Commit graph

8 commits

Author SHA1 Message Date
Imugiii
693e4a03bf feat(auth): envoi reel de l'email de reset via relais SMTP (Brevo)
All checks were successful
CI / secret-scan (pull_request) Successful in 15s
CI / php-lint (pull_request) Successful in 28s
CI / static-tests (pull_request) Successful in 1m6s
CI / js-tests (pull_request) Successful in 40s
CI / secret-scan (push) Successful in 14s
CI / php-lint (push) Successful in 33s
CI / static-tests (push) Successful in 1m11s
CI / js-tests (push) Successful in 38s
Client SMTP maison (zero lib, contrainte from-scratch) : ESMTP + STARTTLS +
AUTH LOGIN, conduit par SmtpClient contre un SmtpTransport injectable (seam de
test). SmtpMailer assemble un message text/plain UTF-8 (dot-stuffing, en-tetes
RFC2047) et implemente l'interface Mailer existante. PasswordResetController
choisit SmtpMailer si SMTP_HOST+USER+PASSWORD presents, sinon garde LogMailer
(dev sans infra mail inchange).

STARTTLS exige avant AUTH (pas d'auth en clair). Garde anti-injection CRLF sur
les adresses (SmtpClient) + filter_var du destinataire (SmtpMailer). readReply
borne (anti-boucle sur reponse malformee). Secrets uniquement en .env (hote) :
placeholders dans .env.example / .env.prod.example, rien de versionne.

Revue compliance : verdict block initial (injection CRLF + readReply non borne),
2 must_fix corriges + tests de regression. 8 tests SMTP, 429 total, PHPStan L6.
2026-06-23 13:31:47 +00:00
9d75fabdca chore(docker): docker-compose.yml standalone portable + .env local-first (#41)
All checks were successful
CI / secret-scan (push) Successful in 9s
CI / js-tests (push) Successful in 22s
CI / php-lint (push) Successful in 22s
CI / static-tests (push) Successful in 50s
CI / auto-merge (push) Has been skipped
2026-06-17 15:31:57 +02:00
e613adc24a chore: remplace le Makefile par un service compose wakdo-migrate (migrate + seed idempotents) (#40)
All checks were successful
CI / static-tests (push) Successful in 46s
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 20s
CI / js-tests (push) Successful in 21s
CI / auto-merge (push) Has been skipped
2026-06-17 15:07:05 +02:00
656c7a2f3d fix(auth): retire le bouton mort PASSWORD_ALGO (argon2id fixe dans le code) (#29)
Some checks failed
CI / secret-scan (push) Has been cancelled
CI / php-lint (push) Has been cancelled
CI / static-tests (push) Has been cancelled
CI / auto-merge (push) Has been cancelled
2026-06-16 14:21:09 +02:00
ad5203d3fc feat(admin): throttle du PIN d action sensible par acteur (RG-T22) (#18)
All checks were successful
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 20s
CI / static-tests (push) Successful in 32s
CI / auto-merge (push) Has been skipped
2026-06-16 00:06:33 +02:00
7c35f8e2dc feat: PIN d action sensible P2 (PinVerifier RG-T13) (#13)
All checks were successful
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 16s
CI / static-tests (push) Successful in 30s
CI / auto-merge (push) Has been skipped
2026-06-15 21:00:11 +02:00
32ff6a63ba P1 conception: security-by-design layer (Merise 21 entities, Forgejo CI/CD, hardening) (#3)
All checks were successful
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 16s
CI / static-tests (push) Successful in 4s
2026-06-15 12:16:11 +02:00
Imugiii
32924a5813 chore(docker): add env template, dockerignore and Makefile scaffold
.env.example : template neutre (kiosk.example.com / admin.example.com /
traefik_proxy, RFC 2606 pour le domaine), a editer par l'utilisateur.
Variables DB_*, SESSION_*, CORS_*, APP_URL_*, TRAEFIK_DOMAIN_*,
REVERSE_PROXY_NETWORK. Aucune information de prod (FQDN, noms de reseau)
n'est exposee dans ce template committe.

.dockerignore : exclusion du contexte de build des artefacts non
pertinents ou sensibles (git, docs, tests, .claude, _byan, secrets,
node_modules, logs, volumes locaux).

Makefile : orchestration en une seule commande conforme Cr RNCP 7.c.4.
- Charge .env automatiquement avec export vers l'environnement shell
- Cible check-env valide la presence des 8 variables critiques Wakdo
  et guide l'utilisateur vers un merge plutot qu'un ecrasement si un
  .env pre-existant (tooling externe) est detecte incomplet
- Cible init enchaine .env check -> check-env -> reseau proxy ->
  build -> up -> wait-db -> migrate -> status final
- Verification du reseau REVERSE_PROXY_NETWORK avec message d'aide
  precis si absent (sans auto-creation silencieuse : l'utilisateur
  decide soit d'adapter la variable soit de creer le reseau)
- Cibles secondaires : up / down / stop / restart / build / rebuild,
  logs(-app|-web|-db), shell-(app|db|cron), wait-db, migrate, seed,
  backup, test(-unit|-integration), lint, clean (interactif),
  clean-force (CI), install-hooks. Aide auto-generee via make help.

Les cibles marquees [a venir] seront completees lors des phases
correspondantes (P2 back squelette, P6 tests, P7 DevOps finalisation).
2026-04-24 09:50:59 +00:00