feat(borne): cablage de la borne sur l'API (CORS + data.js) #61

Merged

Corentin merged 1 commit from feat/p4-borne-cors-datajs into dev

2026-06-18 16:46:17 +02:00

Corentin commented

2026-06-18 16:43:03 +02:00

Owner

No description provided.

Corentin added 1 commit 2026-06-18 16:43:04 +02:00

feat(borne): cablage de la borne sur l'API (CORS + data.js)

CI / secret-scan (push) Successful in 8s

Details

CI / php-lint (push) Successful in 20s

Details

CI / php-lint (pull_request) Successful in 23s

Details

CI / static-tests (pull_request) Successful in 50s

Details

CI / static-tests (push) Successful in 46s

Details

CI / js-tests (push) Successful in 24s

Details

CI / secret-scan (pull_request) Successful in 9s

Details

CI / js-tests (pull_request) Successful in 25s

Details

b896cf9677

La borne kiosk consomme desormais l'API REST catalogue au lieu des fichiers JSON
statiques (docs/api/conventions.md 5.2 et 10).

- Middleware CORS (App\Core\Cors) : origine UNIQUE et EXACTE (CORS_ALLOWED_ORIGIN,
  sans joker), scope /api/, GET/POST/OPTIONS, Content-Type, SANS credentials,
  fail-closed. Cable dans index.php : preflight OPTIONS -> 204 avant le routeur,
  decoration de la reponse y compris le 500 du catch (erreur lisible cross-origin).
  CorsTest (10 tests).
- data.js : URLs -> /api/categories|products|menus, deballe l'enveloppe {data},
  traduit la forme canonique (name/price_cents/image_path) vers la forme borne
  (nom/prix/image/type), regroupe par slug de categorie, glisse les menus sous la
  cle 'menus'. Signatures publiques inchangees (pages intactes). findProduct
  desambigue par categorie : product et menu ont des espaces d'id distincts (tables
  auto-increment separees), un id peut donc collisionner. data.test.js (10 tests).
- loadAllergens reste statique (data/allergens.json) ; consommation des slots
  /api/menus + refactor du composeur differes.

Corentin scheduled this pull request to auto merge when all checks succeed 2026-06-18 16:43:05 +02:00