feat: systeme de design du back-office et balayage automatique (lot 0) #158

Merged

Corentin merged 2 commits from feat/backoffice-design-system-v2 into dev

2026-09-26 13:34:36 +02:00

Corentin commented

2026-09-26 13:29:04 +02:00

Owner

No description provided.

Corentin added 2 commits

2026-09-26 13:29:04 +02:00

test: add a back-office sweep that checks every role, page and width da0a6138a0

The sweep walks each role's real navigation, at 1366, 1024, 768 and 390 pixels, and checks that no interactive element covers another, that nothing overflows, that touch targets are large enough, that tab order follows the visual order and the focus stays visible, that each action has a visible effect, and that no technical wording reaches the screen. It writes a report with a screenshot for every failure, plus reference screenshots for later comparison.

Passwords and PINs for the accounts the test creates itself are generated at
run time (crypto.randomBytes / crypto.randomInt), never hardcoded: gitleaks
scans the full commit history on every PR, and a literal-looking credential
in a test fixture is indistinguishable to it from a real one. The seed's
admin account is read from ADMIN_EMAIL/ADMIN_PASSWORD (same names as
a11y.spec.js and rbac-channel.spec.js), falling back to the value documented
in db/seeds/0001_rbac_and_reference.sql so the test still runs unconfigured.

Generated credentials are written once to a file under the sweep's own
(gitignored) output directory and read back from there afterward, instead of
staying only in the module's in-memory constants: Playwright can restart the
worker that runs this file mid-suite, which re-executes the module and would
otherwise generate a second, different password for an account the first
execution already created and hashed in the database, failing every later
login for it with a generic "wrong email or password" (confirmed via
audit_log: one auth.login_success right after account creation, then
auth.login_failed a minute later, no user.update in between). The same file
also makes a reused throwaway stack log back in with the account it created
earlier, consistent with this file's existing account-reuse check.

feat: design-system tokens and sweep CSS fixes for the back-office

CI / secret-scan (pull_request) Successful in 20s

Details

CI / php-lint (pull_request) Successful in 28s

Details

CI / static-tests (pull_request) Successful in 2m35s

Details

CI / js-tests (pull_request) Successful in 44s

Details

CI / secret-scan (push) Successful in 27s

Details

CI / php-lint (push) Successful in 28s

Details

CI / static-tests (push) Successful in 2m43s

Details

CI / js-tests (push) Successful in 46s

Details

caa26a3f7d

Add the spacing and typography tokens, .table-num, .row-actions with its danger variant, details.form-advanced and .pos-tile.is-selected, and raise the sidebar breakpoint from 640 to 900 pixels. Fix every CSS-level sweep failure: keyboard focus hidden under the fixed accessibility toggle, the counter and drive catalogue overflowing below 860 pixels, dashboard tiles overflowing at 768, the active counter tab having no visible focus, and the category reorder arrows below the 24 pixel touch target. Two focus rings deviate from the design-system draft because the drafted yellow measured below the 3:1 non-text floor; the measured ratios are documented in the file.

Corentin scheduled this pull request to auto merge when all checks succeed

2026-09-26 13:29:05 +02:00

Corentin merged commit 608198fe9b into dev

2026-09-26 13:34:36 +02:00

Corentin referenced this pull request from a commit

2026-09-26 13:34:37 +02:00

feat: systeme de design du back-office et balayage automatique (lot 0) (#158)

Corentin referenced this pull request

2026-09-26 18:30:58 +02:00

release: dev -> main v0.4.0 (refonte du back-office, API JSON d administration, accessibilite elargie) #172