Commit graph

62 commits

Author SHA1 Message Date
Imugiii
d555988b81 Merge remote-tracking branch 'origin/dev' into feat/p1-conception
# Conflicts:
#	.forgejo/workflows/ci.yml
2026-06-15 10:11:37 +00:00
Imugiii
371c029e8a docs(merise): replace stale v0.1 drawio with per-subdomain Mermaid + SVG (21 entities)
All checks were successful
CI / secret-scan (push) Successful in 7s
CI / php-lint (push) Successful in 16s
CI / static-tests (push) Successful in 4s
2026-06-15 10:11:04 +00:00
822fdc1bc4 ci: add Forgejo Actions pipeline + gitleaks secret-scan (#2)
All checks were successful
CI / secret-scan (push) Successful in 7s
CI / php-lint (push) Successful in 15s
CI / static-tests (push) Successful in 6s
2026-06-15 12:01:31 +02:00
Imugiii
f65daf3a27 ci: trigger first Forgejo Actions run (actions enabled on prod)
All checks were successful
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 17s
CI / static-tests (push) Successful in 4s
2026-06-15 09:41:02 +00:00
Imugiii
6cccaf8ad7 ci: scope push trigger to dev/main + feature branches (final)
All checks were successful
CI / secret-scan (push) Successful in 21s
CI / php-lint (push) Successful in 19s
CI / static-tests (push) Successful in 4s
2026-06-15 08:36:24 +00:00
Imugiii
7a10e2519a ci: trigger on any push (diagnostic - will scope down once dispatch confirmed)
Some checks are pending
CI / secret-scan (push) Waiting to run
CI / php-lint (push) Waiting to run
CI / static-tests (push) Waiting to run
2026-06-15 08:34:50 +00:00
Imugiii
a5058c02cd ci: also run CI on push to feat/fix/ci/refactor branches (pre-PR feedback)
Some checks are pending
CI / secret-scan (push) Waiting to run
CI / php-lint (push) Waiting to run
CI / static-tests (push) Waiting to run
2026-06-15 08:33:01 +00:00
Imugiii
84ed730e8d ci(security): Forgejo Actions CI (gitleaks + php-lint + guarded phpstan/phpunit), SECURITY.md, PR auto-merge script 2026-06-15 08:32:06 +00:00
Imugiii
bf82ba25e6 ci(security): gitleaks config, branch-protection script, Forgejo runner setup doc 2026-06-15 08:27:34 +00:00
Imugiii
2d33e9d442 chore(security): SbD parameters in .env.example + hardened php.ini 2026-06-15 08:27:34 +00:00
Imugiii
fae5c23722 docs(uml): add security sequence + v0.2 drift fixes (sequence, state, use-cases) 2026-06-15 08:04:13 +00:00
Imugiii
d305a095fc docs(context): align CI/CD on Forgejo Actions, integrate security-by-design layer, rechiffer planning 2026-06-15 08:04:13 +00:00
Imugiii
5c34f6b2e3 docs(merise): add security-by-design treatment rules to MLT
Transverse rules RG-T13-T21 (PIN, audit, escaping, allowlists, idempotency, atomic stock
decrement, computed availability); RGPD erasure and password reset flows; per-IP
login_throttle table with daily purge cron; atomic stock decrement replaces pessimistic
FOR UPDATE.
2026-06-12 09:29:51 +00:00
Imugiii
0f57a44a75 docs(merise): add security-by-design operations to MCT
ERASE_USER_PII (RGPD anonymisation) and RESET_PASSWORD; PIN-gated sensitive set writing
audit_log; auth throttling via login_throttle; computed product availability on catalogue
read. Cross-validation 21/21.
2026-06-12 09:29:51 +00:00
Imugiii
14348ba340 docs(merise): add security-by-design tables to MLD
audit_log + login_throttle tables; user auth/PIN/anonymisation columns; customer_order
acting_user_id + idempotency_key; ingredient percentage stock columns (drop CHECK
stock_quantity >= 0, add stock_capacity, low_stock_pct, critical_stock_pct). 21 tables.
2026-06-12 09:29:51 +00:00
Imugiii
a1692b6b80 docs(merise): extend MCD with security-by-design entities and percentage stock model
Adds audit_log + login_throttle; security columns on user/customer_order; fixes
product_ingredient drift (quantity -> quantity_normal/quantity_maxi); percentage stock
model and computed product availability. 21 entities, cross-validation 21/21.
2026-06-12 09:29:51 +00:00
Imugiii
fadf0bd630 docs(merise): add security-by-design layer to data dictionary
Adds audit_log (20) and login_throttle (21); user auth lifecycle (pin_hash,
failed_login_attempts, lockout_until, reset token, anonymized_at); customer_order
acting_user_id + idempotency_key; percentage stock model on ingredient (signed
stock_quantity, stock_capacity, low_stock_pct, critical_stock_pct). 21 entities.
2026-06-12 09:29:51 +00:00
Imugiii
971ce0c7d0 chore: add Forgejo PR template (BYAN conventions) 2026-06-04 15:31:38 +00:00
Imugiii
a3eae01906
Merge pull request #6 from AcadeNice/feat/p3-admin-shell
feat(admin): admin back-office visual shell (P3 scaffold)
2026-06-04 17:28:31 +02:00
Imugiii
803b840536
Merge pull request #4 from AcadeNice/feat/p5-front-landing
feat(front): P5 kiosk complete flow with vanilla JS and JSON fallback
2026-06-04 17:28:13 +02:00
Imugiii
a9938b6e5c
Merge pull request #5 from AcadeNice/feat/p1-conception
docs(merise): MCD diagrams in drawio XML (4 files)
2026-06-04 17:27:52 +02:00
Imugiii
392ba9a040 docs(merise): rewrite MLT to prod-like v0.2 (logical treatment rules)
service_day 10h cutoff, VAT snapshot by line, drive cross-constraint, atomic stock
decrement/re-credit, optimistic concurrency on status, dashboard filter by role_visible_source,
Maxi format multiplier (quantity_normal/quantity_maxi).
2026-06-04 15:17:33 +00:00
Imugiii
6057ef990f docs(merise): rewrite MCT to prod-like v0.2 (4-state machine)
Drop MARK_IN_PREPARATION / MARK_READY; DELIVER_ORDER as single counter/drive gesture.
Add stock operations (sale decrement, restock, inventory_correction) and RBAC operations.
Actors: 5 seed roles + customer.
2026-06-04 15:17:33 +00:00
Imugiii
36332b4284 docs(merise): rewrite MLD to prod-like v0.2 (19 tables)
Polymorphic order_item (exclusivity CHECK), composite-PK join tables, service_day as
query-time CASE (10h cutoff, generated column dropped), line-by-line VAT, ON DELETE rules,
recommended indexes.
2026-06-04 15:17:33 +00:00
Imugiii
6c1cede3f0 docs(merise): rewrite MCD to prod-like v0.2 (19 entities across 4 subdomains)
Catalogue / Ingredients and Stock / Order / RBAC subdomains, Mermaid erDiagram inline,
Merise (min,max) cardinality tables, cross-validation 19/19.
2026-06-04 15:17:33 +00:00
Imugiii
6ceebf7fb1 docs(merise): rewrite data dictionary to prod-like v0.2 (19 entities, English)
Drop commande_event and menu_produit. Add ingredient configurator (ingredient,
product_ingredient, allergen, ingredient_allergen), numeric stock (stock_movement),
customizable menus (menu_slot, menu_slot_option, order_item_selection, order_item_modifier),
RBAC role attributes (default_route, order_source) and role_visible_source. VAT carried by
product (vat_rate), 4-state order machine, English snake_case naming. Decisions D1-D8 + stock.
2026-06-04 15:17:33 +00:00
Imugiii
de355da54c docs: journal entry for 2026-06-04 prod-like conception decisions
Records the alignment review of all project docs and the point-by-point
decision session: drop commande_event, English naming convention, VAT
carried by product (after BOFiP fact-check), real menu customization,
full ingredient configurator, allergen modal. Lists open points D4-D8.
2026-06-04 10:19:25 +00:00
Imugiii
b8cb3ef68d docs(merise): commit P1 conception v0.1 (dictionary, MCD, MCT, MLT, MLD) + UML
Baseline of the P1 conception work produced over sessions 5-7 (was
uncommitted in the working tree). 11-entity model, French naming.
Superseded next by the prod-like revision (English, ~16 entities) per
the 2026-06-04 decision session - this commit preserves the baseline
in history before that rewrite.
2026-06-04 10:19:25 +00:00
Imugiii
17b792acfa feat(admin): vanilla JS for dropdowns, sortable tables, inline search 2026-05-09 09:27:51 +00:00
Imugiii
199d926903 feat(admin): orders, kitchen view, users pages with realistic placeholders 2026-05-09 09:27:48 +00:00
Imugiii
447cc598f6 feat(admin): catalogue page with tabs categories/products/menus 2026-05-09 09:27:45 +00:00
Imugiii
b9a5414c37 feat(admin): dashboard with KPI cards and recent orders table 2026-05-09 09:27:42 +00:00
Imugiii
0b028e534b feat(admin): admin design system CSS (palette, typography, components) 2026-05-09 09:27:40 +00:00
Imugiii
6f07238569 feat(admin): scaffold login screen and admin layout shell (sidebar, topbar) 2026-05-09 09:27:38 +00:00
Imugiii
c9fafd1c78 feat(front): render menu composition breakdown in cart lines with supplement total 2026-05-09 09:18:56 +00:00
Imugiii
e64adb60d3 feat(front): add menu composer multi-step logic and burger pre-selection 2026-05-09 09:18:49 +00:00
Imugiii
ad0b59a668 feat(front): extend cart state for menu composition with size supplements 2026-05-09 09:18:47 +00:00
Imugiii
6db68da0f9 feat(front): add menu composer modal HTML structure and CSS 2026-05-09 09:18:42 +00:00
Imugiii
6a7e772646 feat(front): extend CSS design system for P5 new screens
Adds components (sections 7-13 in style.css):
- Shared: .btn, .mode-badge, .cart-badge, .site-header__cart
- products page: .products-grid, .product-card (3-col grid)
- product detail: .product-detail, skeleton animation, composition block
- cart: .cart-line, .qty-btn, .cart-summary
- payment: .payment-choice with inline SVG icons
- confirmation: .confirmation-banner with check animation
All new components reuse existing design tokens; no new palette entries.
2026-05-09 07:59:50 +00:00
Imugiii
0d83512a4f feat(front): payment selection and order confirmation pages
payment.html     - card / cash choice with inline SVG icons; both simulate payment (MVP)
confirmation.html - order number WK-<base36 timestamp>, cart cleared on load,
                    new-order button resets flow to index.html
2026-05-09 07:59:45 +00:00
Imugiii
c517b16569 feat(front): cart page with quantity controls and TVA breakdown
Displays line items with - / + controls and delete button.
TVA 10% (restauration FR 2024, simplified).
TODO in P3: verify rate with accountant (sur-place vs a-emporter + product type).
Abandon button clears cart and returns to categories.
2026-05-09 07:59:40 +00:00
Imugiii
cd6e05c353 feat(front): products list and product detail pages
products.html - dynamic grid from ?category=<id>, JS fetch from data/produits.json
product.html  - detail view; menus show fixed composition note (MVP: no selection)
Both pages: cart badge, mode badge, keyboard/RGAA accessible cards
2026-05-09 07:59:35 +00:00
Imugiii
43b6e7a309 feat(front): vanilla JS state management, data loader, and nav helpers
state.js  - cart (localStorage) + mode + price formatting in centimes
data.js   - fetch wrapper over static JSON with in-memory cache; P4 swap points marked
nav.js    - mode badge injection and cart count badge across pages
2026-05-09 07:59:31 +00:00
Imugiii
6f5daca679 feat(front): copy school JSON sources to public/data for static fetch fallback
Normalizes produits.json:
- Prix converted from float EUR to integer centimes
- Image paths rewritten to match actual filesystem (lowercase, dashes)
- Added type field ('produit'|'menu') on each entry
- Added slug field to categories.json

In P4, swap fetch URLs in assets/js/data.js (marked with TODO comments).
2026-05-09 07:59:26 +00:00
Imugiii
71c863d2b2 feat(front): borne welcome screen and category list scaffold using school assets
- Welcome screen (index.html): background photo, white card, Sur Place / A Emporter
  choice buttons with verified school illustrations; pure HTML <a> navigation, no JS
- Category grid (categories.html): 9 categories from categories.json rendered as 3-col
  card grid with verified category images; stub links to products.html?category=<id>
- Design system CSS (assets/css/style.css): CSS custom properties for brand yellow
  #FFC72C, spacing scale, border-radius, shadows extracted from maquette PDF;
  BEM-style component classes; WCAG AA focus-visible rings; kiosk portrait 1080px primary
2026-05-09 07:12:55 +00:00
Imugiii
64f5a279da docs(merise): add drawio XML sources for MCD diagrams
Switch from Mermaid to drawio for MCD diagrams to gain manual layout
control on the global view (10 entites + 10 associations, planarite
intrinseque non resolue par Mermaid auto-layout).

- mcd-global.drawio    : 10 entites + 8 associations (vue compacte sans attributs)
- mcd-catalogue.drawio : Categorie / Produit / Menu / MenuProduit avec attributs
- mcd-commande.drawio  : Commande / LigneCommande + polymorphisme vers Produit/Menu
- mcd-rbac.drawio      : User / Role / Permission / RolePermission

Notation Merise (min,max) sur chaque cote d'association. Layout de
depart a affiner manuellement dans drawio web (Edit Diagram -> XML).
SVG a regenerer en exportant depuis drawio web.
2026-05-09 07:03:27 +00:00
Imugiii
68db2eef0d
Merge pull request #3 from AcadeNice/feat/p1-stubs-and-dictionary
P1: stubs unblock-403 + data dictionary v0.1
2026-04-30 16:27:57 +02:00
Imugiii
d1a98764d0 docs(merise): data dictionary v0.1 - 10 entities + Mermaid ER diagram + 7 modeling notes
Bottom-up derivation from school JSON sources + PROJECT_CONTEXT business rules.
Covers : Categorie, Produit, Menu, MenuProduit, Commande, LigneCommande,
User, Role, Permission, RolePermission. Decisions documented :
prices in INT cents, VAT in per-mille, polymorphic FK with snapshots
on ligne_commande, dynamic roles vs static permissions for RBAC.
2026-04-30 14:24:14 +00:00
Imugiii
b8f7d35064 feat(stubs): unblock 403 with kiosk and admin index pages, plus FastCGI fixes
Three changes bundled because the stubs surfaced two pre-existing infra bugs
that had never been hit (the smoke test only exercised PHP via 'docker exec',
not via the full Apache->PHP-FPM FastCGI path).

- src/public/borne/index.html : minimal HTML stub for the kiosk vhost
  (200 OK with the imported logo)
- src/public/admin/index.php : minimal PHP stub that proves the full
  FastCGI chain works end-to-end (renders PHP_VERSION + current timestamp)
- docker/apache/vhost.conf : add 'DirectoryIndex index.php index.html' on
  the admin vhost. Without it, hitting / returned 403 because the default
  Apache DirectoryIndex is index.html only, and the existing RewriteRule
  did not apply to the directory request (\!-d cond was false).
- docker/php-fpm/www.conf : comment out 'listen.allowed_clients = any'.
  PHP-FPM 8.3 rejects 'any' with 'Wrong IP address' and ends up dropping
  every connection from Apache. With the directive absent, all connections
  are accepted, which is acceptable in our isolated Docker network.
2026-04-30 13:07:12 +00:00
Imugiii
84d2559ba9
Merge pull request #2 from AcadeNice/feat/p1-assets-import
chore(assets): import school source data and normalize visual assets
2026-04-30 14:58:32 +02:00