corrigé avec la configuration IP directe\n'
+  );
 }
 
 // Run test
@@ -222,7 +224,7 @@ testEmailConfig()
     console.log('✅ Tests terminés avec succès');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('❌ Erreur lors des tests:', error);
     process.exit(1);
   });

apps/backend/scripts/test/test-carrier-email.js

@@ -0,0 +1,32 @@
+const nodemailer = require('nodemailer');
+
+const transporter = nodemailer.createTransport({
+  host: 'sandbox.smtp.mailtrap.io',
+  port: 2525,
+  auth: {
+    user: '2597bd31d265eb',
+    pass: 'cd126234193c89',
+  },
+});
+
+console.log("🔄 Tentative d'envoi d'email...");
+
+transporter
+  .sendMail({
+    from: 'noreply@xpeditis.com',
+    to: 'test@example.com',
+    subject: 'Test Email depuis Portail Transporteur',
+    text: 'Email de test pour vérifier la configuration',
+  })
+  .then(info => {
+    console.log('✅ Email envoyé:', info.messageId);
+    console.log('📧 Response:', info.response);
+    process.exit(0);
+  })
+  .catch(err => {
+    console.error('❌ Erreur:', err.message);
+    console.error('Code:', err.code);
+    console.error('Command:', err.command);
+    console.error('Stack:', err.stack);
+    process.exit(1);
+  });

apps/backend/scripts/test/test-email-ip.js

@@ -31,7 +31,8 @@ const transporter = nodemailer.createTransport(config);
 
 console.log('\n1️⃣ Verifying SMTP connection...');
 
-transporter.verify()
+transporter
+  .verify()
   .then(() => {
     console.log('✅ SMTP connection verified!');
     console.log('\n2️⃣ Sending test email...');
@@ -40,17 +41,17 @@ transporter.verify()
       from: 'noreply@xpeditis.com',
       to: 'test@example.com',
       subject: 'Test Xpeditis - Envoi Direct IP',
-      html: '<h1>✅ Email envoyé avec succès!</h1><p>Ce test utilise l\'IP directe pour contourner le DNS.</p>',
+      html: "<h1>✅ Email envoyé avec succès!</h1><p>Ce test utilise l'IP directe pour contourner le DNS.</p>",
     });
   })
-  .then((info) => {
+  .then(info => {
     console.log('✅ Email sent successfully!');
     console.log('📧 Message ID:', info.messageId);
     console.log('📬 Response:', info.response);
     console.log('\n🎉 SUCCESS! Email sending works with IP directly.');
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('\n❌ ERROR:', error.message);
     console.error('Code:', error.code);
     console.error('Command:', error.command);

apps/backend/scripts/test/test-email-service.js

@@ -6,7 +6,8 @@ const axios = require('axios');
 const API_URL = 'http://localhost:4000/api/v1';
 
 // Token d'authentification (admin@xpeditis.com)
-const AUTH_TOKEN = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5MTI3Y2M0Zi04Yzg4LTRjNGUtYmU1ZC1hNmY1ZTE2MWZlNDMiLCJlbWFpbCI6ImFkbWluQHhwZWRpdGlzLmNvbSIsInJvbGUiOiJBRE1JTiIsIm9yZ2FuaXphdGlvbklkIjoiMWZhOWE1NjUtZjNjOC00ZTExLTliMzAtMTIwZDEwNTJjZWYwIiwidHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2NDg3NDQ2MSwiZXhwIjoxNzY0ODc1MzYxfQ.l_-97_rikGj-DP8aA14CK-Ab-0Usy722MRe1lqi0u9I';
+const AUTH_TOKEN =
+  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5MTI3Y2M0Zi04Yzg4LTRjNGUtYmU1ZC1hNmY1ZTE2MWZlNDMiLCJlbWFpbCI6ImFkbWluQHhwZWRpdGlzLmNvbSIsInJvbGUiOiJBRE1JTiIsIm9yZ2FuaXphdGlvbklkIjoiMWZhOWE1NjUtZjNjOC00ZTExLTliMzAtMTIwZDEwNTJjZWYwIiwidHlwZSI6ImFjY2VzcyIsImlhdCI6MTc2NDg3NDQ2MSwiZXhwIjoxNzY0ODc1MzYxfQ.l_-97_rikGj-DP8aA14CK-Ab-0Usy722MRe1lqi0u9I';
 
 async function testCsvBookingEmail() {
   console.log('🧪 Test envoi email via CSV booking...\n');
@@ -19,7 +20,10 @@ async function testCsvBookingEmail() {
 
     // Créer un fichier de test temporaire
     const testFile = Buffer.from('Test document content');
-    form.append('documents', testFile, { filename: 'test-document.pdf', contentType: 'application/pdf' });
+    form.append('documents', testFile, {
+      filename: 'test-document.pdf',
+      contentType: 'application/pdf',
+    });
 
     // Ajouter les champs du formulaire
     form.append('carrierName', 'Test Carrier Email');
@@ -41,8 +45,8 @@ async function testCsvBookingEmail() {
     const response = await axios.post(`${API_URL}/csv-bookings`, form, {
       headers: {
         ...form.getHeaders(),
-        'Authorization': `Bearer ${AUTH_TOKEN}`
-      }
+        Authorization: `Bearer ${AUTH_TOKEN}`,
+      },
     });
 
     console.log('✅ Réponse reçue:', response.status);
@@ -51,11 +55,10 @@ async function testCsvBookingEmail() {
     console.log('1. Les logs du backend pour voir "Email sent to carrier:"');
     console.log('2. Votre inbox Mailtrap: https://mailtrap.io/inboxes');
     console.log('3. Email destinataire: test-carrier@example.com');
-
   } catch (error) {
     console.error('❌ Erreur:', error.response?.data || error.message);
     if (error.response?.status === 401) {
-      console.error('\n⚠️  Token expiré. Connectez-vous d\'abord avec:');
+      console.error("\n⚠️  Token expiré. Connectez-vous d'abord avec:");
       console.error('POST /api/v1/auth/login');
       console.error('{ "email": "admin@xpeditis.com", "password": "..." }');
     }

apps/backend/scripts/test/test-email.js

@@ -31,7 +31,8 @@ const transporter = nodemailer.createTransport(config);
 
 console.log('\nVerifying SMTP connection...');
 
-transporter.verify()
+transporter
+  .verify()
   .then(() => {
     console.log('✅ SMTP connection verified successfully!');
     console.log('\nSending test email...');
@@ -43,13 +44,13 @@ transporter.verify()
       html: '<h1>Test Email</h1><p>If you see this, email sending works!</p>',
     });
   })
-  .then((info) => {
+  .then(info => {
     console.log('✅ Email sent successfully!');
     console.log('Message ID:', info.messageId);
     console.log('Response:', info.response);
     process.exit(0);
   })
-  .catch((error) => {
+  .catch(error => {
     console.error('❌ Error:', error.message);
     console.error('Full error:', error);
     process.exit(1);

apps/backend/scripts/test/test-smtp-simple.js

@@ -49,12 +49,12 @@ async function test() {
     await transporter.verify();
     console.log('✅ Connexion SMTP OK\n');
 
-    console.log('Test 2: Envoi d\'un email...');
+    console.log("Test 2: Envoi d'un email...");
     const info = await transporter.sendMail({
       from: 'noreply@xpeditis.com',
       to: 'test@example.com',
       subject: 'Test - ' + new Date().toISOString(),
-      html: '<h1>Test réussi!</h1><p>Ce message confirme que l\'envoi d\'email fonctionne.</p>',
+      html: "<h1>Test réussi!</h1><p>Ce message confirme que l'envoi d'email fonctionne.</p>",
     });
 
     console.log('✅ Email envoyé avec succès!');

apps/backend/src/app.module.ts

@@ -1,9 +1,24 @@
+import { SafeDatabaseLogger } from './infrastructure/persistence/typeorm/safe-database-logger';
+import { safeHttpSerializers } from './application/logging/safe-http-log';
+import { TradeAssistantModule } from './application/trade-assistant/trade-assistant.module';
+import { McpModule } from './application/mcp/mcp.module';
 import { Module } from '@nestjs/common';
+import { ScheduleModule } from '@nestjs/schedule';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { LoggerModule } from 'nestjs-pino';
 import { APP_GUARD } from '@nestjs/core';
+import {
+  AcceptLanguageResolver,
+  CookieResolver,
+  HeaderResolver,
+  I18nModule,
+  QueryResolver,
+} from 'nestjs-i18n';
+import * as path from 'path';
 import * as Joi from 'joi';
+import { UserPreferenceResolver } from './infrastructure/i18n/user-preference.resolver';
+import { databaseTlsOptions } from './infrastructure/persistence/typeorm/database-tls';
 
 // Import feature modules
 import { AuthModule } from './application/auth/auth.module';
@@ -17,8 +32,9 @@ import { AuditModule } from './application/audit/audit.module';
 import { NotificationsModule } from './application/notifications/notifications.module';
 import { WebhooksModule } from './application/webhooks/webhooks.module';
 import { GDPRModule } from './application/gdpr/gdpr.module';
-import { CsvBookingsModule } from './application/csv-bookings.module';
+import { CsvBookingsModule } from './application/csv-bookings/csv-bookings.module';
 import { AdminModule } from './application/admin/admin.module';
+import { BlogModule } from './application/blog/blog.module';
 import { LogsModule } from './application/logs/logs.module';
 import { SubscriptionsModule } from './application/subscriptions/subscriptions.module';
 import { ApiKeysModule } from './application/api-keys/api-keys.module';
@@ -26,13 +42,16 @@ import { CacheModule } from './infrastructure/cache/cache.module';
 import { CarrierModule } from './infrastructure/carriers/carrier.module';
 import { SecurityModule } from './infrastructure/security/security.module';
 import { CsvRateModule } from './infrastructure/carriers/csv-loader/csv-rate.module';
+import { AdminBootstrapModule } from './infrastructure/persistence/typeorm/admin-bootstrap.module';
 
 // Import global guards
 import { ApiKeyOrJwtGuard } from './application/guards/api-key-or-jwt.guard';
+import { HealthController } from './application/controllers/health.controller';
 import { CustomThrottlerGuard } from './application/guards/throttle.guard';
 
 @Module({
   imports: [
+    ScheduleModule.forRoot(),
     // Configuration
     ConfigModule.forRoot({
       isGlobal: true,
@@ -46,12 +65,19 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
         DATABASE_USER: Joi.string().required(),
         DATABASE_PASSWORD: Joi.string().required(),
         DATABASE_NAME: Joi.string().required(),
+        DATABASE_SSL: Joi.boolean().default(false),
+        DATABASE_SSL_CA: Joi.string().optional(),
         REDIS_HOST: Joi.string().required(),
         REDIS_PORT: Joi.number().default(6379),
         REDIS_PASSWORD: Joi.string().required(),
-        JWT_SECRET: Joi.string().required(),
+        JWT_SECRET: Joi.string().min(32).required(),
         JWT_ACCESS_EXPIRATION: Joi.string().default('15m'),
         JWT_REFRESH_EXPIRATION: Joi.string().default('7d'),
+        // Cookie domain for auth cookies (e.g. ".xpeditis.com" so the frontend
+        // and API subdomains share them). Unset = host-only (fine for localhost).
+        COOKIE_DOMAIN: Joi.string().optional(),
+        // Secret used to derive carrier document passwords (falls back to JWT_SECRET)
+        DOCUMENT_PASSWORD_SECRET: Joi.string().min(16).optional(),
         // SMTP Configuration
         SMTP_HOST: Joi.string().required(),
         SMTP_PORT: Joi.number().default(2525),
@@ -60,6 +86,14 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
         SMTP_FROM: Joi.string().email().default('noreply@xpeditis.com'),
         SMTP_SECURE: Joi.boolean().default(false),
         // Stripe Configuration (optional for development)
+        // Purge des donnees arrivees au terme de leur duree de
+        // conservation. Desactivee par defaut : elle supprime
+        // definitivement des lignes, l'activer est une decision
+        // d'exploitation.
+        RETENTION_PURGE_ENABLED: Joi.string().valid('true', 'false').default('false'),
+        OPENAI_API_KEY: Joi.string().allow('').optional(),
+        OPENAI_MODEL: Joi.string().default('gpt-4.1-mini'),
+        OPENAI_EMBEDDING_MODEL: Joi.string().default('text-embedding-3-small'),
         STRIPE_SECRET_KEY: Joi.string().optional(),
         STRIPE_WEBHOOK_SECRET: Joi.string().optional(),
         STRIPE_SILVER_MONTHLY_PRICE_ID: Joi.string().optional(),
@@ -69,6 +103,13 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
         STRIPE_PLATINIUM_MONTHLY_PRICE_ID: Joi.string().optional(),
         STRIPE_PLATINIUM_YEARLY_PRICE_ID: Joi.string().optional(),
         LOG_EXPORTER_URL: Joi.string().uri().default('http://xpeditis-log-exporter:3200'),
+        // Administrateur garanti a chaque lancement (AdminBootstrapService).
+        // Pas de .email() ici : Joi rejette les TLD hors liste IANA et une
+        // adresse refusee empecherait l'API entiere de demarrer. Le service
+        // valide l'adresse et journalise une erreur sans bloquer.
+        BOOTSTRAP_ADMIN_EMAIL: Joi.string().allow('').optional(),
+        BOOTSTRAP_ADMIN_PASSWORD_HASH: Joi.string().allow('').optional(),
+        BOOTSTRAP_ADMIN_RESET_PASSWORD: Joi.string().valid('true', 'false', '').default('false'),
       }),
     }),
 
@@ -82,6 +123,7 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
 
         return {
           pinoHttp: {
+            serializers: safeHttpSerializers,
             transport: usePretty
               ? {
                   target: 'pino-pretty',
@@ -110,6 +152,29 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
       inject: [ConfigService],
     }),
 
+    // Internationalization (FR / EN)
+    // Resolver chain (highest priority first):
+    //   1. UserPreferenceResolver — authenticated user's preferredLanguage
+    //   2. CookieResolver (NEXT_LOCALE)     — set by frontend switcher
+    //   3. HeaderResolver (x-lang / x-locale)
+    //   4. QueryResolver  (?lang=xx)
+    //   5. AcceptLanguageResolver
+    //   6. fallback → 'fr'
+    I18nModule.forRoot({
+      fallbackLanguage: 'fr',
+      loaderOptions: {
+        path: path.join(__dirname, '/i18n/'),
+        watch: true,
+      },
+      resolvers: [
+        UserPreferenceResolver,
+        new CookieResolver(['NEXT_LOCALE', 'lang']),
+        new HeaderResolver(['x-lang', 'x-locale']),
+        new QueryResolver(['lang', 'locale']),
+        AcceptLanguageResolver,
+      ],
+    }),
+
     // Database
     TypeOrmModule.forRootAsync({
       useFactory: (configService: ConfigService) => ({
@@ -119,9 +184,15 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
         username: configService.get('DATABASE_USER'),
         password: configService.get('DATABASE_PASSWORD'),
         database: configService.get('DATABASE_NAME'),
+        ssl: databaseTlsOptions(
+          configService.get<boolean>('DATABASE_SSL'),
+          configService.get<string>('DATABASE_SSL_CA'),
+          configService.get<string>('DATABASE_HOST')
+        ),
         entities: [__dirname + '/**/*.orm-entity{.ts,.js}'],
         synchronize: false, // ✅ Force false - use migrations instead
         logging: configService.get('DATABASE_LOGGING', false),
+        logger: new SafeDatabaseLogger(configService.get('DATABASE_LOGGING', false)),
         autoLoadEntities: true, // Auto-load entities from forFeature()
       }),
       inject: [ConfigService],
@@ -132,6 +203,8 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
     CacheModule,
     CarrierModule,
     CsvRateModule,
+    // Un administrateur exploitable a chaque lancement (base neuve comprise)
+    AdminBootstrapModule,
 
     // Feature modules
     AuthModule,
@@ -147,11 +220,14 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
     WebhooksModule,
     GDPRModule,
     AdminModule,
+    BlogModule,
     SubscriptionsModule,
+    TradeAssistantModule,
+    McpModule,
     ApiKeysModule,
     LogsModule,
   ],
-  controllers: [],
+  controllers: [HealthController],
   providers: [
     // Global authentication guard — supports both JWT (frontend) and API key (Gold/Platinium)
     // All routes are protected by default, use @Public() to bypass

apps/backend/src/application/admin/admin.module.ts

@@ -24,23 +24,29 @@ import { SIRET_VERIFICATION_PORT } from '@domain/ports/out/siret-verification.po
 import { PappersSiretAdapter } from '@infrastructure/external/pappers-siret.adapter';
 
 // CSV Booking Service
-import { CsvBookingsModule } from '../csv-bookings.module';
+import { CsvBookingsModule } from '../csv-bookings/csv-bookings.module';
 
 // Email
 import { EmailModule } from '@infrastructure/email/email.module';
 
-/**
- * Admin Module
- *
- * Provides admin-only endpoints for managing all data in the system.
- * All endpoints require ADMIN role.
- */
+// Blog
+import { BlogModule } from '../blog/blog.module';
+
+// Storage
+import { StorageModule } from '@infrastructure/storage/storage.module';
+
+// User deletion (GDPR erasure)
+import { GDPRModule } from '../gdpr/gdpr.module';
+
 @Module({
   imports: [
     TypeOrmModule.forFeature([UserOrmEntity, OrganizationOrmEntity, CsvBookingOrmEntity]),
     ConfigModule,
     CsvBookingsModule,
     EmailModule,
+    BlogModule,
+    StorageModule,
+    GDPRModule,
   ],
   controllers: [AdminController],
   providers: [

apps/backend/src/application/api-keys/api-keys-entitlement.security.spec.ts

@@ -0,0 +1,88 @@
+import { ForbiddenException } from '@nestjs/common';
+import { ApiKey } from '@domain/entities/api-key.entity';
+import { Subscription } from '@domain/entities/subscription.entity';
+import { SubscriptionPlan } from '@domain/value-objects/subscription-plan.vo';
+import {
+  SubscriptionStatus,
+  SubscriptionStatusType,
+} from '@domain/value-objects/subscription-status.vo';
+import { ApiKeyRepository } from '@domain/ports/out/api-key.repository';
+import { UserRepository } from '@domain/ports/out/user.repository';
+import { SubscriptionRepository } from '@domain/ports/out/subscription.repository';
+import { ApiKeysService } from './api-keys.service';
+
+describe('API key current entitlement', () => {
+  const setup = () => {
+    let subscription = Subscription.create({
+      id: 'sub',
+      organizationId: 'org',
+      plan: SubscriptionPlan.gold(),
+    });
+    const key = ApiKey.create({
+      id: 'key',
+      userId: 'user',
+      organizationId: 'org',
+      name: 'test',
+      keyHash: 'hash',
+      keyPrefix: 'xped_live_test',
+    });
+    const keys = {
+      findByKeyHash: jest.fn().mockResolvedValue(key),
+      save: jest.fn().mockImplementation(async value => value),
+    };
+    const users = {
+      findById: jest
+        .fn()
+        .mockResolvedValue({ id: 'user', organizationId: 'org', isActive: true, role: 'MANAGER' }),
+    };
+    const subscriptions = {
+      findByOrganizationId: jest.fn().mockImplementation(async () => subscription),
+    };
+    return {
+      service: new ApiKeysService(
+        keys as unknown as ApiKeyRepository,
+        users as unknown as UserRepository,
+        subscriptions as unknown as SubscriptionRepository
+      ),
+      keys,
+      setStatus: (status: SubscriptionStatusType) => {
+        subscription = subscription.updateStatus(SubscriptionStatus.create(status));
+      },
+    };
+  };
+
+  it.each<SubscriptionStatusType>([
+    'UNPAID',
+    'PAUSED',
+    'INCOMPLETE',
+    'INCOMPLETE_EXPIRED',
+    'CANCELED',
+  ])('%s invalidates an existing key and forbids creation', async status => {
+    const { service, keys, setStatus } = setup();
+    await expect(service.validateAndGetUser('xped_live_test')).resolves.toMatchObject({
+      plan: 'GOLD',
+    });
+    keys.save.mockClear();
+    setStatus(status);
+    await expect(service.validateAndGetUser('xped_live_test')).resolves.toBeNull();
+    await expect(service.generateApiKey('user', 'org', { name: 'new' })).rejects.toBeInstanceOf(
+      ForbiddenException
+    );
+    expect(keys.save).not.toHaveBeenCalled();
+  });
+
+  it.each<SubscriptionStatusType>(['ACTIVE', 'TRIALING', 'PAST_DUE'])(
+    '%s permits keys',
+    async status => {
+      const { service, setStatus } = setup();
+      setStatus(status);
+      await expect(service.validateAndGetUser('xped_live_test')).resolves.toMatchObject({
+        plan: 'GOLD',
+      });
+      await expect(service.generateApiKey('user', 'org', { name: 'new' })).resolves.toMatchObject({
+        name: 'new',
+        isActive: true,
+      });
+    }
+  );
+});

apps/backend/src/application/api-keys/api-keys.controller.ts

@@ -10,13 +10,7 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import {
-  ApiBearerAuth,
-  ApiOperation,
-  ApiResponse,
-  ApiSecurity,
-  ApiTags,
-} from '@nestjs/swagger';
+import { ApiBearerAuth, ApiOperation, ApiResponse, ApiSecurity, ApiTags } from '@nestjs/swagger';
 
 import { CurrentUser } from '../decorators/current-user.decorator';
 import { RequiresFeature } from '../decorators/requires-feature.decorator';
@@ -38,7 +32,7 @@ export class ApiKeysController {
   @ApiOperation({
     summary: 'Générer une nouvelle clé API',
     description:
-      "Crée une clé API pour accès programmatique. La clé complète est retournée **une seule fois** — conservez-la immédiatement. Réservé aux abonnements Gold et Platinium.",
+      'Crée une clé API pour accès programmatique. La clé complète est retournée **une seule fois** — conservez-la immédiatement. Réservé aux abonnements Gold et Platinium.',
   })
   @ApiResponse({
     status: 201,

apps/backend/src/application/api-keys/api-keys.module.ts

@@ -23,10 +23,7 @@ import { SubscriptionsModule } from '../subscriptions/subscriptions.module';
 import { FeatureFlagGuard } from '../guards/feature-flag.guard';
 
 @Module({
-  imports: [
-    TypeOrmModule.forFeature([ApiKeyOrmEntity, UserOrmEntity]),
-    SubscriptionsModule,
-  ],
+  imports: [TypeOrmModule.forFeature([ApiKeyOrmEntity, UserOrmEntity]), SubscriptionsModule],
   controllers: [ApiKeysController],
   providers: [
     ApiKeysService,

apps/backend/src/application/api-keys/api-keys.service.ts

@@ -8,13 +8,7 @@
  * - Validation for inbound API key authentication
  */
 
-import {
-  ForbiddenException,
-  Inject,
-  Injectable,
-  Logger,
-  NotFoundException,
-} from '@nestjs/common';
+import { ForbiddenException, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
 import * as crypto from 'crypto';
 import { v4 as uuidv4 } from 'uuid';
 
@@ -160,8 +154,8 @@ export class ApiKeysService {
       organizationId: user.organizationId,
       firstName: user.firstName,
       lastName: user.lastName,
-      plan: subscription.plan.value,
-      planFeatures: [...subscription.plan.planFeatures],
+      plan: subscription.accessPlan.value,
+      planFeatures: [...subscription.accessPlan.planFeatures],
     };
   }
 

apps/backend/src/application/auth/auth-session.spec.ts

@@ -0,0 +1,69 @@
+import { ConfigService } from '@nestjs/config';
+import { JwtService } from '@nestjs/jwt';
+import { Repository } from 'typeorm';
+import { AuthService, JwtPayload } from './auth.service';
+import { User, UserRole } from '@domain/entities/user.entity';
+import { UserRepository } from '@domain/ports/out/user.repository';
+import { OrganizationRepository } from '@domain/ports/out/organization.repository';
+import { EmailPort } from '@domain/ports/out/email.port';
+import { CachePort } from '@domain/ports/out/cache.port';
+import { PasswordResetTokenOrmEntity } from '@infrastructure/persistence/typeorm/entities/password-reset-token.orm-entity';
+import { SubscriptionService } from '../services/subscription.service';
+
+jest.mock('argon2', () => ({ verify: jest.fn().mockResolvedValue(true) }));
+
+describe('password-bound sessions', () => {
+  let user: User;
+  let auth: AuthService;
+  let jwt: JwtService;
+  beforeEach(() => {
+    user = User.create({
+      id: 'user-1',
+      organizationId: 'org-1',
+      email: 'test@example.org',
+      firstName: 'Test',
+      lastName: 'User',
+      role: UserRole.ADMIN,
+      passwordHash: 'old-salted-hash',
+    });
+    jwt = new JwtService({ secret: 'test-only-session-secret' });
+    auth = new AuthService(
+      {
+        findById: jest.fn(async () => user),
+        findByEmail: jest.fn(async () => user),
+      } as unknown as UserRepository,
+      {} as OrganizationRepository,
+      {} as EmailPort,
+      { get: jest.fn(async () => null) } as unknown as CachePort,
+      {} as Repository<PasswordResetTokenOrmEntity>,
+      jwt,
+      new ConfigService({ JWT_SECRET: 'test-only-session-secret' }),
+      {} as SubscriptionService
+    );
+  });
+
+  it('rejects old access and refresh tokens after a password change, but accepts a new login', async () => {
+    const tokens = await auth.login(user.email, 'password');
+    const payload = jwt.verify<JwtPayload>(tokens.accessToken);
+    expect(await auth.validateUser(payload)).toBe(user);
+    expect(payload.credentialVersion).not.toContain(user.passwordHash);
+    user.updatePassword('new-salted-hash');
+    expect(await auth.validateUser(payload)).toBeNull();
+    await expect(auth.refreshAccessToken(tokens.refreshToken)).rejects.toThrow();
+    const fresh = await auth.login(user.email, 'new-password');
+    expect(await auth.validateUser(jwt.verify<JwtPayload>(fresh.accessToken))).toBe(user);
+    await expect(auth.refreshAccessToken(fresh.refreshToken)).resolves.toHaveProperty(
+      'accessToken'
+    );
+  });
+
+  it('preserves sessions after a profile change and rejects legacy or disabled sessions', async () => {
+    const tokens = await auth.login(user.email, 'password');
+    const payload = jwt.verify<JwtPayload>(tokens.accessToken);
+    user.updateFirstName('New name');
+    expect(await auth.validateUser(payload)).toBe(user);
+    expect(await auth.validateUser({ ...payload, credentialVersion: undefined })).toBeNull();
+    user.deactivate();
+    expect(await auth.validateUser(payload)).toBeNull();
+  });
+});

apps/backend/src/application/auth/auth.module.ts

@@ -1,5 +1,5 @@
 import { Module } from '@nestjs/common';
-import { JwtModule } from '@nestjs/jwt';
+import { JwtModule, JwtSignOptions } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { TypeOrmModule } from '@nestjs/typeorm';
@@ -22,6 +22,7 @@ import { InvitationService } from '../services/invitation.service';
 import { InvitationsController } from '../controllers/invitations.controller';
 import { EmailModule } from '../../infrastructure/email/email.module';
 import { SubscriptionsModule } from '../subscriptions/subscriptions.module';
+import { AuditModule } from '../audit/audit.module';
 
 @Module({
   imports: [
@@ -35,19 +36,27 @@ import { SubscriptionsModule } from '../subscriptions/subscriptions.module';
       useFactory: async (configService: ConfigService) => ({
         secret: configService.get<string>('JWT_SECRET'),
         signOptions: {
-          expiresIn: configService.get<string>('JWT_ACCESS_EXPIRATION', '15m'),
+          expiresIn: configService.get<JwtSignOptions['expiresIn']>('JWT_ACCESS_EXPIRATION', '15m'),
         },
       }),
     }),
 
     // 👇 Add this to register TypeORM repositories
-    TypeOrmModule.forFeature([UserOrmEntity, OrganizationOrmEntity, InvitationTokenOrmEntity, PasswordResetTokenOrmEntity]),
+    TypeOrmModule.forFeature([
+      UserOrmEntity,
+      OrganizationOrmEntity,
+      InvitationTokenOrmEntity,
+      PasswordResetTokenOrmEntity,
+    ]),
 
     // Email module for sending invitations
     EmailModule,
 
     // Subscriptions module for license checks
     SubscriptionsModule,
+
+    // Audit module for login/logout tracking
+    AuditModule,
   ],
   controllers: [AuthController, InvitationsController],
   providers: [

apps/backend/src/application/auth/auth.service.ts

@@ -21,6 +21,7 @@ import {
 } from '@domain/ports/out/organization.repository';
 import { Organization } from '@domain/entities/organization.entity';
 import { EmailPort, EMAIL_PORT } from '@domain/ports/out/email.port';
+import { CachePort, CACHE_PORT } from '@domain/ports/out/cache.port';
 import { v4 as uuidv4 } from 'uuid';
 import { RegisterOrganizationDto } from '../dto/auth-login.dto';
 import { SubscriptionService } from '../services/subscription.service';
@@ -34,6 +35,8 @@ export interface JwtPayload {
   plan?: string; // subscription plan (BRONZE, SILVER, GOLD, PLATINIUM)
   planFeatures?: string[]; // plan feature flags
   type: 'access' | 'refresh';
+  credentialVersion?: string;
+  rememberMe?: boolean; // drives auth cookie persistence across refreshes
 }
 
 @Injectable()
@@ -47,6 +50,8 @@ export class AuthService {
     private readonly organizationRepository: OrganizationRepository,
     @Inject(EMAIL_PORT)
     private readonly emailService: EmailPort,
+    @Inject(CACHE_PORT)
+    private readonly cache: CachePort,
     @InjectRepository(PasswordResetTokenOrmEntity)
     private readonly passwordResetTokenRepository: Repository<PasswordResetTokenOrmEntity>,
     private readonly jwtService: JwtService,
@@ -66,6 +71,12 @@ export class AuthService {
     organizationData?: RegisterOrganizationDto,
     invitationRole?: string
   ): Promise<{ accessToken: string; refreshToken: string; user: any }> {
+    // Emails are stored lowercase (enforced by the chk_users_email DB CHECK
+    // constraint), so normalize before any lookup or insert. Without this, an
+    // address containing uppercase letters fails the user INSERT after the
+    // organization has already been created — leaving an orphaned organization.
+    email = email.trim().toLowerCase();
+
     this.logger.log(`Registering new user: ${email}`);
 
     const existingUser = await this.userRepository.findByEmail(email);
@@ -86,6 +97,9 @@ export class AuthService {
     // 2. If organizationData is provided (new user), create a new organization
     // 3. Otherwise, use default organization
     const finalOrganizationId = await this.resolveOrganizationId(organizationId, organizationData);
+    // Track whether a brand-new organization was created for this registration,
+    // so it can be rolled back if the subsequent user creation fails.
+    const createdNewOrg = !organizationId && !!organizationData;
 
     // Determine role:
     // - If invitation role is provided (invited user), use it
@@ -93,6 +107,11 @@ export class AuthService {
     // - Otherwise, default to USER
     let userRole: UserRole;
     if (invitationRole) {
+      // Invitations can only grant non-admin roles — reject anything else
+      const allowedInvitationRoles: UserRole[] = [UserRole.MANAGER, UserRole.USER, UserRole.VIEWER];
+      if (!allowedInvitationRoles.includes(invitationRole as UserRole)) {
+        throw new BadRequestException('Invalid invitation role');
+      }
       userRole = invitationRole as UserRole;
     } else if (organizationData) {
       // User creating a new organization becomes MANAGER
@@ -112,7 +131,28 @@ export class AuthService {
       role: userRole,
     });
 
-    const savedUser = await this.userRepository.save(user);
+    let savedUser: User;
+    try {
+      savedUser = await this.userRepository.save(user);
+    } catch (err) {
+      // The organization is created before the user (non-atomic flow). If the
+      // user INSERT fails, roll the organization back so a retry isn't blocked
+      // by an orphaned organization ("name already exists").
+      if (createdNewOrg) {
+        try {
+          await this.organizationRepository.deleteById(finalOrganizationId);
+          this.logger.warn(
+            `Rolled back orphaned organization ${finalOrganizationId} after failed user creation`
+          );
+        } catch (cleanupErr) {
+          this.logger.error(
+            `Failed to roll back organization ${finalOrganizationId}`,
+            cleanupErr as Error
+          );
+        }
+      }
+      throw err;
+    }
 
     // Allocate a license for the new user
     try {
@@ -146,8 +186,10 @@ export class AuthService {
    */
   async login(
     email: string,
-    password: string
+    password: string,
+    rememberMe = false
   ): Promise<{ accessToken: string; refreshToken: string; user: any }> {
+    email = email.trim().toLowerCase();
     this.logger.log(`Login attempt for: ${email}`);
 
     const user = await this.userRepository.findByEmail(email);
@@ -166,7 +208,17 @@ export class AuthService {
       throw new UnauthorizedException('Invalid credentials');
     }
 
-    const tokens = await this.generateTokens(user);
+    // last_login_at n'etait jamais renseigne. L'amorcage de l'administrateur
+    // s'en sert pour ne jamais ecraser le mot de passe d'un compte deja utilise.
+    try {
+      user.recordLogin();
+      await this.userRepository.save(user);
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`Could not record last login for ${email}: ${message}`);
+    }
+
+    const tokens = await this.generateTokens(user, rememberMe);
 
     this.logger.log(`User logged in successfully: ${email}`);
 
@@ -188,7 +240,7 @@ export class AuthService {
    */
   async refreshAccessToken(
     refreshToken: string
-  ): Promise<{ accessToken: string; refreshToken: string }> {
+  ): Promise<{ accessToken: string; refreshToken: string; rememberMe: boolean }> {
     try {
       const payload = await this.jwtService.verifyAsync<JwtPayload>(refreshToken, {
         secret: this.configService.get('JWT_SECRET'),
@@ -198,23 +250,78 @@ export class AuthService {
         throw new UnauthorizedException('Invalid token type');
       }
 
-      const user = await this.userRepository.findById(payload.sub);
+      if (await this.isRefreshTokenRevoked(refreshToken)) {
+        throw new UnauthorizedException('Refresh token has been revoked');
+      }
+
+      const user = await this.validateUser(payload);
 
       if (!user || !user.isActive) {
         throw new UnauthorizedException('User not found or inactive');
       }
 
-      const tokens = await this.generateTokens(user);
+      const rememberMe = payload.rememberMe === true;
+      const tokens = await this.generateTokens(user, rememberMe);
 
       this.logger.log(`Access token refreshed for user: ${user.email}`);
 
-      return tokens;
+      return { ...tokens, rememberMe };
     } catch (error: any) {
       this.logger.error(`Token refresh failed: ${error?.message || 'Unknown error'}`);
       throw new UnauthorizedException('Invalid or expired refresh token');
     }
   }
 
+  /**
+   * Logout — revoke the refresh token so it can no longer be used.
+   * The revocation list lives in Redis with a TTL matching the token's
+   * remaining lifetime, so entries clean themselves up.
+   */
+  async logout(
+    refreshToken?: string
+  ): Promise<{ userId: string; email: string; organizationId: string } | null> {
+    if (!refreshToken) {
+      return null;
+    }
+
+    try {
+      const payload = this.jwtService.decode(refreshToken) as JwtPayload & { exp?: number };
+      const remainingSeconds = payload?.exp
+        ? Math.max(payload.exp - Math.floor(Date.now() / 1000), 1)
+        : 7 * 24 * 60 * 60;
+
+      await this.cache.set(this.revokedTokenKey(refreshToken), true, remainingSeconds);
+      this.logger.log(`Refresh token revoked for user: ${payload?.email ?? 'unknown'}`);
+
+      if (payload?.sub) {
+        return {
+          userId: payload.sub,
+          email: payload.email,
+          organizationId: payload.organizationId,
+        };
+      }
+      return null;
+    } catch (error) {
+      // Never block logout on revocation failures — log and continue
+      this.logger.error(`Failed to revoke refresh token: ${error}`);
+      return null;
+    }
+  }
+
+  private async isRefreshTokenRevoked(refreshToken: string): Promise<boolean> {
+    try {
+      return (await this.cache.get<boolean>(this.revokedTokenKey(refreshToken))) === true;
+    } catch (error) {
+      this.logger.error(`Failed to check refresh token revocation: ${error}`);
+      return false;
+    }
+  }
+
+  private revokedTokenKey(refreshToken: string): string {
+    const hash = crypto.createHash('sha256').update(refreshToken).digest('hex');
+    return `auth:revoked-refresh:${hash}`;
+  }
+
   /**
    * Initiate password reset — generates token and sends email
    */
@@ -234,13 +341,15 @@ export class AuthService {
       { usedAt: new Date() }
     );
 
-    // Generate a secure random token
+    // Generate a secure random token; only its hash is stored so a database
+    // leak cannot be used to take over accounts via pending reset tokens
     const token = crypto.randomBytes(32).toString('hex');
+    const tokenHash = this.hashResetToken(token);
     const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
 
     await this.passwordResetTokenRepository.save({
       userId: user.id,
-      token,
+      token: tokenHash,
       expiresAt,
       usedAt: null,
     });
@@ -254,7 +363,9 @@ export class AuthService {
    * Reset password using token from email
    */
   async resetPassword(token: string, newPassword: string): Promise<void> {
-    const resetToken = await this.passwordResetTokenRepository.findOne({ where: { token } });
+    const resetToken = await this.passwordResetTokenRepository.findOne({
+      where: { token: this.hashResetToken(token) },
+    });
 
     if (!resetToken) {
       throw new BadRequestException('Token de réinitialisation invalide ou expiré');
@@ -265,7 +376,9 @@ export class AuthService {
     }
 
     if (resetToken.expiresAt < new Date()) {
-      throw new BadRequestException('Le lien de réinitialisation a expiré. Veuillez en demander un nouveau.');
+      throw new BadRequestException(
+        'Le lien de réinitialisation a expiré. Veuillez en demander un nouveau.'
+      );
     }
 
     const user = await this.userRepository.findById(resetToken.userId);
@@ -286,31 +399,44 @@ export class AuthService {
     await this.userRepository.save(user);
 
     // Mark token as used
-    await this.passwordResetTokenRepository.update(
-      { id: resetToken.id },
-      { usedAt: new Date() }
-    );
+    await this.passwordResetTokenRepository.update({ id: resetToken.id }, { usedAt: new Date() });
 
     this.logger.log(`Password reset successfully for user: ${user.email}`);
   }
 
+  private hashResetToken(token: string): string {
+    return crypto.createHash('sha256').update(token).digest('hex');
+  }
+
   /**
    * Validate user from JWT payload
    */
   async validateUser(payload: JwtPayload): Promise<User | null> {
     const user = await this.userRepository.findById(payload.sub);
 
-    if (!user || !user.isActive) {
+    if (!user || !user.isActive || payload.credentialVersion !== this.credentialVersion(user)) {
       return null;
     }
 
     return user;
   }
 
+  // Bind sessions to the current password hash without exposing the hash in JWTs.
+  // Tokens minted before this binding was introduced require a fresh login.
+  private credentialVersion(user: User): string {
+    return crypto
+      .createHmac('sha256', this.configService.getOrThrow<string>('JWT_SECRET'))
+      .update(JSON.stringify(['credential-version-v1', user.id, user.passwordHash]))
+      .digest('hex');
+  }
+
   /**
    * Generate access and refresh tokens
    */
-  private async generateTokens(user: User): Promise<{ accessToken: string; refreshToken: string }> {
+  private async generateTokens(
+    user: User,
+    rememberMe = false
+  ): Promise<{ accessToken: string; refreshToken: string }> {
     // ADMIN users always get PLATINIUM plan with no expiration
     let plan = 'BRONZE';
     let planFeatures: string[] = [];
@@ -331,8 +457,8 @@ export class AuthService {
         const subscription = await this.subscriptionService.getOrCreateSubscription(
           user.organizationId
         );
-        plan = subscription.plan.value;
-        planFeatures = [...subscription.plan.planFeatures];
+        plan = subscription.accessPlan.value;
+        planFeatures = [...subscription.accessPlan.planFeatures];
       } catch (error) {
         this.logger.warn(`Failed to fetch subscription for JWT: ${error}`);
       }
@@ -346,6 +472,7 @@ export class AuthService {
       plan,
       planFeatures,
       type: 'access',
+      credentialVersion: this.credentialVersion(user),
     };
 
     const refreshPayload: JwtPayload = {
@@ -356,6 +483,8 @@ export class AuthService {
       plan,
       planFeatures,
       type: 'refresh',
+      credentialVersion: this.credentialVersion(user),
+      rememberMe,
     };
 
     const [accessToken, refreshToken] = await Promise.all([

apps/backend/src/application/auth/jwt.strategy.ts

@@ -13,6 +13,7 @@ export interface JwtPayload {
   role: string;
   organizationId: string;
   type: 'access' | 'refresh';
+  credentialVersion?: string;
   iat?: number; // issued at
   exp?: number; // expiration
 }
@@ -35,7 +36,11 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     private readonly authService: AuthService
   ) {
     super({
-      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      jwtFromRequest: ExtractJwt.fromExtractors([
+        ExtractJwt.fromAuthHeaderAsBearerToken(),
+        // httpOnly cookie set by the auth endpoints (XSS-safe storage)
+        (req: { cookies?: Record<string, string> }) => req?.cookies?.accessToken ?? null,
+      ]),
       ignoreExpiration: false,
       secretOrKey: configService.get<string>('JWT_SECRET'),
     });

apps/backend/src/application/blog/blog.module.ts

@@ -0,0 +1,22 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { BlogController } from '../controllers/blog.controller';
+import { BlogService } from '../services/blog.service';
+import { BlogPostOrmEntity } from '../../infrastructure/persistence/typeorm/entities/blog-post.orm-entity';
+import { TypeOrmBlogPostRepository } from '../../infrastructure/persistence/typeorm/repositories/typeorm-blog-post.repository';
+import { BLOG_POST_REPOSITORY } from '@domain/ports/out/blog-post.repository';
+import { StorageModule } from '../../infrastructure/storage/storage.module';
+
+@Module({
+  imports: [TypeOrmModule.forFeature([BlogPostOrmEntity]), StorageModule],
+  controllers: [BlogController],
+  providers: [
+    BlogService,
+    {
+      provide: BLOG_POST_REPOSITORY,
+      useClass: TypeOrmBlogPostRepository,
+    },
+  ],
+  exports: [BlogService],
+})
+export class BlogModule {}

apps/backend/src/application/controllers/admin.controller.ts

@@ -6,6 +6,7 @@ import {
   Delete,
   Param,
   Body,
+  Query,
   HttpCode,
   HttpStatus,
   Logger,
@@ -15,14 +16,23 @@ import {
   BadRequestException,
   ParseUUIDPipe,
   UseGuards,
+  UseInterceptors,
+  UploadedFile,
   Inject,
 } from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { memoryStorage } from 'multer';
+import { v4 as uuidv4 } from 'uuid';
+import * as path from 'path';
+import sharp from 'sharp';
 import {
   ApiTags,
   ApiOperation,
   ApiResponse,
   ApiNotFoundResponse,
   ApiParam,
+  ApiQuery,
+  ApiConsumes,
   ApiBearerAuth,
 } from '@nestjs/swagger';
 import { JwtAuthGuard } from '../guards/jwt-auth.guard';
@@ -56,6 +66,30 @@ import {
 // Email imports
 import { EmailPort, EMAIL_PORT } from '@domain/ports/out/email.port';
 
+// Blog imports
+import { BlogService } from '../services/blog.service';
+import { CreateBlogPostDto, UpdateBlogPostDto } from '../dto/blog-post.dto';
+import { BlogPost } from '@domain/entities/blog-post.entity';
+import type { BlogPostCategory } from '@domain/entities/blog-post.entity';
+
+// Storage imports
+import { StoragePort, STORAGE_PORT } from '@domain/ports/out/storage.port';
+
+// User deletion
+import { UserDeletionService } from '../services/user-deletion.service';
+import { AdminContinuityService } from '../services/admin-continuity.service';
+import { isAnonymisedEmail } from '@domain/services/data-retention';
+
+const BLOG_IMAGES_BUCKET = 'xpeditis-blog';
+const ALLOWED_IMAGE_MIMETYPES = [
+  'image/jpeg',
+  'image/png',
+  'image/webp',
+  'image/gif',
+  'image/svg+xml',
+];
+const MAX_IMAGE_SIZE = 5 * 1024 * 1024; // 5MB
+
 /**
  * Admin Controller
  *
@@ -80,7 +114,11 @@ export class AdminController {
     private readonly csvBookingService: CsvBookingService,
     @Inject(SIRET_VERIFICATION_PORT)
     private readonly siretVerificationPort: SiretVerificationPort,
-    @Inject(EMAIL_PORT) private readonly emailPort: EmailPort
+    @Inject(EMAIL_PORT) private readonly emailPort: EmailPort,
+    private readonly blogService: BlogService,
+    @Inject(STORAGE_PORT) private readonly storage: StoragePort,
+    private readonly userDeletionService: UserDeletionService,
+    private readonly adminContinuity: AdminContinuityService
   ) {}
 
   // ==================== USERS ENDPOINTS ====================
@@ -112,7 +150,9 @@ export class AdminController {
   async getAllUsers(@CurrentUser() user: UserPayload): Promise<UserListResponseDto> {
     this.logger.log(`[ADMIN: ${user.email}] Fetching ALL users from database`);
 
-    let users = await this.userRepository.findAll();
+    // Erased accounts stay in the table (their bookings reference them) but are
+    // no longer users: they must not come back in the list after a deletion.
+    let users = (await this.userRepository.findAll()).filter(u => !isAnonymisedEmail(u.email));
 
     // Security: Non-admin users (MANAGER and below) cannot see ADMIN users
     if (user.role !== 'ADMIN') {
@@ -206,6 +246,12 @@ export class AdminController {
       throw new BadRequestException('You cannot change your own role');
     }
 
+    // At least one active admin must remain: refuse demoting or deactivating the last one
+    await this.adminContinuity.assertKeepsAnActiveAdmin(foundUser, {
+      role: dto.role ?? foundUser.role,
+      isActive: dto.isActive ?? foundUser.isActive,
+    });
+
     // Apply updates
     if (dto.firstName) {
       foundUser.updateFirstName(dto.firstName);
@@ -237,7 +283,10 @@ export class AdminController {
   @HttpCode(HttpStatus.NO_CONTENT)
   @ApiOperation({
     summary: 'Delete user (Admin only)',
-    description: 'Permanently delete a user from the database',
+    description:
+      'Erase a user (any role, including another ADMIN): personal data is deleted or anonymised, ' +
+      'the account is disabled and its license revoked. Bookings are kept. ' +
+      'An admin cannot delete their own account here, nor the last active admin.',
   })
   @ApiParam({
     name: 'id',
@@ -256,12 +305,7 @@ export class AdminController {
   ): Promise<void> {
     this.logger.log(`[ADMIN: ${user.email}] Deleting user: ${id}`);
 
-    const foundUser = await this.userRepository.findById(id);
-    if (!foundUser) {
-      throw new NotFoundException(`User ${id} not found`);
-    }
-
-    await this.userRepository.deleteById(id);
+    await this.userDeletionService.deleteByAdmin(id, user);
     this.logger.log(`[ADMIN] User deleted successfully: ${id}`);
   }
 
@@ -726,6 +770,12 @@ export class AdminController {
       routeDescription: booking.getRouteDescription(),
       isExpired: booking.isExpired(),
       price: booking.getPriceInCurrency(primaryCurrency),
+      commissionRate: booking.commissionRate,
+      commissionAmountEur: booking.commissionAmountEur,
+      freightTotal: booking.freightTotal,
+      freightCurrency: booking.freightCurrency,
+      fobTotal: booking.fobTotal,
+      fobCurrency: booking.fobCurrency,
     };
   }
 
@@ -744,10 +794,7 @@ export class AdminController {
   })
   @ApiResponse({ status: 200, description: 'Email sent successfully' })
   @ApiResponse({ status: 400, description: 'SMTP error — check the message field' })
-  async sendTestEmail(
-    @Body() body: { to: string },
-    @CurrentUser() user: UserPayload
-  ) {
+  async sendTestEmail(@Body() body: { to: string }, @CurrentUser() user: UserPayload) {
     if (!body?.to) {
       throw new BadRequestException('Field "to" is required');
     }
@@ -755,12 +802,8 @@ export class AdminController {
     this.logger.log(`[ADMIN: ${user.email}] Sending test email to ${body.to}`);
 
     try {
-      await this.emailPort.send({
-        to: body.to,
-        subject: '[Xpeditis] Test SMTP',
-        html: `<p>Email de test envoyé depuis le panel admin par <strong>${user.email}</strong>.</p><p>Si vous lisez ceci, la configuration SMTP fonctionne correctement.</p>`,
-        text: `Email de test envoyé par ${user.email}. Si vous lisez ceci, le SMTP fonctionne.`,
-      });
+      // Même gabarit que les vrais emails : le test valide aussi leur affichage.
+      await this.emailPort.sendSmtpTest(body.to, user.email);
 
       this.logger.log(`[ADMIN] Test email sent successfully to ${body.to}`);
       return { success: true, message: `Email envoyé avec succès à ${body.to}` };
@@ -880,7 +923,9 @@ export class AdminController {
     @Param('documentId', ParseUUIDPipe) documentId: string,
     @CurrentUser() user: UserPayload
   ): Promise<{ success: boolean; message: string }> {
-    this.logger.log(`[ADMIN: ${user.email}] Deleting document ${documentId} from booking ${bookingId}`);
+    this.logger.log(
+      `[ADMIN: ${user.email}] Deleting document ${documentId} from booking ${bookingId}`
+    );
 
     const booking = await this.csvBookingRepository.findById(bookingId);
     if (!booking) {
@@ -894,7 +939,9 @@ export class AdminController {
 
     const updatedDocuments = booking.documents.filter(doc => doc.id !== documentId);
 
-    const ormBooking = await this.csvBookingRepository['repository'].findOne({ where: { id: bookingId } });
+    const ormBooking = await this.csvBookingRepository['repository'].findOne({
+      where: { id: bookingId },
+    });
     if (ormBooking) {
       ormBooking.documents = updatedDocuments.map(doc => ({
         id: doc.id,
@@ -911,4 +958,235 @@ export class AdminController {
     this.logger.log(`[ADMIN] Document ${documentId} deleted from booking ${bookingId}`);
     return { success: true, message: 'Document deleted successfully' };
   }
+
+  // ==================== BLOG ENDPOINTS ====================
+
+  @Post('blog/images')
+  @UseInterceptors(
+    FileInterceptor('image', {
+      storage: memoryStorage(),
+      limits: { fileSize: MAX_IMAGE_SIZE },
+      fileFilter: (_req, file, cb) => {
+        if (ALLOWED_IMAGE_MIMETYPES.includes(file.mimetype)) {
+          cb(null, true);
+        } else {
+          cb(
+            new BadRequestException('Only image files are allowed (jpg, png, webp, gif, svg)'),
+            false
+          );
+        }
+      },
+    })
+  )
+  @ApiConsumes('multipart/form-data')
+  @ApiOperation({ summary: 'Upload a blog image to storage (Admin only)' })
+  @ApiResponse({
+    status: 201,
+    schema: { properties: { url: { type: 'string' }, filename: { type: 'string' } } },
+  })
+  async uploadBlogImage(
+    @UploadedFile() file: Express.Multer.File,
+    @CurrentUser() user: UserPayload
+  ): Promise<{ url: string; filename: string }> {
+    if (!file) throw new BadRequestException('No image file provided');
+
+    this.logger.log(`[ADMIN: ${user.email}] Uploading blog image: ${file.originalname}`);
+
+    const ext = path.extname(file.originalname).toLowerCase();
+    const sanitizedName = path
+      .basename(file.originalname, ext)
+      .replace(/[^a-z0-9]/gi, '-')
+      .toLowerCase();
+    const filename = `${uuidv4()}-${sanitizedName}${ext}`;
+    const key = `blog-images/${filename}`;
+
+    await this.storage.upload({
+      bucket: BLOG_IMAGES_BUCKET,
+      key,
+      body: file.buffer,
+      contentType: file.mimetype,
+    });
+
+    this.logger.log(`[ADMIN] Blog image uploaded: ${key}`);
+    return { url: `/api/v1/blog/images/${filename}`, filename };
+  }
+
+  @Post('blog/cover-images')
+  @UseInterceptors(
+    FileInterceptor('image', {
+      storage: memoryStorage(),
+      limits: { fileSize: MAX_IMAGE_SIZE },
+      fileFilter: (_req, file, cb) => {
+        // SVG cannot be raster-cropped; restrict to raster formats.
+        if (['image/jpeg', 'image/png', 'image/webp', 'image/gif'].includes(file.mimetype)) {
+          cb(null, true);
+        } else {
+          cb(new BadRequestException('Only JPG, PNG, WebP or GIF images are allowed'), false);
+        }
+      },
+    })
+  )
+  @ApiConsumes('multipart/form-data')
+  @ApiOperation({
+    summary: 'Upload and auto-crop a blog cover image (Admin only)',
+    description:
+      'Resizes and crops the image to the public 16:9 card ratio (1280x720) so covers are never distorted or cut off on the public site.',
+  })
+  @ApiResponse({
+    status: 201,
+    schema: { properties: { url: { type: 'string' }, filename: { type: 'string' } } },
+  })
+  async uploadBlogCoverImage(
+    @UploadedFile() file: Express.Multer.File,
+    @CurrentUser() user: UserPayload
+  ): Promise<{ url: string; filename: string }> {
+    if (!file) throw new BadRequestException('No image file provided');
+
+    this.logger.log(`[ADMIN: ${user.email}] Uploading blog cover image: ${file.originalname}`);
+
+    // Crop to the public blog card ratio (16:9). "attention" focuses on the most
+    // salient region so important content is preserved.
+    let processed: Buffer;
+    try {
+      processed = await sharp(file.buffer)
+        .resize(1280, 720, { fit: 'cover', position: sharp.strategy.attention })
+        .webp({ quality: 82 })
+        .toBuffer();
+    } catch (err: any) {
+      this.logger.error(`Failed to process cover image: ${err?.message}`);
+      throw new BadRequestException("Impossible de traiter l'image");
+    }
+
+    const filename = `${uuidv4()}-cover.webp`;
+    const key = `blog-images/${filename}`;
+
+    await this.storage.upload({
+      bucket: BLOG_IMAGES_BUCKET,
+      key,
+      body: processed,
+      contentType: 'image/webp',
+    });
+
+    this.logger.log(`[ADMIN] Blog cover image uploaded: ${key}`);
+    return { url: `/api/v1/blog/images/${filename}`, filename };
+  }
+
+  @Get('blog')
+  @ApiOperation({ summary: 'List all blog posts (Admin only)' })
+  @ApiQuery({ name: 'status', required: false })
+  @ApiQuery({ name: 'category', required: false })
+  @ApiQuery({ name: 'search', required: false })
+  @ApiQuery({ name: 'trashed', required: false, type: Boolean })
+  @ApiQuery({ name: 'limit', required: false, type: Number })
+  @ApiQuery({ name: 'offset', required: false, type: Number })
+  async listBlogPosts(
+    @Query('status') status?: any,
+    @Query('category') category?: BlogPostCategory,
+    @Query('search') search?: string,
+    @Query('trashed') trashed?: string,
+    @Query('limit') limit = 50,
+    @Query('offset') offset = 0,
+    @CurrentUser() user?: UserPayload
+  ) {
+    this.logger.log(`[ADMIN: ${user?.email}] Listing blog posts`);
+    const { posts, total } = await this.blogService.listAllPosts({
+      status,
+      category,
+      search,
+      trashed: trashed === 'true',
+      limit: Number(limit),
+      offset: Number(offset),
+    });
+    return { posts: posts.map(this.mapBlogPostToDto), total };
+  }
+
+  @Post('blog')
+  @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
+  @ApiOperation({ summary: 'Create a blog post (Admin only)' })
+  async createBlogPost(@Body() dto: CreateBlogPostDto, @CurrentUser() user: UserPayload) {
+    this.logger.log(`[ADMIN: ${user.email}] Creating blog post: ${dto.slug}`);
+    const post = await this.blogService.createPost(dto);
+    return this.mapBlogPostToDto(post);
+  }
+
+  @Patch('blog/:id')
+  @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
+  @ApiOperation({ summary: 'Update a blog post (Admin only)' })
+  async updateBlogPost(
+    @Param('id', ParseUUIDPipe) id: string,
+    @Body() dto: UpdateBlogPostDto,
+    @CurrentUser() user: UserPayload
+  ) {
+    this.logger.log(`[ADMIN: ${user.email}] Updating blog post: ${id}`);
+    const post = await this.blogService.updatePost(id, dto);
+    return this.mapBlogPostToDto(post);
+  }
+
+  @Delete('blog/:id')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @ApiOperation({ summary: 'Move a blog post to the trash (Admin only)' })
+  async deleteBlogPost(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: UserPayload
+  ): Promise<void> {
+    this.logger.log(`[ADMIN: ${user.email}] Trashing blog post: ${id}`);
+    await this.blogService.deletePost(id);
+  }
+
+  @Post('blog/:id/restore')
+  @ApiOperation({ summary: 'Restore a blog post from the trash (Admin only)' })
+  async restoreBlogPost(@Param('id', ParseUUIDPipe) id: string, @CurrentUser() user: UserPayload) {
+    this.logger.log(`[ADMIN: ${user.email}] Restoring blog post: ${id}`);
+    const post = await this.blogService.restorePost(id);
+    return this.mapBlogPostToDto(post);
+  }
+
+  @Delete('blog/:id/permanent')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @ApiOperation({ summary: 'Permanently delete a blog post (Admin only)' })
+  async permanentlyDeleteBlogPost(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: UserPayload
+  ): Promise<void> {
+    this.logger.log(`[ADMIN: ${user.email}] Permanently deleting blog post: ${id}`);
+    await this.blogService.permanentlyDeletePost(id);
+  }
+
+  @Post('blog/:id/duplicate')
+  @ApiOperation({ summary: 'Duplicate a blog post as a new draft (Admin only)' })
+  async duplicateBlogPost(
+    @Param('id', ParseUUIDPipe) id: string,
+    @CurrentUser() user: UserPayload
+  ) {
+    this.logger.log(`[ADMIN: ${user.email}] Duplicating blog post: ${id}`);
+    const post = await this.blogService.duplicatePost(id);
+    return this.mapBlogPostToDto(post);
+  }
+
+  private mapBlogPostToDto(post: BlogPost) {
+    return {
+      id: post.id,
+      title: post.title,
+      slug: post.slug,
+      excerpt: post.excerpt,
+      content: post.content,
+      coverImageUrl: post.coverImageUrl,
+      category: post.category,
+      tags: post.tags,
+      authorName: post.authorName,
+      status: post.status,
+      isFeatured: post.isFeatured,
+      publishedAt: post.publishedAt,
+      metaTitle: post.metaTitle,
+      metaDescription: post.metaDescription,
+      primaryKeyword: post.primaryKeyword,
+      secondaryKeywords: post.secondaryKeywords,
+      aiSummary: post.aiSummary,
+      faq: post.faq,
+      keyTakeaways: post.keyTakeaways,
+      aiEntities: post.aiEntities,
+      createdAt: post.createdAt,
+      updatedAt: post.updatedAt,
+    };
+  }
 }

apps/backend/src/application/controllers/admin/csv-rates.controller.ts

@@ -4,6 +4,7 @@ import {
   Get,
   Delete,
   Param,
+  Query,
   Body,
   UseGuards,
   UseInterceptors,
@@ -21,6 +22,7 @@ import {
   ApiBearerAuth,
   ApiConsumes,
   ApiBody,
+  ApiQuery,
 } from '@nestjs/swagger';
 import { diskStorage } from 'multer';
 import { extname } from 'path';
@@ -172,12 +174,15 @@ export class CsvRatesAdminController {
     }
 
     try {
-      // Generate final filename based on company name
+      const direction = dto.direction ?? 'EXPORT';
+
+      // Generate final filename based on company name + direction
+      // (a company can have one export grid and one import grid)
       const sanitizedCompanyName = dto.companyName
         .toLowerCase()
         .replace(/\s+/g, '-')
         .replace(/[^a-z0-9-]/g, '');
-      const finalFilename = `${sanitizedCompanyName}.csv`;
+      const finalFilename = `${sanitizedCompanyName}-${direction.toLowerCase()}.csv`;
 
       // Auto-convert CSV if needed (FOB FRET → Standard format)
       const conversionResult = await this.csvConverter.autoConvert(file.path, dto.companyName);
@@ -207,7 +212,8 @@ export class CsvRatesAdminController {
       const rates = await this.csvLoader.loadRatesFromCsv(
         filePathToValidate,
         dto.companyEmail,
-        dto.companyName
+        dto.companyName,
+        direction
       );
       const ratesCount = rates.length;
 
@@ -241,6 +247,7 @@ export class CsvRatesAdminController {
           metadata: {
             companyName: dto.companyName,
             companyEmail: dto.companyEmail,
+            direction,
             uploadedBy: user.email,
             uploadedAt: new Date().toISOString(),
           },
@@ -256,13 +263,17 @@ export class CsvRatesAdminController {
         // The file is still available locally
       }
 
-      // Check if config exists for this company
-      const existingConfig = await this.csvConfigRepository.findByCompanyName(dto.companyName);
+      // Check if config exists for this company + direction
+      const existingConfig = await this.csvConfigRepository.findByCompanyName(
+        dto.companyName,
+        direction
+      );
 
       if (existingConfig) {
         // Update existing configuration
         await this.csvConfigRepository.update(existingConfig.id, {
           csvFilePath: finalFilename,
+          direction,
           uploadedAt: new Date(),
           uploadedBy: user.id,
           rowCount: ratesCount,
@@ -285,6 +296,7 @@ export class CsvRatesAdminController {
         await this.csvConfigRepository.create({
           companyName: dto.companyName,
           csvFilePath: finalFilename,
+          direction,
           type: 'CSV_ONLY',
           hasApi: false,
           apiConnector: null,
@@ -410,7 +422,13 @@ export class CsvRatesAdminController {
   @ApiOperation({
     summary: 'Delete CSV rate configuration (ADMIN only)',
     description:
-      'Deletes the CSV rate configuration for a company. Note: This does not delete the actual CSV file.',
+      'Deletes the CSV rate configuration for a company. Without a direction, both the export and import grids of that company are deleted. Note: This does not delete the actual CSV file.',
+  })
+  @ApiQuery({
+    name: 'direction',
+    required: false,
+    enum: ['EXPORT', 'IMPORT'],
+    description: 'Only delete the grid of this direction',
   })
   @ApiResponse({
     status: HttpStatus.NO_CONTENT,
@@ -422,11 +440,14 @@ export class CsvRatesAdminController {
   })
   async deleteConfig(
     @Param('companyName') companyName: string,
-    @CurrentUser() user: UserPayload
+    @CurrentUser() user: UserPayload,
+    @Query('direction') direction?: string
   ): Promise<void> {
     this.logger.warn(`[Admin: ${user.email}] Deleting CSV config for company: ${companyName}`);
 
-    await this.csvConfigRepository.delete(companyName);
+    const upper = direction?.trim().toUpperCase();
+    const scoped = upper === 'EXPORT' || upper === 'IMPORT' ? upper : undefined;
+    await this.csvConfigRepository.delete(companyName, scoped);
 
     this.logger.log(`Deleted CSV config for company: ${companyName}`);
   }
@@ -453,10 +474,12 @@ export class CsvRatesAdminController {
           items: {
             type: 'object',
             properties: {
-              filename: { type: 'string', example: 'ssc-consolidation.csv' },
+              filename: { type: 'string', example: 'ssc-consolidation-export.csv' },
               size: { type: 'number', example: 2048 },
               uploadedAt: { type: 'string', format: 'date-time' },
               rowCount: { type: 'number', example: 150 },
+              companyName: { type: 'string', example: 'SSC Consolidation' },
+              direction: { type: 'string', enum: ['EXPORT', 'IMPORT'], example: 'EXPORT' },
             },
           },
         },
@@ -468,21 +491,34 @@ export class CsvRatesAdminController {
 
     const configs = await this.csvConfigRepository.findAll();
 
+    // Sizes come from MinIO, which is where the grids actually live; the local
+    // csv-storage copy is only a fallback and is often absent.
+    const sizeByKey = new Map<string, number>();
+    try {
+      const bucket = this.configService.get<string>('AWS_S3_BUCKET', 'xpeditis-csv-rates');
+      const objects = await this.s3Storage.list(bucket, 'csv-rates/');
+      objects.forEach(o => sizeByKey.set(o.key, o.size));
+    } catch (error: any) {
+      this.logger.warn(`Could not list CSV objects from MinIO: ${error.message}`);
+    }
+
     // Map configs to file info format expected by frontend
     const files = configs.map(config => {
+      const minioKey = config.metadata?.minioObjectKey as string | undefined;
+      let fileSize = (minioKey && sizeByKey.get(minioKey)) || 0;
+
+      if (!fileSize) {
         const filePath = path.join(
           process.cwd(),
           'apps/backend/src/infrastructure/storage/csv-storage/rates',
           config.csvFilePath
         );
-
-      let fileSize = 0;
         try {
-        const stats = fs.statSync(filePath);
-        fileSize = stats.size;
+          fileSize = fs.statSync(filePath).size;
         } catch (error) {
           this.logger.warn(`Could not get file size for ${config.csvFilePath}`);
         }
+      }
 
       return {
         filename: config.csvFilePath,
@@ -490,6 +526,9 @@ export class CsvRatesAdminController {
         uploadedAt: config.uploadedAt.toISOString(),
         rowCount: config.rowCount,
         companyEmail: config.metadata?.companyEmail ?? null,
+        companyName: config.companyName,
+        direction: config.direction ?? 'EXPORT',
+        isActive: config.isActive,
       };
     });
 
@@ -564,10 +603,11 @@ export class CsvRatesAdminController {
       }
     }
 
-    // Delete the configuration
-    await this.csvConfigRepository.delete(config.companyName);
+    // Delete the configuration — scoped to this grid's direction, otherwise the
+    // company's other grid (export vs import) would be deleted too.
+    await this.csvConfigRepository.delete(config.companyName, config.direction);
 
-    this.logger.log(`Deleted CSV config and file for: ${config.companyName}`);
+    this.logger.log(`Deleted CSV config and file for: ${config.companyName} (${config.direction})`);
 
     return {
       success: true,

apps/backend/src/application/controllers/audit.controller.ts

@@ -25,9 +25,9 @@ class AuditLogResponseDto {
   id: string;
   action: string;
   status: string;
-  userId: string;
+  userId: string | null;
   userEmail: string;
-  organizationId: string;
+  organizationId: string | null;
   resourceType?: string;
   resourceId?: string;
   resourceName?: string;

apps/backend/src/application/controllers/auth.controller.ts

@@ -8,10 +8,15 @@ import {
   Get,
   Inject,
   NotFoundException,
+  UnauthorizedException,
   InternalServerErrorException,
   Logger,
+  Req,
+  Res,
 } from '@nestjs/common';
+import type { Request, Response } from 'express';
 import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
 import { AuthService } from '../auth/auth.service';
 import {
   LoginDto,
@@ -29,6 +34,14 @@ import { JwtAuthGuard } from '../guards/jwt-auth.guard';
 import { UserRepository, USER_REPOSITORY } from '@domain/ports/out/user.repository';
 import { UserMapper } from '../mappers/user.mapper';
 import { InvitationService } from '../services/invitation.service';
+import { AuditService } from '../services/audit.service';
+import { AuditAction } from '@domain/entities/audit-log.entity';
+import {
+  AUTH_COOKIE_NAMES,
+  authCookieOptions,
+} from '../../infrastructure/security/security.config';
+
+const REFRESH_COOKIE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
 
 /**
  * Authentication Controller
@@ -49,9 +62,53 @@ export class AuthController {
     private readonly authService: AuthService,
     @Inject(USER_REPOSITORY) private readonly userRepository: UserRepository,
     private readonly invitationService: InvitationService,
+    private readonly auditService: AuditService,
     @Inject(EMAIL_PORT) private readonly emailService: EmailPort
   ) {}
 
+  /**
+   * Extract the client IP and user agent from the request so we can record
+   * *who* connected and *from where* in the audit trail.
+   */
+  private getClientInfo(req: Request): { ipAddress?: string; userAgent?: string } {
+    const forwardedFor = req.headers['x-forwarded-for'];
+    const ipAddress =
+      (Array.isArray(forwardedFor) ? forwardedFor[0] : forwardedFor?.split(',')[0]?.trim()) ||
+      req.ip ||
+      req.socket?.remoteAddress;
+    return {
+      ipAddress,
+      userAgent: req.headers['user-agent'],
+    };
+  }
+
+  /**
+   * Deliver tokens as httpOnly cookies so they are out of reach of XSS.
+   * When rememberMe is false the cookies are session-scoped (cleared when
+   * the browser closes); otherwise they persist for the refresh window.
+   */
+  private setAuthCookies(
+    res: Response,
+    tokens: { accessToken: string; refreshToken: string },
+    rememberMe: boolean
+  ): void {
+    const maxAgeMs = rememberMe ? REFRESH_COOKIE_MAX_AGE_MS : undefined;
+    res.cookie(AUTH_COOKIE_NAMES.accessToken, tokens.accessToken, authCookieOptions({ maxAgeMs }));
+    res.cookie(
+      AUTH_COOKIE_NAMES.refreshToken,
+      tokens.refreshToken,
+      authCookieOptions({ maxAgeMs })
+    );
+    // Readable flag (no token inside) so the frontend knows a session exists
+    res.cookie(AUTH_COOKIE_NAMES.session, '1', authCookieOptions({ maxAgeMs, httpOnly: false }));
+  }
+
+  private clearAuthCookies(res: Response): void {
+    res.clearCookie(AUTH_COOKIE_NAMES.accessToken, authCookieOptions());
+    res.clearCookie(AUTH_COOKIE_NAMES.refreshToken, authCookieOptions());
+    res.clearCookie(AUTH_COOKIE_NAMES.session, authCookieOptions({ httpOnly: false }));
+  }
+
   /**
    * Register a new user
    *
@@ -61,6 +118,7 @@ export class AuthController {
    * @returns Access token, refresh token, and user info
    */
   @Public()
+  @Throttle({ default: { limit: 5, ttl: 60000 } })
   @Post('register')
   @HttpCode(HttpStatus.CREATED)
   @ApiOperation({
@@ -80,7 +138,10 @@ export class AuthController {
     status: 400,
     description: 'Validation error (invalid email, weak password, etc.)',
   })
-  async register(@Body() dto: RegisterDto): Promise<AuthResponseDto> {
+  async register(
+    @Body() dto: RegisterDto,
+    @Res({ passthrough: true }) res: Response
+  ): Promise<AuthResponseDto> {
     // If invitation token is provided, verify and use it
     let invitationOrganizationId: string | undefined;
     let invitationRole: string | undefined;
@@ -101,12 +162,14 @@ export class AuthController {
       dto.lastName = dto.lastName || invitation.lastName;
     }
 
+    // Joining an existing organization is only allowed through a verified
+    // invitation token — never from a caller-supplied organization ID.
     const result = await this.authService.register(
       dto.email,
       dto.password,
       dto.firstName,
       dto.lastName,
-      invitationOrganizationId || dto.organizationId,
+      invitationOrganizationId,
       dto.organization,
       invitationRole
     );
@@ -116,6 +179,8 @@ export class AuthController {
       await this.invitationService.markInvitationAsUsed(dto.invitationToken);
     }
 
+    this.setAuthCookies(res, result, false);
+
     return {
       accessToken: result.accessToken,
       refreshToken: result.refreshToken,
@@ -132,6 +197,7 @@ export class AuthController {
    * @returns Access token, refresh token, and user info
    */
   @Public()
+  @Throttle({ default: { limit: 5, ttl: 60000 } })
   @Post('login')
   @HttpCode(HttpStatus.OK)
   @ApiOperation({
@@ -147,14 +213,62 @@ export class AuthController {
     status: 401,
     description: 'Invalid credentials or inactive account',
   })
-  async login(@Body() dto: LoginDto): Promise<AuthResponseDto> {
-    const result = await this.authService.login(dto.email, dto.password);
+  async login(
+    @Body() dto: LoginDto,
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response
+  ): Promise<AuthResponseDto> {
+    const rememberMe = dto.rememberMe === true;
+    const { ipAddress, userAgent } = this.getClientInfo(req);
+
+    try {
+      const result = await this.authService.login(dto.email, dto.password, rememberMe);
+
+      this.setAuthCookies(res, result, rememberMe);
+
+      // Audit log: record who logged in, when and from where
+      await this.auditService.logSuccess(
+        AuditAction.USER_LOGIN,
+        result.user.id,
+        result.user.email,
+        result.user.organizationId,
+        {
+          resourceType: 'user',
+          resourceId: result.user.id,
+          ipAddress,
+          userAgent,
+          metadata: { rememberMe },
+        }
+      );
+
+      this.logger.log(`Login success: ${result.user.email} from ${ipAddress ?? 'unknown IP'}`);
 
       return {
         accessToken: result.accessToken,
         refreshToken: result.refreshToken,
         user: result.user,
       };
+    } catch (error: any) {
+      // Audit log: record failed login attempts (the attempted email is the
+      // only identity we have — the credentials did not match a valid user,
+      // so user and organization are recorded as null)
+      await this.auditService.logFailure(
+        AuditAction.USER_LOGIN,
+        null,
+        dto.email,
+        null,
+        error?.message || 'Invalid credentials',
+        {
+          resourceType: 'user',
+          ipAddress,
+          userAgent,
+        }
+      );
+
+      this.logger.warn(`Login failed for ${dto.email} from ${ipAddress ?? 'unknown IP'}`);
+
+      throw error;
+    }
   }
 
   /**
@@ -166,6 +280,7 @@ export class AuthController {
    * @returns New access token
    */
   @Public()
+  @Throttle({ default: { limit: 20, ttl: 60000 } })
   @Post('refresh')
   @HttpCode(HttpStatus.OK)
   @ApiOperation({
@@ -175,10 +290,10 @@ export class AuthController {
   })
   @ApiResponse({
     status: 200,
-    description: 'Token refreshed successfully',
+    description: 'Token refreshed successfully — new tokens are set as httpOnly cookies',
     schema: {
       properties: {
-        accessToken: { type: 'string', example: 'eyJhbGciOiJIUzI1NiIs...' },
+        success: { type: 'boolean', example: true },
       },
     },
   })
@@ -186,27 +301,49 @@ export class AuthController {
     status: 401,
     description: 'Invalid or expired refresh token',
   })
-  async refresh(@Body() dto: RefreshTokenDto): Promise<{ accessToken: string }> {
-    const result = await this.authService.refreshAccessToken(dto.refreshToken);
+  async refresh(
+    @Body() dto: RefreshTokenDto,
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response
+  ): Promise<{ success: boolean }> {
+    // Prefer the httpOnly cookie; fall back to the body for legacy clients
+    const refreshToken = req.cookies?.[AUTH_COOKIE_NAMES.refreshToken] || dto.refreshToken;
 
-    return { accessToken: result.accessToken };
+    if (!refreshToken) {
+      this.clearAuthCookies(res);
+      throw new UnauthorizedException('No refresh token provided');
+    }
+
+    let result: Awaited<ReturnType<typeof this.authService.refreshAccessToken>>;
+    try {
+      result = await this.authService.refreshAccessToken(refreshToken);
+    } catch (error) {
+      // The refresh token is expired/revoked: wipe every auth cookie (including
+      // the readable session flag) so the client stops believing a session
+      // exists. Without this the frontend keeps retrying and reloading.
+      this.clearAuthCookies(res);
+      throw error;
+    }
+
+    this.setAuthCookies(res, result, result.rememberMe);
+
+    // Tokens are intentionally NOT returned in the body: an XSS payload could
+    // otherwise call this endpoint and exfiltrate a fresh access token.
+    return { success: true };
   }
 
   /**
-   * Logout (placeholder)
+   * Logout
    *
-   * Currently a no-op endpoint. With JWT, logout is typically handled client-side
-   * by removing tokens. For more security, implement token blacklisting with Redis.
-   *
-   * @returns Success message
+   * Revokes the refresh token (Redis blacklist) and clears the auth cookies.
+   * The access token naturally expires within 15 minutes.
    */
-  @UseGuards(JwtAuthGuard)
+  @Public()
   @Post('logout')
   @HttpCode(HttpStatus.OK)
-  @ApiBearerAuth()
   @ApiOperation({
     summary: 'Logout',
-    description: 'Logout the current user. Currently handled client-side by removing tokens.',
+    description: 'Revoke the refresh token and clear authentication cookies.',
   })
   @ApiResponse({
     status: 200,
@@ -217,9 +354,28 @@ export class AuthController {
       },
     },
   })
-  async logout(): Promise<{ message: string }> {
-    // TODO: Implement token blacklisting with Redis for more security
-    // For now, logout is handled client-side by removing tokens
+  async logout(
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response
+  ): Promise<{ message: string }> {
+    const refreshToken = req.cookies?.[AUTH_COOKIE_NAMES.refreshToken];
+
+    const loggedOutUser = await this.authService.logout(refreshToken);
+    this.clearAuthCookies(res);
+
+    // Audit log: record who logged out and when
+    if (loggedOutUser) {
+      const { ipAddress, userAgent } = this.getClientInfo(req);
+      await this.auditService.logSuccess(
+        AuditAction.USER_LOGOUT,
+        loggedOutUser.userId,
+        loggedOutUser.email,
+        loggedOutUser.organizationId,
+        { resourceType: 'user', resourceId: loggedOutUser.userId, ipAddress, userAgent }
+      );
+      this.logger.log(`Logout: ${loggedOutUser.email} from ${ipAddress ?? 'unknown IP'}`);
+    }
+
     return { message: 'Logout successful' };
   }
 
@@ -227,6 +383,7 @@ export class AuthController {
    * Contact form — forwards message to contact@xpeditis.com
    */
   @Public()
+  @Throttle({ default: { limit: 3, ttl: 60000 } })
   @Post('contact')
   @HttpCode(HttpStatus.OK)
   @ApiOperation({
@@ -245,51 +402,22 @@ export class AuthController {
       other: 'Autre',
     };
 
-    const subjectLabel = subjectLabels[dto.subject] || dto.subject;
-
-    const html = `
-      <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-        <div style="background: #10183A; padding: 24px; border-radius: 8px 8px 0 0;">
-          <h1 style="color: #34CCCD; margin: 0; font-size: 20px;">Nouveau message de contact</h1>
-        </div>
-        <div style="background: #f9f9f9; padding: 24px; border: 1px solid #e0e0e0;">
-          <table style="width: 100%; border-collapse: collapse;">
-            <tr>
-              <td style="padding: 8px 0; color: #666; width: 130px; font-size: 14px;">Nom</td>
-              <td style="padding: 8px 0; color: #222; font-weight: bold; font-size: 14px;">${dto.firstName} ${dto.lastName}</td>
-            </tr>
-            <tr>
-              <td style="padding: 8px 0; color: #666; font-size: 14px;">Email</td>
-              <td style="padding: 8px 0; font-size: 14px;"><a href="mailto:${dto.email}" style="color: #34CCCD;">${dto.email}</a></td>
-            </tr>
-            ${dto.company ? `<tr><td style="padding: 8px 0; color: #666; font-size: 14px;">Entreprise</td><td style="padding: 8px 0; color: #222; font-size: 14px;">${dto.company}</td></tr>` : ''}
-            ${dto.phone ? `<tr><td style="padding: 8px 0; color: #666; font-size: 14px;">Téléphone</td><td style="padding: 8px 0; color: #222; font-size: 14px;">${dto.phone}</td></tr>` : ''}
-            <tr>
-              <td style="padding: 8px 0; color: #666; font-size: 14px;">Sujet</td>
-              <td style="padding: 8px 0; color: #222; font-size: 14px;">${subjectLabel}</td>
-            </tr>
-          </table>
-          <div style="margin-top: 16px; padding-top: 16px; border-top: 1px solid #ddd;">
-            <p style="color: #666; font-size: 14px; margin: 0 0 8px 0;">Message :</p>
-            <p style="color: #222; font-size: 14px; white-space: pre-wrap; margin: 0;">${dto.message}</p>
-          </div>
-        </div>
-        <div style="background: #f0f0f0; padding: 12px 24px; border-radius: 0 0 8px 8px; text-align: center;">
-          <p style="color: #999; font-size: 12px; margin: 0;">Xpeditis — Formulaire de contact</p>
-        </div>
-      </div>
-    `;
-
+    // Le gabarit échappe lui-même chaque champ saisi par le visiteur.
     try {
-      await this.emailService.send({
-        to: 'contact@xpeditis.com',
-        replyTo: dto.email,
-        subject: `[Contact] ${subjectLabel} — ${dto.firstName} ${dto.lastName}`,
-        html,
+      await this.emailService.sendContactMessage('contact@xpeditis.com', {
+        firstName: dto.firstName,
+        lastName: dto.lastName,
+        email: dto.email,
+        company: dto.company || undefined,
+        phone: dto.phone || undefined,
+        subjectLabel: subjectLabels[dto.subject] || dto.subject,
+        message: dto.message,
       });
     } catch (error) {
       this.logger.error(`Failed to send contact email: ${error}`);
-      throw new InternalServerErrorException("Erreur lors de l'envoi du message. Veuillez réessayer.");
+      throw new InternalServerErrorException(
+        "Erreur lors de l'envoi du message. Veuillez réessayer."
+      );
     }
 
     return { message: 'Message envoyé avec succès.' };
@@ -299,6 +427,7 @@ export class AuthController {
    * Forgot password — sends reset email
    */
   @Public()
+  @Throttle({ default: { limit: 3, ttl: 60000 } })
   @Post('forgot-password')
   @HttpCode(HttpStatus.OK)
   @ApiOperation({
@@ -317,6 +446,7 @@ export class AuthController {
    * Reset password using token from email
    */
   @Public()
+  @Throttle({ default: { limit: 5, ttl: 60000 } })
   @Post('reset-password')
   @HttpCode(HttpStatus.OK)
   @ApiOperation({

apps/backend/src/application/controllers/blog.controller.ts

@@ -0,0 +1,139 @@
+import {
+  Controller,
+  Get,
+  Param,
+  Query,
+  HttpCode,
+  HttpStatus,
+  Res,
+  NotFoundException,
+  Inject,
+  Logger,
+  StreamableFile,
+} from '@nestjs/common';
+import { Response } from 'express';
+import { ApiTags, ApiOperation, ApiResponse, ApiParam, ApiQuery } from '@nestjs/swagger';
+import { Public } from '../decorators/public.decorator';
+import { BlogService } from '../services/blog.service';
+import { BlogPost } from '@domain/entities/blog-post.entity';
+import { BlogPostResponseDto, BlogPostListResponseDto } from '../dto/blog-post.dto';
+import type { BlogPostCategory } from '@domain/entities/blog-post.entity';
+import { StoragePort, STORAGE_PORT } from '@domain/ports/out/storage.port';
+
+const BLOG_IMAGES_BUCKET = 'xpeditis-blog';
+
+@ApiTags('Blog')
+@Controller('blog')
+@Public()
+export class BlogController {
+  private readonly logger = new Logger(BlogController.name);
+
+  constructor(
+    private readonly blogService: BlogService,
+    @Inject(STORAGE_PORT) private readonly storage: StoragePort
+  ) {}
+
+  @Get()
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'List published blog posts' })
+  @ApiQuery({
+    name: 'category',
+    required: false,
+    enum: ['industry', 'technology', 'guides', 'news'],
+  })
+  @ApiQuery({ name: 'search', required: false })
+  @ApiQuery({ name: 'limit', required: false, type: Number })
+  @ApiQuery({ name: 'offset', required: false, type: Number })
+  @ApiResponse({ status: 200, type: BlogPostListResponseDto })
+  async listPosts(
+    @Query('category') category?: BlogPostCategory,
+    @Query('search') search?: string,
+    @Query('limit') limit = 20,
+    @Query('offset') offset = 0
+  ): Promise<BlogPostListResponseDto> {
+    const { posts, total } = await this.blogService.listPublishedPosts({
+      category,
+      search,
+      limit: Number(limit),
+      offset: Number(offset),
+    });
+
+    return {
+      posts: posts.map(this.mapToDto),
+      total,
+      limit: Number(limit),
+      offset: Number(offset),
+    };
+  }
+
+  @Get('images/:filename')
+  @ApiOperation({ summary: 'Serve a blog image from storage' })
+  @ApiParam({ name: 'filename' })
+  async serveImage(
+    @Param('filename') filename: string,
+    @Res({ passthrough: true }) res: Response
+  ): Promise<StreamableFile> {
+    const key = `blog-images/${filename}`;
+
+    let buffer: Buffer;
+    try {
+      buffer = await this.storage.download({ bucket: BLOG_IMAGES_BUCKET, key });
+    } catch (err: any) {
+      this.logger.error(`Failed to serve blog image "${key}": ${err?.message}`);
+      throw new NotFoundException(`Image not found: ${filename}`);
+    }
+
+    const ext = filename.split('.').pop()?.toLowerCase() ?? '';
+    const contentTypeMap: Record<string, string> = {
+      jpg: 'image/jpeg',
+      jpeg: 'image/jpeg',
+      png: 'image/png',
+      webp: 'image/webp',
+      gif: 'image/gif',
+      svg: 'image/svg+xml',
+    };
+    const contentType = contentTypeMap[ext] ?? 'application/octet-stream';
+
+    res.setHeader('Content-Type', contentType);
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    return new StreamableFile(buffer);
+  }
+
+  @Get(':slug')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Get a published blog post by slug' })
+  @ApiParam({ name: 'slug' })
+  @ApiResponse({ status: 200, type: BlogPostResponseDto })
+  async getPost(@Param('slug') slug: string): Promise<BlogPostResponseDto> {
+    const post = await this.blogService.getPublishedPostBySlug(slug);
+    return this.mapToDto(post);
+  }
+
+  private mapToDto(post: BlogPost): BlogPostResponseDto {
+    return {
+      id: post.id,
+      title: post.title,
+      slug: post.slug,
+      excerpt: post.excerpt,
+      content: post.content,
+      coverImageUrl: post.coverImageUrl ?? undefined,
+      category: post.category,
+      tags: post.tags,
+      authorName: post.authorName,
+      status: post.status,
+      isFeatured: post.isFeatured,
+      publishedAt: post.publishedAt,
+      metaTitle: post.metaTitle,
+      metaDescription: post.metaDescription,
+      primaryKeyword: post.primaryKeyword,
+      secondaryKeywords: post.secondaryKeywords,
+      aiSummary: post.aiSummary ?? undefined,
+      faq: post.faq,
+      keyTakeaways: post.keyTakeaways,
+      aiEntities: post.aiEntities,
+      createdAt: post.createdAt,
+      updatedAt: post.updatedAt,
+    };
+  }
+}

apps/backend/src/application/controllers/bookings.controller.ts

@@ -117,7 +117,7 @@ export class BookingsController {
     const subscription = await this.subscriptionService.getOrCreateSubscription(
       user.organizationId
     );
-    const maxShipments = subscription.plan.maxShipmentsPerYear;
+    const maxShipments = subscription.maxShipmentsPerYear;
     if (maxShipments !== -1) {
       const currentYear = new Date().getFullYear();
       const count = await this.shipmentCounter.countShipmentsForOrganizationInYear(

apps/backend/src/application/controllers/csv-booking-actions.controller.ts

@@ -1,4 +1,5 @@
-import { Controller, Get, Post, Param, Query, Body } from '@nestjs/common';
+import { Controller, Get, Post, Param, Query, Body, Res, StreamableFile } from '@nestjs/common';
+import { Response } from 'express';
 import { ApiTags, ApiOperation, ApiResponse, ApiParam, ApiQuery, ApiBody } from '@nestjs/swagger';
 import { Public } from '../decorators/public.decorator';
 import { CsvBookingService } from '../services/csv-booking.service';
@@ -173,4 +174,75 @@ export class CsvBookingActionsController {
   async getBookingDocuments(@Param('token') token: string): Promise<CarrierDocumentsResponseDto> {
     return this.csvBookingService.getDocumentsForCarrier(token);
   }
+
+  /**
+   * Download a single booking document, streamed through the API (PUBLIC - token-based).
+   *
+   * Password-protected bookings must use POST with the password in the body.
+   *
+   * POST /api/v1/csv-booking-actions/documents/:token/:documentId/download
+   */
+  @Public()
+  @Post('documents/:token/:documentId/download')
+  @ApiOperation({
+    summary: 'Download a booking document with password (public)',
+    description:
+      'Streams a single booking document to the carrier. Applies the same access rules as the documents list (booking accepted + password when protected).',
+  })
+  @ApiParam({ name: 'token', description: 'Booking confirmation token (UUID)' })
+  @ApiParam({ name: 'documentId', description: 'Document ID' })
+  @ApiBody({ type: VerifyDocumentAccessDto })
+  @ApiResponse({ status: 200, description: 'Document streamed successfully.' })
+  @ApiResponse({ status: 401, description: 'Invalid or missing password' })
+  @ApiResponse({ status: 404, description: 'Booking or document not found' })
+  async downloadBookingDocumentWithPassword(
+    @Param('token') token: string,
+    @Param('documentId') documentId: string,
+    @Body() dto: VerifyDocumentAccessDto,
+    @Res({ passthrough: true }) res: Response
+  ): Promise<StreamableFile> {
+    return this.streamDocument(token, documentId, dto?.password, res);
+  }
+
+  /**
+   * Download a single booking document (PUBLIC - token-based) - Legacy without password.
+   *
+   * GET /api/v1/csv-booking-actions/documents/:token/:documentId/download
+   */
+  @Public()
+  @Get('documents/:token/:documentId/download')
+  @ApiOperation({
+    summary: 'Download a booking document (public) - Legacy',
+    description:
+      'Streams a single booking document for bookings without password protection. Protected bookings must use the POST variant.',
+  })
+  @ApiParam({ name: 'token', description: 'Booking confirmation token (UUID)' })
+  @ApiParam({ name: 'documentId', description: 'Document ID' })
+  @ApiResponse({ status: 200, description: 'Document streamed successfully.' })
+  @ApiResponse({ status: 401, description: 'Password required for this booking' })
+  @ApiResponse({ status: 404, description: 'Booking or document not found' })
+  async downloadBookingDocument(
+    @Param('token') token: string,
+    @Param('documentId') documentId: string,
+    @Res({ passthrough: true }) res: Response
+  ): Promise<StreamableFile> {
+    return this.streamDocument(token, documentId, undefined, res);
+  }
+
+  private async streamDocument(
+    token: string,
+    documentId: string,
+    password: string | undefined,
+    res: Response
+  ): Promise<StreamableFile> {
+    const { buffer, fileName, mimeType } = await this.csvBookingService.streamDocumentForCarrier(
+      token,
+      documentId,
+      password
+    );
+
+    res.setHeader('Content-Type', mimeType);
+    res.setHeader('Content-Disposition', `attachment; filename="${encodeURIComponent(fileName)}"`);
+    return new StreamableFile(buffer);
+  }
 }

apps/backend/src/application/controllers/csv-bookings.controller.ts

@@ -14,6 +14,7 @@ import {
   BadRequestException,
   ForbiddenException,
   ParseIntPipe,
+  ParseUUIDPipe,
   DefaultValuePipe,
   Inject,
 } from '@nestjs/common';
@@ -30,6 +31,8 @@ import {
   ApiParam,
 } from '@nestjs/swagger';
 import { JwtAuthGuard } from '../guards/jwt-auth.guard';
+import { RolesGuard } from '../guards/roles.guard';
+import { Roles } from '../decorators/roles.decorator';
 import { Public } from '../decorators/public.decorator';
 import { CsvBookingService } from '../services/csv-booking.service';
 import { SubscriptionService } from '../services/subscription.service';
@@ -47,6 +50,8 @@ import {
   CsvBookingResponseDto,
   CsvBookingListResponseDto,
   CsvBookingStatsDto,
+  UpdateCsvBookingDetailsDto,
+  UpdateCsvBookingRateDto,
 } from '../dto/csv-booking.dto';
 
 /**
@@ -81,8 +86,20 @@ export class CsvBookingsController {
    * POST /api/v1/csv-bookings
    */
   @Post()
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @ApiBearerAuth()
-  @UseInterceptors(FilesInterceptor('documents', 10))
+  @UseInterceptors(
+    FilesInterceptor('documents', 10, {
+      limits: {
+        fileSize: 10 * 1024 * 1024,
+        files: 10,
+        fields: 40,
+        parts: 50,
+        fieldSize: 64 * 1024,
+      },
+    })
+  )
   @ApiConsumes('multipart/form-data')
   @ApiOperation({
     summary: 'Create a new CSV booking request',
@@ -141,13 +158,6 @@ export class CsvBookingsController {
     @Request() req: any
   ): Promise<CsvBookingResponseDto> {
     // Debug: Log request details
-    console.log('=== CSV Booking Request Debug ===');
-    console.log('req.user:', req.user);
-    console.log('req.body:', req.body);
-    console.log('dto:', dto);
-    console.log('files:', files?.length);
-    console.log('================================');
-
     if (!files || files.length === 0) {
       throw new BadRequestException('At least one document is required');
     }
@@ -166,12 +176,12 @@ export class CsvBookingsController {
 
     // ADMIN users bypass shipment limits
     if (req.user.role !== 'ADMIN') {
-      // Check shipment limit (Bronze plan = 12/year)
+      // Check the paid-reservation limit (free/Bronze plan = 5 paid shipments/year)
       const subscription = await this.subscriptionService.getOrCreateSubscription(organizationId);
-      const maxShipments = subscription.plan.maxShipmentsPerYear;
+      const maxShipments = subscription.maxShipmentsPerYear;
       if (maxShipments !== -1) {
         const currentYear = new Date().getFullYear();
-        const count = await this.shipmentCounter.countShipmentsForOrganizationInYear(
+        const count = await this.shipmentCounter.countPaidShipmentsForOrganizationInYear(
           organizationId,
           currentYear
         );
@@ -226,6 +236,35 @@ export class CsvBookingsController {
     return await this.csvBookingService.getUserBookings(userId, page, limit);
   }
 
+  /**
+   * Get the reservation (paid shipment) quota for the current organization.
+   *
+   * Uses the organization's real plan (not the ADMIN PLATINIUM override) and
+   * counts only PAID shipments this year, so the UI can show an upgrade prompt.
+   *
+   * GET /api/v1/csv-bookings/reservation-quota
+   */
+  @Get('reservation-quota')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth()
+  @ApiOperation({ summary: 'Get the paid-reservation quota for the current organization' })
+  @ApiResponse({ status: 200, description: 'Quota retrieved successfully' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  async getReservationQuota(
+    @Request() req: any
+  ): Promise<{ max: number; used: number; unlimited: boolean; limitReached: boolean }> {
+    const organizationId = req.user.organizationId;
+    const subscription = await this.subscriptionService.getOrCreateSubscription(organizationId);
+    const max = subscription.maxShipmentsPerYear;
+    const unlimited = max === -1;
+    const currentYear = new Date().getFullYear();
+    const used = await this.shipmentCounter.countPaidShipmentsForOrganizationInYear(
+      organizationId,
+      currentYear
+    );
+    return { max, used, unlimited, limitReached: !unlimited && used >= max };
+  }
+
   /**
    * Get booking statistics for user
    *
@@ -256,6 +295,8 @@ export class CsvBookingsController {
    * GET /api/v1/csv-bookings/stats/organization
    */
   @Get('stats/organization')
+  @UseGuards(RolesGuard)
+  @Roles('ADMIN', 'MANAGER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOperation({
@@ -279,12 +320,15 @@ export class CsvBookingsController {
    * GET /api/v1/csv-bookings/organization/all
    */
   @Get('organization/all')
+  @UseGuards(RolesGuard)
+  @Roles('ADMIN', 'MANAGER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOperation({
     summary: 'Get organization bookings',
     description:
-      "Retrieve all bookings for the user's organization with pagination. For managers/admins.",
+      "Retrieve all bookings and quotes of the user's organization, whoever created them, " +
+      'with the name of their creator. Available to every member of the organization.',
   })
   @ApiQuery({ name: 'page', required: false, type: Number, example: 1 })
   @ApiQuery({ name: 'limit', required: false, type: Number, example: 10 })
@@ -384,6 +428,8 @@ export class CsvBookingsController {
    * POST /api/v1/csv-bookings/:id/pay
    */
   @Post(':id/pay')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOperation({
@@ -404,7 +450,7 @@ export class CsvBookingsController {
       },
     },
   })
-  @ApiResponse({ status: 400, description: 'Booking not in PENDING_PAYMENT status' })
+  @ApiResponse({ status: 400, description: 'Booking not in QUOTE status' })
   @ApiResponse({ status: 404, description: 'Booking not found' })
   async payCommission(@Param('id') id: string, @Request() req: any) {
     const userId = req.user.id;
@@ -432,6 +478,8 @@ export class CsvBookingsController {
    * POST /api/v1/csv-bookings/:id/confirm-payment
    */
   @Post(':id/confirm-payment')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOperation({
@@ -475,6 +523,8 @@ export class CsvBookingsController {
    * POST /api/v1/csv-bookings/:id/declare-transfer
    */
   @Post(':id/declare-transfer')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOperation({
@@ -488,7 +538,7 @@ export class CsvBookingsController {
     description: 'Bank transfer declared, booking awaiting admin validation',
     type: CsvBookingResponseDto,
   })
-  @ApiResponse({ status: 400, description: 'Booking not in PENDING_PAYMENT status' })
+  @ApiResponse({ status: 400, description: 'Booking not in QUOTE status' })
   @ApiResponse({ status: 404, description: 'Booking not found' })
   async declareTransfer(
     @Param('id') id: string,
@@ -515,7 +565,9 @@ export class CsvBookingsController {
   @ApiBearerAuth()
   @ApiOperation({
     summary: 'Get booking by ID',
-    description: 'Retrieve a specific CSV booking by its ID. Only accessible by the booking owner.',
+    description:
+      'Retrieve a specific CSV booking by its ID. Readable by any member of the booking organization ' +
+      'and by the assigned carrier; changes remain reserved to the booking owner.',
   })
   @ApiParam({ name: 'id', description: 'Booking ID (UUID)' })
   @ApiResponse({
@@ -528,7 +580,12 @@ export class CsvBookingsController {
   async getBooking(@Param('id') id: string, @Request() req: any): Promise<CsvBookingResponseDto> {
     const userId = req.user.id;
     const carrierId = req.user.carrierId; // May be undefined if not a carrier
-    return await this.csvBookingService.getBookingById(id, userId, carrierId);
+    return await this.csvBookingService.getBookingById(
+      id,
+      userId,
+      carrierId,
+      req.user.organizationId
+    );
   }
 
   /**
@@ -537,6 +594,8 @@ export class CsvBookingsController {
    * PATCH /api/v1/csv-bookings/:id/cancel
    */
   @Patch(':id/cancel')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOperation({
@@ -560,15 +619,120 @@ export class CsvBookingsController {
     return await this.csvBookingService.cancelBooking(id, userId);
   }
 
+  /**
+   * Delete an unpaid booking
+   *
+   * DELETE /api/v1/csv-bookings/:id
+   */
+  @Delete(':id')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth()
+  @ApiOperation({
+    summary: 'Delete an unpaid booking',
+    description:
+      'Permanently deletes a booking whose commission has not been paid. Only accessible by the booking owner. A paid booking has been sent to the carrier and can only be cancelled.',
+  })
+  @ApiParam({ name: 'id', description: 'Booking ID (UUID)' })
+  @ApiResponse({ status: 200, description: 'Booking deleted successfully' })
+  @ApiResponse({ status: 400, description: 'Booking has been paid and cannot be deleted' })
+  @ApiResponse({ status: 404, description: 'Booking not found' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  async deleteBooking(
+    @Param('id', ParseUUIDPipe) id: string,
+    @Request() req: any
+  ): Promise<{ success: boolean; message: string }> {
+    return await this.csvBookingService.deleteBooking(id, req.user.id);
+  }
+
+  /**
+   * Update booking cargo details before payment
+   *
+   * PATCH /api/v1/csv-bookings/:id/details
+   */
+  @Patch(':id/details')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth()
+  @ApiOperation({
+    summary: 'Update booking details before payment',
+    description:
+      'Edit cargo characteristics (volume, weight, pallets, notes) of a booking awaiting payment. Only the owner can edit, and only while the booking is QUOTE.',
+  })
+  @ApiParam({ name: 'id', description: 'Booking ID (UUID)' })
+  @ApiResponse({
+    status: 200,
+    description: 'Booking details updated successfully',
+    type: CsvBookingResponseDto,
+  })
+  @ApiResponse({ status: 400, description: 'Booking cannot be edited (invalid status or values)' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  @ApiResponse({ status: 404, description: 'Booking not found' })
+  async updateBookingDetails(
+    @Param('id') id: string,
+    @Body() dto: UpdateCsvBookingDetailsDto,
+    @Request() req: any
+  ): Promise<CsvBookingResponseDto> {
+    const userId = req.user.id;
+    return await this.csvBookingService.updateBookingDetails(id, userId, dto);
+  }
+
+  /**
+   * Re-apply a full rate selection before payment
+   *
+   * PATCH /api/v1/csv-bookings/:id/rate
+   */
+  @Patch(':id/rate')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth()
+  @ApiOperation({
+    summary: 'Update booking rate/route before payment',
+    description:
+      'Re-apply a rate selection (carrier, route, container, transit, cargo, price) to a QUOTE booking. Only the owner can edit.',
+  })
+  @ApiParam({ name: 'id', description: 'Booking ID (UUID)' })
+  @ApiResponse({
+    status: 200,
+    description: 'Booking rate updated successfully',
+    type: CsvBookingResponseDto,
+  })
+  @ApiResponse({ status: 400, description: 'Booking cannot be edited (invalid status or values)' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  @ApiResponse({ status: 404, description: 'Booking not found' })
+  async updateBookingRate(
+    @Param('id') id: string,
+    @Body() dto: UpdateCsvBookingRateDto,
+    @Request() req: any
+  ): Promise<CsvBookingResponseDto> {
+    const userId = req.user.id;
+    return await this.csvBookingService.updateBookingRate(id, userId, dto);
+  }
+
   /**
    * Add documents to an existing booking
    *
    * POST /api/v1/csv-bookings/:id/documents
    */
   @Post(':id/documents')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
-  @UseInterceptors(FilesInterceptor('documents', 10))
+  @UseInterceptors(
+    FilesInterceptor('documents', 10, {
+      limits: {
+        fileSize: 10 * 1024 * 1024,
+        files: 10,
+        fields: 40,
+        parts: 50,
+        fieldSize: 64 * 1024,
+      },
+    })
+  )
   @ApiConsumes('multipart/form-data')
   @ApiOperation({
     summary: 'Add documents to an existing booking',
@@ -622,9 +786,15 @@ export class CsvBookingsController {
    * PUT /api/v1/csv-bookings/:bookingId/documents/:documentId
    */
   @Patch(':bookingId/documents/:documentId')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
-  @UseInterceptors(FilesInterceptor('document', 1))
+  @UseInterceptors(
+    FilesInterceptor('document', 1, {
+      limits: { fileSize: 10 * 1024 * 1024, files: 1, fields: 10, parts: 11, fieldSize: 64 * 1024 },
+    })
+  )
   @ApiConsumes('multipart/form-data')
   @ApiOperation({
     summary: 'Replace a document in a booking',
@@ -691,6 +861,8 @@ export class CsvBookingsController {
    * DELETE /api/v1/csv-bookings/:bookingId/documents/:documentId
    */
   @Delete(':bookingId/documents/:documentId')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('ADMIN', 'MANAGER', 'USER')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOperation({

apps/backend/src/application/controllers/csv-bookings.security.spec.ts

@@ -0,0 +1,119 @@
+import { ExecutionContext, INestApplication } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import { ConfigService } from '@nestjs/config';
+import request from 'supertest';
+import { Subscription } from '@domain/entities/subscription.entity';
+import { SubscriptionPlan } from '@domain/value-objects/subscription-plan.vo';
+import { ShipmentLimitExceededException } from '@domain/exceptions/shipment-limit-exceeded.exception';
+import { CreateCsvBookingDto } from '../dto/csv-booking.dto';
+import { SubscriptionStatus } from '@domain/value-objects/subscription-status.vo';
+import { CsvBookingsController } from './csv-bookings.controller';
+import { JwtAuthGuard } from '../guards/jwt-auth.guard';
+import { CsvBookingService } from '../services/csv-booking.service';
+import { SubscriptionService } from '../services/subscription.service';
+import { SHIPMENT_COUNTER_PORT } from '@domain/ports/out/shipment-counter.port';
+import { ORGANIZATION_REPOSITORY } from '@domain/ports/out/organization.repository';
+
+describe('CSV booking HTTP security', () => {
+  let app: INestApplication;
+  let subscription: Subscription;
+  const countPaidShipmentsForOrganizationInYear = jest.fn().mockResolvedValue(0);
+  const createBooking = jest.fn(async () => ({ id: 'booking' }));
+  const getUserBookings = jest.fn(async () => ({ bookings: [] }));
+  beforeAll(async () => {
+    const module = await Test.createTestingModule({
+      controllers: [CsvBookingsController],
+      providers: [
+        { provide: CsvBookingService, useValue: { createBooking, getUserBookings } },
+        {
+          provide: SubscriptionService,
+          useValue: {
+            getOrCreateSubscription: async () => subscription,
+          },
+        },
+        { provide: ConfigService, useValue: {} },
+        { provide: SHIPMENT_COUNTER_PORT, useValue: { countPaidShipmentsForOrganizationInYear } },
+        { provide: ORGANIZATION_REPOSITORY, useValue: {} },
+      ],
+    })
+      .overrideGuard(JwtAuthGuard)
+      .useValue({
+        canActivate: (context: ExecutionContext) => {
+          const req = context.switchToHttp().getRequest();
+          req.user = {
+            id: 'user',
+            organizationId: 'org',
+            role: req.headers['x-test-role'] || 'USER',
+          };
+          return true;
+        },
+      })
+      .compile();
+    app = module.createNestApplication({ logger: false });
+    await app.init();
+    await app.listen(0, '127.0.0.1');
+  });
+  afterAll(async () => {
+    await app?.close();
+  });
+  beforeEach(() => {
+    jest.clearAllMocks();
+    subscription = Subscription.create({
+      id: 'sub',
+      organizationId: 'org',
+      plan: SubscriptionPlan.gold(),
+    });
+    countPaidShipmentsForOrganizationInYear.mockResolvedValue(0);
+  });
+
+  it('rejects VIEWER mutations before invoking the booking service', async () => {
+    await request(app.getHttpServer())
+      .post('/csv-bookings')
+      .set('x-test-role', 'VIEWER')
+      .attach('documents', Buffer.from('document'), 'test.pdf')
+      .expect(403);
+    expect(createBooking).not.toHaveBeenCalled();
+  });
+  it('preserves VIEWER reads', async () => {
+    await request(app.getHttpServer())
+      .get('/csv-bookings')
+      .set('x-test-role', 'VIEWER')
+      .expect(200);
+    expect(getUserBookings).toHaveBeenCalled();
+  });
+  it('rejects organization-wide reads for an ordinary member', async () => {
+    await request(app.getHttpServer()).get('/csv-bookings/organization/all').expect(403);
+  });
+  it('rejects oversized documents before invoking the service', async () => {
+    await request(app.getHttpServer())
+      .post('/csv-bookings')
+      .attach('documents', Buffer.alloc(10 * 1024 * 1024 + 1), 'large.pdf')
+      .expect(413);
+    expect(createBooking).not.toHaveBeenCalled();
+  });
+  it('applies the Bronze quota after a paid subscription is suspended', async () => {
+    subscription = subscription.updateStatus(SubscriptionStatus.create('UNPAID'));
+    countPaidShipmentsForOrganizationInYear.mockResolvedValue(
+      SubscriptionPlan.bronze().maxShipmentsPerYear
+    );
+    await expect(
+      app
+        .get(CsvBookingsController)
+        .createBooking({} as CreateCsvBookingDto, [{} as Express.Multer.File], {
+          user: { id: 'user', organizationId: 'org', role: 'USER' },
+        })
+    ).rejects.toBeInstanceOf(ShipmentLimitExceededException);
+    expect(createBooking).not.toHaveBeenCalled();
+    expect(countPaidShipmentsForOrganizationInYear).toHaveBeenCalledWith(
+      'org',
+      new Date().getFullYear()
+    );
+  });
+  it('preserves permitted uploads', async () => {
+    await request(app.getHttpServer())
+      .post('/csv-bookings')
+      .attach('documents', Buffer.from('document'), 'test.pdf')
+      .expect(201);
+    expect(createBooking).toHaveBeenCalledTimes(1);
+  });
+});

apps/backend/src/application/controllers/gdpr.controller.ts

@@ -1,169 +1,189 @@
 /**
- * GDPR Controller
- *
- * Endpoints for GDPR compliance (data export, deletion, consent)
+ * Droits des personnes (RGPD) : accès et portabilité, effacement, consentement.
  */
 
 import {
-  Controller,
-  Get,
-  Post,
-  Delete,
+  BadRequestException,
   Body,
-  UseGuards,
+  Controller,
+  Delete,
+  Get,
   HttpCode,
   HttpStatus,
-  Res,
+  Post,
   Req,
+  Res,
+  UseGuards,
 } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse } from '@nestjs/swagger';
 import { Response, Request } from 'express';
 import { JwtAuthGuard } from '../guards/jwt-auth.guard';
-import { CurrentUser } from '../decorators/current-user.decorator';
-import { UserPayload } from '../decorators/current-user.decorator';
-import { GDPRService } from '../services/gdpr.service';
+import { RolesGuard } from '../guards/roles.guard';
+import { Roles } from '../decorators/roles.decorator';
+import { CurrentUser, UserPayload } from '../decorators/current-user.decorator';
+import { GDPRService, GDPRDataExport, GDPRErasureReport } from '../services/gdpr.service';
 import { UpdateConsentDto, ConsentResponseDto, WithdrawConsentDto } from '../dto/consent.dto';
+import { DeleteAccountDto } from '../dto/delete-account.dto';
+import { RetentionService, RetentionReport } from '../services/retention.service';
+import { AdminContinuityService } from '../services/admin-continuity.service';
+import { RETENTION_RULES } from '@domain/services/data-retention';
 
 @ApiTags('GDPR')
 @Controller('gdpr')
-@UseGuards(JwtAuthGuard)
+@UseGuards(JwtAuthGuard, RolesGuard)
 @ApiBearerAuth()
 export class GDPRController {
-  constructor(private readonly gdprService: GDPRService) {}
+  constructor(
+    private readonly gdprService: GDPRService,
+    private readonly retentionService: RetentionService,
+    private readonly adminContinuity: AdminContinuityService
+  ) {}
 
-  /**
-   * Export user data (GDPR Right to Data Portability)
-   */
+  /** Export de portabilité au format JSON (art. 20). */
   @Get('export')
-  @ApiOperation({
-    summary: 'Export all user data',
-    description: 'Export all personal data in JSON format (GDPR Article 20)',
-  })
-  @ApiResponse({
-    status: 200,
-    description: 'Data export successful',
-  })
+  @ApiOperation({ summary: 'Exporter ses données personnelles (JSON)' })
+  @ApiResponse({ status: 200, description: 'Export produit' })
   async exportData(@CurrentUser() user: UserPayload, @Res() res: Response): Promise<void> {
-    const exportData = await this.gdprService.exportUserData(user.id);
+    const data = await this.gdprService.exportUserData(user.id);
+    const day = new Date().toISOString().slice(0, 10);
 
-    // Set headers for file download
-    res.setHeader('Content-Type', 'application/json');
-    res.setHeader(
-      'Content-Disposition',
-      `attachment; filename="xpeditis-data-export-${user.id}-${Date.now()}.json"`
-    );
-
-    res.json(exportData);
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Content-Disposition', `attachment; filename="xpeditis-donnees-${day}.json"`);
+    res.json(data);
   }
 
   /**
-   * Export user data as CSV
+   * Même export, en tableur.
+   *
+   * Il ne reprenait que le profil et le consentement cookies, ce qui donnait
+   * deux exports au contenu différent selon le format demandé. Il aplatit
+   * désormais l'export complet.
    */
   @Get('export/csv')
-  @ApiOperation({
-    summary: 'Export user data as CSV',
-    description: 'Export personal data in CSV format for easy viewing',
-  })
-  @ApiResponse({
-    status: 200,
-    description: 'CSV export successful',
-  })
+  @ApiOperation({ summary: 'Exporter ses données personnelles (CSV)' })
+  @ApiResponse({ status: 200, description: 'Export produit' })
   async exportDataCSV(@CurrentUser() user: UserPayload, @Res() res: Response): Promise<void> {
-    const exportData = await this.gdprService.exportUserData(user.id);
+    const data = await this.gdprService.exportUserData(user.id);
+    const day = new Date().toISOString().slice(0, 10);
 
-    // Convert to CSV (simplified version)
-    let csv = 'Category,Field,Value\n';
-
-    // User data
-    Object.entries(exportData.userData).forEach(([key, value]) => {
-      csv += `User Data,${key},"${value}"\n`;
-    });
-
-    // Cookie consent data
-    if (exportData.cookieConsent) {
-      Object.entries(exportData.cookieConsent).forEach(([key, value]) => {
-        csv += `Cookie Consent,${key},"${value}"\n`;
-      });
-    }
-
-    // Set headers
-    res.setHeader('Content-Type', 'text/csv');
-    res.setHeader(
-      'Content-Disposition',
-      `attachment; filename="xpeditis-data-export-${user.id}-${Date.now()}.csv"`
-    );
-
-    res.send(csv);
+    res.setHeader('Content-Type', 'text/csv; charset=utf-8');
+    res.setHeader('Content-Disposition', `attachment; filename="xpeditis-donnees-${day}.csv"`);
+    // BOM : sans lui Excel lit l'UTF-8 comme du latin-1 et casse les accents.
+    res.send('' + toCsv(data));
   }
 
   /**
-   * Delete user data (GDPR Right to Erasure)
+   * Effacement (art. 17).
+   *
+   * Renvoie le détail de ce qui a été effacé et de ce qui a été anonymisé.
+   * L'endpoint répondait 204 : la personne obtenait une page blanche pour
+   * seule réponse à une demande d'effacement, sans moyen de vérifier ce qui
+   * avait effectivement été traité.
    */
   @Delete('delete-account')
-  @HttpCode(HttpStatus.NO_CONTENT)
-  @ApiOperation({
-    summary: 'Delete user account and data',
-    description: 'Permanently delete or anonymize user data (GDPR Article 17)',
-  })
-  @ApiResponse({
-    status: 204,
-    description: 'Account deletion initiated',
-  })
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Effacer son compte et ses données' })
+  @ApiResponse({ status: 200, description: 'Effacement appliqué' })
   async deleteAccount(
     @CurrentUser() user: UserPayload,
-    @Body() body: { reason?: string; confirmEmail: string }
-  ): Promise<void> {
-    // Verify email confirmation (security measure)
-    if (body.confirmEmail !== user.email) {
-      throw new Error('Email confirmation does not match');
+    @Body() body: DeleteAccountDto
+  ): Promise<GDPRErasureReport> {
+    // Confirmation par saisie de l'adresse : l'effacement est irréversible.
+    // `new Error` remontait ici en « Internal server error » — une erreur de
+    // saisie affichée comme une panne du service.
+    if (body.confirmEmail.trim().toLowerCase() !== user.email.toLowerCase()) {
+      throw new BadRequestException({
+        code: 'email_mismatch',
+        message: "L'adresse saisie ne correspond pas à celle du compte.",
+      });
     }
 
-    await this.gdprService.deleteUserData(user.id, body.reason);
+    // Le dernier administrateur actif ne peut pas effacer son propre compte :
+    // la plateforme resterait sans personne pour l'administrer.
+    await this.adminContinuity.assertCanErase(user.id);
+
+    return this.gdprService.deleteUserData(user.id, body.reason);
   }
 
   /**
-   * Record consent
+   * Politique de conservation appliquée (art. 13.2.a).
+   *
+   * L'information sur les durées doit être accessible à la personne, pas
+   * seulement écrite dans une politique de confidentialité : elle est servie
+   * ici depuis la règle réellement appliquée par le code.
    */
+  @Get('retention')
+  @ApiOperation({ summary: 'Durées de conservation appliquées' })
+  @ApiResponse({ status: 200, description: 'Politique de conservation' })
+  getRetentionPolicy(): { rules: typeof RETENTION_RULES } {
+    return { rules: RETENTION_RULES };
+  }
+
+  /**
+   * Journal des demandes de droits, pour la console de conformité.
+   *
+   * Réservé aux administrateurs : c'est l'élément qu'on présente à une
+   * autorité de contrôle pour démontrer que les demandes sont traitées
+   * (art. 5.2). Les effacements y figurent sous une adresse anonymisée.
+   */
+  @Get('admin/requests')
+  @Roles('admin')
+  @ApiOperation({ summary: 'Journal des demandes de droits (administration)' })
+  @ApiResponse({ status: 200, description: 'Demandes récentes' })
+  async listRightsRequests(): Promise<{ requests: Record<string, unknown>[] }> {
+    return { requests: await this.gdprService.listRightsRequests() };
+  }
+
+  /**
+   * Ce que la purge supprimerait, sans rien supprimer.
+   *
+   * Une purge est irréversible : la console la montre avant de l'autoriser.
+   */
+  @Get('admin/retention/preview')
+  @Roles('admin')
+  @ApiOperation({ summary: 'Aperçu de la purge de conservation (administration)' })
+  @ApiResponse({ status: 200, description: 'Lignes arrivées à échéance' })
+  async previewRetention(): Promise<RetentionReport> {
+    return this.retentionService.preview();
+  }
+
+  /**
+   * Déclenche la purge immédiatement.
+   *
+   * Le POST est délibéré : la purge supprime définitivement des lignes, elle
+   * ne peut pas être déclenchée par une simple navigation.
+   */
+  @Post('admin/retention/purge')
+  @Roles('admin')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Appliquer les durées de conservation (administration)' })
+  @ApiResponse({ status: 200, description: 'Purge appliquée' })
+  async runRetention(): Promise<RetentionReport> {
+    return this.retentionService.purge();
+  }
+
+  /** Recueil du consentement cookies (art. 7). */
   @Post('consent')
   @HttpCode(HttpStatus.OK)
-  @ApiOperation({
-    summary: 'Record user consent',
-    description: 'Record consent for cookies (GDPR Article 7)',
-  })
-  @ApiResponse({
-    status: 200,
-    description: 'Consent recorded',
-    type: ConsentResponseDto,
-  })
+  @ApiOperation({ summary: 'Enregistrer ses préférences de cookies' })
+  @ApiResponse({ status: 200, type: ConsentResponseDto })
   async recordConsent(
     @CurrentUser() user: UserPayload,
     @Body() body: UpdateConsentDto,
     @Req() req: Request
   ): Promise<ConsentResponseDto> {
-    // Add IP and user agent from request if not provided
-    const consentData: UpdateConsentDto = {
+    return this.gdprService.recordConsent(user.id, {
       ...body,
       ipAddress: body.ipAddress || req.ip || req.socket.remoteAddress,
       userAgent: body.userAgent || req.headers['user-agent'],
-    };
-
-    return this.gdprService.recordConsent(user.id, consentData);
+    });
   }
 
-  /**
-   * Withdraw consent
-   */
+  /** Retrait du consentement (art. 7.3). */
   @Post('consent/withdraw')
   @HttpCode(HttpStatus.OK)
-  @ApiOperation({
-    summary: 'Withdraw consent',
-    description: 'Withdraw consent for functional, analytics, or marketing (GDPR Article 7.3)',
-  })
-  @ApiResponse({
-    status: 200,
-    description: 'Consent withdrawn',
-    type: ConsentResponseDto,
-  })
+  @ApiOperation({ summary: 'Retirer un consentement' })
+  @ApiResponse({ status: 200, type: ConsentResponseDto })
   async withdrawConsent(
     @CurrentUser() user: UserPayload,
     @Body() body: WithdrawConsentDto
@@ -171,20 +191,51 @@ export class GDPRController {
     return this.gdprService.withdrawConsent(user.id, body.consentType);
   }
 
-  /**
-   * Get consent status
-   */
   @Get('consent')
-  @ApiOperation({
-    summary: 'Get current consent status',
-    description: 'Retrieve current consent preferences',
-  })
-  @ApiResponse({
-    status: 200,
-    description: 'Consent status retrieved',
-    type: ConsentResponseDto,
-  })
+  @ApiOperation({ summary: 'Consulter ses préférences de cookies' })
+  @ApiResponse({ status: 200, type: ConsentResponseDto })
   async getConsentStatus(@CurrentUser() user: UserPayload): Promise<ConsentResponseDto | null> {
     return this.gdprService.getConsentStatus(user.id);
   }
 }
+
+/** Échappement CSV : guillemets doublés, valeur toujours encadrée. */
+const cell = (value: unknown): string => {
+  if (value === null || value === undefined) return '""';
+  const text = typeof value === 'object' ? JSON.stringify(value) : String(value);
+  return `"${text.replace(/"/g, '""')}"`;
+};
+
+/**
+ * Aplatit l'export en trois colonnes (section, champ, valeur).
+ *
+ * Un CSV par section serait plus lisible mais imposerait une archive ; la
+ * personne qui demande un CSV veut ouvrir un fichier, pas un zip.
+ */
+function toCsv(data: GDPRDataExport): string {
+  const lines = ['Section,Champ,Valeur'];
+
+  const flat = (section: string, record: Record<string, unknown>) => {
+    for (const [key, value] of Object.entries(record)) {
+      lines.push([cell(section), cell(key), cell(value)].join(','));
+    }
+  };
+
+  flat('Compte', data.userData);
+  if (data.organisation) flat('Organisation', data.organisation);
+  if (data.cookieConsent) flat('Consentement cookies', data.cookieConsent);
+
+  const collections: [string, Record<string, unknown>[]][] = [
+    ['Réservations', data.bookings],
+    ['Notifications', data.notifications],
+    ['Conversations assistant', data.assistantConversations],
+    ["Clés d'API", data.apiKeys],
+    ['Journal d activite', data.activityLog],
+  ];
+
+  for (const [section, rows] of collections) {
+    rows.forEach((row, index) => flat(`${section} ${index + 1}`, row));
+  }
+
+  return lines.join('\n');
+}

apps/backend/src/application/controllers/index.ts

@@ -1,2 +1,16 @@
 export * from './rates.controller';
 export * from './bookings.controller';
+export * from './auth.controller';
+export * from './users.controller';
+export * from './organizations.controller';
+export * from './ports.controller';
+export * from './notifications.controller';
+export * from './webhooks.controller';
+export * from './audit.controller';
+export * from './subscriptions.controller';
+export * from './invitations.controller';
+export * from './gdpr.controller';
+export * from './health.controller';
+export * from './blog.controller';
+export * from './csv-bookings.controller';
+export * from './csv-booking-actions.controller';

apps/backend/src/application/controllers/invitations.controller.ts

@@ -119,7 +119,7 @@ export class InvitationsController {
     description: 'Invitation expired or already used',
   })
   async verifyInvitation(@Param('token') token: string): Promise<InvitationResponseDto> {
-    this.logger.log(`Verifying invitation token: ${token}`);
+    this.logger.log('Verifying invitation token');
 
     const invitation = await this.invitationService.verifyInvitation(token);
 
@@ -153,10 +153,7 @@ export class InvitationsController {
   @ApiResponse({ status: 204, description: 'Invitation cancelled' })
   @ApiResponse({ status: 404, description: 'Invitation not found' })
   @ApiResponse({ status: 400, description: 'Invitation already used' })
-  async cancelInvitation(
-    @Param('id') id: string,
-    @CurrentUser() user: UserPayload
-  ): Promise<void> {
+  async cancelInvitation(@Param('id') id: string, @CurrentUser() user: UserPayload): Promise<void> {
     this.logger.log(`[User: ${user.email}] Cancelling invitation: ${id}`);
     await this.invitationService.cancelInvitation(id, user.organizationId);
   }

apps/backend/src/application/controllers/notifications.controller.ts

@@ -22,6 +22,7 @@ import { NotificationService } from '../services/notification.service';
 import { JwtAuthGuard } from '../guards/jwt-auth.guard';
 import { CurrentUser, UserPayload } from '../decorators/current-user.decorator';
 import { Notification } from '@domain/entities/notification.entity';
+import { notificationTarget } from '@domain/services/notification-target';
 
 class NotificationResponseDto {
   id: string;
@@ -151,7 +152,7 @@ export class NotificationsController {
       throw new NotFoundException('Notification not found');
     }
 
-    await this.notificationService.markAsRead(id);
+    await this.notificationService.markAsRead(id, user.id);
     return { success: true };
   }
 
@@ -200,7 +201,12 @@ export class NotificationsController {
       metadata: notification.metadata,
       read: notification.read,
       readAt: notification.readAt?.toISOString(),
-      actionUrl: notification.actionUrl,
+      // La destination est derivee du type et des metadonnees : les liens
+      // ecrits a la main visaient des routes inexistantes.
+      actionUrl:
+        notification.actionUrl ??
+        notificationTarget(notification.type, notification.metadata) ??
+        undefined,
       createdAt: notification.createdAt.toISOString(),
     };
   }

apps/backend/src/application/controllers/organizations.controller.spec.ts

@@ -0,0 +1,67 @@
+import { ForbiddenException, NotFoundException } from '@nestjs/common';
+import { Organization, OrganizationType } from '@domain/entities/organization.entity';
+import { OrganizationRepository } from '@domain/ports/out/organization.repository';
+import { UserRepository } from '@domain/ports/out/user.repository';
+import { OrganizationsController } from './organizations.controller';
+import { NotificationService } from '../services/notification.service';
+import { UserPayload } from '../decorators/current-user.decorator';
+
+describe('OrganizationsController tenant authorization', () => {
+  const actor = (role: string): UserPayload => ({
+    id: 'user-id',
+    email: 'manager@example.org',
+    role,
+    organizationId: 'own-org',
+    firstName: 'Test',
+    lastName: 'User',
+  });
+  const makeOrganization = (id: string) =>
+    Organization.create({
+      id,
+      name: 'Original',
+      type: OrganizationType.FREIGHT_FORWARDER,
+      address: { street: '1 rue Test', city: 'Paris', postalCode: '75001', country: 'FR' },
+      documents: [],
+      isActive: true,
+    });
+  const findById = jest.fn();
+  const save = jest.fn(async (organization: Organization) => organization);
+  const controller = new OrganizationsController(
+    { findById, save } as unknown as OrganizationRepository,
+    {} as UserRepository,
+    {} as NotificationService
+  );
+
+  beforeEach(() => jest.clearAllMocks());
+
+  it.each(['MANAGER', 'manager', 'USER', 'VIEWER'])(
+    'rejects foreign organization for %s',
+    async role => {
+      const target = makeOrganization('other-org');
+      findById.mockResolvedValue(target);
+      await expect(
+        controller.updateOrganization(target.id, { name: 'Changed' }, actor(role))
+      ).rejects.toBeInstanceOf(ForbiddenException);
+      expect(target.name).toBe('Original');
+      expect(save).not.toHaveBeenCalled();
+    }
+  );
+
+  it.each([
+    ['MANAGER', 'own-org'],
+    ['ADMIN', 'other-org'],
+  ])('allows %s to update %s', async (role, id) => {
+    findById.mockResolvedValue(makeOrganization(id));
+    const result = await controller.updateOrganization(id, { name: 'Changed' }, actor(role));
+    expect(result.name).toBe('Changed');
+    expect(save).toHaveBeenCalledTimes(1);
+  });
+
+  it('preserves missing organization response', async () => {
+    findById.mockResolvedValue(null);
+    await expect(
+      controller.updateOrganization('missing', {}, actor('ADMIN'))
+    ).rejects.toBeInstanceOf(NotFoundException);
+    expect(save).not.toHaveBeenCalled();
+  });
+});

apps/backend/src/application/controllers/organizations.controller.ts

@@ -12,6 +12,7 @@ import {
   UsePipes,
   ValidationPipe,
   NotFoundException,
+  BadRequestException,
   ParseUUIDPipe,
   ParseIntPipe,
   DefaultValuePipe,
@@ -41,10 +42,14 @@ import {
   ORGANIZATION_REPOSITORY,
 } from '@domain/ports/out/organization.repository';
 import { Organization, OrganizationType } from '@domain/entities/organization.entity';
+import { UserRole } from '@domain/entities/user.entity';
+import { NotificationType, NotificationPriority } from '@domain/entities/notification.entity';
+import { UserRepository, USER_REPOSITORY } from '@domain/ports/out/user.repository';
 import { JwtAuthGuard } from '../guards/jwt-auth.guard';
 import { RolesGuard } from '../guards/roles.guard';
 import { CurrentUser, UserPayload } from '../decorators/current-user.decorator';
 import { Roles } from '../decorators/roles.decorator';
+import { NotificationService } from '../services/notification.service';
 import { v4 as uuidv4 } from 'uuid';
 
 /**
@@ -64,7 +69,10 @@ export class OrganizationsController {
   private readonly logger = new Logger(OrganizationsController.name);
 
   constructor(
-    @Inject(ORGANIZATION_REPOSITORY) private readonly organizationRepository: OrganizationRepository
+    @Inject(ORGANIZATION_REPOSITORY)
+    private readonly organizationRepository: OrganizationRepository,
+    @Inject(USER_REPOSITORY) private readonly userRepository: UserRepository,
+    private readonly notificationService: NotificationService
   ) {}
 
   /**
@@ -123,6 +131,11 @@ export class OrganizationsController {
         name: dto.name,
         type: dto.type,
         scac: dto.scac,
+        siren: dto.siren,
+        siret: dto.siret,
+        eori: dto.eori,
+        contact_phone: dto.contact_phone,
+        contact_email: dto.contact_email,
         address: OrganizationMapper.mapDtoToAddress(dto.address),
         logoUrl: dto.logoUrl,
         documents: [],
@@ -239,7 +252,7 @@ export class OrganizationsController {
     }
 
     // Authorization: Managers can only update their own organization
-    if (user.role === 'manager' && organization.id !== user.organizationId) {
+    if (user.role !== UserRole.ADMIN && organization.id !== user.organizationId) {
       throw new ForbiddenException('You can only update your own organization');
     }
 
@@ -252,6 +265,10 @@ export class OrganizationsController {
       organization.updateSiren(dto.siren);
     }
 
+    if (dto.siret) {
+      organization.updateSiret(dto.siret);
+    }
+
     if (dto.eori) {
       organization.updateEori(dto.eori);
     }
@@ -288,6 +305,69 @@ export class OrganizationsController {
     return OrganizationMapper.toDto(updatedOrg);
   }
 
+  /**
+   * Request SIRET/SIREN approval from admins
+   *
+   * Any authenticated user can call this to notify all admins
+   * that their organization's SIRET/SIREN needs approval.
+   */
+  @Post('request-siret-approval')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({
+    summary: 'Request SIRET/SIREN approval',
+    description: 'Sends a notification to all admins requesting manual SIRET/SIREN verification.',
+  })
+  @ApiResponse({ status: 200, description: 'Approval request sent to admins' })
+  @ApiResponse({ status: 400, description: 'No SIRET/SIREN registered or already verified' })
+  async requestSiretApproval(@CurrentUser() user: UserPayload): Promise<{ message: string }> {
+    const organization = await this.organizationRepository.findById(user.organizationId);
+    if (!organization) {
+      throw new NotFoundException('Organization not found');
+    }
+
+    if (!organization.siren && !organization.siret) {
+      throw new BadRequestException(
+        'Aucun SIRET ou SIREN renseigné sur votre organisation. Veuillez les ajouter avant de demander la validation.'
+      );
+    }
+
+    if (organization.siretVerified) {
+      throw new BadRequestException('Votre SIRET/SIREN est déjà vérifié.');
+    }
+
+    const admins = await this.userRepository.findByRole('ADMIN');
+
+    const identifier = organization.siret
+      ? `SIRET ${organization.siret}`
+      : `SIREN ${organization.siren}`;
+
+    await Promise.all(
+      admins.map(admin =>
+        this.notificationService.createNotification({
+          userId: admin.id,
+          organizationId: admin.organizationId,
+          type: NotificationType.ORGANIZATION_UPDATE,
+          priority: NotificationPriority.HIGH,
+          title: 'Demande de validation SIRET/SIREN',
+          message: `L'organisation "${organization.name}" demande la validation de son ${identifier}.`,
+          metadata: {
+            organizationId: organization.id,
+            organizationName: organization.name,
+            siret: organization.siret,
+            siren: organization.siren,
+            requestedBy: user.email,
+          },
+        })
+      )
+    );
+
+    this.logger.log(
+      `[${user.email}] SIRET/SIREN approval requested for org ${organization.name} (${organization.id})`
+    );
+
+    return { message: 'Votre demande a été envoyée aux administrateurs.' };
+  }
+
   /**
    * List organizations
    *

apps/backend/src/application/controllers/rates.controller.ts

@@ -33,6 +33,7 @@ import {
   FilterOptionsDto,
   AvailableOriginsDto,
   AvailableDestinationsDto,
+  AvailableDirectionsDto,
   RoutePortInfoDto,
 } from '../dto/csv-rate-upload.dto';
 import { CsvRateMapper } from '../mappers/csv-rate.mapper';
@@ -166,27 +167,17 @@ export class RatesController {
     );
 
     try {
-      // Map DTO to domain input
       const searchInput = {
         origin: dto.origin,
         destination: dto.destination,
         volumeCBM: dto.volumeCBM,
         weightKG: dto.weightKG,
-        palletCount: dto.palletCount ?? 0,
         containerType: dto.containerType,
-        filters: this.csvRateMapper.mapFiltersDtoToDomain(dto.filters),
-
-        // Service requirements for detailed pricing
         hasDangerousGoods: dto.hasDangerousGoods ?? false,
-        requiresSpecialHandling: dto.requiresSpecialHandling ?? false,
-        requiresTailgate: dto.requiresTailgate ?? false,
-        requiresStraps: dto.requiresStraps ?? false,
-        requiresThermalCover: dto.requiresThermalCover ?? false,
-        hasRegulatedProducts: dto.hasRegulatedProducts ?? false,
-        requiresAppointment: dto.requiresAppointment ?? false,
+        direction: dto.direction,
+        filters: this.csvRateMapper.mapFiltersDtoToDomain(dto.filters),
       };
 
-      // Execute CSV rate search
       const result = await this.csvRateSearchService.execute(searchInput);
 
       // Map domain output to response DTO
@@ -241,27 +232,17 @@ export class RatesController {
     );
 
     try {
-      // Map DTO to domain input
       const searchInput = {
         origin: dto.origin,
         destination: dto.destination,
         volumeCBM: dto.volumeCBM,
         weightKG: dto.weightKG,
-        palletCount: dto.palletCount ?? 0,
         containerType: dto.containerType,
-        filters: this.csvRateMapper.mapFiltersDtoToDomain(dto.filters),
-
-        // Service requirements for detailed pricing
         hasDangerousGoods: dto.hasDangerousGoods ?? false,
-        requiresSpecialHandling: dto.requiresSpecialHandling ?? false,
-        requiresTailgate: dto.requiresTailgate ?? false,
-        requiresStraps: dto.requiresStraps ?? false,
-        requiresThermalCover: dto.requiresThermalCover ?? false,
-        hasRegulatedProducts: dto.hasRegulatedProducts ?? false,
-        requiresAppointment: dto.requiresAppointment ?? false,
+        direction: dto.direction,
+        filters: this.csvRateMapper.mapFiltersDtoToDomain(dto.filters),
       };
 
-      // Execute CSV rate search WITH OFFERS GENERATION
       const result = await this.csvRateSearchService.executeWithOffers(searchInput);
 
       // Map domain output to response DTO
@@ -282,6 +263,42 @@ export class RatesController {
     }
   }
 
+  /**
+   * Get the trade directions that currently have usable rate grids.
+   * Lets the booking wizard skip the import/export step when only one applies.
+   */
+  @Get('available-routes/directions')
+  @UseGuards(JwtAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({
+    summary: 'Get available trade directions',
+    description:
+      'Returns the trade directions (EXPORT / IMPORT) for which at least one usable rate grid exists. An empty or single-entry list means the direction choice can be skipped in the UI.',
+  })
+  @ApiResponse({
+    status: HttpStatus.OK,
+    description: 'List of available trade directions',
+    type: AvailableDirectionsDto,
+  })
+  @ApiResponse({
+    status: 401,
+    description: 'Unauthorized - missing or invalid token',
+  })
+  async getAvailableDirections(): Promise<AvailableDirectionsDto> {
+    this.logger.log('Fetching available trade directions from CSV rates');
+
+    try {
+      const directions = await this.csvRateSearchService.getAvailableDirections();
+      return { directions };
+    } catch (error: any) {
+      this.logger.error(
+        `Failed to fetch available directions: ${error?.message || 'Unknown error'}`,
+        error?.stack
+      );
+      throw error;
+    }
+  }
+
   /**
    * Get available origin ports from CSV rates
    * Returns only ports that have routes defined in CSV files
@@ -294,6 +311,12 @@ export class RatesController {
     description:
       'Returns list of origin ports that have shipping routes defined in CSV rate files. Use this to populate origin port selection dropdown.',
   })
+  @ApiQuery({
+    name: 'direction',
+    required: false,
+    enum: ['EXPORT', 'IMPORT'],
+    description: 'Restrict to grids of this trade direction (EXPORT = French origins)',
+  })
   @ApiResponse({
     status: HttpStatus.OK,
     description: 'List of available origin ports with details',
@@ -303,12 +326,16 @@ export class RatesController {
     status: 401,
     description: 'Unauthorized - missing or invalid token',
   })
-  async getAvailableOrigins(): Promise<AvailableOriginsDto> {
-    this.logger.log('Fetching available origin ports from CSV rates');
+  async getAvailableOrigins(@Query('direction') direction?: string): Promise<AvailableOriginsDto> {
+    this.logger.log(
+      `Fetching available origin ports from CSV rates${direction ? ` (${direction})` : ''}`
+    );
 
     try {
       // Get unique origin port codes from CSV rates
-      const originCodes = await this.csvRateSearchService.getAvailableOrigins();
+      const originCodes = await this.csvRateSearchService.getAvailableOrigins(
+        this.parseDirection(direction)
+      );
 
       // Fetch port details from database
       const ports = await this.portRepository.findByCodes(originCodes);
@@ -382,11 +409,18 @@ export class RatesController {
     status: 401,
     description: 'Unauthorized - missing or invalid token',
   })
+  @ApiQuery({
+    name: 'direction',
+    required: false,
+    enum: ['EXPORT', 'IMPORT'],
+    description: 'Restrict to grids of this trade direction (EXPORT = French origins)',
+  })
   @ApiBadRequestResponse({
     description: 'Origin port code is required',
   })
   async getAvailableDestinations(
-    @Query('origin') origin: string
+    @Query('origin') origin: string,
+    @Query('direction') direction?: string
   ): Promise<AvailableDestinationsDto> {
     this.logger.log(`Fetching available destinations for origin: ${origin}`);
 
@@ -396,7 +430,10 @@ export class RatesController {
 
     try {
       // Get destination port codes for this origin from CSV rates
-      const destinationCodes = await this.csvRateSearchService.getAvailableDestinations(origin);
+      const destinationCodes = await this.csvRateSearchService.getAvailableDestinations(
+        origin,
+        this.parseDirection(direction)
+      );
 
       // Fetch port details from database
       const ports = await this.portRepository.findByCodes(destinationCodes);
@@ -516,4 +553,10 @@ export class RatesController {
       throw error;
     }
   }
+
+  /** Normalize the direction query param; anything unrecognized means "no filter". */
+  private parseDirection(direction?: string): 'EXPORT' | 'IMPORT' | undefined {
+    const upper = direction?.trim().toUpperCase();
+    return upper === 'EXPORT' || upper === 'IMPORT' ? upper : undefined;
+  }
 }