From 943c6afe2863e01121d4106dda7e38f7fccc8641 Mon Sep 17 00:00:00 2001
From: Imugiii <corentin.jog@gmail.com>
Date: Tue, 16 Jun 2026 12:06:13 +0000
Subject: [PATCH] fix(admin): lien decouvrable vers la page de definition du
 PIN

La page self-service /admin/profile/pin (definir/changer son PIN d'action
sensible) existait mais n'etait liee nulle part : joignable seulement par URL
directe -> capacite non decouvrable. Ajout d'un lien dans le menu utilisateur
de la topbar (au-dessus de la deconnexion, separateur). Styles existants
(.dropdown-menu a, .divider). Assertion de rendu ajoutee a DashboardControllerTest.
---
 src/app/Views/admin/layout.php               | 2 ++
 tests/Unit/Admin/DashboardControllerTest.php | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/src/app/Views/admin/layout.php b/src/app/Views/admin/layout.php
index ea84009..b115ae1 100644
--- a/src/app/Views/admin/layout.php
+++ b/src/app/Views/admin/layout.php
@@ -79,6 +79,8 @@ $navClass = static function (string $code, string $current): string {
                     </div>
                 </button>
                 <div class="dropdown-menu" id="userMenu">
+                    <a href="/admin/profile/pin">Mon PIN d'action sensible</a>
+                    <div class="divider"></div>
                     <form method="post" action="/logout">
                         <input type="hidden" name="_csrf" value="<?= $csrf ?>">
                         <button class="danger" type="submit">Se deconnecter</button>
diff --git a/tests/Unit/Admin/DashboardControllerTest.php b/tests/Unit/Admin/DashboardControllerTest.php
index e161e8d..9408282 100644
--- a/tests/Unit/Admin/DashboardControllerTest.php
+++ b/tests/Unit/Admin/DashboardControllerTest.php
@@ -157,6 +157,9 @@ final class DashboardControllerTest extends TestCase
         // Deconnexion = formulaire POST avec CSRF.
         self::assertStringContainsString('action="/logout"', $body);
         self::assertStringContainsString('name="_csrf"', $body);
+        // Le menu utilisateur rend la page self-service du PIN (decouvrable, pas
+        // seulement par URL directe).
+        self::assertStringContainsString('/admin/profile/pin', $body);
     }
 
     public function testForbiddenWhenPermissionDenied(): void