.claude/settings.local.json

@@ -36,9 +36,7 @@
       "Bash(xargs -r docker rm:*)",
       "Bash(npm run migration:run:*)",
       "Bash(npm run dev:*)",
-      "Bash(npm run backend:dev:*)",
+      "Bash(npm run backend:dev:*)"
-      "Bash(env -i PATH=\"$PATH\" HOME=\"$HOME\" node:*)",
-      "Bash(PGPASSWORD=xpeditis_dev_password psql -h localhost -U xpeditis -d xpeditis_dev -c:*)"
     ],
     "deny": [],
     "ask": []

.github/workflows/cd-main.yml

@@ -1,276 +0,0 @@
-name: CD Production
-
-# Production pipeline — Hetzner k3s.
-#
-# SECURITY: Two mandatory gates before any production deployment:
-#   1. quality-gate  — lint + unit tests on the exact commit being deployed
-#   2. verify-image  — confirms preprod-SHA image EXISTS in registry,
-#                      which proves this commit passed the full preprod
-#                      pipeline (lint + unit + integration + docker build).
-#                      If someone merges to main without going through preprod,
-#                      this step fails and the deployment is blocked.
-#
-# Flow: quality-gate → verify-image → promote → deploy → notify
-#
-# Secrets required:
-#   REGISTRY_TOKEN          — Scaleway registry (read/write)
-#   HETZNER_KUBECONFIG      — base64: cat ~/.kube/kubeconfig-xpeditis-prod | base64 -w 0
-#   PROD_BACKEND_URL        — https://api.xpeditis.com
-#   PROD_FRONTEND_URL       — https://app.xpeditis.com
-#   DISCORD_WEBHOOK_URL
-
-on:
-  push:
-    branches: [main]
-
-concurrency:
-  group: cd-production
-  cancel-in-progress: false
-
-env:
-  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
-  NODE_VERSION: '20'
-  K8S_NAMESPACE: xpeditis-prod
-
-jobs:
-  # ── 1. Quality Gate ──────────────────────────────────────────────────
-  # Runs on every prod deployment regardless of what happened in preprod.
-  backend-quality:
-    name: Backend — Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
-
-  frontend-quality:
-    name: Frontend — Lint & Type-check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
-
-  backend-tests:
-    name: Backend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: backend-quality
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  frontend-tests:
-    name: Frontend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  # ── 2. Image Verification ────────────────────────────────────────────
-  # Checks that preprod-SHA tags exist for this EXACT commit.
-  # This is the security gate: if the preprod pipeline never ran for this
-  # commit (or failed before the docker build step), this job fails and
-  # the deployment is fully blocked.
-  verify-image:
-    name: Verify Preprod Image Exists
-    runs-on: ubuntu-latest
-    needs: [backend-tests, frontend-tests]
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Check backend image preprod-SHA
-        run: |
-          TAG="${{ env.REGISTRY }}/xpeditis-backend:preprod-${{ steps.sha.outputs.short }}"
-          echo "Verifying: $TAG"
-          docker buildx imagetools inspect "$TAG" || {
-            echo ""
-            echo "BLOCKED: Image $TAG not found in registry."
-            echo "This commit was not built by the preprod pipeline."
-            echo "Merge to preprod first and wait for the full pipeline to succeed."
-            exit 1
-          }
-
-      - name: Check frontend image preprod-SHA
-        run: |
-          TAG="${{ env.REGISTRY }}/xpeditis-frontend:preprod-${{ steps.sha.outputs.short }}"
-          echo "Verifying: $TAG"
-          docker buildx imagetools inspect "$TAG" || {
-            echo ""
-            echo "BLOCKED: Image $TAG not found in registry."
-            echo "This commit was not built by the preprod pipeline."
-            echo "Merge to preprod first and wait for the full pipeline to succeed."
-            exit 1
-          }
-
-  # ── 3. Promote Images ────────────────────────────────────────────────
-  # Re-tags preprod-SHA → latest + prod-SHA within Scaleway.
-  # No rebuild. No layer transfer. Manifest-level operation only.
-  promote-images:
-    name: Promote Images (preprod-SHA → prod)
-    runs-on: ubuntu-latest
-    needs: verify-image
-    steps:
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Promote backend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          docker buildx imagetools create \
-            --tag ${{ env.REGISTRY }}/xpeditis-backend:latest \
-            --tag ${{ env.REGISTRY }}/xpeditis-backend:prod-${SHA} \
-            ${{ env.REGISTRY }}/xpeditis-backend:preprod-${SHA}
-          echo "Backend promoted: preprod-${SHA} → latest + prod-${SHA}"
-
-      - name: Promote frontend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          docker buildx imagetools create \
-            --tag ${{ env.REGISTRY }}/xpeditis-frontend:latest \
-            --tag ${{ env.REGISTRY }}/xpeditis-frontend:prod-${SHA} \
-            ${{ env.REGISTRY }}/xpeditis-frontend:preprod-${SHA}
-          echo "Frontend promoted: preprod-${SHA} → latest + prod-${SHA}"
-
-  # ── 4. Deploy to k3s ─────────────────────────────────────────────────
-  deploy:
-    name: Deploy to Production (k3s)
-    runs-on: ubuntu-latest
-    needs: [verify-image, promote-images]
-    environment:
-      name: production
-      url: https://app.xpeditis.com
-    steps:
-      - name: Configure kubectl
-        run: |
-          mkdir -p ~/.kube
-          echo "${{ secrets.HETZNER_KUBECONFIG }}" | base64 -d > ~/.kube/config
-          chmod 600 ~/.kube/config
-          kubectl cluster-info
-          kubectl get nodes -o wide
-
-      - name: Deploy backend
-        id: deploy-backend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          IMAGE="${{ env.REGISTRY }}/xpeditis-backend:prod-${SHA}"
-          echo "Deploying: $IMAGE"
-          kubectl set image deployment/xpeditis-backend backend="$IMAGE" -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=300s
-          echo "Backend rollout complete."
-
-      - name: Deploy frontend
-        id: deploy-frontend
-        run: |
-          SHA="${{ needs.verify-image.outputs.sha }}"
-          IMAGE="${{ env.REGISTRY }}/xpeditis-frontend:prod-${SHA}"
-          echo "Deploying: $IMAGE"
-          kubectl set image deployment/xpeditis-frontend frontend="$IMAGE" -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=300s
-          echo "Frontend rollout complete."
-
-      - name: Auto-rollback on deployment failure
-        if: failure()
-        run: |
-          echo "Deployment failed — initiating rollback..."
-          kubectl rollout undo deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout undo deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=120s
-          kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=120s
-          echo "Rollback complete. Previous version is live."
-
-  # ── Notifications ────────────────────────────────────────────────────
-  notify-success:
-    name: Notify Success
-    runs-on: ubuntu-latest
-    needs: [verify-image, deploy]
-    if: success()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "🚀 Production Deployed & Healthy",
-              "color": 3066993,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Version", "value": "`prod-${{ needs.verify-image.outputs.sha }}`", "inline": true},
-                {"name": "Cluster", "value": "Hetzner k3s — `xpeditis-prod`", "inline": false},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Production"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
-
-  notify-failure:
-    name: Notify Failure
-    runs-on: ubuntu-latest
-    needs: [backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, promote-images, deploy]
-    if: failure()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "content": "@here PRODUCTION PIPELINE FAILED",
-            "embeds": [{
-              "title": "🔴 Production Pipeline Failed",
-              "description": "Check the workflow for details. Auto-rollback was triggered if the failure was during deploy.",
-              "color": 15158332,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false},
-                {"name": "Rollback", "value": "[Run rollback workflow](${{ github.server_url }}/${{ github.repository }}/actions/workflows/rollback.yml)", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Production"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.github/workflows/cd-preprod.yml

@@ -1,316 +0,0 @@
-name: CD Preprod
-
-# Full pipeline triggered on every push to preprod.
-# Flow: lint → unit tests → integration tests → docker build → deploy → notify
-#
-# Secrets required:
-#   REGISTRY_TOKEN            — Scaleway registry (read/write)
-#   NEXT_PUBLIC_API_URL       — https://api.preprod.xpeditis.com
-#   NEXT_PUBLIC_APP_URL       — https://preprod.xpeditis.com
-#   PORTAINER_WEBHOOK_BACKEND — Portainer webhook (preprod backend)
-#   PORTAINER_WEBHOOK_FRONTEND— Portainer webhook (preprod frontend)
-#   PREPROD_BACKEND_URL       — https://api.preprod.xpeditis.com
-#   PREPROD_FRONTEND_URL      — https://preprod.xpeditis.com
-#   DISCORD_WEBHOOK_URL
-
-on:
-  push:
-    branches: [preprod]
-
-concurrency:
-  group: cd-preprod
-  cancel-in-progress: false
-
-env:
-  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
-  NODE_VERSION: '20'
-
-jobs:
-  # ── 1. Lint ─────────────────────────────────────────────────────────
-  backend-quality:
-    name: Backend — Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
-
-  frontend-quality:
-    name: Frontend — Lint & Type-check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
-
-  # ── 2. Unit Tests ────────────────────────────────────────────────────
-  backend-tests:
-    name: Backend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: backend-quality
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  frontend-tests:
-    name: Frontend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  # ── 3. Integration Tests ─────────────────────────────────────────────
-  integration-tests:
-    name: Backend — Integration Tests
-    runs-on: ubuntu-latest
-    needs: [backend-tests, frontend-tests]
-    defaults:
-      run:
-        working-directory: apps/backend
-
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: xpeditis_test
-          POSTGRES_PASSWORD: xpeditis_test_password
-          POSTGRES_DB: xpeditis_test
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 5432:5432
-      redis:
-        image: redis:7-alpine
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 6379:6379
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - name: Run integration tests
-        env:
-          NODE_ENV: test
-          DATABASE_HOST: localhost
-          DATABASE_PORT: 5432
-          DATABASE_USER: xpeditis_test
-          DATABASE_PASSWORD: xpeditis_test_password
-          DATABASE_NAME: xpeditis_test
-          DATABASE_SYNCHRONIZE: 'false'
-          REDIS_HOST: localhost
-          REDIS_PORT: 6379
-          REDIS_PASSWORD: ''
-          JWT_SECRET: test-secret-key-ci
-          SMTP_HOST: localhost
-          SMTP_PORT: 1025
-          SMTP_FROM: test@xpeditis.com
-        run: npm run test:integration -- --passWithNoTests
-
-  # ── 4. Docker Build & Push ───────────────────────────────────────────
-  # Tags: preprod (latest for this env) + preprod-SHA (used by prod for exact promotion)
-  build-backend:
-    name: Build Backend
-    runs-on: ubuntu-latest
-    needs: integration-tests
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v5
-        with:
-          context: ./apps/backend
-          file: ./apps/backend/Dockerfile
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/xpeditis-backend:preprod
-            ${{ env.REGISTRY }}/xpeditis-backend:preprod-${{ steps.sha.outputs.short }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache,mode=max
-          platforms: linux/amd64,linux/arm64
-
-  build-frontend:
-    name: Build Frontend
-    runs-on: ubuntu-latest
-    needs: integration-tests
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v5
-        with:
-          context: ./apps/frontend
-          file: ./apps/frontend/Dockerfile
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/xpeditis-frontend:preprod
-            ${{ env.REGISTRY }}/xpeditis-frontend:preprod-${{ steps.sha.outputs.short }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache,mode=max
-          platforms: linux/amd64,linux/arm64
-          build-args: |
-            NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL }}
-            NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL }}
-
-  build-log-exporter:
-    name: Build Log Exporter
-    runs-on: ubuntu-latest
-    needs: integration-tests
-    outputs:
-      sha: ${{ steps.sha.outputs.short }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Short SHA
-        id: sha
-        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v5
-        with:
-          context: ./apps/log-exporter
-          file: ./apps/log-exporter/Dockerfile
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/xpeditis-log-exporter:preprod
-            ${{ env.REGISTRY }}/xpeditis-log-exporter:preprod-${{ steps.sha.outputs.short }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-log-exporter:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-log-exporter:buildcache,mode=max
-          platforms: linux/amd64,linux/arm64
-
-  # ── 5. Deploy via Portainer ──────────────────────────────────────────
-  deploy:
-    name: Deploy to Preprod
-    runs-on: ubuntu-latest
-    needs: [build-backend, build-frontend, build-log-exporter]
-    environment: preprod
-    steps:
-      - name: Deploy backend
-        run: |
-          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${{ secrets.PORTAINER_WEBHOOK_BACKEND }}")
-          echo "Portainer response: HTTP $HTTP_CODE"
-          if [[ "$HTTP_CODE" != "2"* ]]; then
-            echo "ERROR: Portainer webhook failed with HTTP $HTTP_CODE"
-            exit 1
-          fi
-          echo "Backend webhook triggered."
-      - name: Wait for backend startup
-        run: sleep 20
-      - name: Deploy frontend
-        run: |
-          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${{ secrets.PORTAINER_WEBHOOK_FRONTEND }}")
-          echo "Portainer response: HTTP $HTTP_CODE"
-          if [[ "$HTTP_CODE" != "2"* ]]; then
-            echo "ERROR: Portainer webhook failed with HTTP $HTTP_CODE"
-            exit 1
-          fi
-          echo "Frontend webhook triggered."
-
-  # ── Notifications ────────────────────────────────────────────────────
-  notify-success:
-    name: Notify Success
-    runs-on: ubuntu-latest
-    needs: [build-backend, build-frontend, deploy]
-    if: success()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "✅ Preprod Deployed & Healthy",
-              "color": 3066993,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "SHA", "value": "`${{ needs.build-backend.outputs.sha }}`", "inline": true},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Preprod"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
-
-  notify-failure:
-    name: Notify Failure
-    runs-on: ubuntu-latest
-    needs: [backend-quality, frontend-quality, backend-tests, frontend-tests, integration-tests, build-backend, build-frontend, deploy]
-    if: failure()
-    steps:
-      - run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "❌ Preprod Pipeline Failed",
-              "description": "Preprod was NOT deployed.",
-              "color": 15158332,
-              "fields": [
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Preprod"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.github/workflows/ci.yml

@@ -1,103 +1,372 @@
-name: Dev CI
+name: CI/CD Pipeline
 
 on:
   push:
-    branches: [dev]
+    branches:
-  pull_request:
+      - preprod
-    branches: [dev]
-
-concurrency:
-  group: dev-ci-${{ github.ref }}
-  cancel-in-progress: true
 
 env:
+  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
   NODE_VERSION: '20'
 
 jobs:
-  backend-quality:
+  # ============================================
-    name: Backend — Lint
+  # Backend Build, Test & Deploy
+  # ============================================
+  backend:
+    name: Backend - Build, Test & Push
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: apps/backend
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
-      - uses: actions/setup-node@v4
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
 
-  frontend-quality:
+      - name: Install dependencies
-    name: Frontend — Lint & Type-check
+        run: npm install --legacy-peer-deps
+
+      - name: Lint code
+        run: npm run lint
+
+      - name: Run unit tests
+        run: npm test -- --coverage --passWithNoTests
+
+      - name: Build application
+        run: npm run build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Scaleway Registry
+        uses: docker/login-action@v3
+        with:
+          registry: rg.fr-par.scw.cloud/weworkstudio
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/xpeditis-backend
+          tags: |
+            type=ref,event=branch
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Backend Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./apps/backend
+          file: ./apps/backend/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-backend:buildcache,mode=max
+          platforms: linux/amd64,linux/arm64
+
+  # ============================================
+  # Frontend Build, Test & Deploy
+  # ============================================
+  frontend:
+    name: Frontend - Build, Test & Push
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: apps/frontend
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
-      - uses: actions/setup-node@v4
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
           cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
 
-  backend-tests:
+      - name: Install dependencies
-    name: Backend — Unit Tests
+        run: npm ci --legacy-peer-deps
+
+      - name: Lint code
+        run: npm run lint
+
+      - name: Run tests
+        run: npm test -- --passWithNoTests || echo "No tests found"
+
+      - name: Build application
+        env:
+          NEXT_PUBLIC_API_URL: ${{ secrets.NEXT_PUBLIC_API_URL || 'http://localhost:4000' }}
+          NEXT_PUBLIC_APP_URL: ${{ secrets.NEXT_PUBLIC_APP_URL || 'http://localhost:3000' }}
+          NEXT_TELEMETRY_DISABLED: 1
+        run: npm run build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Scaleway Registry
+        uses: docker/login-action@v3
+        with:
+          registry: rg.fr-par.scw.cloud/weworkstudio
+          username: nologin
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/xpeditis-frontend
+          tags: |
+            type=ref,event=branch
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Frontend Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./apps/frontend
+          file: ./apps/frontend/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache,mode=max
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL || 'http://localhost:4000' }}
+            NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL || 'http://localhost:3000' }}
+
+  # ============================================
+  # Integration Tests (Optional)
+  # ============================================
+  integration-tests:
+    name: Integration Tests
     runs-on: ubuntu-latest
-    needs: backend-quality
+    needs: [backend, frontend]
+    if: github.event_name == 'pull_request'
     defaults:
       run:
         working-directory: apps/backend
+
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_USER: xpeditis
+          POSTGRES_PASSWORD: xpeditis_dev_password
+          POSTGRES_DB: xpeditis_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+      redis:
+        image: redis:7-alpine
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 6379:6379
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
-      - uses: actions/setup-node@v4
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
 
-  frontend-tests:
+      - name: Install dependencies
-    name: Frontend — Unit Tests
+        run: npm install --legacy-peer-deps
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
 
-  notify-failure:
+      - name: Run integration tests
-    name: Notify Failure
+        env:
+          DATABASE_HOST: localhost
+          DATABASE_PORT: 5432
+          DATABASE_USER: xpeditis
+          DATABASE_PASSWORD: xpeditis_dev_password
+          DATABASE_NAME: xpeditis_test
+          REDIS_HOST: localhost
+          REDIS_PORT: 6379
+          JWT_SECRET: test-secret-key-for-ci
+        run: npm run test:integration || echo "No integration tests found"
+
+  # ============================================
+  # Deployment Summary
+  # ============================================
+  deployment-summary:
+    name: Deployment Summary
     runs-on: ubuntu-latest
-    needs: [backend-quality, frontend-quality, backend-tests, frontend-tests]
+    needs: [backend, frontend]
-    if: failure()
+    if: success()
+
     steps:
-      - name: Discord
+      - name: Summary
         run: |
-          curl -s -H "Content-Type: application/json" -d '{
+          echo "## 🚀 Deployment Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Backend Image" >> $GITHUB_STEP_SUMMARY
+          echo "- Registry: \`${{ env.REGISTRY }}/xpeditis-backend\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Branch: \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Commit: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Frontend Image" >> $GITHUB_STEP_SUMMARY
+          echo "- Registry: \`${{ env.REGISTRY }}/xpeditis-frontend\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Branch: \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Commit: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Pull Commands" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
+          echo "docker pull ${{ env.REGISTRY }}/xpeditis-backend:${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "docker pull ${{ env.REGISTRY }}/xpeditis-frontend:${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+
+  # ============================================
+  # Deploy to Portainer via Webhooks
+  # ============================================
+  deploy-portainer:
+    name: Deploy to Portainer
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    if: success() && github.ref == 'refs/heads/preprod'
+
+    steps:
+      - name: Trigger Backend Webhook
+        run: |
+          echo "🚀 Deploying Backend to Portainer..."
+          curl -X POST \
+            -H "Content-Type: application/json" \
+            -d '{"data": "backend-deployment"}' \
+            ${{ secrets.PORTAINER_WEBHOOK_BACKEND }}
+          echo "✅ Backend webhook triggered"
+
+      - name: Wait before Frontend deployment
+        run: sleep 10
+
+      - name: Trigger Frontend Webhook
+        run: |
+          echo "🚀 Deploying Frontend to Portainer..."
+          curl -X POST \
+            -H "Content-Type: application/json" \
+            -d '{"data": "frontend-deployment"}' \
+            ${{ secrets.PORTAINER_WEBHOOK_FRONTEND }}
+          echo "✅ Frontend webhook triggered"
+
+  # ============================================
+  # Discord Notification - Success
+  # ============================================
+  notify-success:
+    name: Discord Notification (Success)
+    runs-on: ubuntu-latest
+    needs: [backend, frontend, deploy-portainer]
+    if: success()
+
+    steps:
+      - name: Send Discord notification
+        run: |
+          curl -H "Content-Type: application/json" \
+            -d '{
               "embeds": [{
-              "title": "❌ Dev CI Failed",
+                "title": "✅ CI/CD Pipeline Success",
+                "description": "Deployment completed successfully!",
+                "color": 3066993,
+                "fields": [
+                  {
+                    "name": "Repository",
+                    "value": "${{ github.repository }}",
+                    "inline": true
+                  },
+                  {
+                    "name": "Branch",
+                    "value": "${{ github.ref_name }}",
+                    "inline": true
+                  },
+                  {
+                    "name": "Commit",
+                    "value": "[${{ github.sha }}](${{ github.event.head_commit.url }})",
+                    "inline": false
+                  },
+                  {
+                    "name": "Backend Image",
+                    "value": "`${{ env.REGISTRY }}/xpeditis-backend:${{ github.ref_name }}`",
+                    "inline": false
+                  },
+                  {
+                    "name": "Frontend Image",
+                    "value": "`${{ env.REGISTRY }}/xpeditis-frontend:${{ github.ref_name }}`",
+                    "inline": false
+                  },
+                  {
+                    "name": "Workflow",
+                    "value": "[${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})",
+                    "inline": false
+                  }
+                ],
+                "timestamp": "${{ github.event.head_commit.timestamp }}",
+                "footer": {
+                  "text": "Xpeditis CI/CD"
+                }
+              }]
+            }' \
+            ${{ secrets.DISCORD_WEBHOOK_URL }}
+
+  # ============================================
+  # Discord Notification - Failure
+  # ============================================
+  notify-failure:
+    name: Discord Notification (Failure)
+    runs-on: ubuntu-latest
+    needs: [backend, frontend, deploy-portainer]
+    if: failure()
+
+    steps:
+      - name: Send Discord notification
+        run: |
+          curl -H "Content-Type: application/json" \
+            -d '{
+              "embeds": [{
+                "title": "❌ CI/CD Pipeline Failed",
+                "description": "Deployment failed! Check the logs for details.",
                 "color": 15158332,
                 "fields": [
-                {"name": "Branch", "value": "`${{ github.ref_name }}`", "inline": true},
+                  {
-                {"name": "Author", "value": "${{ github.actor }}", "inline": true},
+                    "name": "Repository",
-                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
+                    "value": "${{ github.repository }}",
+                    "inline": true
+                  },
+                  {
+                    "name": "Branch",
+                    "value": "${{ github.ref_name }}",
+                    "inline": true
+                  },
+                  {
+                    "name": "Commit",
+                    "value": "[${{ github.sha }}](${{ github.event.head_commit.url }})",
+                    "inline": false
+                  },
+                  {
+                    "name": "Workflow",
+                    "value": "[${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})",
+                    "inline": false
+                  }
                 ],
-              "footer": {"text": "Xpeditis CI • Dev"}
+                "timestamp": "${{ github.event.head_commit.timestamp }}",
+                "footer": {
+                  "text": "Xpeditis CI/CD"
+                }
               }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
+            }' \
+            ${{ secrets.DISCORD_WEBHOOK_URL }}

.github/workflows/pr-checks.yml

@@ -1,145 +0,0 @@
-name: PR Checks
-
-# Required status checks — configure these in branch protection rules.
-# PRs to preprod : lint + type-check + unit tests + integration tests
-# PRs to main    : lint + type-check + unit tests only
-
-on:
-  pull_request:
-    branches: [preprod, main]
-
-concurrency:
-  group: pr-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-env:
-  NODE_VERSION: '20'
-
-jobs:
-  backend-quality:
-    name: Backend — Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm run lint
-
-  frontend-quality:
-    name: Frontend — Lint & Type-check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-      - run: npm run type-check
-
-  backend-tests:
-    name: Backend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: backend-quality
-    defaults:
-      run:
-        working-directory: apps/backend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  frontend-tests:
-    name: Frontend — Unit Tests
-    runs-on: ubuntu-latest
-    needs: frontend-quality
-    defaults:
-      run:
-        working-directory: apps/frontend
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/frontend/package-lock.json
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --passWithNoTests
-
-  # Integration tests — PRs to preprod only
-  # Code going to main was already integration-tested when it passed through preprod
-  integration-tests:
-    name: Backend — Integration Tests
-    runs-on: ubuntu-latest
-    needs: backend-tests
-    if: github.base_ref == 'preprod'
-    defaults:
-      run:
-        working-directory: apps/backend
-
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: xpeditis_test
-          POSTGRES_PASSWORD: xpeditis_test_password
-          POSTGRES_DB: xpeditis_test
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 5432:5432
-      redis:
-        image: redis:7-alpine
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-        ports:
-          - 6379:6379
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: apps/backend/package-lock.json
-      - run: npm install --legacy-peer-deps
-      - name: Run integration tests
-        env:
-          NODE_ENV: test
-          DATABASE_HOST: localhost
-          DATABASE_PORT: 5432
-          DATABASE_USER: xpeditis_test
-          DATABASE_PASSWORD: xpeditis_test_password
-          DATABASE_NAME: xpeditis_test
-          DATABASE_SYNCHRONIZE: 'false'
-          REDIS_HOST: localhost
-          REDIS_PORT: 6379
-          REDIS_PASSWORD: ''
-          JWT_SECRET: test-secret-key-ci
-          SMTP_HOST: localhost
-          SMTP_PORT: 1025
-          SMTP_FROM: test@xpeditis.com
-        run: npm run test:integration -- --passWithNoTests

.github/workflows/rollback.yml

@@ -1,269 +0,0 @@
-name: Rollback
-
-# Emergency rollback — production (Hetzner k3s) and preprod (Portainer).
-#
-# Production strategies:
-#   previous         — kubectl rollout undo (fastest, reverts to previous ReplicaSet)
-#   specific-version — kubectl set image to a specific prod-SHA tag
-#
-# Preprod strategy:
-#   Re-tags a preprod-SHA image back to :preprod, triggers Portainer webhook.
-#
-# Secrets required:
-#   REGISTRY_TOKEN              — Scaleway registry
-#   HETZNER_KUBECONFIG          — base64 kubeconfig (production only)
-#   PORTAINER_WEBHOOK_BACKEND   — Portainer webhook preprod backend
-#   PORTAINER_WEBHOOK_FRONTEND  — Portainer webhook preprod frontend
-#   PROD_BACKEND_URL            — https://api.xpeditis.com
-#   PROD_FRONTEND_URL           — https://app.xpeditis.com
-#   PREPROD_BACKEND_URL         — https://api.preprod.xpeditis.com
-#   PREPROD_FRONTEND_URL        — https://preprod.xpeditis.com
-#   DISCORD_WEBHOOK_URL
-
-on:
-  workflow_dispatch:
-    inputs:
-      environment:
-        description: 'Target environment'
-        required: true
-        type: choice
-        options: [production, preprod]
-      strategy:
-        description: 'Strategy (production only — "previous" = instant kubectl undo)'
-        required: true
-        type: choice
-        options: [previous, specific-version]
-      version_tag:
-        description: 'Tag for specific-version (e.g. prod-a1b2c3d or preprod-a1b2c3d)'
-        required: false
-        type: string
-      reason:
-        description: 'Reason (audit trail)'
-        required: true
-        type: string
-
-env:
-  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
-  K8S_NAMESPACE: xpeditis-prod
-
-jobs:
-  validate:
-    name: Validate Inputs
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check inputs
-        run: |
-          ENV="${{ github.event.inputs.environment }}"
-          STRATEGY="${{ github.event.inputs.strategy }}"
-          TAG="${{ github.event.inputs.version_tag }}"
-
-          if [ "$STRATEGY" = "specific-version" ] && [ -z "$TAG" ]; then
-            echo "ERROR: version_tag is required for specific-version strategy."
-            exit 1
-          fi
-
-          if [ "$ENV" = "production" ] && [ "$STRATEGY" = "specific-version" ]; then
-            if [[ ! "$TAG" =~ ^prod- ]]; then
-              echo "ERROR: Production tag must start with 'prod-' (got: $TAG)"
-              exit 1
-            fi
-          fi
-
-          if [ "$ENV" = "preprod" ]; then
-            if [[ ! "$TAG" =~ ^preprod- ]]; then
-              echo "ERROR: Preprod tag must start with 'preprod-' (got: $TAG)"
-              exit 1
-            fi
-          fi
-
-          echo "Validated — env: $ENV | strategy: $STRATEGY | tag: ${TAG:-N/A} | reason: ${{ github.event.inputs.reason }}"
-
-  # ── Production rollback via kubectl ──────────────────────────────────
-  rollback-production:
-    name: Rollback Production
-    runs-on: ubuntu-latest
-    needs: validate
-    if: github.event.inputs.environment == 'production'
-    environment:
-      name: production
-      url: https://app.xpeditis.com
-    steps:
-      - name: Configure kubectl
-        run: |
-          mkdir -p ~/.kube
-          echo "${{ secrets.HETZNER_KUBECONFIG }}" | base64 -d > ~/.kube/config
-          chmod 600 ~/.kube/config
-          kubectl cluster-info
-
-      - name: Rollback — previous version
-        if: github.event.inputs.strategy == 'previous'
-        run: |
-          kubectl rollout undo deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=180s
-          kubectl rollout undo deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=180s
-          kubectl get pods -n ${{ env.K8S_NAMESPACE }}
-
-      - name: Login to Scaleway (for image verification)
-        if: github.event.inputs.strategy == 'specific-version'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - uses: docker/setup-buildx-action@v3
-        if: github.event.inputs.strategy == 'specific-version'
-
-      - name: Rollback — specific version
-        if: github.event.inputs.strategy == 'specific-version'
-        run: |
-          TAG="${{ github.event.inputs.version_tag }}"
-          BACKEND="${{ env.REGISTRY }}/xpeditis-backend:${TAG}"
-          FRONTEND="${{ env.REGISTRY }}/xpeditis-frontend:${TAG}"
-
-          echo "Verifying images exist..."
-          docker buildx imagetools inspect "$BACKEND" || { echo "ERROR: $BACKEND not found"; exit 1; }
-          docker buildx imagetools inspect "$FRONTEND" || { echo "ERROR: $FRONTEND not found"; exit 1; }
-
-          kubectl set image deployment/xpeditis-backend backend="$BACKEND" -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=180s
-
-          kubectl set image deployment/xpeditis-frontend frontend="$FRONTEND" -n ${{ env.K8S_NAMESPACE }}
-          kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=180s
-
-          kubectl get pods -n ${{ env.K8S_NAMESPACE }}
-
-      - name: Rollout history
-        if: always()
-        run: |
-          kubectl rollout history deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} || true
-          kubectl rollout history deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} || true
-
-  # ── Preprod rollback via Portainer ───────────────────────────────────
-  rollback-preprod:
-    name: Rollback Preprod
-    runs-on: ubuntu-latest
-    needs: validate
-    if: github.event.inputs.environment == 'preprod'
-    steps:
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: nologin
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Verify target image exists
-        run: |
-          TAG="${{ github.event.inputs.version_tag }}"
-          docker buildx imagetools inspect "${{ env.REGISTRY }}/xpeditis-backend:${TAG}" || \
-            { echo "ERROR: backend image not found: $TAG"; exit 1; }
-          docker buildx imagetools inspect "${{ env.REGISTRY }}/xpeditis-frontend:${TAG}" || \
-            { echo "ERROR: frontend image not found: $TAG"; exit 1; }
-
-      - name: Re-tag as preprod
-        run: |
-          TAG="${{ github.event.inputs.version_tag }}"
-          docker buildx imagetools create \
-            --tag ${{ env.REGISTRY }}/xpeditis-backend:preprod \
-            ${{ env.REGISTRY }}/xpeditis-backend:${TAG}
-          docker buildx imagetools create \
-            --tag ${{ env.REGISTRY }}/xpeditis-frontend:preprod \
-            ${{ env.REGISTRY }}/xpeditis-frontend:${TAG}
-
-      - name: Deploy backend (Portainer)
-        run: curl -sf -X POST "${{ secrets.PORTAINER_WEBHOOK_BACKEND }}"
-      - run: sleep 20
-      - name: Deploy frontend (Portainer)
-        run: curl -sf -X POST "${{ secrets.PORTAINER_WEBHOOK_FRONTEND }}"
-
-  # ── Smoke Tests ───────────────────────────────────────────────────────
-  smoke-tests:
-    name: Smoke Tests Post-Rollback
-    runs-on: ubuntu-latest
-    needs: [rollback-production, rollback-preprod]
-    if: always() && (needs.rollback-production.result == 'success' || needs.rollback-preprod.result == 'success')
-    steps:
-      - name: Set URLs
-        id: urls
-        run: |
-          if [ "${{ github.event.inputs.environment }}" = "production" ]; then
-            echo "backend=${{ secrets.PROD_BACKEND_URL }}/api/v1/health" >> $GITHUB_OUTPUT
-            echo "frontend=${{ secrets.PROD_FRONTEND_URL }}" >> $GITHUB_OUTPUT
-            echo "wait=30" >> $GITHUB_OUTPUT
-          else
-            echo "backend=${{ secrets.PREPROD_BACKEND_URL }}/api/v1/health" >> $GITHUB_OUTPUT
-            echo "frontend=${{ secrets.PREPROD_FRONTEND_URL }}" >> $GITHUB_OUTPUT
-            echo "wait=60" >> $GITHUB_OUTPUT
-          fi
-
-      - run: sleep ${{ steps.urls.outputs.wait }}
-
-      - name: Health — Backend
-        run: |
-          for i in {1..12}; do
-            STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 \
-              "${{ steps.urls.outputs.backend }}" 2>/dev/null || echo "000")
-            echo "  Attempt $i: HTTP $STATUS"
-            if [ "$STATUS" = "200" ]; then echo "Backend OK."; exit 0; fi
-            sleep 15
-          done
-          echo "Backend unhealthy after rollback."
-          exit 1
-
-      - name: Health — Frontend
-        run: |
-          for i in {1..12}; do
-            STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 \
-              "${{ steps.urls.outputs.frontend }}" 2>/dev/null || echo "000")
-            echo "  Attempt $i: HTTP $STATUS"
-            if [ "$STATUS" = "200" ]; then echo "Frontend OK."; exit 0; fi
-            sleep 15
-          done
-          echo "Frontend unhealthy after rollback."
-          exit 1
-
-  # ── Notifications ─────────────────────────────────────────────────────
-  notify:
-    name: Notify
-    runs-on: ubuntu-latest
-    needs: [rollback-production, rollback-preprod, smoke-tests]
-    if: always()
-    steps:
-      - name: Success
-        if: needs.smoke-tests.result == 'success'
-        run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "embeds": [{
-              "title": "↩️ Rollback Successful",
-              "color": 16776960,
-              "fields": [
-                {"name": "Environment", "value": "`${{ github.event.inputs.environment }}`", "inline": true},
-                {"name": "Strategy", "value": "`${{ github.event.inputs.strategy }}`", "inline": true},
-                {"name": "Version", "value": "`${{ github.event.inputs.version_tag || 'previous' }}`", "inline": true},
-                {"name": "By", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Reason", "value": "${{ github.event.inputs.reason }}", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Rollback"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}
-
-      - name: Failure
-        if: needs.smoke-tests.result != 'success'
-        run: |
-          curl -s -H "Content-Type: application/json" -d '{
-            "content": "@here ROLLBACK FAILED — MANUAL INTERVENTION REQUIRED",
-            "embeds": [{
-              "title": "🔴 Rollback Failed",
-              "color": 15158332,
-              "fields": [
-                {"name": "Environment", "value": "`${{ github.event.inputs.environment }}`", "inline": true},
-                {"name": "Attempted", "value": "`${{ github.event.inputs.version_tag || 'previous' }}`", "inline": true},
-                {"name": "By", "value": "${{ github.actor }}", "inline": true},
-                {"name": "Reason", "value": "${{ github.event.inputs.reason }}", "inline": false}
-              ],
-              "footer": {"text": "Xpeditis CI/CD • Rollback"}
-            }]
-          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

.gitignore

@@ -44,8 +44,6 @@ lerna-debug.log*
 
 # Docker
 docker-compose.override.yml
-stack-portainer.yaml
-tmp.stack-portainer.yaml
 
 # Uploads
 uploads/

CLAUDE.md

@@ -4,274 +4,609 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-**Xpeditis** is a B2B SaaS maritime freight booking platform. Freight forwarders search and compare real-time shipping rates, book containers, and manage shipments. Monorepo with NestJS 10 backend (Hexagonal Architecture) and Next.js 14 frontend.
+**Xpeditis** is a B2B SaaS maritime freight booking and management platform (maritime equivalent of WebCargo). The platform allows freight forwarders to search and compare real-time shipping rates, book containers online, and manage shipments from a centralized dashboard.
+
+**Current Status**: Phase 4 - Production-ready with security hardening, monitoring, and comprehensive testing infrastructure.
 
 ## Development Commands
 
-All commands run from repo root unless noted otherwise.
+### Local Development Setup
 
 ```bash
-# Infrastructure (PostgreSQL 15 + Redis 7 + MinIO)
+# Install all dependencies (monorepo)
+npm install
+cd apps/backend && npm install
+cd ../frontend && npm install
+
+# Start infrastructure (PostgreSQL + Redis + MinIO)
 docker-compose up -d
 
-# Install all dependencies
+# Verify all services are running
-npm run install:all
+docker-compose ps
+# Expected: xpeditis-postgres, xpeditis-redis, xpeditis-minio
 
-# Environment setup (required on first run)
+# Run database migrations
-cp apps/backend/.env.example apps/backend/.env
+cd apps/backend
-cp apps/frontend/.env.example apps/frontend/.env
+npm run migration:run
 
-# Database migrations (from apps/backend/)
+# Start backend development server (with hot reload)
-cd apps/backend && npm run migration:run
+npm run backend:dev          # From root, or:
+cd apps/backend && npm run dev
 
-# Development servers
+# Start frontend development server
-npm run backend:dev    # http://localhost:4000, Swagger: /api/docs
+npm run frontend:dev         # From root, or:
-npm run frontend:dev   # http://localhost:3000
+cd apps/frontend && npm run dev
 ```
 
-### Testing
+**Access Points**:
+- Frontend: http://localhost:3000
+- Backend API: http://localhost:4000
+- API Docs (Swagger): http://localhost:4000/api/docs
+- MinIO Console (local S3): http://localhost:9001 (minioadmin/minioadmin)
+
+### Monorepo Scripts (from root)
 
 ```bash
-# Backend (from apps/backend/)
+# Development
-npm test                                           # Unit tests (Jest)
+npm run backend:dev          # Start backend dev server
-npm test -- booking.entity.spec.ts                 # Single file
+npm run frontend:dev         # Start frontend dev server
-npm test -- --testNamePattern="should create"      # Filter by test name
-npm run test:cov                                   # With coverage
-npm run test:integration              # Integration tests (needs DB/Redis, 30s timeout)
-npm run test:e2e                      # E2E tests
 
-# Frontend (from apps/frontend/)
+# Testing
-npm test
+npm run backend:test         # Run backend unit tests
-npm run test:e2e                      # Playwright (chromium, firefox, webkit + mobile)
+npm run frontend:test        # Run frontend tests
+npm run backend:lint         # Lint backend code
+npm run frontend:lint        # Lint frontend code
 
-# From root
+# Code Quality
-npm run backend:test
+npm run format               # Format all code (Prettier)
-npm run frontend:test
-```
-
-Backend test config is in `apps/backend/package.json` (Jest). Integration test config: `apps/backend/jest-integration.json` (covers infrastructure layer, setup in `test/setup-integration.ts`). Frontend E2E config: `apps/frontend/playwright.config.ts`.
-
-### Linting, Formatting & Type Checking
-
-```bash
-npm run backend:lint       # ESLint backend
-npm run frontend:lint      # ESLint frontend
-npm run format             # Prettier (all files)
 npm run format:check         # Check formatting
-# From apps/frontend/
+
-npm run type-check         # TypeScript checking (frontend only)
+# Build
+npm run backend:build        # Build backend for production
+npm run frontend:build       # Build frontend for production
+
+# Utilities
+npm run install:all          # Install deps for all workspaces
+npm run clean                # Clean all node_modules and build artifacts
+```
+
+### Testing Commands
+
+#### Backend Tests
+
+```bash
+cd apps/backend
+
+# Unit tests (domain layer - no external dependencies)
+npm test                          # Run all unit tests
+npm run test:watch                # Run in watch mode
+npm run test:cov                  # With coverage report
+
+# Integration tests (infrastructure layer with real DB/Redis)
+npm run test:integration          # Run all integration tests
+npm run test:integration:watch    # Run in watch mode
+npm run test:integration:cov      # With coverage report
+
+# E2E tests (full API workflow)
+npm run test:e2e                  # Run end-to-end tests
+
+# Run a single test file
+npm test -- booking.service.spec.ts
+npm run test:integration -- redis-cache.adapter.spec.ts
+```
+
+#### Load Testing (K6)
+
+```bash
+cd apps/backend
+
+# Install k6 (macOS)
+brew install k6
+
+# Run rate search load test (100 virtual users)
+k6 run load-tests/rate-search.test.js
+
+# Run with custom parameters
+k6 run --vus 50 --duration 60s load-tests/rate-search.test.js
+```
+
+#### E2E Testing (Playwright)
+
+```bash
+cd apps/frontend
+
+# Install Playwright
+npx playwright install
+
+# Run E2E tests (booking workflow)
+npx playwright test e2e/booking-workflow.spec.ts
+
+# Run with UI mode
+npx playwright test --ui
+
+# Run specific browser
+npx playwright test --project=chromium
+```
+
+#### API Testing (Postman/Newman)
+
+```bash
+# Install Newman globally
+npm install -g newman
+
+# Run Postman collection
+newman run postman/Xpeditis_API.postman_collection.json
 ```
 
 ### Database Migrations
 
 ```bash
 cd apps/backend
+
+# Generate new migration (after changing ORM entities)
 npm run migration:generate -- src/infrastructure/persistence/typeorm/migrations/MigrationName
+
+# Run pending migrations
 npm run migration:run
+
+# Revert last migration
 npm run migration:revert
 ```
 
-### Build
+### Build & Production
 
 ```bash
-npm run backend:build    # NestJS build with tsc-alias for path resolution
+# Backend build
-npm run frontend:build   # Next.js production build (standalone output)
+cd apps/backend
-npm run clean            # Remove all node_modules, dist, .next directories
+npm run build
+npm run start:prod
+
+# Frontend build
+cd apps/frontend
+npm run build
+npm start
 ```
 
-## Local Infrastructure
-
-Docker-compose defaults (no `.env` changes needed for local dev):
-- **PostgreSQL**: `xpeditis:xpeditis_dev_password@localhost:5432/xpeditis_dev`
-- **Redis**: password `xpeditis_redis_password`, port 6379
-- **MinIO** (S3-compatible storage): `minioadmin:minioadmin`, API port 9000, console port 9001
-
-Frontend env var: `NEXT_PUBLIC_API_URL` (defaults to `http://localhost:4000`) — configured in `next.config.js`.
-
 ## Architecture
 
-### Hexagonal Architecture (Backend)
+### Hexagonal Architecture (Ports & Adapters)
+
+The backend follows strict hexagonal architecture with three isolated layers:
 
 ```
 apps/backend/src/
-├── domain/           # CORE - Pure TypeScript, NO framework imports
+├── domain/              # 🎯 Pure business logic (ZERO external dependencies)
-│   ├── entities/     # Booking, RateQuote, Carrier, Port, Container, Notification, Webhook,
+│   ├── entities/       # Booking, RateQuote, User, Organization, Carrier
-│   │                 # AuditLog, User, Organization, Subscription, License, CsvBooking,
+│   ├── value-objects/  # Email, Money, BookingNumber, PortCode
-│   │                 # CsvRate, InvitationToken
+│   ├── services/       # Domain services (rate-search, booking, availability)
-│   ├── value-objects/ # Money, Email, BookingNumber, BookingStatus, PortCode, ContainerType,
-│   │                  # Volume, DateRange, Surcharge
-│   ├── services/     # Pure domain services (csv-rate-price-calculator)
 │   ├── ports/
-│   │   ├── in/       # Use case interfaces with execute() method
+│   │   ├── in/        # Use cases (search-rates, create-booking)
-│   │   └── out/      # Repository/SPI interfaces (token constants like BOOKING_REPOSITORY = 'BookingRepository')
+│   │   └── out/       # Repository interfaces, connector ports
-│   └── exceptions/   # Domain-specific exceptions
+│   └── exceptions/    # Business exceptions
-├── application/      # Controllers, DTOs (class-validator), Guards, Decorators, Mappers
+│
-│   ├── [feature]/    # Feature modules: auth/, bookings/, csv-bookings, rates/, ports/,
+├── application/        # 🔌 Controllers & DTOs (depends ONLY on domain)
-│   │                 # organizations/, users/, dashboard/, audit/, notifications/, webhooks/,
+│   ├── controllers/   # REST endpoints
-│   │                 # gdpr/, admin/, subscriptions/
+│   ├── dto/           # Data transfer objects with validation
-│   ├── controllers/  # REST controllers (also nested under feature folders)
+│   ├── guards/        # Auth guards, rate limiting, RBAC
-│   ├── services/     # Application services: audit, notification, webhook,
+│   ├── services/      # Brute-force protection, file validation
-│   │                 # booking-automation, export, fuzzy-search, brute-force-protection
+│   └── mappers/       # DTO ↔ Domain entity mapping
-│   ├── gateways/     # WebSocket gateways (notifications.gateway.ts via Socket.IO)
+│
-│   ├── guards/       # JwtAuthGuard, RolesGuard, CustomThrottlerGuard
+└── infrastructure/    # 🏗️ External integrations (depends ONLY on domain)
-│   ├── decorators/   # @Public(), @Roles(), @CurrentUser()
+    ├── persistence/typeorm/  # PostgreSQL repositories
-│   ├── dto/          # Request/response DTOs with class-validator
+    ├── cache/               # Redis adapter
-│   ├── mappers/      # Domain ↔ DTO mappers
+    ├── carriers/            # Maersk, MSC, CMA CGM connectors
-│   └── interceptors/ # PerformanceMonitoringInterceptor
+    ├── email/               # MJML email service
-└── infrastructure/   # TypeORM entities/repos/mappers, Redis cache, carrier APIs,
+    ├── storage/             # S3 storage adapter
-                      # MinIO/S3, email (MJML+Nodemailer), Stripe, Sentry,
+    ├── websocket/           # Real-time carrier updates
-                      # Pappers (French SIRET registry), PDF generation
+    └── security/            # Helmet.js, rate limiting, CORS
 ```
 
-**Critical dependency rules**:
+**Critical Rules**:
-- Domain layer: zero imports from NestJS, TypeORM, Redis, or any framework
+1. **Domain layer**: No imports of NestJS, TypeORM, Redis, or any framework
-- Dependencies flow inward only: Infrastructure → Application → Domain
+2. **Dependencies flow inward**: Infrastructure → Application → Domain
-- Path aliases: `@domain/*`, `@application/*`, `@infrastructure/*` (defined in `apps/backend/tsconfig.json`)
+3. **TypeScript path aliases**: Use `@domain/*`, `@application/*`, `@infrastructure/*`
-- Domain tests run without NestJS TestingModule
+4. **Testing**: Domain tests must run without NestJS TestingModule
-- Backend has strict TypeScript: `strict: true`, `strictNullChecks: true` (but `strictPropertyInitialization: false`)
-- Env vars validated at startup via Joi schema in `app.module.ts` — required vars include DATABASE_*, REDIS_*, JWT_SECRET, SMTP_*
 
-### NestJS Modules (app.module.ts)
+### Frontend Architecture (Next.js 14 App Router)
-
-Global guards: JwtAuthGuard (all routes protected by default), CustomThrottlerGuard.
-
-Feature modules: Auth, Rates, Ports, Bookings, CsvBookings, Organizations, Users, Dashboard, Audit, Notifications, Webhooks, GDPR, Admin, Subscriptions.
-
-Infrastructure modules: CacheModule, CarrierModule, SecurityModule, CsvRateModule, StripeModule, PdfModule, StorageModule, EmailModule.
-
-Swagger plugin enabled in `nest-cli.json` — DTOs auto-documented. Logging via `nestjs-pino` (pino-pretty in dev).
-
-### Frontend (Next.js 14 App Router)
 
 ```
 apps/frontend/
-├── app/              # App Router pages (root-level)
+├── app/                # Next.js 14 App Router (routing)
-│   ├── dashboard/    # Protected routes (bookings, admin, settings, wiki, search)
+│   ├── page.tsx       # Landing page
-│   ├── carrier/      # Carrier portal (magic link auth — accept/reject/documents)
+│   ├── layout.tsx     # Root layout
-│   ├── booking/      # Booking confirmation/rejection flows
+│   ├── login/         # Auth pages
-│   └── [auth pages]  # login, register, forgot-password, verify-email
+│   ├── register/
-└── src/
+│   └── dashboard/     # Protected dashboard routes
-    ├── app/          # Additional app pages (e.g. rates/csv-search)
+├── src/
-    ├── components/   # React components (ui/, layout/, bookings/, admin/, rate-search/, organization/)
+│   ├── components/    # React components
-    ├── hooks/        # useBookings, useNotifications, useCsvRateSearch, useCompanies, useFilterOptions
+│   │   ├── ui/       # shadcn/ui components (Button, Dialog, etc.)
-    ├── lib/
+│   │   └── features/ # Feature-specific components
-    │   ├── api/      # Fetch-based API client with auto token refresh (client.ts + per-module files)
+│   ├── hooks/        # Custom React hooks
-    │   ├── context/  # Auth context, cookie context
+│   ├── lib/          # Utilities and API client
-    │   ├── providers/ # QueryProvider (TanStack Query / React Query)
+│   ├── types/        # TypeScript type definitions
-    │   └── fonts.ts  # Manrope (headings) + Montserrat (body)
+│   ├── utils/        # Helper functions
-    ├── types/        # TypeScript type definitions
+│   └── pages/        # Legacy page components
-    ├── utils/        # Export utilities (Excel, PDF)
+└── public/           # Static assets (logos, images)
-    └── legacy-pages/ # Archived page components (BookingsManagement, CarrierManagement, CarrierMonitoring)
 ```
 
-Path aliases: `@/*` → `./src/*`, `@/components/*`, `@/lib/*`, `@/app/*` → `./app/*`, `@/types/*`, `@/hooks/*`, `@/utils/*`
+**Frontend Patterns**:
+- Server Components by default, Client Components when needed (`"use client"`)
+- React Hook Form + Zod for form validation
+- TanStack Query for server state management
+- Zustand for client state management
+- shadcn/ui for accessible UI components
 
-**Note**: Frontend tsconfig has `strict: false`, `noImplicitAny: false`, `strictNullChecks: false` (unlike backend which is strict). Uses TanStack Query (React Query) for server state — wrap new data fetching in hooks, not bare `fetch` calls.
+**TypeScript Path Aliases** (Frontend):
+- `@/*` - Maps to `./src/*`
+- `@/components/*` - Maps to `./src/components/*`
+- `@/lib/*` - Maps to `./src/lib/*`
+- `@/app/*` - Maps to `./app/*`
+- `@/types/*` - Maps to `./src/types/*`
+- `@/hooks/*` - Maps to `./src/hooks/*`
+- `@/utils/*` - Maps to `./src/utils/*`
+- `@/pages/*` - Maps to `./src/pages/*`
 
-### Brand Design
+### Tech Stack
 
-Colors: Navy `#10183A` (primary), Turquoise `#34CCCD` (accent), Green `#067224` (success), Gray `#F2F2F2`.
+**Backend**:
-Fonts: Manrope (headings), Montserrat (body).
+- NestJS 10+ (framework)
-Landing page is in French.
+- TypeScript 5+ (strict mode)
+- PostgreSQL 15+ (database)
+- TypeORM 0.3+ (ORM)
+- Redis 7+ (cache, 15min TTL for rates)
+- Passport + JWT (authentication)
+- Argon2 (password hashing)
+- Helmet.js (security headers)
+- Pino (structured logging)
+- Sentry (error tracking + APM)
 
-## Key Patterns
+**Frontend**:
+- Next.js 14+ App Router
+- TypeScript 5+
+- React 18+
+- TanStack Table (data grids)
+- TanStack Query (server state)
+- React Hook Form + Zod (forms)
+- Socket.IO (real-time updates)
+- Tailwind CSS + shadcn/ui
+- Framer Motion (animations)
 
-### Entity Pattern (Domain)
+**Infrastructure**:
-Private constructor + static `create()` factory. Immutable — mutation methods return new instances. Some entities also have `fromPersistence()` for reconstitution and `toObject()` for serialization.
+- Docker + Docker Compose
-```typescript
+- GitHub Actions (CI/CD)
-export class Booking {
+- AWS RDS (PostgreSQL)
-  private readonly props: BookingProps;
+- AWS ElastiCache (Redis)
-  static create(props: Omit<BookingProps, 'bookingNumber' | 'status'>): Booking { ... }
+- AWS S3 (document storage)
-  updateStatus(newStatus: BookingStatus): Booking { // Returns new instance
+- MinIO (local S3-compatible storage for development)
-    return new Booking({ ...this.props, status: newStatus });
+
-  }
+## Testing Strategy
-}
+
+### Test Coverage Targets
+- **Domain layer**: 90%+ (currently ~100% for value objects and entities)
+- **Application layer**: 80%+
+- **Infrastructure layer**: 70%+ (currently ~82% for Phase 3 services)
+
+### Test File Locations
+
+```
+apps/backend/
+├── src/
+│   └── domain/
+│       ├── entities/
+│       │   └── rate-quote.entity.spec.ts        # Unit test example
+│       └── value-objects/
+│           ├── email.vo.spec.ts
+│           └── money.vo.spec.ts
+├── test/
+│   ├── integration/                              # Infrastructure tests
+│   │   ├── booking.repository.spec.ts
+│   │   ├── redis-cache.adapter.spec.ts
+│   │   └── maersk.connector.spec.ts
+│   ├── app.e2e-spec.ts                          # E2E API tests
+│   ├── jest-integration.json                     # Integration test config
+│   └── setup-integration.ts                      # Test setup
+└── load-tests/
+    └── rate-search.test.js                       # K6 load tests
+
+apps/frontend/
+└── e2e/
+    └── booking-workflow.spec.ts                  # Playwright E2E tests
 ```
 
-### Value Object Pattern
+### Running Tests in CI
-Immutable, self-validating via static `create()`. E.g. `Money` supports USD, EUR, GBP, CNY, JPY with arithmetic and formatting methods.
 
-### Repository Pattern
+Tests run automatically on GitHub Actions for all PRs:
-- Interface in `domain/ports/out/` with token constant (e.g. `BOOKING_REPOSITORY = 'BookingRepository'`)
+- Linting & formatting check
-- Implementation in `infrastructure/persistence/typeorm/repositories/`
+- Backend unit tests
-- ORM entities: `infrastructure/persistence/typeorm/entities/*.orm-entity.ts`
+- Backend integration tests (with PostgreSQL + Redis services)
-- Separate mapper classes (`infrastructure/persistence/typeorm/mappers/`) with static `toOrm()`, `toDomain()`, `toDomainMany()` methods
+- Backend E2E tests
+- Frontend tests
+- Security scans
 
-### Frontend API Client
+See [.github/workflows/ci.yml](.github/workflows/ci.yml) for full pipeline.
-Custom Fetch wrapper in `src/lib/api/client.ts` — exports `get()`, `post()`, `patch()`, `del()`, `upload()`, `download()`. Auto-refreshes JWT on 401. Tokens stored in localStorage **and synced to cookies** (`accessToken` cookie) so Next.js middleware can read them server-side. Per-module files (auth.ts, bookings.ts, rates.ts, etc.) import from client.
 
-### Route Protection (Middleware)
+## Security Features (Phase 4)
-`apps/frontend/middleware.ts` checks the `accessToken` cookie to protect routes. Public paths are defined in two lists:
-- `exactPublicPaths`: exact matches (e.g. `/`)
-- `prefixPublicPaths`: prefix matches including sub-paths (e.g. `/login`, `/carrier`, `/about`, etc.)
 
-All other routes redirect to `/login?redirect=<pathname>` when the cookie is absent.
+**OWASP Top 10 Compliance**:
+- ✅ Helmet.js security headers (CSP, HSTS, X-Frame-Options)
+- ✅ Rate limiting (global: 100/min, auth: 5/min, search: 30/min)
+- ✅ Brute-force protection (exponential backoff after 3 failed attempts)
+- ✅ File upload validation (MIME, magic number, size limits)
+- ✅ Password policy (12+ chars, complexity requirements, Argon2 hashing)
+- ✅ CORS with strict origin validation
+- ✅ SQL injection prevention (TypeORM parameterized queries)
+- ✅ XSS protection (CSP headers + input sanitization)
 
-### Application Decorators
+**Monitoring & Observability**:
-- `@Public()` — skip JWT auth
+- Sentry error tracking + APM (10% trace sampling)
-- `@Roles()` — role-based access control
+- Performance monitoring interceptor (slow request alerts)
-- `@CurrentUser()` — inject authenticated user
+- Structured JSON logging with Pino
+- WebSocket real-time notifications (NotificationsGateway)
+- WebSocket carrier status updates
 
-### API Key Authentication
+## Database Schema
-A second auth mechanism alongside JWT. `ApiKey` domain entity (`domain/entities/api-key.entity.ts`) — keys are hashed with Argon2. `ApiKeyGuard` in `application/guards/` checks the `x-api-key` header. Routes can accept either JWT or API key; see `admin.controller.ts` for examples.
 
-### WebSocket (Real-time Notifications)
+**Key Tables**:
-Socket.IO gateway at `application/gateways/notifications.gateway.ts`. Clients connect to `/` namespace with a JWT bearer token in the handshake auth. Server emits `notification` events. The frontend `useNotifications` hook handles subscriptions.
+- `organizations` - Freight forwarders and carriers
+- `users` - User accounts with RBAC roles (Argon2 password hashing)
+- `carriers` - Shipping line integrations (Maersk, MSC, CMA CGM, etc.)
+- `ports` - 10k+ global ports (UN LOCODE)
+- `rate_quotes` - Cached shipping rates (15min TTL)
+- `bookings` - Container bookings (status workflow)
+- `containers` - Container details (type, VGM, seal numbers)
+- `shipments` - Real-time shipment tracking
+- `audit_logs` - Compliance audit trail
+- `csv_rates` - CSV-based rate data for offline/bulk rate loading
+- `csv_bookings` - CSV-based booking imports
+- `notifications` - User notifications (email, in-app)
+- `webhooks` - Webhook configurations for external integrations
 
-### Carrier Connectors
+**Migrations**: Located in `apps/backend/src/infrastructure/persistence/typeorm/migrations/`
-Five carrier connectors (Maersk, MSC, CMA CGM, Hapag-Lloyd, ONE) extending `base-carrier.connector.ts`, each with request/response mappers. Circuit breaker via `opossum` (5s timeout).
 
-### Caching
+See [apps/backend/DATABASE-SCHEMA.md](apps/backend/DATABASE-SCHEMA.md) for complete schema documentation.
-Redis with 15-min TTL for rate quotes. Key format: `rate:{origin}:{destination}:{containerType}`.
+
+## Environment Variables
+
+### Required Variables
+
+**Backend** (`apps/backend/.env`):
+```bash
+NODE_ENV=development
+PORT=4000
+DATABASE_HOST=localhost
+DATABASE_PORT=5432
+DATABASE_USER=xpeditis
+DATABASE_PASSWORD=xpeditis_dev_password
+DATABASE_NAME=xpeditis_dev
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=xpeditis_redis_password
+JWT_SECRET=your-super-secret-jwt-key-change-this-in-production
+JWT_ACCESS_EXPIRATION=15m
+JWT_REFRESH_EXPIRATION=7d
+```
+
+**Frontend** (`apps/frontend/.env.local`):
+```bash
+NEXT_PUBLIC_API_URL=http://localhost:4000
+NEXT_PUBLIC_WS_URL=ws://localhost:4000
+```
+
+See `apps/backend/.env.example` and `apps/frontend/.env.example` for all available variables.
+
+## API Documentation
+
+**OpenAPI/Swagger**: http://localhost:4000/api/docs (when backend running)
+
+**Key Endpoints**:
+- `POST /api/v1/auth/login` - JWT authentication
+- `POST /api/v1/auth/register` - User registration
+- `POST /api/v1/rates/search` - Search shipping rates (cached 15min)
+- `POST /api/v1/bookings` - Create booking
+- `GET /api/v1/bookings` - List bookings (paginated)
+- `GET /api/v1/bookings/:id` - Get booking details
+- `GET /api/v1/carriers/:id/status` - Real-time carrier status
+- `POST /api/v1/rates/csv-search` - Search rates from CSV data
+- `POST /api/v1/bookings/csv-import` - Bulk import bookings from CSV
+- `GET /api/v1/notifications` - Get user notifications
+- `WS /notifications` - WebSocket for real-time notifications
+- `WS /carrier-status` - WebSocket for carrier status updates
 
 ## Business Rules
 
-- Booking number format: `WCM-YYYY-XXXXXX`
+**Critical Constraints**:
-- Booking status flow: draft → confirmed → shipped → delivered
+- Rate quotes expire after 15 minutes (Redis TTL)
-- Rate quotes expire after 15 minutes
+- Carrier API timeout: 5 seconds per carrier
-- Multi-currency: USD, EUR, GBP, CNY, JPY
+- Booking workflow: Maximum 4 steps
-- RBAC Roles: ADMIN, MANAGER, USER, VIEWER, CARRIER
+- Session timeout: 2 hours inactivity
-- JWT: access token 15min, refresh token 7d
+- Rate search: <2s response time (90% with cache)
-- Password hashing: Argon2
+- Booking number format: `WCM-YYYY-XXXXXX` (6 alphanumeric chars)
-- OAuth providers: Google, Microsoft (configured via passport strategies)
+- Cache hit target: >90% for common routes
-- Organizations can be validated via Pappers API (French SIRET/company registry) at `infrastructure/external/pappers-siret.adapter.ts`
+- Multi-currency support: USD, EUR
 
-### Carrier Portal Workflow
+**RBAC Roles**:
-1. Admin creates CSV booking → assigns carrier
+- `ADMIN` - Full system access
-2. Email with magic link sent (1-hour expiry)
+- `MANAGER` - Manage organization bookings + users
-3. Carrier auto-login → accept/reject booking
+- `USER` - Create and view own bookings
-4. Activity logged in `carrier_activities` table (via `CarrierProfile` + `CarrierActivity` ORM entities)
+- `VIEWER` - Read-only access
 
-## Common Pitfalls
+## Real-Time Features (WebSocket)
 
-- Never import NestJS/TypeORM in domain layer
+The platform uses WebSocket connections for real-time updates:
-- Never use `any` type in backend (strict mode enabled)
-- Never modify applied migrations — create new ones
-- Always validate DTOs with `class-validator` decorators
-- Always create separate mappers for Domain ↔ ORM conversions
-- ORM entity files must match pattern `*.orm-entity.{ts,js}` (auto-discovered by data-source)
-- Migration files must be in `infrastructure/persistence/typeorm/migrations/`
-- Database synchronize is hard-coded to `false` — always use migrations
 
-## Adding a New Feature
+**Notifications Gateway** (`application/gateways/notifications.gateway.ts`):
+- Real-time user notifications (booking updates, system alerts)
+- JWT-authenticated WebSocket connections
+- Auto-reconnect with exponential backoff
+- Connect to `ws://localhost:4000/notifications`
 
-1. **Domain Entity** → `domain/entities/*.entity.ts` (pure TS, unit tests)
+**Carrier Status Updates**:
-2. **Value Objects** → `domain/value-objects/*.vo.ts` (immutable)
+- Real-time carrier API status monitoring
-3. **In Port (Use Case)** → `domain/ports/in/*.use-case.ts` (interface with `execute()`)
+- Live shipment tracking updates
-4. **Out Port (Repository)** → `domain/ports/out/*.repository.ts` (with token constant)
+- Connection status: online/offline/degraded
-5. **ORM Entity** → `infrastructure/persistence/typeorm/entities/*.orm-entity.ts`
+- Connect to `ws://localhost:4000/carrier-status`
-6. **Migration** → `npm run migration:generate -- src/infrastructure/persistence/typeorm/migrations/MigrationName`
+
-7. **Repository Impl** → `infrastructure/persistence/typeorm/repositories/`
+**Frontend Integration**:
-8. **Mapper** → `infrastructure/persistence/typeorm/mappers/` (static toOrm/toDomain/toDomainMany)
+- Socket.IO client for WebSocket connections
-9. **DTOs** → `application/dto/` (with class-validator decorators)
+- Context providers in `lib/providers/`
-10. **Controller** → `application/controllers/` (with Swagger decorators)
+- Real-time notification dropdown component
-11. **Module** → Register repository + use-case providers, import in `app.module.ts`
+- Auto-refresh on status changes
+
+## CSV Import/Export Features
+
+The platform supports CSV-based operations for bulk data management:
+
+**CSV Rate Search**:
+- Upload CSV files with rate data for offline/bulk rate loading
+- CSV-based carrier connectors in `infrastructure/carriers/csv-loader/`
+- Stored in `csv_rates` table
+- Accessible via admin dashboard at `/admin/csv-rates`
+
+**CSV Booking Import**:
+- Bulk import bookings from CSV files
+- Validation and mapping to domain entities
+- Stored in `csv_bookings` table
+- CSV parsing with `csv-parse` library
+
+**Export Features**:
+- Export bookings to Excel (`.xlsx`) using `exceljs`
+- Export to CSV format
+- Export to PDF documents using `pdfkit`
+- File downloads using `file-saver` on frontend
+
+## Admin User Management
+
+The platform includes a dedicated admin interface for user management:
+
+**Admin Features** (Branch: `users_admin`):
+- User CRUD operations (Create, Read, Update, Delete)
+- Organization management
+- Role assignment and permissions
+- Argon2 password hash generation for new users
+- Accessible at `/admin/users` (ADMIN role required)
+
+**Password Hashing Utility**:
+- Use `apps/backend/generate-hash.js` to generate Argon2 password hashes
+- Example: `node apps/backend/generate-hash.js mypassword`
+
+## Deployment
+
+### Docker Build
+
+```bash
+# Build backend image
+docker build -t xpeditis-backend:latest -f apps/backend/Dockerfile .
+
+# Build frontend image
+docker build -t xpeditis-frontend:latest -f apps/frontend/Dockerfile .
+
+# Run with Docker Compose (development)
+docker-compose up -d
+```
+
+### Production Deployment (Portainer)
+
+See [docker/PORTAINER_DEPLOYMENT_GUIDE.md](docker/PORTAINER_DEPLOYMENT_GUIDE.md) for complete instructions:
+- Scaleway Container Registry (rg.fr-par.scw.cloud/weworkstudio)
+- Docker Swarm stack deployment
+- Traefik reverse proxy configuration
+- Environment-specific configs (staging/production)
+
+**CI/CD**: Automated via GitHub Actions
+- Build and push Docker images to Scaleway Registry
+- Deploy to staging/production via Portainer
+- Run smoke tests post-deployment
+
+**Deployment Scripts**:
+- `docker/build-images.sh` - Build and tag Docker images
+- `deploy-to-portainer.sh` - Automated deployment script
+- `docker/portainer-stack.yml` - Production stack configuration
+
+## Performance Targets
+
+- Rate search: <2s for 90% of requests (with cache)
+- Rate search: <5s for 90% of requests (cache miss)
+- Dashboard load: <1s for up to 5k bookings
+- Email confirmation: Send within 3s of booking
+- Cache hit ratio: >90% for top 100 trade lanes
+- Carrier API timeout: 5s (with circuit breaker)
+
+## Naming Conventions
+
+**TypeScript**:
+- Entities: `Booking`, `RateQuote` (PascalCase)
+- Value Objects: `Email`, `Money`, `BookingNumber`
+- Services: `BookingService`, `RateSearchService`
+- Repositories: `BookingRepository` (interface in domain)
+- Repository Implementations: `TypeOrmBookingRepository`
+- DTOs: `CreateBookingDto`, `RateSearchRequestDto`
+- Ports: `SearchRatesPort`, `CarrierConnectorPort`
+
+**Files**:
+- Entities: `booking.entity.ts`
+- Value Objects: `email.vo.ts`
+- Services: `booking.service.ts`
+- Tests: `booking.service.spec.ts`
+- ORM Entities: `booking.orm-entity.ts`
+- Migrations: `1730000000001-CreateBookings.ts`
+
+## Common Pitfalls to Avoid
+
+❌ **DO NOT**:
+- Import NestJS/TypeORM in domain layer
+- Put business logic in controllers or repositories
+- Use `any` type (strict mode enabled)
+- Skip writing tests (coverage targets enforced)
+- Use `DATABASE_SYNC=true` in production
+- Commit `.env` files
+- Expose sensitive data in API responses
+- Skip rate limiting on public endpoints
+- Use circular imports (leverage barrel exports)
+
+✅ **DO**:
+- Follow hexagonal architecture strictly
+- Write tests for all new features (domain 90%+)
+- Use TypeScript path aliases (`@domain/*`)
+- Validate all DTOs with `class-validator`
+- Implement circuit breakers for external APIs
+- Cache frequently accessed data (Redis)
+- Use structured logging (Pino)
+- Document APIs with Swagger decorators
+- Run migrations before deployment
 
 ## Documentation
 
-- API Docs: http://localhost:4000/api/docs (Swagger, when running)
+**Architecture & Planning**:
-- Setup guide: `docs/installation/START-HERE.md`
+- [ARCHITECTURE.md](ARCHITECTURE.md) - System architecture (5,800 words)
-- Carrier Portal API: `apps/backend/docs/CARRIER_PORTAL_API.md`
+- [DEPLOYMENT.md](DEPLOYMENT.md) - Deployment guide (4,500 words)
-- Full docs index: `docs/README.md`
+- [PRD.md](PRD.md) - Product requirements
-- Development roadmap: `TODO.md`
+- [TODO.md](TODO.md) - 30-week development roadmap
-- Infrastructure configs (CI/CD, Docker): `infra/`
+
+**Implementation Summaries**:
+- [PHASE4_SUMMARY.md](PHASE4_SUMMARY.md) - Security, monitoring, testing
+- [PHASE3_COMPLETE.md](PHASE3_COMPLETE.md) - Booking workflow, exports
+- [PHASE2_COMPLETE.md](PHASE2_COMPLETE.md) - Authentication, RBAC
+- [PHASE-1-WEEK5-COMPLETE.md](PHASE-1-WEEK5-COMPLETE.md) - Rate search, cache
+
+**Testing**:
+- [TEST_EXECUTION_GUIDE.md](TEST_EXECUTION_GUIDE.md) - How to run all tests
+- [TEST_COVERAGE_REPORT.md](TEST_COVERAGE_REPORT.md) - Coverage metrics
+- [GUIDE_TESTS_POSTMAN.md](GUIDE_TESTS_POSTMAN.md) - Postman API tests
+
+**Deployment**:
+- [docker/PORTAINER_DEPLOYMENT_GUIDE.md](docker/PORTAINER_DEPLOYMENT_GUIDE.md) - Portainer setup
+- [docker/DOCKER_BUILD_GUIDE.md](docker/DOCKER_BUILD_GUIDE.md) - Docker build instructions
+- [DEPLOYMENT_CHECKLIST.md](DEPLOYMENT_CHECKLIST.md) - Pre-deployment checklist
+
+## Code Review Checklist
+
+1. Hexagonal architecture principles followed
+2. Domain layer has zero external dependencies
+3. Unit tests written (90%+ coverage for domain)
+4. Integration tests for infrastructure adapters
+5. DTOs validated with class-validator
+6. Swagger documentation updated
+7. No secrets committed
+8. TypeScript strict mode passes
+9. Prettier formatting applied
+10. ESLint passes with no warnings

EMAIL_IMPLEMENTATION_STATUS.md

@@ -18,7 +18,7 @@
 
 ### 4. Nettoyage des fichiers CSV
 - ✅ Suppression de la colonne `companyEmail` des fichiers CSV (elle n'est plus nécessaire)
-- ✅ Script Python créé pour automatiser l'ajout/suppression: `scripts/add-email-to-csv.py`
+- ✅ Script Python créé pour automatiser l'ajout/suppression: `add-email-to-csv.py`
 
 ## ✅ Ce qui a été complété (SUITE)
 

REGISTRY_PUSH_GUIDE.md

@@ -130,16 +130,16 @@ docker push rg.fr-par.scw.cloud/weworkstudio/xpeditis-frontend:preprod
 
 ```bash
 # Rendre le script exécutable
-chmod +x docker/deploy-to-portainer.sh
+chmod +x deploy-to-portainer.sh
 
 # Option 1 : Build et push tout
-./docker/deploy-to-portainer.sh all
+./deploy-to-portainer.sh all
 
 # Option 2 : Backend seulement
-./docker/deploy-to-portainer.sh backend
+./deploy-to-portainer.sh backend
 
 # Option 3 : Frontend seulement
-./docker/deploy-to-portainer.sh frontend
+./deploy-to-portainer.sh frontend
 ```
 
 Le script fait automatiquement :
@@ -271,8 +271,8 @@ docker images | grep rg.fr-par.scw.cloud
 
 ```bash
 # Plus simple et recommandé
-chmod +x docker/deploy-to-portainer.sh
+chmod +x deploy-to-portainer.sh
-./docker/deploy-to-portainer.sh all
+./deploy-to-portainer.sh all
 ```
 
 ---

apps/backend/.dockerignore

@@ -2,6 +2,7 @@
 node_modules
 npm-debug.log
 yarn-error.log
+package-lock.json
 yarn.lock
 pnpm-lock.yaml
 

apps/backend/.env.example

@@ -37,13 +37,11 @@ MICROSOFT_CALLBACK_URL=http://localhost:4000/api/v1/auth/microsoft/callback
 APP_URL=http://localhost:3000
 
 # Email (SMTP)
-  SMTP_HOST=smtp-relay.brevo.com
+SMTP_HOST=smtp.sendgrid.net
 SMTP_PORT=587
-  SMTP_USER=ton-email@brevo.com
-  SMTP_PASS=ta-cle-smtp-brevo
 SMTP_SECURE=false
-
+SMTP_USER=apikey
-# SMTP_FROM devient le fallback uniquement (chaque méthode a son propre from maintenant)
+SMTP_PASS=your-sendgrid-api-key
 SMTP_FROM=noreply@xpeditis.com
 
 # AWS S3 / Storage (or MinIO for development)
@@ -76,11 +74,6 @@ ONE_API_URL=https://api.one-line.com/v1
 ONE_USERNAME=your-one-username
 ONE_PASSWORD=your-one-password
 
-# Swagger Documentation Access (HTTP Basic Auth)
-# Leave empty to disable Swagger in production, or set both to protect with a password
-SWAGGER_USERNAME=admin
-SWAGGER_PASSWORD=change-this-strong-password
-
 # Security
 BCRYPT_ROUNDS=12
 SESSION_TIMEOUT_MS=7200000
@@ -91,18 +84,3 @@ RATE_LIMIT_MAX=100
 
 # Monitoring
 SENTRY_DSN=your-sentry-dsn
-
-# Frontend URL (for redirects)
-FRONTEND_URL=http://localhost:3000
-
-# Stripe (Subscriptions & Payments)
-STRIPE_SECRET_KEY=sk_test_your_stripe_secret_key
-STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret
-
-# Stripe Price IDs (create these in Stripe Dashboard)
-STRIPE_SILVER_MONTHLY_PRICE_ID=price_silver_monthly
-STRIPE_SILVER_YEARLY_PRICE_ID=price_silver_yearly
-STRIPE_GOLD_MONTHLY_PRICE_ID=price_gold_monthly
-STRIPE_GOLD_YEARLY_PRICE_ID=price_gold_yearly
-STRIPE_PLATINIUM_MONTHLY_PRICE_ID=price_platinium_monthly
-STRIPE_PLATINIUM_YEARLY_PRICE_ID=price_platinium_yearly

apps/backend/.eslintrc.js

@@ -5,22 +5,20 @@ module.exports = {
     tsconfigRootDir: __dirname,
     sourceType: 'module',
   },
-  plugins: ['@typescript-eslint/eslint-plugin', 'unused-imports'],
+  plugins: ['@typescript-eslint/eslint-plugin'],
   extends: ['plugin:@typescript-eslint/recommended', 'plugin:prettier/recommended'],
   root: true,
   env: {
     node: true,
     jest: true,
   },
-  ignorePatterns: ['.eslintrc.js', 'dist/**', 'node_modules/**', 'apps/**'],
+  ignorePatterns: ['.eslintrc.js', 'dist/**', 'node_modules/**'],
   rules: {
     '@typescript-eslint/interface-name-prefix': 'off',
     '@typescript-eslint/explicit-function-return-type': 'off',
     '@typescript-eslint/explicit-module-boundary-types': 'off',
-    '@typescript-eslint/no-explicit-any': 'off', // Désactivé pour projet existant en production
+    '@typescript-eslint/no-explicit-any': 'warn',
-    '@typescript-eslint/no-unused-vars': 'off', // Désactivé car remplacé par unused-imports
+    '@typescript-eslint/no-unused-vars': [
-    'unused-imports/no-unused-imports': 'error',
-    'unused-imports/no-unused-vars': [
       'warn',
       {
         argsIgnorePattern: '^_',

apps/backend/CARRIER_ACCEPT_REJECT_FIX.md

@@ -1,328 +0,0 @@
-# ✅ FIX: Redirection Transporteur après Accept/Reject
-
-**Date**: 5 décembre 2025
-**Statut**: ✅ **CORRIGÉ ET TESTÉ**
-
----
-
-## 🎯 Problème Identifié
-
-**Symptôme**: Quand un transporteur clique sur "Accepter" ou "Refuser" dans l'email:
-- ❌ Pas de redirection vers le dashboard transporteur
-- ❌ Le status du booking ne change pas
-- ❌ Erreur 404 ou pas de réponse
-
-**URL problématique**:
-```
-http://localhost:3000/api/v1/csv-bookings/{token}/accept
-```
-
-**Cause Racine**: Les URLs dans l'email pointaient vers le **frontend** (port 3000) au lieu du **backend** (port 4000).
-
----
-
-## 🔍 Analyse du Problème
-
-### Ce qui se passait AVANT (❌ Cassé)
-
-1. **Email envoyé** avec URL: `http://localhost:3000/api/v1/csv-bookings/{token}/accept`
-2. **Transporteur clique** sur le lien
-3. **Frontend** (port 3000) reçoit la requête
-4. **Erreur 404** car `/api/v1/*` n'existe pas sur le frontend
-5. **Aucune redirection**, aucun traitement
-
-### Workflow Attendu (✅ Correct)
-
-1. **Email envoyé** avec URL: `http://localhost:4000/api/v1/csv-bookings/{token}/accept`
-2. **Transporteur clique** sur le lien
-3. **Backend** (port 4000) reçoit la requête
-4. **Backend traite**:
-   - Accepte le booking
-   - Crée un compte transporteur si nécessaire
-   - Génère un token d'auto-login
-5. **Backend redirige** vers: `http://localhost:3000/carrier/confirmed?token={autoLoginToken}&action=accepted&bookingId={id}&new={isNew}`
-6. **Frontend** affiche la page de confirmation
-7. **Transporteur** est auto-connecté et voit son dashboard
-
----
-
-## ✅ Correction Appliquée
-
-### Fichier 1: `email.adapter.ts` (lignes 259-264)
-
-**AVANT** (❌):
-```typescript
-const baseUrl = this.configService.get('APP_URL', 'http://localhost:3000'); // Frontend!
-const acceptUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/accept`;
-const rejectUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/reject`;
-```
-
-**APRÈS** (✅):
-```typescript
-// Use BACKEND_URL if available, otherwise construct from PORT
-// The accept/reject endpoints are on the BACKEND, not the frontend
-const port = this.configService.get('PORT', '4000');
-const backendUrl = this.configService.get('BACKEND_URL', `http://localhost:${port}`);
-const acceptUrl = `${backendUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/accept`;
-const rejectUrl = `${backendUrl}/api/v1/csv-bookings/${bookingData.confirmationToken}/reject`;
-```
-
-**Changements**:
-- ✅ Utilise `BACKEND_URL` ou construit à partir de `PORT`
-- ✅ URLs pointent maintenant vers `http://localhost:4000/api/v1/...`
-- ✅ Commentaires ajoutés pour clarifier
-
-### Fichier 2: `app.module.ts` (lignes 39-40)
-
-Ajout des variables `APP_URL` et `BACKEND_URL` au schéma de validation:
-
-```typescript
-validationSchema: Joi.object({
-  // ...
-  APP_URL: Joi.string().uri().default('http://localhost:3000'),
-  BACKEND_URL: Joi.string().uri().optional(),
-  // ...
-}),
-```
-
-**Pourquoi**: Pour éviter que ces variables soient supprimées par la validation Joi.
-
----
-
-## 🧪 Test du Workflow Complet
-
-### Prérequis
-
-- ✅ Backend en cours d'exécution (port 4000)
-- ✅ Frontend en cours d'exécution (port 3000)
-- ✅ MinIO en cours d'exécution
-- ✅ Email adapter initialisé
-
-### Étape 1: Créer un Booking CSV
-
-1. **Se connecter** au frontend: http://localhost:3000
-2. **Aller sur** la page de recherche avancée
-3. **Rechercher un tarif** et cliquer sur "Réserver"
-4. **Remplir le formulaire**:
-   - Carrier email: Votre email de test (ou Mailtrap)
-   - Ajouter au moins 1 document
-5. **Cliquer sur "Envoyer la demande"**
-
-### Étape 2: Vérifier l'Email Reçu
-
-1. **Ouvrir Mailtrap**: https://mailtrap.io/inboxes
-2. **Trouver l'email**: "Nouvelle demande de réservation - {origin} → {destination}"
-3. **Vérifier les URLs** des boutons:
-   - ✅ Accepter: `http://localhost:4000/api/v1/csv-bookings/{token}/accept`
-   - ✅ Refuser: `http://localhost:4000/api/v1/csv-bookings/{token}/reject`
-
-**IMPORTANT**: Les URLs doivent pointer vers **port 4000** (backend), PAS port 3000!
-
-### Étape 3: Tester l'Acceptation
-
-1. **Copier l'URL** du bouton "Accepter" depuis l'email
-2. **Ouvrir dans le navigateur** (ou cliquer sur le bouton)
-3. **Observer**:
-   - ✅ Le navigateur va d'abord vers `localhost:4000`
-   - ✅ Puis redirige automatiquement vers `localhost:3000/carrier/confirmed?...`
-   - ✅ Page de confirmation affichée
-   - ✅ Transporteur auto-connecté
-
-### Étape 4: Vérifier le Dashboard Transporteur
-
-Après la redirection:
-
-1. **URL attendue**:
-   ```
-   http://localhost:3000/carrier/confirmed?token={autoLoginToken}&action=accepted&bookingId={id}&new=true
-   ```
-
-2. **Page affichée**:
-   - ✅ Message de confirmation: "Réservation acceptée avec succès!"
-   - ✅ Lien vers le dashboard transporteur
-   - ✅ Si nouveau compte: Message avec credentials
-
-3. **Vérifier le status**:
-   - Le booking doit maintenant avoir le status `ACCEPTED`
-   - Visible dans le dashboard utilisateur (celui qui a créé le booking)
-
-### Étape 5: Tester le Rejet
-
-Répéter avec le bouton "Refuser":
-
-1. **Créer un nouveau booking** (étape 1)
-2. **Cliquer sur "Refuser"** dans l'email
-3. **Vérifier**:
-   - ✅ Redirection vers `/carrier/confirmed?...&action=rejected`
-   - ✅ Message: "Réservation refusée"
-   - ✅ Status du booking: `REJECTED`
-
----
-
-## 📊 Vérifications Backend
-
-### Logs Attendus lors de l'Acceptation
-
-```bash
-# Monitorer les logs
-tail -f /tmp/backend-restart.log | grep -i "accept\|carrier\|booking"
-```
-
-**Logs attendus**:
-```
-[CsvBookingService] Accepting booking with token: {token}
-[CarrierAuthService] Creating carrier account for email: carrier@test.com
-[CarrierAuthService] Carrier account created with ID: {carrierId}
-[CsvBookingService] Successfully linked booking {bookingId} to carrier {carrierId}
-```
-
----
-
-## 🔧 Variables d'Environnement
-
-### `.env` Backend
-
-**Variables requises**:
-```bash
-PORT=4000                                 # Port du backend
-APP_URL=http://localhost:3000            # URL du frontend
-BACKEND_URL=http://localhost:4000        # URL du backend (optionnel, auto-construit si absent)
-```
-
-**En production**:
-```bash
-PORT=4000
-APP_URL=https://xpeditis.com
-BACKEND_URL=https://api.xpeditis.com
-```
-
----
-
-## 🐛 Dépannage
-
-### Problème 1: Toujours redirigé vers port 3000
-
-**Cause**: Email envoyé AVANT la correction
-
-**Solution**:
-1. Backend a été redémarré après la correction ✅
-2. Créer un **NOUVEAU booking** pour recevoir un email avec les bonnes URLs
-3. Les anciens bookings ont encore les anciennes URLs (port 3000)
-
----
-
-### Problème 2: 404 Not Found sur /accept
-
-**Cause**: Backend pas démarré ou route mal configurée
-
-**Solution**:
-```bash
-# Vérifier que le backend tourne
-curl http://localhost:4000/api/v1/health || echo "Backend not responding"
-
-# Vérifier les logs backend
-tail -50 /tmp/backend-restart.log | grep -i "csv-bookings"
-
-# Redémarrer le backend
-cd apps/backend
-npm run dev
-```
-
----
-
-### Problème 3: Token Invalid
-
-**Cause**: Token expiré ou booking déjà accepté/refusé
-
-**Solution**:
-- Les bookings ne peuvent être acceptés/refusés qu'une seule fois
-- Si token invalide, créer un nouveau booking
-- Vérifier dans la base de données le status du booking
-
----
-
-### Problème 4: Pas de redirection vers /carrier/confirmed
-
-**Cause**: Frontend route manquante ou token d'auto-login invalide
-
-**Vérification**:
-1. Vérifier que la route `/carrier/confirmed` existe dans le frontend
-2. Vérifier les logs backend pour voir si le token est généré
-3. Vérifier que le frontend affiche bien la page
-
----
-
-## 📝 Checklist de Validation
-
-- [x] Backend redémarré avec la correction
-- [x] Email adapter initialisé correctement
-- [x] Variables `APP_URL` et `BACKEND_URL` dans le schéma Joi
-- [ ] Nouveau booking créé (APRÈS la correction)
-- [ ] Email reçu avec URLs correctes (port 4000)
-- [ ] Clic sur "Accepter" → Redirection vers /carrier/confirmed
-- [ ] Status du booking changé en `ACCEPTED`
-- [ ] Dashboard transporteur accessible
-- [ ] Test "Refuser" fonctionne aussi
-
----
-
-## 🎯 Résumé des Corrections
-
-| Aspect | Avant (❌) | Après (✅) |
-|--------|-----------|-----------|
-| **Email URL Accept** | `localhost:3000/api/v1/...` | `localhost:4000/api/v1/...` |
-| **Email URL Reject** | `localhost:3000/api/v1/...` | `localhost:4000/api/v1/...` |
-| **Redirection** | Aucune (404) | Vers `/carrier/confirmed` |
-| **Status booking** | Ne change pas | `ACCEPTED` ou `REJECTED` |
-| **Dashboard transporteur** | Inaccessible | Accessible avec auto-login |
-
----
-
-## ✅ Workflow Complet Corrigé
-
-```
-1. Utilisateur crée booking
-   └─> Backend sauvegarde booking (status: PENDING)
-   └─> Backend envoie email avec URLs backend (port 4000) ✅
-
-2. Transporteur clique "Accepter" dans email
-   └─> Ouvre: http://localhost:4000/api/v1/csv-bookings/{token}/accept ✅
-   └─> Backend traite la requête:
-       ├─> Change status → ACCEPTED ✅
-       ├─> Crée compte transporteur si nécessaire ✅
-       ├─> Génère token auto-login ✅
-       └─> Redirige vers frontend: localhost:3000/carrier/confirmed?... ✅
-
-3. Frontend affiche page confirmation
-   └─> Message de succès ✅
-   └─> Auto-login du transporteur ✅
-   └─> Lien vers dashboard ✅
-
-4. Transporteur accède à son dashboard
-   └─> Voir la liste de ses bookings ✅
-   └─> Gérer ses réservations ✅
-```
-
----
-
-## 🚀 Prochaines Étapes
-
-1. **Tester immédiatement**:
-   - Créer un nouveau booking (important: APRÈS le redémarrage)
-   - Vérifier l'email reçu
-   - Tester Accept/Reject
-
-2. **Vérifier en production**:
-   - Mettre à jour la variable `BACKEND_URL` dans le .env production
-   - Redéployer le backend
-   - Tester le workflow complet
-
-3. **Documentation**:
-   - Mettre à jour le guide utilisateur
-   - Documenter le workflow transporteur
-
----
-
-**Correction effectuée le 5 décembre 2025 par Claude Code** ✅
-
-_Le système d'acceptation/rejet transporteur est maintenant 100% fonctionnel!_ 🚢✨

apps/backend/CSV_BOOKING_DIAGNOSTIC.md

@@ -1,282 +0,0 @@
-# 🔍 Diagnostic Complet - Workflow CSV Booking
-
-**Date**: 5 décembre 2025
-**Problème**: Le workflow d'envoi de demande de booking ne fonctionne pas
-
----
-
-## ✅ Vérifications Effectuées
-
-### 1. Backend ✅
-- ✅ Backend en cours d'exécution (port 4000)
-- ✅ Configuration SMTP corrigée (variables ajoutées au schéma Joi)
-- ✅ Email adapter initialisé correctement avec DNS bypass
-- ✅ Module CsvBookingsModule importé dans app.module.ts
-- ✅ Controller CsvBookingsController bien configuré
-- ✅ Service CsvBookingService bien configuré
-- ✅ MinIO container en cours d'exécution
-- ✅ Bucket 'xpeditis-documents' existe dans MinIO
-
-### 2. Frontend ✅
-- ✅ Page `/dashboard/booking/new` existe
-- ✅ Fonction `handleSubmit` bien configurée
-- ✅ FormData correctement construit avec tous les champs
-- ✅ Documents ajoutés avec le nom 'documents' (pluriel)
-- ✅ Appel API via `createCsvBooking()` qui utilise `upload()`
-- ✅ Gestion d'erreurs présente (affiche message si échec)
-
----
-
-## 🔍 Points de Défaillance Possibles
-
-### Scénario 1: Erreur Frontend (Browser Console)
-**Symptômes**: Le bouton "Envoyer la demande" ne fait rien, ou affiche un message d'erreur
-
-**Vérification**:
-1. Ouvrir les DevTools du navigateur (F12)
-2. Aller dans l'onglet Console
-3. Cliquer sur "Envoyer la demande"
-4. Regarder les erreurs affichées
-
-**Erreurs Possibles**:
-- `Failed to fetch` → Problème de connexion au backend
-- `401 Unauthorized` → Token JWT expiré
-- `400 Bad Request` → Données invalides
-- `500 Internal Server Error` → Erreur backend (voir logs)
-
----
-
-### Scénario 2: Erreur Backend (Logs)
-**Symptômes**: La requête arrive au backend mais échoue
-
-**Vérification**:
-```bash
-# Voir les logs backend en temps réel
-tail -f /tmp/backend-startup.log
-
-# Puis créer un booking via le frontend
-```
-
-**Erreurs Possibles**:
-- **Pas de logs `=== CSV Booking Request Debug ===`** → La requête n'arrive pas au controller
-- **`At least one document is required`** → Aucun fichier uploadé
-- **`User authentication failed`** → Problème de JWT
-- **`Organization ID is required`** → User sans organizationId
-- **Erreur S3/MinIO** → Upload de fichiers échoué
-- **Erreur Email** → Envoi email échoué (ne devrait plus arriver après le fix)
-
----
-
-### Scénario 3: Validation Échouée
-**Symptômes**: Erreur 400 Bad Request
-
-**Causes Possibles**:
-- **Port codes invalides** (origin/destination): Doivent être exactement 5 caractères (ex: NLRTM, USNYC)
-- **Email invalide** (carrierEmail): Doit être un email valide
-- **Champs numériques** (volumeCBM, weightKG, etc.): Doivent être > 0
-- **Currency invalide**: Doit être 'USD' ou 'EUR'
-- **Pas de documents**: Au moins 1 fichier requis
-
----
-
-### Scénario 4: CORS ou Network
-**Symptômes**: Erreur CORS ou network error
-
-**Vérification**:
-1. Ouvrir DevTools → Network tab
-2. Créer un booking
-3. Regarder la requête POST vers `/api/v1/csv-bookings`
-4. Vérifier:
-   - Status code (200/201 = OK, 4xx/5xx = erreur)
-   - Response body (message d'erreur)
-   - Request headers (Authorization token présent?)
-
-**Solutions**:
-- Backend et frontend doivent tourner simultanément
-- Frontend: `http://localhost:3000`
-- Backend: `http://localhost:4000`
-
----
-
-## 🧪 Tests à Effectuer
-
-### Test 1: Vérifier que le Backend Reçoit la Requête
-
-1. **Ouvrir un terminal et monitorer les logs**:
-   ```bash
-   tail -f /tmp/backend-startup.log | grep -i "csv\|booking\|error"
-   ```
-
-2. **Dans le navigateur**:
-   - Aller sur: http://localhost:3000/dashboard/booking/new?rateData=%7B%22companyName%22%3A%22Test%20Carrier%22%2C%22companyEmail%22%3A%22carrier%40test.com%22%2C%22origin%22%3A%22NLRTM%22%2C%22destination%22%3A%22USNYC%22%2C%22containerType%22%3A%22LCL%22%2C%22priceUSD%22%3A1000%2C%22priceEUR%22%3A900%2C%22primaryCurrency%22%3A%22USD%22%2C%22transitDays%22%3A22%7D&volumeCBM=2.88&weightKG=1500&palletCount=3
-   - Ajouter au moins 1 document
-   - Cliquer sur "Envoyer la demande"
-
-3. **Dans les logs, vous devriez voir**:
-   ```
-   === CSV Booking Request Debug ===
-   req.user: { id: '...', organizationId: '...' }
-   req.body: { carrierName: 'Test Carrier', ... }
-   files: 1
-   ================================
-   Creating CSV booking for user ...
-   Uploaded 1 documents for booking ...
-   CSV booking created with ID: ...
-   Email sent to carrier: carrier@test.com
-   Notification created for user ...
-   ```
-
-4. **Si vous NE voyez PAS ces logs** → La requête n'arrive pas au backend. Vérifier:
-   - Frontend connecté et JWT valide
-   - Backend en cours d'exécution
-   - Network tab du navigateur pour voir l'erreur exacte
-
----
-
-### Test 2: Vérifier le Browser Console
-
-1. **Ouvrir DevTools** (F12)
-2. **Aller dans Console**
-3. **Créer un booking**
-4. **Regarder les erreurs**:
-   - Si erreur affichée → noter le message exact
-   - Si aucune erreur → le problème est silencieux (voir Network tab)
-
----
-
-### Test 3: Vérifier Network Tab
-
-1. **Ouvrir DevTools** (F12)
-2. **Aller dans Network**
-3. **Créer un booking**
-4. **Trouver la requête** `POST /api/v1/csv-bookings`
-5. **Vérifier**:
-   - Status: Doit être 200 ou 201
-   - Request Payload: Tous les champs présents?
-   - Response: Message d'erreur?
-
----
-
-## 🔧 Solutions par Erreur
-
-### Erreur: "At least one document is required"
-**Cause**: Aucun fichier n'a été uploadé
-
-**Solution**:
-- Vérifier que vous avez bien sélectionné au moins 1 fichier
-- Vérifier que le fichier est dans les formats acceptés (PDF, DOC, DOCX, JPG, PNG)
-- Vérifier que le fichier fait moins de 5MB
-
----
-
-### Erreur: "User authentication failed"
-**Cause**: Token JWT invalide ou expiré
-
-**Solution**:
-1. Se déconnecter
-2. Se reconnecter
-3. Réessayer
-
----
-
-### Erreur: "Organization ID is required"
-**Cause**: L'utilisateur n'a pas d'organizationId
-
-**Solution**:
-1. Vérifier dans la base de données que l'utilisateur a bien un `organizationId`
-2. Si non, assigner une organization à l'utilisateur
-
----
-
-### Erreur: S3/MinIO Upload Failed
-**Cause**: Impossible d'uploader vers MinIO
-
-**Solution**:
-```bash
-# Vérifier que MinIO tourne
-docker ps | grep minio
-
-# Si non, le démarrer
-docker-compose up -d
-
-# Vérifier que le bucket existe
-cd apps/backend
-node setup-minio-bucket.js
-```
-
----
-
-### Erreur: Email Failed (ne devrait plus arriver)
-**Cause**: Envoi email échoué
-
-**Solution**:
-- Vérifier que les variables SMTP sont dans le schéma Joi (déjà corrigé ✅)
-- Tester l'envoi d'email: `node test-smtp-simple.js`
-
----
-
-## 📊 Checklist de Diagnostic
-
-Cocher au fur et à mesure:
-
-- [ ] Backend en cours d'exécution (port 4000)
-- [ ] Frontend en cours d'exécution (port 3000)
-- [ ] MinIO en cours d'exécution (port 9000)
-- [ ] Bucket 'xpeditis-documents' existe
-- [ ] Variables SMTP configurées
-- [ ] Email adapter initialisé (logs backend)
-- [ ] Utilisateur connecté au frontend
-- [ ] Token JWT valide (pas expiré)
-- [ ] Browser console sans erreurs
-- [ ] Network tab montre requête POST envoyée
-- [ ] Logs backend montrent "CSV Booking Request Debug"
-- [ ] Documents uploadés (au moins 1)
-- [ ] Port codes valides (5 caractères exactement)
-- [ ] Email transporteur valide
-
----
-
-## 🚀 Commandes Utiles
-
-```bash
-# Redémarrer backend
-cd apps/backend
-npm run dev
-
-# Vérifier logs backend
-tail -f /tmp/backend-startup.log | grep -i "csv\|booking\|error"
-
-# Tester email
-cd apps/backend
-node test-smtp-simple.js
-
-# Vérifier MinIO
-docker ps | grep minio
-node setup-minio-bucket.js
-
-# Voir tous les endpoints
-curl http://localhost:4000/api/docs
-```
-
----
-
-## 📝 Prochaines Étapes
-
-1. **Effectuer les tests** ci-dessus dans l'ordre
-2. **Noter l'erreur exacte** qui apparaît (console, network, logs)
-3. **Appliquer la solution** correspondante
-4. **Réessayer**
-
-Si après tous ces tests le problème persiste, partager:
-- Le message d'erreur exact (browser console)
-- Les logs backend au moment de l'erreur
-- Le status code HTTP de la requête (network tab)
-
----
-
-**Dernière mise à jour**: 5 décembre 2025
-**Statut**:
-- ✅ Email fix appliqué
-- ✅ MinIO bucket vérifié
-- ✅ Code analysé
-- ⏳ En attente de tests utilisateur

apps/backend/Dockerfile

@@ -14,7 +14,7 @@ COPY package*.json ./
 COPY tsconfig*.json ./
 
 # Install all dependencies (including dev for build)
-RUN npm ci --legacy-peer-deps
+RUN npm install --legacy-peer-deps
 
 # ===============================================
 # Stage 2: Build Application

apps/backend/EMAIL_CARRIER_FIX_COMPLETE.md

@@ -1,386 +0,0 @@
-# ✅ CORRECTION COMPLÈTE - Envoi d'Email aux Transporteurs
-
-**Date**: 5 décembre 2025
-**Statut**: ✅ **CORRIGÉ**
-
----
-
-## 🔍 Problème Identifié
-
-**Symptôme**: Les emails ne sont plus envoyés aux transporteurs lors de la création de bookings CSV.
-
-**Cause Racine**:
-Le fix DNS implémenté dans `EMAIL_FIX_SUMMARY.md` n'était **PAS appliqué** dans le code actuel de `email.adapter.ts`. Le code utilisait la configuration standard sans contournement DNS, ce qui causait des timeouts sur certains réseaux.
-
-```typescript
-// ❌ CODE PROBLÉMATIQUE (avant correction)
-this.transporter = nodemailer.createTransport({
-  host,  // ← utilisait directement 'sandbox.smtp.mailtrap.io' sans contournement DNS
-  port,
-  secure,
-  auth: { user, pass },
-});
-```
-
----
-
-## ✅ Solution Implémentée
-
-### 1. **Correction de `email.adapter.ts`** (Lignes 25-63)
-
-**Fichier modifié**: `src/infrastructure/email/email.adapter.ts`
-
-```typescript
-private initializeTransporter(): void {
-  const host = this.configService.get<string>('SMTP_HOST', 'localhost');
-  const port = this.configService.get<number>('SMTP_PORT', 2525);
-  const user = this.configService.get<string>('SMTP_USER');
-  const pass = this.configService.get<string>('SMTP_PASS');
-  const secure = this.configService.get<boolean>('SMTP_SECURE', false);
-
-  // 🔧 FIX: Contournement DNS pour Mailtrap
-  // Utilise automatiquement l'IP directe quand 'mailtrap.io' est détecté
-  const useDirectIP = host.includes('mailtrap.io');
-  const actualHost = useDirectIP ? '3.209.246.195' : host;
-  const serverName = useDirectIP ? 'smtp.mailtrap.io' : host; // Pour TLS
-
-  this.transporter = nodemailer.createTransport({
-    host: actualHost,  // ← Utilise IP directe pour Mailtrap
-    port,
-    secure,
-    auth: { user, pass },
-    tls: {
-      rejectUnauthorized: false,
-      servername: serverName, // ⚠️ CRITIQUE pour TLS avec IP directe
-    },
-    connectionTimeout: 10000,
-    greetingTimeout: 10000,
-    socketTimeout: 30000,
-    dnsTimeout: 10000,
-  });
-
-  this.logger.log(
-    `Email adapter initialized with SMTP host: ${host}:${port} (secure: ${secure})` +
-      (useDirectIP ? ` [Using direct IP: ${actualHost} with servername: ${serverName}]` : '')
-  );
-}
-```
-
-**Changements clés**:
-- ✅ Détection automatique de `mailtrap.io` dans le hostname
-- ✅ Utilisation de l'IP directe `3.209.246.195` au lieu du DNS
-- ✅ Configuration TLS avec `servername` pour validation du certificat
-- ✅ Timeouts optimisés (10s connection, 30s socket)
-- ✅ Logs détaillés pour debug
-
-### 2. **Vérification du comportement synchrone**
-
-**Fichier vérifié**: `src/application/services/csv-booking.service.ts` (Lignes 111-136)
-
-Le code utilise **déjà** le comportement synchrone correct avec `await`:
-
-```typescript
-// ✅ CODE CORRECT (comportement synchrone)
-try {
-  await this.emailAdapter.sendCsvBookingRequest(dto.carrierEmail, {
-    bookingId,
-    origin: dto.origin,
-    destination: dto.destination,
-    // ... autres données
-    confirmationToken,
-  });
-  this.logger.log(`Email sent to carrier: ${dto.carrierEmail}`);
-} catch (error: any) {
-  this.logger.error(`Failed to send email to carrier: ${error?.message}`, error?.stack);
-  // Continue even if email fails - booking is already saved
-}
-```
-
-**Important**: L'email est envoyé de manière **synchrone** - le bouton attend la confirmation d'envoi avant de répondre.
-
----
-
-## 🧪 Tests de Validation
-
-### Test 1: Script de Test Nodemailer
-
-Un script de test complet a été créé pour valider les 3 configurations :
-
-```bash
-cd apps/backend
-node test-carrier-email-fix.js
-```
-
-**Ce script teste**:
-1. ❌ **Test 1**: Configuration standard (peut échouer avec timeout DNS)
-2. ✅ **Test 2**: Configuration avec IP directe (doit réussir)
-3. ✅ **Test 3**: Email complet avec template HTML (doit réussir)
-
-**Résultat attendu**:
-```bash
-✅ Test 2 RÉUSSI - Configuration IP directe OK
-   Message ID: <unique-id>
-   Response: 250 2.0.0 Ok: queued
-
-✅ Test 3 RÉUSSI - Email complet avec template envoyé
-   Message ID: <unique-id>
-   Response: 250 2.0.0 Ok: queued
-```
-
-### Test 2: Redémarrage du Backend
-
-**IMPORTANT**: Le backend DOIT être redémarré pour appliquer les changements.
-
-```bash
-# 1. Tuer tous les processus backend
-lsof -ti:4000 | xargs -r kill -9
-
-# 2. Redémarrer proprement
-cd apps/backend
-npm run dev
-```
-
-**Logs attendus au démarrage**:
-```bash
-✅ Email adapter initialized with SMTP host: sandbox.smtp.mailtrap.io:2525 (secure: false) [Using direct IP: 3.209.246.195 with servername: smtp.mailtrap.io]
-```
-
-### Test 3: Test End-to-End avec API
-
-**Prérequis**:
-- Backend démarré
-- Frontend démarré (optionnel)
-- Compte Mailtrap configuré
-
-**Scénario de test**:
-
-1. **Créer un booking CSV** via API ou Frontend
-
-```bash
-# Via API (Postman/cURL)
-POST http://localhost:4000/api/v1/csv-bookings
-Authorization: Bearer <votre-token-jwt>
-Content-Type: multipart/form-data
-
-Données:
-- carrierName: "Test Carrier"
-- carrierEmail: "carrier@test.com"
-- origin: "FRPAR"
-- destination: "USNYC"
-- volumeCBM: 10
-- weightKG: 500
-- palletCount: 2
-- priceUSD: 1500
-- priceEUR: 1350
-- primaryCurrency: "USD"
-- transitDays: 15
-- containerType: "20FT"
-- notes: "Test booking"
-- files: [bill_of_lading.pdf, packing_list.pdf]
-```
-
-2. **Vérifier les logs backend**:
-
-```bash
-# Succès attendu
-✅ [CsvBookingService] Creating CSV booking for user <userId>
-✅ [CsvBookingService] Uploaded 2 documents for booking <bookingId>
-✅ [CsvBookingService] CSV booking created with ID: <bookingId>
-✅ [EmailAdapter] Email sent to carrier@test.com: Nouvelle demande de réservation - FRPAR → USNYC
-✅ [CsvBookingService] Email sent to carrier: carrier@test.com
-✅ [CsvBookingService] Notification created for user <userId>
-```
-
-3. **Vérifier Mailtrap Inbox**:
-   - Connexion: https://mailtrap.io/inboxes
-   - Rechercher: "Nouvelle demande de réservation - FRPAR → USNYC"
-   - Vérifier: Email avec template HTML complet, boutons Accepter/Refuser
-
----
-
-## 📊 Comparaison Avant/Après
-
-| Critère | ❌ Avant (Cassé) | ✅ Après (Corrigé) |
-|---------|------------------|-------------------|
-| **Envoi d'emails** | 0% (timeout DNS) | 100% (IP directe) |
-| **Temps de réponse API** | ~10s (timeout) | ~2s (normal) |
-| **Logs d'erreur** | `queryA ETIMEOUT` | Aucune erreur |
-| **Configuration requise** | DNS fonctionnel | Fonctionne partout |
-| **Messages reçus** | Aucun | Tous les emails |
-
----
-
-## 🔧 Configuration Environnement
-
-### Développement (`.env` actuel)
-
-```bash
-SMTP_HOST=sandbox.smtp.mailtrap.io  # ← Détecté automatiquement
-SMTP_PORT=2525
-SMTP_SECURE=false
-SMTP_USER=2597bd31d265eb
-SMTP_PASS=cd126234193c89
-SMTP_FROM=noreply@xpeditis.com
-```
-
-**Note**: Le code détecte automatiquement `mailtrap.io` et utilise l'IP directe.
-
-### Production (Recommandations)
-
-#### Option 1: Mailtrap Production
-
-```bash
-SMTP_HOST=smtp.mailtrap.io  # ← Le code utilisera l'IP directe automatiquement
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=<votre-user-production>
-SMTP_PASS=<votre-pass-production>
-```
-
-#### Option 2: SendGrid
-
-```bash
-SMTP_HOST=smtp.sendgrid.net  # ← Pas de contournement DNS nécessaire
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=apikey
-SMTP_PASS=<votre-clé-API-SendGrid>
-```
-
-#### Option 3: AWS SES
-
-```bash
-SMTP_HOST=email-smtp.us-east-1.amazonaws.com
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=<votre-access-key-id>
-SMTP_PASS=<votre-secret-access-key>
-```
-
----
-
-## 🐛 Dépannage
-
-### Problème 1: "Email sent" dans les logs mais rien dans Mailtrap
-
-**Cause**: Credentials incorrects ou mauvaise inbox
-**Solution**:
-1. Vérifier `SMTP_USER` et `SMTP_PASS` dans `.env`
-2. Régénérer les credentials sur https://mailtrap.io
-3. Vérifier la bonne inbox (Development, Staging, Production)
-
-### Problème 2: "queryA ETIMEOUT" persiste après correction
-
-**Cause**: Backend pas redémarré ou code pas compilé
-**Solution**:
-```bash
-# Tuer tous les backends
-lsof -ti:4000 | xargs -r kill -9
-
-# Nettoyer et redémarrer
-cd apps/backend
-rm -rf dist/
-npm run build
-npm run dev
-```
-
-### Problème 3: "EAUTH" authentication failed
-
-**Cause**: Credentials Mailtrap invalides ou expirés
-**Solution**:
-1. Se connecter à https://mailtrap.io
-2. Aller dans Email Testing > Inboxes > <votre-inbox>
-3. Copier les nouveaux credentials (SMTP Settings)
-4. Mettre à jour `.env` et redémarrer
-
-### Problème 4: Email reçu mais template cassé
-
-**Cause**: Template HTML mal formaté ou variables manquantes
-**Solution**:
-1. Vérifier les logs pour les données envoyées
-2. Vérifier que toutes les variables sont présentes dans `bookingData`
-3. Tester le template avec `test-carrier-email-fix.js`
-
----
-
-## ✅ Checklist de Validation Finale
-
-Avant de déclarer le problème résolu, vérifier:
-
-- [x] `email.adapter.ts` corrigé avec contournement DNS
-- [x] Script de test `test-carrier-email-fix.js` créé
-- [x] Configuration `.env` vérifiée (SMTP_HOST, USER, PASS)
-- [ ] Backend redémarré avec logs confirmant IP directe
-- [ ] Test nodemailer réussi (Test 2 et 3)
-- [ ] Test end-to-end: création de booking CSV
-- [ ] Email reçu dans Mailtrap inbox
-- [ ] Template HTML complet et boutons fonctionnels
-- [ ] Logs backend sans erreur `ETIMEOUT`
-- [ ] Notification créée pour l'utilisateur
-
----
-
-## 📝 Fichiers Modifiés
-
-| Fichier | Lignes | Description |
-|---------|--------|-------------|
-| `src/infrastructure/email/email.adapter.ts` | 25-63 | ✅ Contournement DNS avec IP directe |
-| `test-carrier-email-fix.js` | 1-285 | 🧪 Script de test email (nouveau) |
-| `EMAIL_CARRIER_FIX_COMPLETE.md` | 1-xxx | 📄 Documentation correction (ce fichier) |
-
-**Fichiers vérifiés** (code correct):
-- ✅ `src/application/services/csv-booking.service.ts` (comportement synchrone avec `await`)
-- ✅ `src/infrastructure/email/templates/email-templates.ts` (template `renderCsvBookingRequest` existe)
-- ✅ `src/infrastructure/email/email.module.ts` (module correctement configuré)
-- ✅ `src/domain/ports/out/email.port.ts` (méthode `sendCsvBookingRequest` définie)
-
----
-
-## 🎉 Résultat Final
-
-### ✅ Problème RÉSOLU à 100%
-
-**Ce qui fonctionne maintenant**:
-1. ✅ Emails aux transporteurs envoyés sans timeout DNS
-2. ✅ Template HTML complet avec boutons Accepter/Refuser
-3. ✅ Logs détaillés pour debugging
-4. ✅ Configuration robuste (fonctionne même si DNS lent)
-5. ✅ Compatible avec n'importe quel fournisseur SMTP
-6. ✅ Notifications utilisateur créées
-7. ✅ Comportement synchrone (le bouton attend l'email)
-
-**Performance**:
-- Temps d'envoi: **< 2s** (au lieu de 10s timeout)
-- Taux de succès: **100%** (au lieu de 0%)
-- Compatibilité: **Tous réseaux** (même avec DNS lent)
-
----
-
-## 🚀 Prochaines Étapes
-
-1. **Tester immédiatement**:
-   ```bash
-   # 1. Test nodemailer
-   node apps/backend/test-carrier-email-fix.js
-
-   # 2. Redémarrer backend
-   lsof -ti:4000 | xargs -r kill -9
-   cd apps/backend && npm run dev
-
-   # 3. Créer un booking CSV via frontend ou API
-   ```
-
-2. **Vérifier Mailtrap**: https://mailtrap.io/inboxes
-
-3. **Si tout fonctionne**: ✅ Fermer le ticket
-
-4. **Si problème persiste**:
-   - Copier les logs complets
-   - Exécuter `test-carrier-email-fix.js` et copier la sortie
-   - Partager pour debug supplémentaire
-
----
-
-**Prêt pour la production** 🚢✨
-
-_Correction effectuée le 5 décembre 2025 par Claude Code_

apps/backend/EMAIL_FIX_FINAL.md

@@ -1,275 +0,0 @@
-# ✅ EMAIL FIX COMPLETE - ROOT CAUSE RESOLVED
-
-**Date**: 5 décembre 2025
-**Statut**: ✅ **RÉSOLU ET TESTÉ**
-
----
-
-## 🎯 ROOT CAUSE IDENTIFIÉE
-
-**Problème**: Les emails aux transporteurs ne s'envoyaient plus après l'implémentation du Carrier Portal.
-
-**Cause Racine**: Les variables d'environnement SMTP n'étaient **PAS déclarées** dans le schéma de validation Joi de ConfigModule (`app.module.ts`).
-
-### Pourquoi c'était cassé?
-
-NestJS ConfigModule avec un `validationSchema` Joi **supprime automatiquement** toutes les variables d'environnement qui ne sont pas explicitement déclarées dans le schéma. Le schéma original (lignes 36-50 de `app.module.ts`) ne contenait que:
-
-```typescript
-validationSchema: Joi.object({
-  NODE_ENV: Joi.string()...
-  PORT: Joi.number()...
-  DATABASE_HOST: Joi.string()...
-  REDIS_HOST: Joi.string()...
-  JWT_SECRET: Joi.string()...
-  // ❌ AUCUNE VARIABLE SMTP DÉCLARÉE!
-})
-```
-
-Résultat:
-- `SMTP_HOST` → undefined
-- `SMTP_PORT` → undefined
-- `SMTP_USER` → undefined
-- `SMTP_PASS` → undefined
-- `SMTP_FROM` → undefined
-- `SMTP_SECURE` → undefined
-
-L'email adapter tentait alors de se connecter à `localhost:2525` au lieu de Mailtrap, causant des erreurs `ECONNREFUSED`.
-
----
-
-## ✅ SOLUTION IMPLÉMENTÉE
-
-### 1. Ajout des variables SMTP au schéma de validation
-
-**Fichier modifié**: `apps/backend/src/app.module.ts` (lignes 50-56)
-
-```typescript
-ConfigModule.forRoot({
-  isGlobal: true,
-  validationSchema: Joi.object({
-    // ... variables existantes ...
-
-    // ✅ NOUVEAU: SMTP Configuration
-    SMTP_HOST: Joi.string().required(),
-    SMTP_PORT: Joi.number().default(2525),
-    SMTP_USER: Joi.string().required(),
-    SMTP_PASS: Joi.string().required(),
-    SMTP_FROM: Joi.string().email().default('noreply@xpeditis.com'),
-    SMTP_SECURE: Joi.boolean().default(false),
-  }),
-}),
-```
-
-**Changements**:
-- ✅ Ajout de 6 variables SMTP au schéma Joi
-- ✅ `SMTP_HOST`, `SMTP_USER`, `SMTP_PASS` requis
-- ✅ `SMTP_PORT` avec default 2525
-- ✅ `SMTP_FROM` avec validation email
-- ✅ `SMTP_SECURE` avec default false
-
-### 2. DNS Fix (Déjà présent)
-
-Le DNS fix dans `email.adapter.ts` (lignes 42-45) était déjà correct depuis la correction précédente:
-
-```typescript
-const useDirectIP = host.includes('mailtrap.io');
-const actualHost = useDirectIP ? '3.209.246.195' : host;
-const serverName = useDirectIP ? 'smtp.mailtrap.io' : host;
-```
-
----
-
-## 🧪 TESTS DE VALIDATION
-
-### Test 1: Backend Logs ✅
-
-```bash
-[2025-12-05 13:24:59.567] INFO: Email adapter initialized with SMTP host: sandbox.smtp.mailtrap.io:2525 (secure: false) [Using direct IP: 3.209.246.195 with servername: smtp.mailtrap.io]
-```
-
-**Vérification**:
-- ✅ Host: sandbox.smtp.mailtrap.io:2525
-- ✅ Using direct IP: 3.209.246.195
-- ✅ Servername: smtp.mailtrap.io
-- ✅ Secure: false
-
-### Test 2: SMTP Simple Test ✅
-
-```bash
-$ node test-smtp-simple.js
-
-Configuration:
-  SMTP_HOST: sandbox.smtp.mailtrap.io ✅
-  SMTP_PORT: 2525 ✅
-  SMTP_USER: 2597bd31d265eb ✅
-  SMTP_PASS: *** ✅
-
-Test 1: Vérification de la connexion...
-✅ Connexion SMTP OK
-
-Test 2: Envoi d'un email...
-✅ Email envoyé avec succès!
-   Message ID: <f21d412a-3739-b5c9-62cc-b00db514d9db@xpeditis.com>
-   Response: 250 2.0.0 Ok: queued
-
-✅ TOUS LES TESTS RÉUSSIS - Le SMTP fonctionne!
-```
-
-### Test 3: Email Flow Complet ✅
-
-```bash
-$ node debug-email-flow.js
-
-📊 RÉSUMÉ DES TESTS:
-Connexion SMTP: ✅ OK
-Email simple: ✅ OK
-Email transporteur: ✅ OK
-
-✅ TOUS LES TESTS ONT RÉUSSI!
-   Le système d'envoi d'email fonctionne correctement.
-```
-
----
-
-## 📊 Avant/Après
-
-| Critère | ❌ Avant | ✅ Après |
-|---------|----------|----------|
-| **Variables SMTP** | undefined | Chargées correctement |
-| **Connexion SMTP** | ECONNREFUSED ::1:2525 | Connecté à 3.209.246.195:2525 |
-| **Envoi email** | 0% (échec) | 100% (succès) |
-| **Backend logs** | Pas d'init SMTP | "Email adapter initialized" |
-| **Test scripts** | Tous échouent | Tous réussissent |
-
----
-
-## 🚀 VÉRIFICATION END-TO-END
-
-Le backend est déjà démarré et fonctionnel. Pour tester le flux complet de création de booking avec envoi d'email:
-
-### Option 1: Via l'interface web
-
-1. Ouvrir http://localhost:3000
-2. Se connecter
-3. Créer un CSV booking avec l'email d'un transporteur
-4. Vérifier les logs backend:
-   ```
-   ✅ [CsvBookingService] Email sent to carrier: carrier@example.com
-   ```
-5. Vérifier Mailtrap: https://mailtrap.io/inboxes
-
-### Option 2: Via API (cURL/Postman)
-
-```bash
-POST http://localhost:4000/api/v1/csv-bookings
-Authorization: Bearer <your-jwt-token>
-Content-Type: multipart/form-data
-
-{
-  "carrierName": "Test Carrier",
-  "carrierEmail": "carrier@test.com",
-  "origin": "FRPAR",
-  "destination": "USNYC",
-  "volumeCBM": 10,
-  "weightKG": 500,
-  "palletCount": 2,
-  "priceUSD": 1500,
-  "primaryCurrency": "USD",
-  "transitDays": 15,
-  "containerType": "20FT",
-  "files": [attachment]
-}
-```
-
-**Logs attendus**:
-```
-✅ [CsvBookingService] Creating CSV booking for user <userId>
-✅ [CsvBookingService] Uploaded 2 documents for booking <bookingId>
-✅ [CsvBookingService] CSV booking created with ID: <bookingId>
-✅ [EmailAdapter] Email sent to carrier@test.com
-✅ [CsvBookingService] Email sent to carrier: carrier@test.com
-```
-
----
-
-## 📝 Fichiers Modifiés
-
-| Fichier | Lignes | Changement |
-|---------|--------|------------|
-| `apps/backend/src/app.module.ts` | 50-56 | ✅ Ajout variables SMTP au schéma Joi |
-| `apps/backend/src/infrastructure/email/email.adapter.ts` | 42-65 | ✅ DNS fix (déjà présent) |
-
----
-
-## 🎉 RÉSULTAT FINAL
-
-### ✅ Problème RÉSOLU à 100%
-
-**Ce qui fonctionne**:
-1. ✅ Variables SMTP chargées depuis `.env`
-2. ✅ Email adapter s'initialise correctement
-3. ✅ Connexion SMTP avec DNS bypass (IP directe)
-4. ✅ Envoi d'emails simples réussi
-5. ✅ Envoi d'emails avec template HTML réussi
-6. ✅ Backend démarre sans erreur
-7. ✅ Tous les tests passent
-
-**Performance**:
-- Temps d'envoi: **< 2s**
-- Taux de succès: **100%**
-- Compatibilité: **Tous réseaux**
-
----
-
-## 🔧 Commandes Utiles
-
-### Vérifier le backend
-
-```bash
-# Voir les logs en temps réel
-tail -f /tmp/backend-startup.log
-
-# Vérifier que le backend tourne
-lsof -i:4000
-
-# Redémarrer le backend
-lsof -ti:4000 | xargs -r kill -9
-cd apps/backend && npm run dev
-```
-
-### Tester l'envoi d'emails
-
-```bash
-# Test SMTP simple
-cd apps/backend
-node test-smtp-simple.js
-
-# Test complet avec template
-node debug-email-flow.js
-```
-
----
-
-## ✅ Checklist de Validation
-
-- [x] ConfigModule validation schema updated
-- [x] SMTP variables added to Joi schema
-- [x] Backend redémarré avec succès
-- [x] Backend logs show "Email adapter initialized"
-- [x] Test SMTP simple réussi
-- [x] Test email flow complet réussi
-- [x] Environment variables loading correctly
-- [x] DNS bypass actif (direct IP)
-- [ ] Test end-to-end via création de booking (à faire par l'utilisateur)
-- [ ] Email reçu dans Mailtrap (à vérifier par l'utilisateur)
-
----
-
-**Prêt pour la production** 🚢✨
-
-_Correction effectuée le 5 décembre 2025 par Claude Code_
-
-**Backend Status**: ✅ Running on port 4000
-**Email System**: ✅ Fully functional
-**Next Step**: Create a CSV booking to test the complete workflow

apps/backend/EMAIL_FIX_SUMMARY.md

@@ -1,295 +0,0 @@
-# 📧 Résolution Complète du Problème d'Envoi d'Emails
-
-## 🔍 Problème Identifié
-
-**Symptôme**: Les emails n'étaient plus envoyés aux transporteurs lors de la création de réservations CSV.
-
-**Cause Racine**: Changement du comportement d'envoi d'email de SYNCHRONE à ASYNCHRONE
-- Le code original utilisait `await` pour attendre l'envoi de l'email avant de répondre
-- J'ai tenté d'optimiser avec `setImmediate()` et `void` operator (fire-and-forget)
-- **ERREUR**: L'utilisateur VOULAIT le comportement synchrone où le bouton attend la confirmation d'envoi
-- Les emails n'étaient plus envoyés car le contexte d'exécution était perdu avec les appels asynchrones
-
-## ✅ Solution Implémentée
-
-### **Restauration du comportement SYNCHRONE** ✨ SOLUTION FINALE
-**Fichiers modifiés**:
-- `src/application/services/csv-booking.service.ts` (lignes 111-136)
-- `src/application/services/carrier-auth.service.ts` (lignes 110-117, 287-294)
-- `src/infrastructure/email/email.adapter.ts` (configuration simplifiée)
-
-```typescript
-// Utilise automatiquement l'IP 3.209.246.195 quand 'mailtrap.io' est détecté
-const useDirectIP = host.includes('mailtrap.io');
-const actualHost = useDirectIP ? '3.209.246.195' : host;
-const serverName = useDirectIP ? 'smtp.mailtrap.io' : host; // Pour TLS
-
-// Configuration avec IP directe + servername pour TLS
-this.transporter = nodemailer.createTransport({
-  host: actualHost,
-  port,
-  secure: false,
-  auth: { user, pass },
-  tls: {
-    rejectUnauthorized: false,
-    servername: serverName, // ⚠️ CRITIQUE pour TLS
-  },
-  connectionTimeout: 10000,
-  greetingTimeout: 10000,
-  socketTimeout: 30000,
-  dnsTimeout: 10000,
-});
-```
-
-**Résultat**: ✅ Test réussi - Email envoyé avec succès (Message ID: `576597e7-1a81-165d-2a46-d97c57d21daa`)
-
----
-
-### 2. **Remplacement de `setImmediate()` par `void` operator**
-**Fichiers Modifiés**:
-- `src/application/services/csv-booking.service.ts` (ligne 114)
-- `src/application/services/carrier-auth.service.ts` (lignes 112, 290)
-
-**Avant** (bloquant):
-```typescript
-setImmediate(() => {
-  this.emailAdapter.sendCsvBookingRequest(...)
-    .then(() => { ... })
-    .catch(() => { ... });
-});
-```
-
-**Après** (non-bloquant mais avec contexte):
-```typescript
-void this.emailAdapter.sendCsvBookingRequest(...)
-  .then(() => {
-    this.logger.log(`Email sent to carrier: ${dto.carrierEmail}`);
-  })
-  .catch((error: any) => {
-    this.logger.error(`Failed to send email to carrier: ${error?.message}`, error?.stack);
-  });
-```
-
-**Bénéfices**:
-- ✅ Réponse API ~50% plus rapide (pas d'attente d'envoi)
-- ✅ Logs des erreurs d'envoi préservés
-- ✅ Contexte NestJS maintenu (pas de perte de dépendances)
-
----
-
-### 3. **Configuration `.env` Mise à Jour**
-**Fichier**: `.env`
-
-```bash
-# Email (SMTP)
-# Using smtp.mailtrap.io instead of sandbox.smtp.mailtrap.io to avoid DNS timeout
-SMTP_HOST=smtp.mailtrap.io  # ← Changé
-SMTP_PORT=2525
-SMTP_SECURE=false
-SMTP_USER=2597bd31d265eb
-SMTP_PASS=cd126234193c89
-SMTP_FROM=noreply@xpeditis.com
-```
-
----
-
-### 4. **Ajout des Méthodes d'Email Transporteur**
-**Fichier**: `src/domain/ports/out/email.port.ts`
-
-Ajout de 2 nouvelles méthodes à l'interface:
-- `sendCarrierAccountCreated()` - Email de création de compte avec mot de passe temporaire
-- `sendCarrierPasswordReset()` - Email de réinitialisation de mot de passe
-
-**Implémentation**: `src/infrastructure/email/email.adapter.ts` (lignes 269-413)
-- Templates HTML en français
-- Boutons d'action stylisés
-- Warnings de sécurité
-- Instructions de connexion
-
----
-
-## 📋 Fichiers Modifiés (Récapitulatif)
-
-| Fichier | Lignes | Description |
-|---------|--------|-------------|
-| `infrastructure/email/email.adapter.ts` | 25-63 | ✨ Contournement DNS avec IP directe |
-| `infrastructure/email/email.adapter.ts` | 269-413 | Méthodes emails transporteur |
-| `application/services/csv-booking.service.ts` | 114-137 | `void` operator pour emails async |
-| `application/services/carrier-auth.service.ts` | 112-118 | `void` operator (création compte) |
-| `application/services/carrier-auth.service.ts` | 290-296 | `void` operator (reset password) |
-| `domain/ports/out/email.port.ts` | 107-123 | Interface méthodes transporteur |
-| `.env` | 42 | Changement SMTP_HOST |
-
----
-
-## 🧪 Tests de Validation
-
-### Test 1: Backend Redémarré avec Succès ✅ **RÉUSSI**
-```bash
-# Tuer tous les processus sur port 4000
-lsof -ti:4000 | xargs kill -9
-
-# Démarrer le backend proprement
-npm run dev
-```
-
-**Résultat**:
-```
-✅ Email adapter initialized with SMTP host: sandbox.smtp.mailtrap.io:2525 (secure: false)
-✅ Nest application successfully started
-✅ Connected to Redis at localhost:6379
-🚢 Xpeditis API Server Running on http://localhost:4000
-```
-
-### Test 2: Test d'Envoi d'Email (À faire par l'utilisateur)
-1. ✅ Backend démarré avec configuration correcte
-2. Créer une réservation CSV avec transporteur via API
-3. Vérifier les logs pour: `Email sent to carrier: [email]`
-4. Vérifier Mailtrap inbox: https://mailtrap.io/inboxes
-
----
-
-## 🎯 Comment Tester en Production
-
-### Étape 1: Créer une Réservation CSV
-```bash
-POST http://localhost:4000/api/v1/csv-bookings
-Content-Type: multipart/form-data
-
-{
-  "carrierName": "Test Carrier",
-  "carrierEmail": "test@example.com",
-  "origin": "FRPAR",
-  "destination": "USNYC",
-  "volumeCBM": 10,
-  "weightKG": 500,
-  "palletCount": 2,
-  "priceUSD": 1500,
-  "priceEUR": 1300,
-  "primaryCurrency": "USD",
-  "transitDays": 15,
-  "containerType": "20FT",
-  "notes": "Test booking"
-}
-```
-
-### Étape 2: Vérifier les Logs
-Rechercher dans les logs backend:
-```bash
-# Succès
-✅ "Email sent to carrier: test@example.com"
-✅ "CSV booking request sent to test@example.com for booking <ID>"
-
-# Échec (ne devrait plus arriver)
-❌ "Failed to send email to carrier: queryA ETIMEOUT"
-```
-
-### Étape 3: Vérifier Mailtrap
-1. Connexion: https://mailtrap.io
-2. Inbox: "Xpeditis Development"
-3. Email: "Nouvelle demande de réservation - FRPAR → USNYC"
-
----
-
-## 📊 Performance
-
-### Avant (Problème)
-- ❌ Emails: **0% envoyés** (timeout DNS)
-- ⏱️ Temps réponse API: ~500ms + timeout (10s)
-- ❌ Logs: Erreurs `queryA ETIMEOUT`
-
-### Après (Corrigé)
-- ✅ Emails: **100% envoyés** (IP directe)
-- ⏱️ Temps réponse API: ~200-300ms (async fire-and-forget)
-- ✅ Logs: `Email sent to carrier:`
-- 📧 Latence email: <2s (Mailtrap)
-
----
-
-## 🔧 Configuration Production
-
-Pour le déploiement production, mettre à jour `.env`:
-
-```bash
-# Option 1: Utiliser smtp.mailtrap.io (IP auto)
-SMTP_HOST=smtp.mailtrap.io
-SMTP_PORT=2525
-SMTP_SECURE=false
-
-# Option 2: Autre fournisseur SMTP (ex: SendGrid)
-SMTP_HOST=smtp.sendgrid.net
-SMTP_PORT=587
-SMTP_SECURE=false
-SMTP_USER=apikey
-SMTP_PASS=<votre-clé-API-SendGrid>
-```
-
-**Note**: Le code détecte automatiquement `mailtrap.io` et utilise l'IP. Pour d'autres fournisseurs, le DNS standard sera utilisé.
-
----
-
-## 🐛 Dépannage
-
-### Problème: "Email sent" dans les logs mais rien dans Mailtrap
-**Cause**: Mauvais credentials ou inbox
-**Solution**: Vérifier `SMTP_USER` et `SMTP_PASS` dans `.env`
-
-### Problème: "queryA ETIMEOUT" persiste
-**Cause**: Backend pas redémarré ou code pas compilé
-**Solution**:
-```bash
-# 1. Tuer tous les backends
-lsof -ti:4000 | xargs kill -9
-
-# 2. Redémarrer proprement
-cd apps/backend
-npm run dev
-```
-
-### Problème: "EAUTH" authentication failed
-**Cause**: Credentials Mailtrap invalides
-**Solution**: Régénérer les credentials sur https://mailtrap.io
-
----
-
-## ✅ Checklist de Validation
-
-- [x] Méthodes `sendCarrierAccountCreated` et `sendCarrierPasswordReset` implémentées
-- [x] Comportement SYNCHRONE restauré avec `await` (au lieu de setImmediate/void)
-- [x] Configuration SMTP simplifiée (pas de contournement DNS nécessaire)
-- [x] `.env` mis à jour avec `sandbox.smtp.mailtrap.io`
-- [x] Backend redémarré proprement
-- [x] Email adapter initialisé avec bonne configuration
-- [x] Server écoute sur port 4000
-- [x] Redis connecté
-- [ ] Test end-to-end avec création CSV booking ← **À TESTER PAR L'UTILISATEUR**
-- [ ] Email reçu dans Mailtrap inbox ← **À VALIDER PAR L'UTILISATEUR**
-
----
-
-## 📝 Notes Techniques
-
-### Pourquoi l'IP Directe Fonctionne ?
-Node.js utilise `dns.resolve()` qui peut timeout même si le système DNS fonctionne. En utilisant l'IP directe, on contourne complètement la résolution DNS.
-
-### Pourquoi `servername` dans TLS ?
-Quand on utilise une IP directe, TLS ne peut pas vérifier le certificat sans le `servername`. On spécifie donc `smtp.mailtrap.io` manuellement.
-
-### Alternative (Non Implémentée)
-Configurer Node.js pour utiliser Google DNS:
-```javascript
-const dns = require('dns');
-dns.setServers(['8.8.8.8', '8.8.4.4']);
-```
-
----
-
-## 🎉 Résultat Final
-
-✅ **Problème résolu à 100%**
-- Emails aux transporteurs fonctionnent
-- Performance améliorée (~50% plus rapide)
-- Logs clairs et précis
-- Code robuste avec gestion d'erreurs
-
-**Prêt pour la production** 🚀

apps/backend/MINIO_SETUP_SUMMARY.md

@@ -1,171 +0,0 @@
-# MinIO Document Storage Setup Summary
-
-## Problem
-Documents uploaded to MinIO were returning `AccessDenied` errors when users tried to download them from the admin documents page.
-
-## Root Cause
-The `xpeditis-documents` bucket did not have a public read policy configured, which prevented direct URL access to uploaded documents.
-
-## Solution Implemented
-
-### 1. Fixed Dummy URLs in Database
-**Script**: `fix-dummy-urls.js`
-- Updated 2 bookings that had dummy URLs (`https://dummy-storage.com/...`)
-- Changed to proper MinIO URLs: `http://localhost:9000/xpeditis-documents/csv-bookings/{bookingId}/{documentId}-{fileName}`
-
-### 2. Uploaded Test Documents
-**Script**: `upload-test-documents.js`
-- Created 54 test PDF documents
-- Uploaded to MinIO with proper paths matching database records
-- Files are minimal valid PDFs for testing purposes
-
-### 3. Set Bucket Policy for Public Read Access
-**Script**: `set-bucket-policy.js`
-- Configured the `xpeditis-documents` bucket with a policy allowing public read access
-- Policy applied:
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": "*",
-      "Action": ["s3:GetObject"],
-      "Resource": ["arn:aws:s3:::xpeditis-documents/*"]
-    }
-  ]
-}
-```
-
-## Verification
-
-### Test Document Download
-```bash
-# Test with curl (should return HTTP 200 OK)
-curl -I http://localhost:9000/xpeditis-documents/csv-bookings/70f6802a-f789-4f61-ab35-5e0ebf0e29d5/eba1c60f-c749-4b39-8e26-dcc617964237-Document_Export.pdf
-
-# Download actual file
-curl -o test.pdf http://localhost:9000/xpeditis-documents/csv-bookings/70f6802a-f789-4f61-ab35-5e0ebf0e29d5/eba1c60f-c749-4b39-8e26-dcc617964237-Document_Export.pdf
-```
-
-### Frontend Verification
-1. Navigate to: http://localhost:3000/dashboard/admin/documents
-2. Click the "Download" button on any document
-3. Document should download successfully without errors
-
-## MinIO Console Access
-- **URL**: http://localhost:9001
-- **Username**: minioadmin
-- **Password**: minioadmin
-
-You can view the bucket policy and uploaded files directly in the MinIO console.
-
-## Files Created
-- `apps/backend/fix-dummy-urls.js` - Updates database URLs from dummy to MinIO
-- `apps/backend/upload-test-documents.js` - Uploads test PDFs to MinIO
-- `apps/backend/set-bucket-policy.js` - Configures bucket policy for public read
-
-## Running the Scripts
-```bash
-cd apps/backend
-
-# 1. Fix database URLs (run once)
-node fix-dummy-urls.js
-
-# 2. Upload test documents (run once)
-node upload-test-documents.js
-
-# 3. Set bucket policy (run once)
-node set-bucket-policy.js
-```
-
-## Important Notes
-
-### Development vs Production
-- **Current Setup**: Public read access (suitable for development)
-- **Production**: Consider using signed URLs for better security
-
-### Signed URLs (Production Recommendation)
-Instead of public bucket access, generate temporary signed URLs via the backend:
-
-```typescript
-// Backend endpoint to generate signed URL
-@Get('documents/:id/download-url')
-async getDownloadUrl(@Param('id') documentId: string) {
-  const document = await this.documentsService.findOne(documentId);
-  const signedUrl = await this.storageService.getSignedUrl(document.filePath);
-  return { url: signedUrl };
-}
-```
-
-This approach:
-- ✅ More secure (temporary URLs that expire)
-- ✅ Allows access control (check user permissions before generating URL)
-- ✅ Audit trail (log who accessed what)
-- ❌ Requires backend API call for each download
-
-### Current Architecture
-The `S3StorageAdapter` already has a `getSignedUrl()` method implemented (line 148-162 in `s3-storage.adapter.ts`), so migrating to signed URLs in the future is straightforward.
-
-## Troubleshooting
-
-### AccessDenied Error Returns
-If you get AccessDenied errors again:
-1. Check bucket policy: `node -e "const {S3Client,GetBucketPolicyCommand}=require('@aws-sdk/client-s3');const s3=new S3Client({endpoint:'http://localhost:9000',region:'us-east-1',credentials:{accessKeyId:'minioadmin',secretAccessKey:'minioadmin'},forcePathStyle:true});s3.send(new GetBucketPolicyCommand({Bucket:'xpeditis-documents'})).then(r=>console.log(r.Policy))"`
-2. Re-run: `node set-bucket-policy.js`
-
-### Document Not Found
-If document URLs return 404:
-1. Check MinIO console (http://localhost:9001)
-2. Verify file exists in bucket
-3. Check database URL matches MinIO path exactly
-
-### Documents Not Showing in Admin Page
-1. Verify bookings exist: `SELECT id, documents FROM csv_bookings WHERE documents IS NOT NULL`
-2. Check frontend console for errors
-3. Verify API endpoint returns data: http://localhost:4000/api/v1/admin/bookings
-
-## Database Query Examples
-
-### Check Document URLs
-```sql
-SELECT
-  id,
-  booking_id as "bookingId",
-  documents::jsonb->0->>'filePath' as "firstDocumentUrl"
-FROM csv_bookings
-WHERE documents IS NOT NULL
-LIMIT 5;
-```
-
-### Count Documents by Booking
-```sql
-SELECT
-  id,
-  jsonb_array_length(documents::jsonb) as "documentCount"
-FROM csv_bookings
-WHERE documents IS NOT NULL;
-```
-
-## Next Steps (Optional Production Enhancements)
-
-1. **Implement Signed URLs**
-   - Create backend endpoint for signed URL generation
-   - Update frontend to fetch signed URL before download
-   - Remove public bucket policy
-
-2. **Add Document Permissions**
-   - Check user permissions before generating download URL
-   - Restrict access based on organization membership
-
-3. **Implement Audit Trail**
-   - Log document access events
-   - Track who downloaded what and when
-
-4. **Add Document Scanning**
-   - Virus scanning on upload (ClamAV)
-   - Content validation
-   - File size limits enforcement
-
-## Status
-✅ **FIXED** - Documents can now be downloaded from the admin documents page without AccessDenied errors.

apps/backend/create-test-booking.js

@@ -1,114 +0,0 @@
-/**
- * Script pour créer un booking de test avec statut PENDING
- * Usage: node create-test-booking.js
- */
-
-const { Client } = require('pg');
-const { v4: uuidv4 } = require('uuid');
-
-async function createTestBooking() {
-  const client = new Client({
-    host: process.env.DATABASE_HOST || 'localhost',
-    port: parseInt(process.env.DATABASE_PORT || '5432'),
-    database: process.env.DATABASE_NAME || 'xpeditis_dev',
-    user: process.env.DATABASE_USER || 'xpeditis',
-    password: process.env.DATABASE_PASSWORD || 'xpeditis_dev_password',
-  });
-
-  try {
-    await client.connect();
-    console.log('✅ Connecté à la base de données');
-
-    const bookingId = uuidv4();
-    const confirmationToken = uuidv4();
-    const userId = '8cf7d5b3-d94f-44aa-bb5a-080002919dd1'; // User demo@xpeditis.com
-    const organizationId = '199fafa9-d26f-4cf9-9206-73432baa8f63';
-
-    // Create dummy documents in JSONB format
-    const dummyDocuments = JSON.stringify([
-      {
-        id: uuidv4(),
-        type: 'BILL_OF_LADING',
-        fileName: 'bill-of-lading.pdf',
-        filePath: 'https://dummy-storage.com/documents/bill-of-lading.pdf',
-        mimeType: 'application/pdf',
-        size: 102400, // 100KB
-        uploadedAt: new Date().toISOString(),
-      },
-      {
-        id: uuidv4(),
-        type: 'PACKING_LIST',
-        fileName: 'packing-list.pdf',
-        filePath: 'https://dummy-storage.com/documents/packing-list.pdf',
-        mimeType: 'application/pdf',
-        size: 51200, // 50KB
-        uploadedAt: new Date().toISOString(),
-      },
-      {
-        id: uuidv4(),
-        type: 'COMMERCIAL_INVOICE',
-        fileName: 'commercial-invoice.pdf',
-        filePath: 'https://dummy-storage.com/documents/commercial-invoice.pdf',
-        mimeType: 'application/pdf',
-        size: 76800, // 75KB
-        uploadedAt: new Date().toISOString(),
-      },
-    ]);
-
-    const query = `
-      INSERT INTO csv_bookings (
-        id, user_id, organization_id, carrier_name, carrier_email,
-        origin, destination, volume_cbm, weight_kg, pallet_count,
-        price_usd, price_eur, primary_currency, transit_days, container_type,
-        status, confirmation_token, requested_at, notes, documents
-      ) VALUES (
-        $1, $2, $3, $4, $5, $6, $7, $8, $9, $10,
-        $11, $12, $13, $14, $15, $16, $17, NOW(), $18, $19
-      ) RETURNING id, confirmation_token;
-    `;
-
-    const values = [
-      bookingId,
-      userId,
-      organizationId,
-      'Test Carrier',
-      'test@carrier.com',
-      'NLRTM', // Rotterdam
-      'USNYC', // New York
-      25.5,    // volume_cbm
-      3500,    // weight_kg
-      10,      // pallet_count
-      1850.50, // price_usd
-      1665.45, // price_eur
-      'USD',   // primary_currency
-      28,      // transit_days
-      'LCL',   // container_type
-      'PENDING', // status - IMPORTANT!
-      confirmationToken,
-      'Test booking created by script',
-      dummyDocuments, // documents JSONB
-    ];
-
-    const result = await client.query(query, values);
-
-    console.log('\n🎉 Booking de test créé avec succès!');
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log(`📦 Booking ID: ${bookingId}`);
-    console.log(`🔑 Token: ${confirmationToken}`);
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n');
-    console.log('🔗 URLs de test:');
-    console.log(`   Accept:  http://localhost:3000/carrier/accept/${confirmationToken}`);
-    console.log(`   Reject:  http://localhost:3000/carrier/reject/${confirmationToken}`);
-    console.log('\n📧 URL API (pour curl):');
-    console.log(`   curl http://localhost:4000/api/v1/csv-bookings/accept/${confirmationToken}`);
-    console.log('\n✅ Ce booking est en statut PENDING et peut être accepté/refusé.\n');
-
-  } catch (error) {
-    console.error('❌ Erreur:', error.message);
-    console.error(error);
-  } finally {
-    await client.end();
-  }
-}
-
-createTestBooking();

apps/backend/debug-email-flow.js

@@ -1,321 +0,0 @@
-/**
- * Script de debug pour tester le flux complet d'envoi d'email
- *
- * Ce script teste:
- * 1. Connexion SMTP
- * 2. Envoi d'un email simple
- * 3. Envoi avec le template complet
- */
-
-require('dotenv').config();
-const nodemailer = require('nodemailer');
-
-console.log('\n🔍 DEBUG - Flux d\'envoi d\'email transporteur\n');
-console.log('='.repeat(60));
-
-// 1. Afficher la configuration
-console.log('\n📋 CONFIGURATION ACTUELLE:');
-console.log('----------------------------');
-console.log('SMTP_HOST:', process.env.SMTP_HOST);
-console.log('SMTP_PORT:', process.env.SMTP_PORT);
-console.log('SMTP_SECURE:', process.env.SMTP_SECURE);
-console.log('SMTP_USER:', process.env.SMTP_USER);
-console.log('SMTP_PASS:', process.env.SMTP_PASS ? '***' + process.env.SMTP_PASS.slice(-4) : 'NON DÉFINI');
-console.log('SMTP_FROM:', process.env.SMTP_FROM);
-console.log('APP_URL:', process.env.APP_URL);
-
-// 2. Vérifier les variables requises
-console.log('\n✅ VÉRIFICATION DES VARIABLES:');
-console.log('--------------------------------');
-const requiredVars = ['SMTP_HOST', 'SMTP_PORT', 'SMTP_USER', 'SMTP_PASS'];
-const missing = requiredVars.filter(v => !process.env[v]);
-if (missing.length > 0) {
-  console.error('❌ Variables manquantes:', missing.join(', '));
-  process.exit(1);
-} else {
-  console.log('✅ Toutes les variables requises sont présentes');
-}
-
-// 3. Créer le transporter avec la même configuration que le backend
-console.log('\n🔧 CRÉATION DU TRANSPORTER:');
-console.log('----------------------------');
-
-const host = process.env.SMTP_HOST;
-const port = parseInt(process.env.SMTP_PORT);
-const user = process.env.SMTP_USER;
-const pass = process.env.SMTP_PASS;
-const secure = process.env.SMTP_SECURE === 'true';
-
-// Même logique que dans email.adapter.ts
-const useDirectIP = host.includes('mailtrap.io');
-const actualHost = useDirectIP ? '3.209.246.195' : host;
-const serverName = useDirectIP ? 'smtp.mailtrap.io' : host;
-
-console.log('Configuration détectée:');
-console.log('  Host original:', host);
-console.log('  Utilise IP directe:', useDirectIP);
-console.log('  Host réel:', actualHost);
-console.log('  Server name (TLS):', serverName);
-console.log('  Port:', port);
-console.log('  Secure:', secure);
-
-const transporter = nodemailer.createTransport({
-  host: actualHost,
-  port,
-  secure,
-  auth: {
-    user,
-    pass,
-  },
-  tls: {
-    rejectUnauthorized: false,
-    servername: serverName,
-  },
-  connectionTimeout: 10000,
-  greetingTimeout: 10000,
-  socketTimeout: 30000,
-  dnsTimeout: 10000,
-});
-
-// 4. Tester la connexion
-console.log('\n🔌 TEST DE CONNEXION SMTP:');
-console.log('---------------------------');
-
-async function testConnection() {
-  try {
-    console.log('Vérification de la connexion...');
-    await transporter.verify();
-    console.log('✅ Connexion SMTP réussie!');
-    return true;
-  } catch (error) {
-    console.error('❌ Échec de la connexion SMTP:');
-    console.error('   Message:', error.message);
-    console.error('   Code:', error.code);
-    console.error('   Command:', error.command);
-    if (error.stack) {
-      console.error('   Stack:', error.stack.substring(0, 200) + '...');
-    }
-    return false;
-  }
-}
-
-// 5. Envoyer un email de test simple
-async function sendSimpleEmail() {
-  console.log('\n📧 TEST 1: Email simple');
-  console.log('------------------------');
-
-  try {
-    const info = await transporter.sendMail({
-      from: process.env.SMTP_FROM || 'noreply@xpeditis.com',
-      to: 'test@example.com',
-      subject: 'Test Simple - ' + new Date().toISOString(),
-      text: 'Ceci est un test simple',
-      html: '<h1>Test Simple</h1><p>Ceci est un test simple</p>',
-    });
-
-    console.log('✅ Email simple envoyé avec succès!');
-    console.log('   Message ID:', info.messageId);
-    console.log('   Response:', info.response);
-    console.log('   Accepted:', info.accepted);
-    console.log('   Rejected:', info.rejected);
-    return true;
-  } catch (error) {
-    console.error('❌ Échec d\'envoi email simple:');
-    console.error('   Message:', error.message);
-    console.error('   Code:', error.code);
-    return false;
-  }
-}
-
-// 6. Envoyer un email avec le template transporteur complet
-async function sendCarrierEmail() {
-  console.log('\n📧 TEST 2: Email transporteur avec template');
-  console.log('--------------------------------------------');
-
-  const bookingData = {
-    bookingId: 'TEST-' + Date.now(),
-    origin: 'FRPAR',
-    destination: 'USNYC',
-    volumeCBM: 15.5,
-    weightKG: 1200,
-    palletCount: 6,
-    priceUSD: 2500,
-    priceEUR: 2250,
-    primaryCurrency: 'USD',
-    transitDays: 18,
-    containerType: '40FT',
-    documents: [
-      { type: 'Bill of Lading', fileName: 'bol-test.pdf' },
-      { type: 'Packing List', fileName: 'packing-test.pdf' },
-      { type: 'Commercial Invoice', fileName: 'invoice-test.pdf' },
-    ],
-  };
-
-  const baseUrl = process.env.APP_URL || 'http://localhost:3000';
-  const acceptUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.bookingId}/accept`;
-  const rejectUrl = `${baseUrl}/api/v1/csv-bookings/${bookingData.bookingId}/reject`;
-
-  // Template HTML (version simplifiée pour le test)
-  const htmlTemplate = `
-    <!DOCTYPE html>
-    <html lang="fr">
-    <head>
-      <meta charset="UTF-8">
-      <meta name="viewport" content="width=device-width, initial-scale=1.0">
-      <title>Nouvelle demande de réservation</title>
-    </head>
-    <body style="margin: 0; padding: 0; font-family: Arial, sans-serif; background-color: #f4f6f8;">
-      <div style="max-width: 600px; margin: 20px auto; background-color: #ffffff; border-radius: 8px; overflow: hidden; box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);">
-        <div style="background: linear-gradient(135deg, #045a8d, #00bcd4); color: #ffffff; padding: 30px 20px; text-align: center;">
-          <h1 style="margin: 0; font-size: 28px;">🚢 Nouvelle demande de réservation</h1>
-          <p style="margin: 5px 0 0; font-size: 14px;">Xpeditis</p>
-        </div>
-        <div style="padding: 30px 20px;">
-          <p style="font-size: 16px;">Bonjour,</p>
-          <p>Vous avez reçu une nouvelle demande de réservation via Xpeditis.</p>
-
-          <h2 style="color: #045a8d; border-bottom: 2px solid #00bcd4; padding-bottom: 8px;">📋 Détails du transport</h2>
-          <table style="width: 100%; border-collapse: collapse;">
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Route</td>
-              <td style="padding: 12px;">${bookingData.origin} → ${bookingData.destination}</td>
-            </tr>
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Volume</td>
-              <td style="padding: 12px;">${bookingData.volumeCBM} CBM</td>
-            </tr>
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Poids</td>
-              <td style="padding: 12px;">${bookingData.weightKG} kg</td>
-            </tr>
-            <tr style="border-bottom: 1px solid #e0e0e0;">
-              <td style="padding: 12px; font-weight: bold; color: #045a8d;">Prix</td>
-              <td style="padding: 12px; font-size: 24px; font-weight: bold; color: #00aa00;">
-                ${bookingData.priceUSD} USD
-              </td>
-            </tr>
-          </table>
-
-          <div style="background-color: #f9f9f9; padding: 20px; border-radius: 6px; margin: 20px 0;">
-            <h3 style="margin-top: 0; color: #045a8d;">📄 Documents fournis</h3>
-            <ul style="list-style: none; padding: 0; margin: 10px 0 0;">
-              ${bookingData.documents.map(doc => `<li style="padding: 8px 0;">📄 <strong>${doc.type}:</strong> ${doc.fileName}</li>`).join('')}
-            </ul>
-          </div>
-
-          <div style="text-align: center; margin: 30px 0;">
-            <p style="font-weight: bold; font-size: 16px;">Veuillez confirmer votre décision :</p>
-            <div style="margin: 15px 0;">
-              <a href="${acceptUrl}" style="display: inline-block; padding: 15px 30px; background-color: #00aa00; color: #ffffff; text-decoration: none; border-radius: 6px; margin: 0 5px; min-width: 200px;">✓ Accepter la demande</a>
-              <a href="${rejectUrl}" style="display: inline-block; padding: 15px 30px; background-color: #cc0000; color: #ffffff; text-decoration: none; border-radius: 6px; margin: 0 5px; min-width: 200px;">✗ Refuser la demande</a>
-            </div>
-          </div>
-
-          <div style="background-color: #fff8e1; border-left: 4px solid #f57c00; padding: 15px; margin: 20px 0; border-radius: 4px;">
-            <p style="margin: 0; font-size: 14px; color: #666;">
-              <strong style="color: #f57c00;">⚠️ Important</strong><br>
-              Cette demande expire automatiquement dans <strong>7 jours</strong> si aucune action n'est prise.
-            </p>
-          </div>
-        </div>
-        <div style="background-color: #f4f6f8; padding: 20px; text-align: center; font-size: 12px; color: #666;">
-          <p style="margin: 5px 0; font-weight: bold; color: #045a8d;">Référence de réservation : ${bookingData.bookingId}</p>
-          <p style="margin: 5px 0;">© 2025 Xpeditis. Tous droits réservés.</p>
-          <p style="margin: 5px 0;">Cet email a été envoyé automatiquement. Merci de ne pas y répondre directement.</p>
-        </div>
-      </div>
-    </body>
-    </html>
-  `;
-
-  try {
-    console.log('Données du booking:');
-    console.log('  Booking ID:', bookingData.bookingId);
-    console.log('  Route:', bookingData.origin, '→', bookingData.destination);
-    console.log('  Prix:', bookingData.priceUSD, 'USD');
-    console.log('  Accept URL:', acceptUrl);
-    console.log('  Reject URL:', rejectUrl);
-    console.log('\nEnvoi en cours...');
-
-    const info = await transporter.sendMail({
-      from: process.env.SMTP_FROM || 'noreply@xpeditis.com',
-      to: 'carrier@test.com',
-      subject: `Nouvelle demande de réservation - ${bookingData.origin} → ${bookingData.destination}`,
-      html: htmlTemplate,
-    });
-
-    console.log('\n✅ Email transporteur envoyé avec succès!');
-    console.log('   Message ID:', info.messageId);
-    console.log('   Response:', info.response);
-    console.log('   Accepted:', info.accepted);
-    console.log('   Rejected:', info.rejected);
-    console.log('\n📬 Vérifiez votre inbox Mailtrap:');
-    console.log('   URL: https://mailtrap.io/inboxes');
-    console.log('   Sujet: Nouvelle demande de réservation - FRPAR → USNYC');
-    return true;
-  } catch (error) {
-    console.error('\n❌ Échec d\'envoi email transporteur:');
-    console.error('   Message:', error.message);
-    console.error('   Code:', error.code);
-    console.error('   ResponseCode:', error.responseCode);
-    console.error('   Response:', error.response);
-    if (error.stack) {
-      console.error('   Stack:', error.stack.substring(0, 300));
-    }
-    return false;
-  }
-}
-
-// Exécuter tous les tests
-async function runAllTests() {
-  console.log('\n🚀 DÉMARRAGE DES TESTS');
-  console.log('='.repeat(60));
-
-  // Test 1: Connexion
-  const connectionOk = await testConnection();
-  if (!connectionOk) {
-    console.log('\n❌ ARRÊT: La connexion SMTP a échoué');
-    console.log('   Vérifiez vos credentials SMTP dans .env');
-    process.exit(1);
-  }
-
-  // Test 2: Email simple
-  const simpleEmailOk = await sendSimpleEmail();
-  if (!simpleEmailOk) {
-    console.log('\n⚠️  L\'email simple a échoué, mais on continue...');
-  }
-
-  // Test 3: Email transporteur
-  const carrierEmailOk = await sendCarrierEmail();
-
-  // Résumé
-  console.log('\n' + '='.repeat(60));
-  console.log('📊 RÉSUMÉ DES TESTS:');
-  console.log('='.repeat(60));
-  console.log('Connexion SMTP:', connectionOk ? '✅ OK' : '❌ ÉCHEC');
-  console.log('Email simple:', simpleEmailOk ? '✅ OK' : '❌ ÉCHEC');
-  console.log('Email transporteur:', carrierEmailOk ? '✅ OK' : '❌ ÉCHEC');
-
-  if (connectionOk && simpleEmailOk && carrierEmailOk) {
-    console.log('\n✅ TOUS LES TESTS ONT RÉUSSI!');
-    console.log('   Le système d\'envoi d\'email fonctionne correctement.');
-    console.log('   Si vous ne recevez pas les emails dans le backend,');
-    console.log('   le problème vient de l\'intégration NestJS.');
-  } else {
-    console.log('\n❌ CERTAINS TESTS ONT ÉCHOUÉ');
-    console.log('   Vérifiez les erreurs ci-dessus pour comprendre le problème.');
-  }
-
-  console.log('\n' + '='.repeat(60));
-}
-
-// Lancer les tests
-runAllTests()
-  .then(() => {
-    console.log('\n✅ Tests terminés\n');
-    process.exit(0);
-  })
-  .catch(error => {
-    console.error('\n❌ Erreur fatale:', error);
-    process.exit(1);
-  });

apps/backend/delete-test-documents.js

@@ -1,106 +0,0 @@
-/**
- * Script to delete test documents from MinIO
- *
- * Deletes only small test files (< 1000 bytes) created by upload-test-documents.js
- * Preserves real uploaded documents (larger files)
- */
-
-const { S3Client, ListObjectsV2Command, DeleteObjectCommand } = require('@aws-sdk/client-s3');
-require('dotenv').config();
-
-const MINIO_ENDPOINT = process.env.AWS_S3_ENDPOINT || 'http://localhost:9000';
-const BUCKET_NAME = 'xpeditis-documents';
-const TEST_FILE_SIZE_THRESHOLD = 1000; // Files smaller than 1KB are likely test files
-
-// Initialize MinIO client
-const s3Client = new S3Client({
-  region: 'us-east-1',
-  endpoint: MINIO_ENDPOINT,
-  credentials: {
-    accessKeyId: process.env.AWS_ACCESS_KEY_ID || 'minioadmin',
-    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || 'minioadmin',
-  },
-  forcePathStyle: true,
-});
-
-async function deleteTestDocuments() {
-  try {
-    console.log('📋 Listing all files in bucket:', BUCKET_NAME);
-
-    // List all files
-    let allFiles = [];
-    let continuationToken = null;
-
-    do {
-      const command = new ListObjectsV2Command({
-        Bucket: BUCKET_NAME,
-        ContinuationToken: continuationToken,
-      });
-
-      const response = await s3Client.send(command);
-
-      if (response.Contents) {
-        allFiles = allFiles.concat(response.Contents);
-      }
-
-      continuationToken = response.NextContinuationToken;
-    } while (continuationToken);
-
-    console.log(`\n📊 Found ${allFiles.length} total files\n`);
-
-    // Filter test files (small files < 1000 bytes)
-    const testFiles = allFiles.filter(file => file.Size < TEST_FILE_SIZE_THRESHOLD);
-    const realFiles = allFiles.filter(file => file.Size >= TEST_FILE_SIZE_THRESHOLD);
-
-    console.log(`🔍 Analysis:`);
-    console.log(`   Test files (< ${TEST_FILE_SIZE_THRESHOLD} bytes): ${testFiles.length}`);
-    console.log(`   Real files (>= ${TEST_FILE_SIZE_THRESHOLD} bytes): ${realFiles.length}\n`);
-
-    if (testFiles.length === 0) {
-      console.log('✅ No test files to delete');
-      return;
-    }
-
-    console.log(`🗑️  Deleting ${testFiles.length} test files:\n`);
-
-    let deletedCount = 0;
-    for (const file of testFiles) {
-      console.log(`   Deleting: ${file.Key} (${file.Size} bytes)`);
-
-      try {
-        await s3Client.send(
-          new DeleteObjectCommand({
-            Bucket: BUCKET_NAME,
-            Key: file.Key,
-          })
-        );
-        deletedCount++;
-      } catch (error) {
-        console.error(`   ❌ Failed to delete ${file.Key}:`, error.message);
-      }
-    }
-
-    console.log(`\n✅ Deleted ${deletedCount} test files`);
-    console.log(`✅ Preserved ${realFiles.length} real documents\n`);
-
-    console.log('📂 Remaining real documents:');
-    realFiles.forEach(file => {
-      const filename = file.Key.split('/').pop();
-      const sizeMB = (file.Size / 1024 / 1024).toFixed(2);
-      console.log(`   - ${filename} (${sizeMB} MB)`);
-    });
-  } catch (error) {
-    console.error('❌ Error:', error);
-    throw error;
-  }
-}
-
-deleteTestDocuments()
-  .then(() => {
-    console.log('\n✅ Script completed successfully');
-    process.exit(0);
-  })
-  .catch((error) => {
-    console.error('\n❌ Script failed:', error);
-    process.exit(1);
-  });

apps/backend/diagnostic-complet.sh

@@ -1,192 +0,0 @@
-#!/bin/bash
-
-# Script de diagnostic complet pour l'envoi d'email aux transporteurs
-# Ce script fait TOUT automatiquement
-
-set -e  # Arrêter en cas d'erreur
-
-# Couleurs
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-echo ""
-echo "╔════════════════════════════════════════════════════════════╗"
-echo "║  🔍 DIAGNOSTIC COMPLET - Email Transporteur               ║"
-echo "╚════════════════════════════════════════════════════════════╝"
-echo ""
-
-# Fonction pour afficher les étapes
-step_header() {
-    echo ""
-    echo -e "${BLUE}╔════════════════════════════════════════════════════════════╗${NC}"
-    echo -e "${BLUE}║  $1${NC}"
-    echo -e "${BLUE}╚════════════════════════════════════════════════════════════╝${NC}"
-    echo ""
-}
-
-# Fonction pour les succès
-success() {
-    echo -e "${GREEN}✅ $1${NC}"
-}
-
-# Fonction pour les erreurs
-error() {
-    echo -e "${RED}❌ $1${NC}"
-}
-
-# Fonction pour les warnings
-warning() {
-    echo -e "${YELLOW}⚠️  $1${NC}"
-}
-
-# Fonction pour les infos
-info() {
-    echo -e "${BLUE}ℹ️  $1${NC}"
-}
-
-# Aller dans le répertoire backend
-cd "$(dirname "$0")"
-
-# ============================================================
-# ÉTAPE 1: Arrêter le backend
-# ============================================================
-step_header "ÉTAPE 1/5: Arrêt du backend actuel"
-
-BACKEND_PIDS=$(lsof -ti:4000 2>/dev/null || true)
-if [ -n "$BACKEND_PIDS" ]; then
-    info "Processus backend trouvés: $BACKEND_PIDS"
-    kill -9 $BACKEND_PIDS 2>/dev/null || true
-    sleep 2
-    success "Backend arrêté"
-else
-    info "Aucun backend en cours d'exécution"
-fi
-
-# ============================================================
-# ÉTAPE 2: Vérifier les modifications
-# ============================================================
-step_header "ÉTAPE 2/5: Vérification des modifications"
-
-if grep -q "Using direct IP" src/infrastructure/email/email.adapter.ts; then
-    success "Modifications DNS présentes dans email.adapter.ts"
-else
-    error "Modifications DNS ABSENTES dans email.adapter.ts"
-    error "Le fix n'a pas été appliqué correctement!"
-    exit 1
-fi
-
-# ============================================================
-# ÉTAPE 3: Test de connexion SMTP (sans backend)
-# ============================================================
-step_header "ÉTAPE 3/5: Test de connexion SMTP directe"
-
-info "Exécution de debug-email-flow.js..."
-echo ""
-
-if node debug-email-flow.js > /tmp/email-test.log 2>&1; then
-    success "Test SMTP réussi!"
-    echo ""
-    echo "Résultats du test:"
-    echo "─────────────────"
-    tail -15 /tmp/email-test.log
-else
-    error "Test SMTP échoué!"
-    echo ""
-    echo "Logs d'erreur:"
-    echo "──────────────"
-    cat /tmp/email-test.log
-    echo ""
-    error "ARRÊT: La connexion SMTP ne fonctionne pas"
-    error "Vérifiez vos credentials SMTP dans .env"
-    exit 1
-fi
-
-# ============================================================
-# ÉTAPE 4: Redémarrer le backend
-# ============================================================
-step_header "ÉTAPE 4/5: Redémarrage du backend"
-
-info "Démarrage du backend en arrière-plan..."
-
-# Démarrer le backend
-npm run dev > /tmp/backend.log 2>&1 &
-BACKEND_PID=$!
-
-info "Backend démarré (PID: $BACKEND_PID)"
-info "Attente de l'initialisation (15 secondes)..."
-
-# Attendre que le backend démarre
-sleep 15
-
-# Vérifier que le backend tourne
-if kill -0 $BACKEND_PID 2>/dev/null; then
-    success "Backend en cours d'exécution"
-
-    # Afficher les logs de démarrage
-    echo ""
-    echo "Logs de démarrage du backend:"
-    echo "─────────────────────────────"
-    tail -20 /tmp/backend.log
-    echo ""
-
-    # Vérifier le log DNS fix
-    if grep -q "Using direct IP" /tmp/backend.log; then
-        success "✨ DNS FIX DÉTECTÉ: Le backend utilise bien l'IP directe!"
-    else
-        warning "DNS fix non détecté dans les logs"
-        warning "Cela peut être normal si le message est tronqué"
-    fi
-
-else
-    error "Le backend n'a pas démarré correctement"
-    echo ""
-    echo "Logs d'erreur:"
-    echo "──────────────"
-    cat /tmp/backend.log
-    exit 1
-fi
-
-# ============================================================
-# ÉTAPE 5: Test de création de booking (optionnel)
-# ============================================================
-step_header "ÉTAPE 5/5: Instructions pour tester"
-
-echo ""
-echo "Le backend est maintenant en cours d'exécution avec les corrections."
-echo ""
-echo "Pour tester l'envoi d'email:"
-echo "──────────────────────────────────────────────────────────────"
-echo ""
-echo "1. ${GREEN}Via le frontend${NC}:"
-echo "   - Ouvrez http://localhost:3000"
-echo "   - Créez un CSV booking"
-echo "   - Vérifiez les logs backend pour:"
-echo "     ${GREEN}✅ Email sent to carrier: <email>${NC}"
-echo ""
-echo "2. ${GREEN}Via l'API directement${NC}:"
-echo "   - Utilisez Postman ou curl"
-echo "   - POST http://localhost:4000/api/v1/csv-bookings"
-echo "   - Avec un fichier et les données du booking"
-echo ""
-echo "3. ${GREEN}Vérifier Mailtrap${NC}:"
-echo "   - https://mailtrap.io/inboxes"
-echo "   - Cherchez: 'Nouvelle demande de réservation'"
-echo ""
-echo "──────────────────────────────────────────────────────────────"
-echo ""
-info "Pour voir les logs backend en temps réel:"
-echo "   ${YELLOW}tail -f /tmp/backend.log${NC}"
-echo ""
-info "Pour arrêter le backend:"
-echo "   ${YELLOW}kill $BACKEND_PID${NC}"
-echo ""
-
-success "Diagnostic terminé!"
-echo ""
-echo "╔════════════════════════════════════════════════════════════╗"
-echo "║  ✅ BACKEND PRÊT - Créez un booking pour tester           ║"
-echo "╚════════════════════════════════════════════════════════════╝"
-echo ""

apps/backend/docs/CARRIER_PORTAL_API.md

@@ -1,727 +0,0 @@
-# Carrier Portal API Documentation
-
-**Version**: 1.0
-**Base URL**: `http://localhost:4000/api/v1`
-**Last Updated**: 2025-12-04
-
-## Table of Contents
-
-1. [Overview](#overview)
-2. [Authentication](#authentication)
-3. [API Endpoints](#api-endpoints)
-   - [Carrier Authentication](#carrier-authentication)
-   - [Carrier Dashboard](#carrier-dashboard)
-   - [Booking Management](#booking-management)
-   - [Document Management](#document-management)
-4. [Data Models](#data-models)
-5. [Error Handling](#error-handling)
-6. [Examples](#examples)
-
----
-
-## Overview
-
-The Carrier Portal API provides endpoints for transportation carriers (transporteurs) to:
-- Authenticate and manage their accounts
-- View dashboard statistics
-- Manage booking requests from clients
-- Accept or reject booking requests
-- Download shipment documents
-- Track their performance metrics
-
-All endpoints require JWT authentication except for the public authentication endpoints.
-
----
-
-## Authentication
-
-### Authentication Header
-
-All protected endpoints require a Bearer token in the Authorization header:
-
-```
-Authorization: Bearer <access_token>
-```
-
-### Token Management
-
-- **Access Token**: Valid for 15 minutes
-- **Refresh Token**: Valid for 7 days
-- **Auto-Login Token**: Valid for 1 hour (for magic link authentication)
-
----
-
-## API Endpoints
-
-### Carrier Authentication
-
-#### 1. Login
-
-**Endpoint**: `POST /carrier-auth/login`
-
-**Description**: Authenticate a carrier with email and password.
-
-**Request Body**:
-```json
-{
-  "email": "carrier@example.com",
-  "password": "SecurePassword123!"
-}
-```
-
-**Response** (200 OK):
-```json
-{
-  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
-  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
-  "carrier": {
-    "id": "carrier-uuid",
-    "companyName": "Transport Express",
-    "email": "carrier@example.com"
-  }
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid credentials
-- `401 Unauthorized`: Account is inactive
-- `400 Bad Request`: Validation error
-
----
-
-#### 2. Get Current Carrier Profile
-
-**Endpoint**: `GET /carrier-auth/me`
-
-**Description**: Retrieve the authenticated carrier's profile information.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Response** (200 OK):
-```json
-{
-  "id": "carrier-uuid",
-  "userId": "user-uuid",
-  "companyName": "Transport Express",
-  "email": "carrier@example.com",
-  "role": "CARRIER",
-  "organizationId": "org-uuid",
-  "phone": "+33612345678",
-  "website": "https://transport-express.com",
-  "city": "Paris",
-  "country": "France",
-  "isVerified": true,
-  "isActive": true,
-  "totalBookingsAccepted": 45,
-  "totalBookingsRejected": 5,
-  "acceptanceRate": 90.0,
-  "totalRevenueUsd": 125000,
-  "totalRevenueEur": 112500,
-  "preferredCurrency": "EUR",
-  "lastLoginAt": "2025-12-04T10:30:00Z"
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-
----
-
-#### 3. Change Password
-
-**Endpoint**: `PATCH /carrier-auth/change-password`
-
-**Description**: Change the carrier's password.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Request Body**:
-```json
-{
-  "oldPassword": "OldPassword123!",
-  "newPassword": "NewPassword123!"
-}
-```
-
-**Response** (200 OK):
-```json
-{
-  "message": "Password changed successfully"
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid old password
-- `400 Bad Request`: Password validation failed
-
----
-
-#### 4. Request Password Reset
-
-**Endpoint**: `POST /carrier-auth/request-password-reset`
-
-**Description**: Request a password reset (generates temporary password).
-
-**Request Body**:
-```json
-{
-  "email": "carrier@example.com"
-}
-```
-
-**Response** (200 OK):
-```json
-{
-  "message": "If this email exists, a password reset will be sent"
-}
-```
-
-**Note**: For security, the response is the same whether the email exists or not.
-
----
-
-#### 5. Verify Auto-Login Token
-
-**Endpoint**: `POST /carrier-auth/verify-auto-login`
-
-**Description**: Verify an auto-login token from email magic link.
-
-**Request Body**:
-```json
-{
-  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-}
-```
-
-**Response** (200 OK):
-```json
-{
-  "userId": "user-uuid",
-  "carrierId": "carrier-uuid"
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-
----
-
-### Carrier Dashboard
-
-#### 6. Get Dashboard Statistics
-
-**Endpoint**: `GET /carrier-dashboard/stats`
-
-**Description**: Retrieve carrier dashboard statistics including bookings count, revenue, and recent activities.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Response** (200 OK):
-```json
-{
-  "totalBookings": 50,
-  "pendingBookings": 5,
-  "acceptedBookings": 42,
-  "rejectedBookings": 3,
-  "acceptanceRate": 93.3,
-  "totalRevenue": {
-    "usd": 125000,
-    "eur": 112500
-  },
-  "recentActivities": [
-    {
-      "id": "activity-uuid",
-      "type": "BOOKING_ACCEPTED",
-      "description": "Booking #12345 accepted",
-      "createdAt": "2025-12-04T09:15:00Z",
-      "bookingId": "booking-uuid"
-    },
-    {
-      "id": "activity-uuid-2",
-      "type": "DOCUMENT_DOWNLOADED",
-      "description": "Downloaded invoice.pdf",
-      "createdAt": "2025-12-04T08:30:00Z",
-      "bookingId": "booking-uuid-2"
-    }
-  ]
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-- `404 Not Found`: Carrier not found
-
----
-
-#### 7. Get Carrier Bookings (Paginated)
-
-**Endpoint**: `GET /carrier-dashboard/bookings`
-
-**Description**: Retrieve a paginated list of bookings for the carrier.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Query Parameters**:
-- `page` (number, optional): Page number (default: 1)
-- `limit` (number, optional): Items per page (default: 10)
-- `status` (string, optional): Filter by status (PENDING, ACCEPTED, REJECTED)
-
-**Example Request**:
-```
-GET /carrier-dashboard/bookings?page=1&limit=10&status=PENDING
-```
-
-**Response** (200 OK):
-```json
-{
-  "data": [
-    {
-      "id": "booking-uuid",
-      "origin": "Rotterdam",
-      "destination": "New York",
-      "status": "PENDING",
-      "priceUsd": 1500,
-      "priceEur": 1350,
-      "primaryCurrency": "USD",
-      "requestedAt": "2025-12-04T08:00:00Z",
-      "carrierViewedAt": null,
-      "documentsCount": 3,
-      "volumeCBM": 25.5,
-      "weightKG": 12000,
-      "palletCount": 10,
-      "transitDays": 15,
-      "containerType": "40HC"
-    }
-  ],
-  "total": 50,
-  "page": 1,
-  "limit": 10
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-- `404 Not Found`: Carrier not found
-
----
-
-#### 8. Get Booking Details
-
-**Endpoint**: `GET /carrier-dashboard/bookings/:id`
-
-**Description**: Retrieve detailed information about a specific booking.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Path Parameters**:
-- `id` (string, required): Booking ID
-
-**Response** (200 OK):
-```json
-{
-  "id": "booking-uuid",
-  "carrierName": "Transport Express",
-  "carrierEmail": "carrier@example.com",
-  "origin": "Rotterdam",
-  "destination": "New York",
-  "volumeCBM": 25.5,
-  "weightKG": 12000,
-  "palletCount": 10,
-  "priceUSD": 1500,
-  "priceEUR": 1350,
-  "primaryCurrency": "USD",
-  "transitDays": 15,
-  "containerType": "40HC",
-  "status": "PENDING",
-  "documents": [
-    {
-      "id": "doc-uuid",
-      "fileName": "invoice.pdf",
-      "type": "INVOICE",
-      "url": "https://storage.example.com/doc.pdf",
-      "uploadedAt": "2025-12-03T10:00:00Z"
-    }
-  ],
-  "confirmationToken": "token-123",
-  "requestedAt": "2025-12-04T08:00:00Z",
-  "respondedAt": null,
-  "notes": "Urgent shipment",
-  "rejectionReason": null,
-  "carrierViewedAt": "2025-12-04T10:15:00Z",
-  "carrierAcceptedAt": null,
-  "carrierRejectedAt": null,
-  "carrierRejectionReason": null,
-  "carrierNotes": null,
-  "createdAt": "2025-12-04T08:00:00Z",
-  "updatedAt": "2025-12-04T10:15:00Z"
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-- `403 Forbidden`: Access denied to this booking
-- `404 Not Found`: Booking not found
-
----
-
-### Booking Management
-
-#### 9. Accept Booking
-
-**Endpoint**: `POST /carrier-dashboard/bookings/:id/accept`
-
-**Description**: Accept a booking request.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Path Parameters**:
-- `id` (string, required): Booking ID
-
-**Request Body**:
-```json
-{
-  "notes": "Ready to proceed. Pickup scheduled for Dec 5th."
-}
-```
-
-**Response** (200 OK):
-```json
-{
-  "message": "Booking accepted successfully"
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-- `403 Forbidden`: Access denied to this booking
-- `404 Not Found`: Booking not found
-- `400 Bad Request`: Booking cannot be accepted (wrong status)
-
----
-
-#### 10. Reject Booking
-
-**Endpoint**: `POST /carrier-dashboard/bookings/:id/reject`
-
-**Description**: Reject a booking request with a reason.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Path Parameters**:
-- `id` (string, required): Booking ID
-
-**Request Body**:
-```json
-{
-  "reason": "CAPACITY_NOT_AVAILABLE",
-  "notes": "Sorry, we don't have capacity for this shipment at the moment."
-}
-```
-
-**Response** (200 OK):
-```json
-{
-  "message": "Booking rejected successfully"
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-- `403 Forbidden`: Access denied to this booking
-- `404 Not Found`: Booking not found
-- `400 Bad Request`: Rejection reason required
-- `400 Bad Request`: Booking cannot be rejected (wrong status)
-
----
-
-### Document Management
-
-#### 11. Download Document
-
-**Endpoint**: `GET /carrier-dashboard/bookings/:bookingId/documents/:documentId/download`
-
-**Description**: Download a document associated with a booking.
-
-**Headers**:
-```
-Authorization: Bearer <access_token>
-```
-
-**Path Parameters**:
-- `bookingId` (string, required): Booking ID
-- `documentId` (string, required): Document ID
-
-**Response** (200 OK):
-```json
-{
-  "document": {
-    "id": "doc-uuid",
-    "fileName": "invoice.pdf",
-    "type": "INVOICE",
-    "url": "https://storage.example.com/doc.pdf",
-    "size": 245678,
-    "mimeType": "application/pdf",
-    "uploadedAt": "2025-12-03T10:00:00Z"
-  }
-}
-```
-
-**Errors**:
-- `401 Unauthorized`: Invalid or expired token
-- `403 Forbidden`: Access denied to this document
-- `404 Not Found`: Document or booking not found
-
----
-
-## Data Models
-
-### Carrier Profile
-
-```typescript
-interface CarrierProfile {
-  id: string;
-  userId: string;
-  organizationId: string;
-  companyName: string;
-  email: string;
-  phone?: string;
-  website?: string;
-  city?: string;
-  country?: string;
-  isVerified: boolean;
-  isActive: boolean;
-  totalBookingsAccepted: number;
-  totalBookingsRejected: number;
-  acceptanceRate: number;
-  totalRevenueUsd: number;
-  totalRevenueEur: number;
-  preferredCurrency: 'USD' | 'EUR';
-  lastLoginAt?: Date;
-}
-```
-
-### Booking
-
-```typescript
-interface Booking {
-  id: string;
-  carrierId: string;
-  carrierName: string;
-  carrierEmail: string;
-  origin: string;
-  destination: string;
-  volumeCBM: number;
-  weightKG: number;
-  palletCount: number;
-  priceUSD: number;
-  priceEUR: number;
-  primaryCurrency: 'USD' | 'EUR';
-  transitDays: number;
-  containerType: string;
-  status: 'PENDING' | 'ACCEPTED' | 'REJECTED' | 'CANCELLED';
-  documents: Document[];
-  confirmationToken: string;
-  requestedAt: Date;
-  respondedAt?: Date;
-  notes?: string;
-  rejectionReason?: string;
-  carrierViewedAt?: Date;
-  carrierAcceptedAt?: Date;
-  carrierRejectedAt?: Date;
-  carrierRejectionReason?: string;
-  carrierNotes?: string;
-  createdAt: Date;
-  updatedAt: Date;
-}
-```
-
-### Document
-
-```typescript
-interface Document {
-  id: string;
-  fileName: string;
-  type: 'INVOICE' | 'PACKING_LIST' | 'CERTIFICATE' | 'OTHER';
-  url: string;
-  size?: number;
-  mimeType?: string;
-  uploadedAt: Date;
-}
-```
-
-### Activity
-
-```typescript
-interface CarrierActivity {
-  id: string;
-  carrierId: string;
-  bookingId?: string;
-  activityType: 'BOOKING_ACCEPTED' | 'BOOKING_REJECTED' | 'DOCUMENT_DOWNLOADED' | 'PROFILE_UPDATED';
-  description: string;
-  metadata?: Record<string, any>;
-  createdAt: Date;
-}
-```
-
----
-
-## Error Handling
-
-### Error Response Format
-
-All error responses follow this structure:
-
-```json
-{
-  "statusCode": 400,
-  "message": "Validation failed",
-  "error": "Bad Request",
-  "timestamp": "2025-12-04T10:30:00Z",
-  "path": "/api/v1/carrier-auth/login"
-}
-```
-
-### Common HTTP Status Codes
-
-- `200 OK`: Request successful
-- `201 Created`: Resource created successfully
-- `400 Bad Request`: Validation error or invalid request
-- `401 Unauthorized`: Authentication required or invalid credentials
-- `403 Forbidden`: Insufficient permissions
-- `404 Not Found`: Resource not found
-- `500 Internal Server Error`: Server error
-
----
-
-## Examples
-
-### Complete Authentication Flow
-
-```bash
-# 1. Login
-curl -X POST http://localhost:4000/api/v1/carrier-auth/login \
-  -H "Content-Type: application/json" \
-  -d '{
-    "email": "carrier@example.com",
-    "password": "SecurePassword123!"
-  }'
-
-# Response:
-# {
-#   "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
-#   "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
-#   "carrier": { "id": "carrier-uuid", ... }
-# }
-
-# 2. Get Dashboard Stats
-curl -X GET http://localhost:4000/api/v1/carrier-dashboard/stats \
-  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-
-# 3. Get Pending Bookings
-curl -X GET "http://localhost:4000/api/v1/carrier-dashboard/bookings?status=PENDING&page=1&limit=10" \
-  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-
-# 4. Accept a Booking
-curl -X POST http://localhost:4000/api/v1/carrier-dashboard/bookings/booking-uuid/accept \
-  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
-  -H "Content-Type: application/json" \
-  -d '{
-    "notes": "Ready to proceed with shipment"
-  }'
-```
-
-### Using Auto-Login Token
-
-```bash
-# Verify auto-login token from email magic link
-curl -X POST http://localhost:4000/api/v1/carrier-auth/verify-auto-login \
-  -H "Content-Type: application/json" \
-  -d '{
-    "token": "auto-login-token-from-email"
-  }'
-```
-
----
-
-## Rate Limiting
-
-All API endpoints are rate-limited to prevent abuse:
-
-- **Authentication endpoints**: 5 requests per minute per IP
-- **Dashboard/Booking endpoints**: 30 requests per minute per user
-- **Global limit**: 100 requests per minute per user
-
-Rate limit headers are included in all responses:
-
-```
-X-RateLimit-Limit: 30
-X-RateLimit-Remaining: 29
-X-RateLimit-Reset: 60
-```
-
----
-
-## Security
-
-### Best Practices
-
-1. **Always use HTTPS** in production
-2. **Store tokens securely** (e.g., httpOnly cookies, secure storage)
-3. **Implement token refresh** before access token expires
-4. **Validate all input** on client side before sending to API
-5. **Handle errors gracefully** without exposing sensitive information
-6. **Log out properly** by clearing all stored tokens
-
-### CORS Configuration
-
-The API allows requests from:
-- `http://localhost:3000` (development)
-- `https://your-production-domain.com` (production)
-
----
-
-## Changelog
-
-### Version 1.0 (2025-12-04)
-- Initial release
-- Authentication endpoints
-- Dashboard endpoints
-- Booking management
-- Document management
-- Complete carrier portal workflow
-
----
-
-## Support
-
-For API support or questions:
-- **Email**: support@xpeditis.com
-- **Documentation**: https://docs.xpeditis.com
-- **Status Page**: https://status.xpeditis.com
-
----
-
-**Document created**: 2025-12-04
-**Author**: Xpeditis Development Team
-**Version**: 1.0

apps/backend/fix-dummy-urls.js

@@ -1,90 +0,0 @@
-/**
- * Script to fix dummy storage URLs in the database
- *
- * This script updates all document URLs from "dummy-storage.com" to proper MinIO URLs
- */
-
-const { Client } = require('pg');
-require('dotenv').config();
-
-const MINIO_ENDPOINT = process.env.AWS_S3_ENDPOINT || 'http://localhost:9000';
-const BUCKET_NAME = 'xpeditis-documents';
-
-async function fixDummyUrls() {
-  const client = new Client({
-    host: process.env.DATABASE_HOST || 'localhost',
-    port: process.env.DATABASE_PORT || 5432,
-    user: process.env.DATABASE_USER || 'xpeditis',
-    password: process.env.DATABASE_PASSWORD || 'xpeditis_dev_password',
-    database: process.env.DATABASE_NAME || 'xpeditis_dev',
-  });
-
-  try {
-    await client.connect();
-    console.log('✅ Connected to database');
-
-    // Get all CSV bookings with documents
-    const result = await client.query(
-      `SELECT id, documents FROM csv_bookings WHERE documents IS NOT NULL AND documents::text LIKE '%dummy-storage%'`
-    );
-
-    console.log(`\n📄 Found ${result.rows.length} bookings with dummy URLs\n`);
-
-    let updatedCount = 0;
-
-    for (const row of result.rows) {
-      const bookingId = row.id;
-      const documents = row.documents;
-
-      // Update each document URL
-      const updatedDocuments = documents.map((doc) => {
-        if (doc.filePath && doc.filePath.includes('dummy-storage')) {
-          // Extract filename from dummy URL
-          const fileName = doc.fileName || doc.filePath.split('/').pop();
-          const documentId = doc.id;
-
-          // Build proper MinIO URL
-          const newUrl = `${MINIO_ENDPOINT}/${BUCKET_NAME}/csv-bookings/${bookingId}/${documentId}-${fileName}`;
-
-          console.log(`   Old: ${doc.filePath}`);
-          console.log(`   New: ${newUrl}`);
-
-          return {
-            ...doc,
-            filePath: newUrl,
-          };
-        }
-        return doc;
-      });
-
-      // Update the database
-      await client.query(
-        `UPDATE csv_bookings SET documents = $1 WHERE id = $2`,
-        [JSON.stringify(updatedDocuments), bookingId]
-      );
-
-      updatedCount++;
-      console.log(`✅ Updated booking ${bookingId}\n`);
-    }
-
-    console.log(`\n🎉 Successfully updated ${updatedCount} bookings`);
-    console.log(`\n⚠️  Note: The actual files need to be uploaded to MinIO at the correct paths.`);
-    console.log(`   You can upload test files or re-create the bookings with real file uploads.`);
-  } catch (error) {
-    console.error('❌ Error:', error);
-    throw error;
-  } finally {
-    await client.end();
-    console.log('\n👋 Disconnected from database');
-  }
-}
-
-fixDummyUrls()
-  .then(() => {
-    console.log('\n✅ Script completed successfully');
-    process.exit(0);
-  })
-  .catch((error) => {
-    console.error('\n❌ Script failed:', error);
-    process.exit(1);
-  });

apps/backend/fix-minio-hostname.js

@@ -1,81 +0,0 @@
-/**
- * Script to fix minio hostname in document URLs
- *
- * Changes http://minio:9000 to http://localhost:9000
- */
-
-const { Client } = require('pg');
-require('dotenv').config();
-
-async function fixMinioHostname() {
-  const client = new Client({
-    host: process.env.DATABASE_HOST || 'localhost',
-    port: process.env.DATABASE_PORT || 5432,
-    user: process.env.DATABASE_USER || 'xpeditis',
-    password: process.env.DATABASE_PASSWORD || 'xpeditis_dev_password',
-    database: process.env.DATABASE_NAME || 'xpeditis_dev',
-  });
-
-  try {
-    await client.connect();
-    console.log('✅ Connected to database');
-
-    // Find bookings with minio:9000 in URLs
-    const result = await client.query(
-      `SELECT id, documents FROM csv_bookings WHERE documents::text LIKE '%http://minio:9000%'`
-    );
-
-    console.log(`\n📄 Found ${result.rows.length} bookings with minio hostname\n`);
-
-    let updatedCount = 0;
-
-    for (const row of result.rows) {
-      const bookingId = row.id;
-      const documents = row.documents;
-
-      // Update each document URL
-      const updatedDocuments = documents.map((doc) => {
-        if (doc.filePath && doc.filePath.includes('http://minio:9000')) {
-          const newUrl = doc.filePath.replace('http://minio:9000', 'http://localhost:9000');
-
-          console.log(`   Booking: ${bookingId}`);
-          console.log(`   Old: ${doc.filePath}`);
-          console.log(`   New: ${newUrl}\n`);
-
-          return {
-            ...doc,
-            filePath: newUrl,
-          };
-        }
-        return doc;
-      });
-
-      // Update the database
-      await client.query(
-        `UPDATE csv_bookings SET documents = $1 WHERE id = $2`,
-        [JSON.stringify(updatedDocuments), bookingId]
-      );
-
-      updatedCount++;
-      console.log(`✅ Updated booking ${bookingId}\n`);
-    }
-
-    console.log(`\n🎉 Successfully updated ${updatedCount} bookings`);
-  } catch (error) {
-    console.error('❌ Error:', error);
-    throw error;
-  } finally {
-    await client.end();
-    console.log('\n👋 Disconnected from database');
-  }
-}
-
-fixMinioHostname()
-  .then(() => {
-    console.log('\n✅ Script completed successfully');
-    process.exit(0);
-  })
-  .catch((error) => {
-    console.error('\n❌ Script failed:', error);
-    process.exit(1);
-  });

apps/backend/list-minio-files.js

@@ -1,92 +0,0 @@
-/**
- * Script to list all files in MinIO xpeditis-documents bucket
- */
-
-const { S3Client, ListObjectsV2Command } = require('@aws-sdk/client-s3');
-require('dotenv').config();
-
-const MINIO_ENDPOINT = process.env.AWS_S3_ENDPOINT || 'http://localhost:9000';
-const BUCKET_NAME = 'xpeditis-documents';
-
-// Initialize MinIO client
-const s3Client = new S3Client({
-  region: 'us-east-1',
-  endpoint: MINIO_ENDPOINT,
-  credentials: {
-    accessKeyId: process.env.AWS_ACCESS_KEY_ID || 'minioadmin',
-    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || 'minioadmin',
-  },
-  forcePathStyle: true,
-});
-
-async function listFiles() {
-  try {
-    console.log(`📋 Listing all files in bucket: ${BUCKET_NAME}\n`);
-
-    let allFiles = [];
-    let continuationToken = null;
-
-    do {
-      const command = new ListObjectsV2Command({
-        Bucket: BUCKET_NAME,
-        ContinuationToken: continuationToken,
-      });
-
-      const response = await s3Client.send(command);
-
-      if (response.Contents) {
-        allFiles = allFiles.concat(response.Contents);
-      }
-
-      continuationToken = response.NextContinuationToken;
-    } while (continuationToken);
-
-    console.log(`Found ${allFiles.length} files total:\n`);
-
-    // Group by booking ID
-    const byBooking = {};
-    allFiles.forEach(file => {
-      const parts = file.Key.split('/');
-      if (parts.length >= 3 && parts[0] === 'csv-bookings') {
-        const bookingId = parts[1];
-        if (!byBooking[bookingId]) {
-          byBooking[bookingId] = [];
-        }
-        byBooking[bookingId].push({
-          key: file.Key,
-          size: file.Size,
-          lastModified: file.LastModified,
-        });
-      } else {
-        console.log(`  Other: ${file.Key} (${file.Size} bytes)`);
-      }
-    });
-
-    console.log(`\nFiles grouped by booking:\n`);
-    Object.entries(byBooking).forEach(([bookingId, files]) => {
-      console.log(`📦 Booking: ${bookingId.substring(0, 8)}...`);
-      files.forEach(file => {
-        const filename = file.key.split('/').pop();
-        console.log(`   - ${filename} (${file.size} bytes) - ${file.lastModified}`);
-      });
-      console.log('');
-    });
-
-    console.log(`\n📊 Summary:`);
-    console.log(`   Total files: ${allFiles.length}`);
-    console.log(`   Bookings with files: ${Object.keys(byBooking).length}`);
-  } catch (error) {
-    console.error('❌ Error:', error);
-    throw error;
-  }
-}
-
-listFiles()
-  .then(() => {
-    console.log('\n✅ Script completed successfully');
-    process.exit(0);
-  })
-  .catch((error) => {
-    console.error('\n❌ Script failed:', error);
-    process.exit(1);
-  });

apps/backend/login-and-test.js

@@ -1,65 +0,0 @@
-const axios = require('axios');
-const FormData = require('form-data');
-
-const API_URL = 'http://localhost:4000/api/v1';
-
-async function loginAndTestEmail() {
-  try {
-    // 1. Login
-    console.log('🔐 Connexion...');
-    const loginResponse = await axios.post(`${API_URL}/auth/login`, {
-      email: 'admin@xpeditis.com',
-      password: 'Admin123!@#'
-    });
-
-    const token = loginResponse.data.accessToken;
-    console.log('✅ Connecté avec succès\n');
-
-    // 2. Créer un CSV booking pour tester l'envoi d'email
-    console.log('📧 Création d\'une CSV booking pour tester l\'envoi d\'email...');
-
-    const form = new FormData();
-    const testFile = Buffer.from('Test document PDF content');
-    form.append('documents', testFile, { filename: 'test-doc.pdf', contentType: 'application/pdf' });
-
-    form.append('carrierName', 'Test Carrier');
-    form.append('carrierEmail', 'testcarrier@example.com');
-    form.append('origin', 'NLRTM');
-    form.append('destination', 'USNYC');
-    form.append('volumeCBM', '25.5');
-    form.append('weightKG', '3500');
-    form.append('palletCount', '10');
-    form.append('priceUSD', '1850.50');
-    form.append('priceEUR', '1665.45');
-    form.append('primaryCurrency', 'USD');
-    form.append('transitDays', '28');
-    form.append('containerType', 'LCL');
-    form.append('notes', 'Test email');
-
-    const bookingResponse = await axios.post(`${API_URL}/csv-bookings`, form, {
-      headers: {
-        ...form.getHeaders(),
-        'Authorization': `Bearer ${token}`
-      }
-    });
-
-    console.log('✅ CSV Booking créé:', bookingResponse.data.id);
-    console.log('\n📋 VÉRIFICATIONS À FAIRE:');
-    console.log('1. Vérifier les logs du backend ci-dessus');
-    console.log('   Chercher: "Email sent to carrier: testcarrier@example.com"');
-    console.log('2. Vérifier Mailtrap inbox: https://mailtrap.io/inboxes');
-    console.log('3. Email devrait être envoyé à: testcarrier@example.com');
-    console.log('\n⏳ Attendez quelques secondes puis vérifiez les logs du backend...');
-
-  } catch (error) {
-    console.error('❌ ERREUR:');
-    if (error.response) {
-      console.error('Status:', error.response.status);
-      console.error('Data:', JSON.stringify(error.response.data, null, 2));
-    } else {
-      console.error(error.message);
-    }
-  }
-}
-
-loginAndTestEmail();

apps/backend/package-lock.json

@@ -59,9 +59,7 @@
         "reflect-metadata": "^0.1.14",
         "rxjs": "^7.8.1",
         "socket.io": "^4.8.1",
-        "stripe": "^14.14.0",
+        "typeorm": "^0.3.17"
-        "typeorm": "^0.3.17",
-        "uuid": "^9.0.1"
       },
       "devDependencies": {
         "@faker-js/faker": "^10.0.0",
@@ -83,7 +81,6 @@
         "eslint": "^8.56.0",
         "eslint-config-prettier": "^9.1.0",
         "eslint-plugin-prettier": "^5.0.1",
-        "eslint-plugin-unused-imports": "^4.3.0",
         "ioredis-mock": "^8.13.0",
         "jest": "^29.7.0",
         "prettier": "^3.1.1",
@@ -8214,22 +8211,6 @@
         }
       }
     },
-    "node_modules/eslint-plugin-unused-imports": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-unused-imports/-/eslint-plugin-unused-imports-4.3.0.tgz",
-      "integrity": "sha512-ZFBmXMGBYfHttdRtOG9nFFpmUvMtbHSjsKrS20vdWdbfiVYsO3yA2SGYy9i9XmZJDfMGBflZGBCm70SEnFQtOA==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "@typescript-eslint/eslint-plugin": "^8.0.0-0 || ^7.0.0 || ^6.0.0 || ^5.0.0",
-        "eslint": "^9.0.0 || ^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@typescript-eslint/eslint-plugin": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/eslint-scope": {
       "version": "7.2.2",
       "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.2.2.tgz",
@@ -14572,19 +14553,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/stripe": {
-      "version": "14.25.0",
-      "resolved": "https://registry.npmjs.org/stripe/-/stripe-14.25.0.tgz",
-      "integrity": "sha512-wQS3GNMofCXwH8TSje8E1SE8zr6ODiGtHQgPtO95p9Mb4FhKC9jvXR2NUTpZ9ZINlckJcFidCmaTFV4P6vsb9g==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": ">=8.1.0",
-        "qs": "^6.11.0"
-      },
-      "engines": {
-        "node": ">=12.*"
-      }
-    },
     "node_modules/strnum": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.1.1.tgz",

apps/backend/package.json

@@ -75,9 +75,7 @@
     "reflect-metadata": "^0.1.14",
     "rxjs": "^7.8.1",
     "socket.io": "^4.8.1",
-    "stripe": "^14.14.0",
+    "typeorm": "^0.3.17"
-    "typeorm": "^0.3.17",
-    "uuid": "^9.0.1"
   },
   "devDependencies": {
     "@faker-js/faker": "^10.0.0",
@@ -99,7 +97,6 @@
     "eslint": "^8.56.0",
     "eslint-config-prettier": "^9.1.0",
     "eslint-plugin-prettier": "^5.0.1",
-    "eslint-plugin-unused-imports": "^4.3.0",
     "ioredis-mock": "^8.13.0",
     "jest": "^29.7.0",
     "prettier": "^3.1.1",

apps/backend/restore-document-references.js

@@ -1,176 +0,0 @@
-/**
- * Script to restore document references in database from MinIO files
- *
- * Scans MinIO for existing files and creates/updates database references
- */
-
-const { S3Client, ListObjectsV2Command, HeadObjectCommand } = require('@aws-sdk/client-s3');
-const { Client } = require('pg');
-const { v4: uuidv4 } = require('uuid');
-require('dotenv').config();
-
-const MINIO_ENDPOINT = process.env.AWS_S3_ENDPOINT || 'http://localhost:9000';
-const BUCKET_NAME = 'xpeditis-documents';
-
-// Initialize MinIO client
-const s3Client = new S3Client({
-  region: 'us-east-1',
-  endpoint: MINIO_ENDPOINT,
-  credentials: {
-    accessKeyId: process.env.AWS_ACCESS_KEY_ID || 'minioadmin',
-    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || 'minioadmin',
-  },
-  forcePathStyle: true,
-});
-
-async function restoreDocumentReferences() {
-  const pgClient = new Client({
-    host: process.env.DATABASE_HOST || 'localhost',
-    port: process.env.DATABASE_PORT || 5432,
-    user: process.env.DATABASE_USER || 'xpeditis',
-    password: process.env.DATABASE_PASSWORD || 'xpeditis_dev_password',
-    database: process.env.DATABASE_NAME || 'xpeditis_dev',
-  });
-
-  try {
-    await pgClient.connect();
-    console.log('✅ Connected to database\n');
-
-    // Get all MinIO files
-    console.log('📋 Listing files in MinIO...');
-    let allFiles = [];
-    let continuationToken = null;
-
-    do {
-      const command = new ListObjectsV2Command({
-        Bucket: BUCKET_NAME,
-        ContinuationToken: continuationToken,
-      });
-
-      const response = await s3Client.send(command);
-
-      if (response.Contents) {
-        allFiles = allFiles.concat(response.Contents);
-      }
-
-      continuationToken = response.NextContinuationToken;
-    } while (continuationToken);
-
-    console.log(`   Found ${allFiles.length} files in MinIO\n`);
-
-    // Group files by booking ID
-    const filesByBooking = {};
-    allFiles.forEach(file => {
-      const parts = file.Key.split('/');
-      if (parts.length >= 3 && parts[0] === 'csv-bookings') {
-        const bookingId = parts[1];
-        const documentId = parts[2].split('-')[0]; // Extract UUID from filename
-        const fileName = parts[2].substring(37); // Remove UUID prefix (36 chars + dash)
-
-        if (!filesByBooking[bookingId]) {
-          filesByBooking[bookingId] = [];
-        }
-
-        filesByBooking[bookingId].push({
-          key: file.Key,
-          documentId: documentId,
-          fileName: fileName,
-          size: file.Size,
-          lastModified: file.LastModified,
-        });
-      }
-    });
-
-    console.log(`📦 Found files for ${Object.keys(filesByBooking).length} bookings\n`);
-
-    let updatedCount = 0;
-    let createdDocsCount = 0;
-
-    for (const [bookingId, files] of Object.entries(filesByBooking)) {
-      // Check if booking exists
-      const bookingResult = await pgClient.query(
-        'SELECT id, documents FROM csv_bookings WHERE id = $1',
-        [bookingId]
-      );
-
-      if (bookingResult.rows.length === 0) {
-        console.log(`⚠️  Booking not found: ${bookingId.substring(0, 8)}... (skipping)`);
-        continue;
-      }
-
-      const booking = bookingResult.rows[0];
-      const existingDocs = booking.documents || [];
-
-      console.log(`\n📦 Booking: ${bookingId.substring(0, 8)}...`);
-      console.log(`   Existing documents in DB: ${existingDocs.length}`);
-      console.log(`   Files in MinIO: ${files.length}`);
-
-      // Create document references for files
-      const newDocuments = files.map(file => {
-        // Determine MIME type from file extension
-        const ext = file.fileName.split('.').pop().toLowerCase();
-        const mimeTypeMap = {
-          pdf: 'application/pdf',
-          png: 'image/png',
-          jpg: 'image/jpeg',
-          jpeg: 'image/jpeg',
-          txt: 'text/plain',
-        };
-        const mimeType = mimeTypeMap[ext] || 'application/octet-stream';
-
-        // Determine document type
-        let docType = 'OTHER';
-        if (file.fileName.toLowerCase().includes('bill-of-lading') || file.fileName.toLowerCase().includes('bol')) {
-          docType = 'BILL_OF_LADING';
-        } else if (file.fileName.toLowerCase().includes('packing-list')) {
-          docType = 'PACKING_LIST';
-        } else if (file.fileName.toLowerCase().includes('commercial-invoice') || file.fileName.toLowerCase().includes('invoice')) {
-          docType = 'COMMERCIAL_INVOICE';
-        }
-
-        const doc = {
-          id: file.documentId,
-          type: docType,
-          fileName: file.fileName,
-          filePath: `${MINIO_ENDPOINT}/${BUCKET_NAME}/${file.key}`,
-          mimeType: mimeType,
-          size: file.size,
-          uploadedAt: file.lastModified.toISOString(),
-        };
-
-        console.log(`   ✅ ${file.fileName} (${(file.size / 1024).toFixed(2)} KB)`);
-        return doc;
-      });
-
-      // Update the booking with new document references
-      await pgClient.query(
-        'UPDATE csv_bookings SET documents = $1 WHERE id = $2',
-        [JSON.stringify(newDocuments), bookingId]
-      );
-
-      updatedCount++;
-      createdDocsCount += newDocuments.length;
-    }
-
-    console.log(`\n📊 Summary:`);
-    console.log(`   Bookings updated: ${updatedCount}`);
-    console.log(`   Document references created: ${createdDocsCount}`);
-    console.log(`\n✅ Document references restored`);
-  } catch (error) {
-    console.error('❌ Error:', error);
-    throw error;
-  } finally {
-    await pgClient.end();
-    console.log('\n👋 Disconnected from database');
-  }
-}
-
-restoreDocumentReferences()
-  .then(() => {
-    console.log('\n✅ Script completed successfully');
-    process.exit(0);
-  })
-  .catch((error) => {
-    console.error('\n❌ Script failed:', error);
-    process.exit(1);
-  });

apps/backend/scripts/list-stripe-prices.js

@@ -1,55 +0,0 @@
-/**
- * Script to list all Stripe prices
- * Run with: node scripts/list-stripe-prices.js
- */
-
-const Stripe = require('stripe');
-
-const stripe = new Stripe(process.env.STRIPE_SECRET_KEY || 'sk_test_51R8p8R4atifoBlu1U9sMJh3rkQbO1G1xeguwFMQYMIMeaLNrTX7YFO5Ovu3P1VfbwcOoEmiy6I0UWi4DThNNzHG100YF75TnJr');
-
-async function listPrices() {
-  console.log('Fetching Stripe prices...\n');
-
-  try {
-    const prices = await stripe.prices.list({ limit: 50, expand: ['data.product'] });
-
-    if (prices.data.length === 0) {
-      console.log('No prices found. You need to create prices in Stripe Dashboard.');
-      console.log('\nSteps:');
-      console.log('1. Go to https://dashboard.stripe.com/products');
-      console.log('2. Click on each product (Starter, Pro, Enterprise)');
-      console.log('3. Add a recurring price (monthly and yearly)');
-      console.log('4. Copy the Price IDs (format: price_xxxxx)');
-      return;
-    }
-
-    console.log('Available Prices:\n');
-    console.log('='.repeat(100));
-
-    for (const price of prices.data) {
-      const product = typeof price.product === 'object' ? price.product : { name: price.product };
-      const interval = price.recurring ? `${price.recurring.interval}ly` : 'one-time';
-      const amount = (price.unit_amount / 100).toFixed(2);
-
-      console.log(`Price ID:    ${price.id}`);
-      console.log(`Product:     ${product.name || product.id}`);
-      console.log(`Amount:      ${amount} ${price.currency.toUpperCase()}`);
-      console.log(`Interval:    ${interval}`);
-      console.log(`Active:      ${price.active}`);
-      console.log('-'.repeat(100));
-    }
-
-    console.log('\n\nCopy the relevant Price IDs to your .env file:');
-    console.log('STRIPE_STARTER_MONTHLY_PRICE_ID=price_xxxxx');
-    console.log('STRIPE_STARTER_YEARLY_PRICE_ID=price_xxxxx');
-    console.log('STRIPE_PRO_MONTHLY_PRICE_ID=price_xxxxx');
-    console.log('STRIPE_PRO_YEARLY_PRICE_ID=price_xxxxx');
-    console.log('STRIPE_ENTERPRISE_MONTHLY_PRICE_ID=price_xxxxx');
-    console.log('STRIPE_ENTERPRISE_YEARLY_PRICE_ID=price_xxxxx');
-
-  } catch (error) {
-    console.error('Error fetching prices:', error.message);
-  }
-}
-
-listPrices();

apps/backend/set-bucket-policy.js

@@ -1,79 +0,0 @@
-/**
- * Script to set MinIO bucket policy for public read access
- *
- * This allows documents to be downloaded directly via URL without authentication
- */
-
-const { S3Client, PutBucketPolicyCommand, GetBucketPolicyCommand } = require('@aws-sdk/client-s3');
-require('dotenv').config();
-
-const MINIO_ENDPOINT = process.env.AWS_S3_ENDPOINT || 'http://localhost:9000';
-const BUCKET_NAME = 'xpeditis-documents';
-
-// Initialize MinIO client
-const s3Client = new S3Client({
-  region: 'us-east-1',
-  endpoint: MINIO_ENDPOINT,
-  credentials: {
-    accessKeyId: process.env.AWS_ACCESS_KEY_ID || 'minioadmin',
-    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || 'minioadmin',
-  },
-  forcePathStyle: true,
-});
-
-async function setBucketPolicy() {
-  try {
-    // Policy to allow public read access to all objects in the bucket
-    const policy = {
-      Version: '2012-10-17',
-      Statement: [
-        {
-          Effect: 'Allow',
-          Principal: '*',
-          Action: ['s3:GetObject'],
-          Resource: [`arn:aws:s3:::${BUCKET_NAME}/*`],
-        },
-      ],
-    };
-
-    console.log('📋 Setting bucket policy for:', BUCKET_NAME);
-    console.log('Policy:', JSON.stringify(policy, null, 2));
-
-    // Set the bucket policy
-    await s3Client.send(
-      new PutBucketPolicyCommand({
-        Bucket: BUCKET_NAME,
-        Policy: JSON.stringify(policy),
-      })
-    );
-
-    console.log('\n✅ Bucket policy set successfully!');
-    console.log(`   All objects in ${BUCKET_NAME} are now publicly readable`);
-
-    // Verify the policy was set
-    console.log('\n🔍 Verifying bucket policy...');
-    const getPolicy = await s3Client.send(
-      new GetBucketPolicyCommand({
-        Bucket: BUCKET_NAME,
-      })
-    );
-
-    console.log('✅ Current policy:', getPolicy.Policy);
-
-    console.log('\n📝 Note: This allows public read access to all documents.');
-    console.log('   For production, consider using signed URLs instead.');
-  } catch (error) {
-    console.error('❌ Error:', error);
-    throw error;
-  }
-}
-
-setBucketPolicy()
-  .then(() => {
-    console.log('\n✅ Script completed successfully');
-    process.exit(0);
-  })
-  .catch((error) => {
-    console.error('\n❌ Script failed:', error);
-    process.exit(1);
-  });

apps/backend/setup-minio-bucket.js

@@ -1,91 +0,0 @@
-#!/usr/bin/env node
-/**
- * Setup MinIO Bucket
- *
- * Creates the required bucket for document storage if it doesn't exist
- */
-
-const { S3Client, CreateBucketCommand, HeadBucketCommand } = require('@aws-sdk/client-s3');
-require('dotenv').config();
-
-const BUCKET_NAME = 'xpeditis-documents';
-
-// Configure S3 client for MinIO
-const s3Client = new S3Client({
-  region: process.env.AWS_REGION || 'us-east-1',
-  endpoint: process.env.AWS_S3_ENDPOINT || 'http://localhost:9000',
-  credentials: {
-    accessKeyId: process.env.AWS_ACCESS_KEY_ID || 'minioadmin',
-    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || 'minioadmin',
-  },
-  forcePathStyle: true, // Required for MinIO
-});
-
-async function setupBucket() {
-  console.log('\n🪣 MinIO Bucket Setup');
-  console.log('==========================================');
-  console.log(`Bucket name: ${BUCKET_NAME}`);
-  console.log(`Endpoint: ${process.env.AWS_S3_ENDPOINT || 'http://localhost:9000'}`);
-  console.log('');
-
-  try {
-    // Check if bucket exists
-    console.log('📋 Step 1: Checking if bucket exists...');
-    try {
-      await s3Client.send(new HeadBucketCommand({ Bucket: BUCKET_NAME }));
-      console.log(`✅ Bucket '${BUCKET_NAME}' already exists`);
-      console.log('');
-      console.log('✅ Setup complete! The bucket is ready to use.');
-      process.exit(0);
-    } catch (error) {
-      if (error.name === 'NotFound' || error.$metadata?.httpStatusCode === 404) {
-        console.log(`ℹ️  Bucket '${BUCKET_NAME}' does not exist`);
-      } else {
-        throw error;
-      }
-    }
-
-    // Create bucket
-    console.log('');
-    console.log('📋 Step 2: Creating bucket...');
-    await s3Client.send(new CreateBucketCommand({ Bucket: BUCKET_NAME }));
-    console.log(`✅ Bucket '${BUCKET_NAME}' created successfully!`);
-
-    // Verify creation
-    console.log('');
-    console.log('📋 Step 3: Verifying bucket...');
-    await s3Client.send(new HeadBucketCommand({ Bucket: BUCKET_NAME }));
-    console.log(`✅ Bucket '${BUCKET_NAME}' verified!`);
-
-    console.log('');
-    console.log('==========================================');
-    console.log('✅ Setup complete! The bucket is ready to use.');
-    console.log('');
-    console.log('You can now:');
-    console.log('  1. Create CSV bookings via the frontend');
-    console.log('  2. Upload documents to this bucket');
-    console.log('  3. View files at: http://localhost:9001 (MinIO Console)');
-    console.log('');
-
-    process.exit(0);
-  } catch (error) {
-    console.error('');
-    console.error('❌ ERROR: Failed to setup bucket');
-    console.error('');
-    console.error('Error details:');
-    console.error(`  Name: ${error.name}`);
-    console.error(`  Message: ${error.message}`);
-    if (error.$metadata) {
-      console.error(`  HTTP Status: ${error.$metadata.httpStatusCode}`);
-    }
-    console.error('');
-    console.error('Common solutions:');
-    console.error('  1. Check if MinIO is running: docker ps | grep minio');
-    console.error('  2. Verify credentials in .env file');
-    console.error('  3. Ensure AWS_S3_ENDPOINT is set correctly');
-    console.error('');
-    process.exit(1);
-  }
-}
-
-setupBucket();

apps/backend/src/app.module.ts

@@ -18,17 +18,13 @@ import { NotificationsModule } from './application/notifications/notifications.m
 import { WebhooksModule } from './application/webhooks/webhooks.module';
 import { GDPRModule } from './application/gdpr/gdpr.module';
 import { CsvBookingsModule } from './application/csv-bookings.module';
-import { AdminModule } from './application/admin/admin.module';
-import { LogsModule } from './application/logs/logs.module';
-import { SubscriptionsModule } from './application/subscriptions/subscriptions.module';
-import { ApiKeysModule } from './application/api-keys/api-keys.module';
 import { CacheModule } from './infrastructure/cache/cache.module';
 import { CarrierModule } from './infrastructure/carriers/carrier.module';
 import { SecurityModule } from './infrastructure/security/security.module';
 import { CsvRateModule } from './infrastructure/carriers/csv-loader/csv-rate.module';
 
 // Import global guards
-import { ApiKeyOrJwtGuard } from './application/guards/api-key-or-jwt.guard';
+import { JwtAuthGuard } from './application/guards/jwt-auth.guard';
 import { CustomThrottlerGuard } from './application/guards/throttle.guard';
 
 @Module({
@@ -39,8 +35,6 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
       validationSchema: Joi.object({
         NODE_ENV: Joi.string().valid('development', 'production', 'test').default('development'),
         PORT: Joi.number().default(4000),
-        APP_URL: Joi.string().uri().default('http://localhost:3000'),
-        BACKEND_URL: Joi.string().uri().optional(),
         DATABASE_HOST: Joi.string().required(),
         DATABASE_PORT: Joi.number().default(5432),
         DATABASE_USER: Joi.string().required(),
@@ -52,37 +46,15 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
         JWT_SECRET: Joi.string().required(),
         JWT_ACCESS_EXPIRATION: Joi.string().default('15m'),
         JWT_REFRESH_EXPIRATION: Joi.string().default('7d'),
-        // SMTP Configuration
-        SMTP_HOST: Joi.string().required(),
-        SMTP_PORT: Joi.number().default(2525),
-        SMTP_USER: Joi.string().required(),
-        SMTP_PASS: Joi.string().required(),
-        SMTP_FROM: Joi.string().email().default('noreply@xpeditis.com'),
-        SMTP_SECURE: Joi.boolean().default(false),
-        // Stripe Configuration (optional for development)
-        STRIPE_SECRET_KEY: Joi.string().optional(),
-        STRIPE_WEBHOOK_SECRET: Joi.string().optional(),
-        STRIPE_SILVER_MONTHLY_PRICE_ID: Joi.string().optional(),
-        STRIPE_SILVER_YEARLY_PRICE_ID: Joi.string().optional(),
-        STRIPE_GOLD_MONTHLY_PRICE_ID: Joi.string().optional(),
-        STRIPE_GOLD_YEARLY_PRICE_ID: Joi.string().optional(),
-        STRIPE_PLATINIUM_MONTHLY_PRICE_ID: Joi.string().optional(),
-        STRIPE_PLATINIUM_YEARLY_PRICE_ID: Joi.string().optional(),
-        LOG_EXPORTER_URL: Joi.string().uri().default('http://xpeditis-log-exporter:3200'),
       }),
     }),
 
     // Logging
     LoggerModule.forRootAsync({
-      useFactory: (configService: ConfigService) => {
+      useFactory: (configService: ConfigService) => ({
-        const isDev = configService.get('NODE_ENV') === 'development';
-        // LOG_FORMAT=json forces structured JSON output (e.g. inside Docker + Promtail)
-        const forceJson = configService.get('LOG_FORMAT') === 'json';
-        const usePretty = isDev && !forceJson;
-
-        return {
         pinoHttp: {
-            transport: usePretty
+          transport:
+            configService.get('NODE_ENV') === 'development'
               ? {
                   target: 'pino-pretty',
                   options: {
@@ -92,21 +64,9 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
                   },
                 }
               : undefined,
-            level: isDev ? 'debug' : 'info',
+          level: configService.get('NODE_ENV') === 'production' ? 'info' : 'debug',
-            // Redact sensitive fields from logs
-            redact: {
-              paths: [
-                'req.headers.authorization',
-                'req.headers["x-api-key"]',
-                'req.body.password',
-                'req.body.currentPassword',
-                'req.body.newPassword',
-              ],
-              censor: '[REDACTED]',
-            },
-          },
-        };
         },
+      }),
       inject: [ConfigService],
     }),
 
@@ -146,18 +106,14 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
     NotificationsModule,
     WebhooksModule,
     GDPRModule,
-    AdminModule,
-    SubscriptionsModule,
-    ApiKeysModule,
-    LogsModule,
   ],
   controllers: [],
   providers: [
-    // Global authentication guard — supports both JWT (frontend) and API key (Gold/Platinium)
+    // Global JWT authentication guard
     // All routes are protected by default, use @Public() to bypass
     {
       provide: APP_GUARD,
-      useClass: ApiKeyOrJwtGuard,
+      useClass: JwtAuthGuard,
     },
     // Global rate limiting guard
     {

apps/backend/src/application/admin/admin.module.ts

@@ -1,62 +0,0 @@
-import { Module } from '@nestjs/common';
-import { TypeOrmModule } from '@nestjs/typeorm';
-import { ConfigModule } from '@nestjs/config';
-
-// Controller
-import { AdminController } from '../controllers/admin.controller';
-
-// ORM Entities
-import { UserOrmEntity } from '@infrastructure/persistence/typeorm/entities/user.orm-entity';
-import { OrganizationOrmEntity } from '@infrastructure/persistence/typeorm/entities/organization.orm-entity';
-import { CsvBookingOrmEntity } from '@infrastructure/persistence/typeorm/entities/csv-booking.orm-entity';
-
-// Repositories
-import { TypeOrmUserRepository } from '@infrastructure/persistence/typeorm/repositories/typeorm-user.repository';
-import { TypeOrmOrganizationRepository } from '@infrastructure/persistence/typeorm/repositories/typeorm-organization.repository';
-import { TypeOrmCsvBookingRepository } from '@infrastructure/persistence/typeorm/repositories/csv-booking.repository';
-
-// Repository tokens
-import { USER_REPOSITORY } from '@domain/ports/out/user.repository';
-import { ORGANIZATION_REPOSITORY } from '@domain/ports/out/organization.repository';
-
-// SIRET verification
-import { SIRET_VERIFICATION_PORT } from '@domain/ports/out/siret-verification.port';
-import { PappersSiretAdapter } from '@infrastructure/external/pappers-siret.adapter';
-
-// CSV Booking Service
-import { CsvBookingsModule } from '../csv-bookings.module';
-
-// Email
-import { EmailModule } from '@infrastructure/email/email.module';
-
-/**
- * Admin Module
- *
- * Provides admin-only endpoints for managing all data in the system.
- * All endpoints require ADMIN role.
- */
-@Module({
-  imports: [
-    TypeOrmModule.forFeature([UserOrmEntity, OrganizationOrmEntity, CsvBookingOrmEntity]),
-    ConfigModule,
-    CsvBookingsModule,
-    EmailModule,
-  ],
-  controllers: [AdminController],
-  providers: [
-    {
-      provide: USER_REPOSITORY,
-      useClass: TypeOrmUserRepository,
-    },
-    {
-      provide: ORGANIZATION_REPOSITORY,
-      useClass: TypeOrmOrganizationRepository,
-    },
-    TypeOrmCsvBookingRepository,
-    {
-      provide: SIRET_VERIFICATION_PORT,
-      useClass: PappersSiretAdapter,
-    },
-  ],
-})
-export class AdminModule {}

apps/backend/src/application/api-keys/api-keys.controller.ts

@@ -1,81 +0,0 @@
-import {
-  Body,
-  Controller,
-  Delete,
-  Get,
-  HttpCode,
-  HttpStatus,
-  Param,
-  ParseUUIDPipe,
-  Post,
-  UseGuards,
-} from '@nestjs/common';
-import {
-  ApiBearerAuth,
-  ApiOperation,
-  ApiResponse,
-  ApiSecurity,
-  ApiTags,
-} from '@nestjs/swagger';
-
-import { CurrentUser } from '../decorators/current-user.decorator';
-import { RequiresFeature } from '../decorators/requires-feature.decorator';
-import { FeatureFlagGuard } from '../guards/feature-flag.guard';
-
-import { ApiKeysService } from './api-keys.service';
-import { CreateApiKeyDto, ApiKeyDto, CreateApiKeyResultDto } from '../dto/api-key.dto';
-
-@ApiTags('API Keys')
-@ApiBearerAuth()
-@ApiSecurity('x-api-key')
-@UseGuards(FeatureFlagGuard)
-@RequiresFeature('api_access')
-@Controller('api-keys')
-export class ApiKeysController {
-  constructor(private readonly apiKeysService: ApiKeysService) {}
-
-  @Post()
-  @ApiOperation({
-    summary: 'Générer une nouvelle clé API',
-    description:
-      "Crée une clé API pour accès programmatique. La clé complète est retournée **une seule fois** — conservez-la immédiatement. Réservé aux abonnements Gold et Platinium.",
-  })
-  @ApiResponse({
-    status: 201,
-    description: 'Clé créée avec succès. La clé complète est dans le champ `fullKey`.',
-    type: CreateApiKeyResultDto,
-  })
-  @ApiResponse({ status: 403, description: 'Abonnement Gold ou Platinium requis' })
-  async create(
-    @CurrentUser() user: { id: string; organizationId: string },
-    @Body() dto: CreateApiKeyDto
-  ): Promise<CreateApiKeyResultDto> {
-    return this.apiKeysService.generateApiKey(user.id, user.organizationId, dto);
-  }
-
-  @Get()
-  @ApiOperation({
-    summary: 'Lister les clés API',
-    description:
-      "Retourne toutes les clés API de l'organisation. Les clés complètes ne sont jamais exposées — uniquement le préfixe.",
-  })
-  @ApiResponse({ status: 200, type: [ApiKeyDto] })
-  async list(@CurrentUser() user: { organizationId: string }): Promise<ApiKeyDto[]> {
-    return this.apiKeysService.listApiKeys(user.organizationId);
-  }
-
-  @Delete(':id')
-  @HttpCode(HttpStatus.NO_CONTENT)
-  @ApiOperation({
-    summary: 'Révoquer une clé API',
-    description: 'Désactive immédiatement la clé API. Cette action est irréversible.',
-  })
-  @ApiResponse({ status: 204, description: 'Clé révoquée' })
-  @ApiResponse({ status: 404, description: 'Clé introuvable' })
-  async revoke(
-    @CurrentUser() user: { organizationId: string },
-    @Param('id', ParseUUIDPipe) keyId: string
-  ): Promise<void> {
-    return this.apiKeysService.revokeApiKey(keyId, user.organizationId);
-  }
-}

apps/backend/src/application/api-keys/api-keys.module.ts

@@ -1,45 +0,0 @@
-import { Module } from '@nestjs/common';
-import { TypeOrmModule } from '@nestjs/typeorm';
-
-import { ApiKeysController } from './api-keys.controller';
-import { ApiKeysService } from './api-keys.service';
-
-// ORM Entities
-import { ApiKeyOrmEntity } from '@infrastructure/persistence/typeorm/entities/api-key.orm-entity';
-import { UserOrmEntity } from '@infrastructure/persistence/typeorm/entities/user.orm-entity';
-
-// Repositories
-import { TypeOrmApiKeyRepository } from '@infrastructure/persistence/typeorm/repositories/typeorm-api-key.repository';
-import { TypeOrmUserRepository } from '@infrastructure/persistence/typeorm/repositories/typeorm-user.repository';
-
-// Repository tokens
-import { API_KEY_REPOSITORY } from '@domain/ports/out/api-key.repository';
-import { USER_REPOSITORY } from '@domain/ports/out/user.repository';
-
-// Subscriptions (provides SUBSCRIPTION_REPOSITORY)
-import { SubscriptionsModule } from '../subscriptions/subscriptions.module';
-
-// Feature flag guard needs SubscriptionRepository (injected via SubscriptionsModule)
-import { FeatureFlagGuard } from '../guards/feature-flag.guard';
-
-@Module({
-  imports: [
-    TypeOrmModule.forFeature([ApiKeyOrmEntity, UserOrmEntity]),
-    SubscriptionsModule,
-  ],
-  controllers: [ApiKeysController],
-  providers: [
-    ApiKeysService,
-    FeatureFlagGuard,
-    {
-      provide: API_KEY_REPOSITORY,
-      useClass: TypeOrmApiKeyRepository,
-    },
-    {
-      provide: USER_REPOSITORY,
-      useClass: TypeOrmUserRepository,
-    },
-  ],
-  exports: [ApiKeysService],
-})
-export class ApiKeysModule {}

apps/backend/src/application/api-keys/api-keys.service.ts

@@ -1,200 +0,0 @@
-/**
- * ApiKeys Service
- *
- * Manages API key lifecycle:
- * - Generation (GOLD/PLATINIUM subscribers only)
- * - Listing (masked — prefix only)
- * - Revocation
- * - Validation for inbound API key authentication
- */
-
-import {
-  ForbiddenException,
-  Inject,
-  Injectable,
-  Logger,
-  NotFoundException,
-} from '@nestjs/common';
-import * as crypto from 'crypto';
-import { v4 as uuidv4 } from 'uuid';
-
-import { ApiKey } from '@domain/entities/api-key.entity';
-import { ApiKeyRepository, API_KEY_REPOSITORY } from '@domain/ports/out/api-key.repository';
-import { UserRepository, USER_REPOSITORY } from '@domain/ports/out/user.repository';
-import {
-  SubscriptionRepository,
-  SUBSCRIPTION_REPOSITORY,
-} from '@domain/ports/out/subscription.repository';
-
-import { CreateApiKeyDto, ApiKeyDto, CreateApiKeyResultDto } from '../dto/api-key.dto';
-
-/** Shape of request.user populated when an API key is used. */
-export interface ApiKeyUserContext {
-  id: string;
-  email: string;
-  role: string;
-  organizationId: string;
-  firstName: string;
-  lastName: string;
-  plan: string;
-  planFeatures: string[];
-}
-
-const KEY_PREFIX_DISPLAY_LENGTH = 18; // "xped_live_" (10) + 8 hex chars
-
-@Injectable()
-export class ApiKeysService {
-  private readonly logger = new Logger(ApiKeysService.name);
-
-  constructor(
-    @Inject(API_KEY_REPOSITORY)
-    private readonly apiKeyRepository: ApiKeyRepository,
-    @Inject(USER_REPOSITORY)
-    private readonly userRepository: UserRepository,
-    @Inject(SUBSCRIPTION_REPOSITORY)
-    private readonly subscriptionRepository: SubscriptionRepository
-  ) {}
-
-  /**
-   * Generate a new API key for the given user / organisation.
-   * The full raw key is returned exactly once — it is never persisted.
-   */
-  async generateApiKey(
-    userId: string,
-    organizationId: string,
-    dto: CreateApiKeyDto
-  ): Promise<CreateApiKeyResultDto> {
-    await this.assertApiAccessPlan(organizationId);
-
-    const rawKey = this.buildRawKey();
-    const keyHash = this.hashKey(rawKey);
-    const keyPrefix = rawKey.substring(0, KEY_PREFIX_DISPLAY_LENGTH);
-
-    const apiKey = ApiKey.create({
-      id: uuidv4(),
-      organizationId,
-      userId,
-      name: dto.name,
-      keyHash,
-      keyPrefix,
-      expiresAt: dto.expiresAt ? new Date(dto.expiresAt) : null,
-    });
-
-    const saved = await this.apiKeyRepository.save(apiKey);
-
-    this.logger.log(`API key created: ${saved.id} for org ${organizationId}`);
-
-    return {
-      id: saved.id,
-      name: saved.name,
-      keyPrefix: saved.keyPrefix,
-      isActive: saved.isActive,
-      lastUsedAt: saved.lastUsedAt,
-      expiresAt: saved.expiresAt,
-      createdAt: saved.createdAt,
-      fullKey: rawKey,
-    };
-  }
-
-  /**
-   * List all API keys for an organisation. Never exposes key hashes.
-   */
-  async listApiKeys(organizationId: string): Promise<ApiKeyDto[]> {
-    const keys = await this.apiKeyRepository.findByOrganizationId(organizationId);
-    return keys.map(k => this.toDto(k));
-  }
-
-  /**
-   * Revoke (deactivate) an API key.
-   */
-  async revokeApiKey(keyId: string, organizationId: string): Promise<void> {
-    const key = await this.apiKeyRepository.findById(keyId);
-
-    if (!key || key.organizationId !== organizationId) {
-      throw new NotFoundException('Clé API introuvable');
-    }
-
-    const revoked = key.revoke();
-    await this.apiKeyRepository.save(revoked);
-
-    this.logger.log(`API key revoked: ${keyId} for org ${organizationId}`);
-  }
-
-  /**
-   * Validate an inbound raw API key and return the user context.
-   * Returns null if the key is invalid, expired, or the plan is insufficient.
-   * Also asynchronously updates lastUsedAt.
-   */
-  async validateAndGetUser(rawKey: string): Promise<ApiKeyUserContext | null> {
-    if (!rawKey?.startsWith('xped_live_')) return null;
-
-    const keyHash = this.hashKey(rawKey);
-    const apiKey = await this.apiKeyRepository.findByKeyHash(keyHash);
-
-    if (!apiKey || !apiKey.isValid()) return null;
-
-    // Real-time plan check — in case the org downgraded after key creation
-    const subscription = await this.subscriptionRepository.findByOrganizationId(
-      apiKey.organizationId
-    );
-
-    if (!subscription || !subscription.hasFeature('api_access')) {
-      this.logger.warn(
-        `API key used but org ${apiKey.organizationId} no longer has api_access feature`
-      );
-      return null;
-    }
-
-    // Update lastUsedAt asynchronously — don't block the request
-    this.apiKeyRepository
-      .save(apiKey.recordUsage())
-      .catch(err => this.logger.warn(`Failed to update lastUsedAt for key ${apiKey.id}: ${err}`));
-
-    const user = await this.userRepository.findById(apiKey.userId);
-    if (!user || !user.isActive) return null;
-
-    return {
-      id: user.id,
-      email: user.email,
-      role: user.role,
-      organizationId: user.organizationId,
-      firstName: user.firstName,
-      lastName: user.lastName,
-      plan: subscription.plan.value,
-      planFeatures: [...subscription.plan.planFeatures],
-    };
-  }
-
-  // ── Helpers ─────────────────────────────────────────────────────────────
-
-  private async assertApiAccessPlan(organizationId: string): Promise<void> {
-    const subscription = await this.subscriptionRepository.findByOrganizationId(organizationId);
-
-    if (!subscription || !subscription.hasFeature('api_access')) {
-      throw new ForbiddenException(
-        "L'accès API nécessite un abonnement Gold ou Platinium. Mettez à niveau votre abonnement pour générer des clés API."
-      );
-    }
-  }
-
-  /** Format: xped_live_<64 random hex chars> */
-  private buildRawKey(): string {
-    return `xped_live_${crypto.randomBytes(32).toString('hex')}`;
-  }
-
-  private hashKey(rawKey: string): string {
-    return crypto.createHash('sha256').update(rawKey).digest('hex');
-  }
-
-  private toDto(apiKey: ApiKey): ApiKeyDto {
-    return {
-      id: apiKey.id,
-      name: apiKey.name,
-      keyPrefix: apiKey.keyPrefix,
-      isActive: apiKey.isActive,
-      lastUsedAt: apiKey.lastUsedAt,
-      expiresAt: apiKey.expiresAt,
-      createdAt: apiKey.createdAt,
-    };
-  }
-}

apps/backend/src/application/auth/auth.module.ts

@@ -17,11 +17,9 @@ import { TypeOrmInvitationTokenRepository } from '../../infrastructure/persisten
 import { UserOrmEntity } from '../../infrastructure/persistence/typeorm/entities/user.orm-entity';
 import { OrganizationOrmEntity } from '../../infrastructure/persistence/typeorm/entities/organization.orm-entity';
 import { InvitationTokenOrmEntity } from '../../infrastructure/persistence/typeorm/entities/invitation-token.orm-entity';
-import { PasswordResetTokenOrmEntity } from '../../infrastructure/persistence/typeorm/entities/password-reset-token.orm-entity';
 import { InvitationService } from '../services/invitation.service';
 import { InvitationsController } from '../controllers/invitations.controller';
 import { EmailModule } from '../../infrastructure/email/email.module';
-import { SubscriptionsModule } from '../subscriptions/subscriptions.module';
 
 @Module({
   imports: [
@@ -41,13 +39,10 @@ import { SubscriptionsModule } from '../subscriptions/subscriptions.module';
     }),
 
     // 👇 Add this to register TypeORM repositories
-    TypeOrmModule.forFeature([UserOrmEntity, OrganizationOrmEntity, InvitationTokenOrmEntity, PasswordResetTokenOrmEntity]),
+    TypeOrmModule.forFeature([UserOrmEntity, OrganizationOrmEntity, InvitationTokenOrmEntity]),
 
     // Email module for sending invitations
     EmailModule,
-
-    // Subscriptions module for license checks
-    SubscriptionsModule,
   ],
   controllers: [AuthController, InvitationsController],
   providers: [