refactor(admin): /api/me -> /admin/me (reduction de surface) #122

Merged

Corentin merged 1 commit from feat/api-me-to-admin into dev

2026-07-02 12:37:28 +02:00

Corentin commented

2026-07-02 12:34:53 +02:00

Owner

No description provided.

Corentin added 1 commit

2026-07-02 12:34:54 +02:00

refactor(admin): deplace GET /api/me vers /admin/me (reduction de surface)

CI / secret-scan (pull_request) Successful in 19s

Details

CI / php-lint (pull_request) Successful in 28s

Details

CI / static-tests (pull_request) Successful in 1m5s

Details

CI / static-tests (push) Successful in 1m15s

Details

CI / js-tests (push) Successful in 42s

Details

CI / js-tests (pull_request) Successful in 34s

Details

CI / secret-scan (push) Successful in 16s

Details

CI / php-lint (push) Successful in 36s

Details

29ec7d0ae7

/api/me (identite + permissions de la session, gardee par SessionGuard dans le
controleur) etait la seule route AUTHENTIFIEE du namespace /api, par ailleurs
public et anonyme cote borne. Le vhost borne proxifie /api/* : l'endpoint etait
donc joignable depuis l'origine borne publique (sans fuite, gate 401, mais
surface d'attaque inutile). Il passe sous /admin/* (non relaye par le proxy
borne) : joignable seulement sur l'hote admin, aupres des autres routes de
session. Aucun appelant front (verifie : zero fetch /api/me dans src/public).

La garde vit dans le controleur (pas dans un middleware de prefixe), donc
MeController est inchange. Docstring, test unitaire et functional-schema alignes.
487 tests unit verts, PHPStan L6 propre.

Corentin scheduled this pull request to auto merge when all checks succeed

2026-07-02 12:34:55 +02:00

Corentin merged commit f4d5d7bbaa into dev

2026-07-02 12:37:28 +02:00

Corentin referenced this pull request from a commit

2026-07-02 12:37:30 +02:00

refactor(admin): /api/me -> /admin/me (reduction de surface) (#122)