release: dev -> main v0.2.0 #93

Merged

Corentin merged 96 commits from dev into main 2026-06-23 10:09:58 +02:00

Conversation 0 Commits 96 Files changed 332 +39921 -5537

Corentin commented 2026-06-23 10:04:50 +02:00

Owner

Copy link

Release v0.2.0 — dev vers main.

Perimetre depuis v0.1.0

• P2 : auth back-office (sessions argon2id, CSRF, throttle login + PIN), RBAC permission-driven, moteur PIN d'action sensible.
• P3 : CRUD complet (categories, produits, menus + slots, ingredients/stock + recettes, utilisateurs, matrice RBAC, stats), shell admin.
• P4 : API REST de lecture catalogue + domaine commande (creation/paiement, suivi public GET /api/orders/{number}).
• Front borne : composeur menu slot-driven, modale options, soumission reelle, allergenes, OpenDyslexic, SEO demonstratif.
• Operationnel : KDS cuisine (paid -> delivered), annulation de commande (PIN + audit + restock), composeur comptoir/drive, tailles boissons 30/50cl, variantes Maxi.
• DevOps / qualite : hooks Git versionnes, scripts deploy/restore, enrichissement nutritionnel OpenFoodFacts, page RGPD, schema fonctionnel, strategie de test, audit plan x referentiel + remediation P1/P2/P3.
• Corrections recentes : racine admin -> /login (#91), bouton police adaptee repositionne (#92).

Etat verification

Suite unit ~419 PHP verts + 96 JS, PHPStan L6 propre, CI Forgejo verte sur dev.

Release v0.2.0 — dev vers main. ## Perimetre depuis v0.1.0 - **P2** : auth back-office (sessions argon2id, CSRF, throttle login + PIN), RBAC permission-driven, moteur PIN d'action sensible. - **P3** : CRUD complet (categories, produits, menus + slots, ingredients/stock + recettes, utilisateurs, matrice RBAC, stats), shell admin. - **P4** : API REST de lecture catalogue + domaine commande (creation/paiement, suivi public GET /api/orders/{number}). - **Front borne** : composeur menu slot-driven, modale options, soumission reelle, allergenes, OpenDyslexic, SEO demonstratif. - **Operationnel** : KDS cuisine (paid -> delivered), annulation de commande (PIN + audit + restock), composeur comptoir/drive, tailles boissons 30/50cl, variantes Maxi. - **DevOps / qualite** : hooks Git versionnes, scripts deploy/restore, enrichissement nutritionnel OpenFoodFacts, page RGPD, schema fonctionnel, strategie de test, audit plan x referentiel + remediation P1/P2/P3. - **Corrections recentes** : racine admin -> /login (#91), bouton police adaptee repositionne (#92). ## Etat verification Suite unit ~419 PHP verts + 96 JS, PHPStan L6 propre, CI Forgejo verte sur dev.

Corentin added 96 commits 2026-06-23 10:04:51 +02:00

ci: add Forgejo Actions pipeline + gitleaks secret-scan (#2) 822fdc1bc4

P1 conception: security-by-design layer (Merise 21 entities, Forgejo CI/CD, hardening) (#3) 32ff6a63ba

docs(merise): MLD relational schema diagrams (4 sub-domains) (#4) 79d8ad9985

docs(merise): traduction de la prose en francais (identifiants inchanges) (#5) 2a67b6fc34

ci: opt-in auto-merge job (label-gated, API merge on green) (#7) 5581d2adea

feat(db): initial schema DDL (21 tables) + migration runner (#6) 41f9c96d33

feat(db): seed data - RBAC matrix + INCO allergens + admin user + catalogue (9 cat / 53 products / 13 menus + composition) fcf52a0895

docs: clarify manager has read-only user access (user.read), not zero access 04404dc8c5

Merge pull request 'feat(db): seed data (RBAC + allergens + catalogue)' (#8) from feat/p2-seed-data into dev ... dca5860869

Reviewed-on: #8

feat(core): from-scratch PHP MVC skeleton (autoloader/config/PDO/router/front controller) + PHPUnit/PHPStan + composer-less CI 8c93b26ec0

Merge remote-tracking branch 'forgejo/dev' into feat/p2-core-php e265b0cb92

ci: install php-xml/php-mbstring for phpunit/phpstan (bookworm php-cli lacks dom/mbstring/xml) 56d0b941e8

Merge pull request 'feat(core): PHP MVC skeleton from scratch (autoloader/router/PDO + tests + CI)' (#9) from feat/p2-core-php into dev ... 93a6b8e292

Reviewed-on: #9

refactor(core): src/app structure + fix auto-merge label gate (#10) c8f5370cfd

feat: authentification back-office P2 (login/logout/reset, throttle, audit) (#11) 1b0b20c12d

feat: RBAC P2 (autorisation par permission + garde de session + /api/me) (#12) f979a2339e

feat: PIN d action sensible P2 (PinVerifier RG-T13) (#13) 7c35f8e2dc

feat: shell back-office P3 (pages rendues serveur + garde) (#14) 2bc22ab5c8

feat: CRUD categories P3 (rendu serveur, garde + CSRF + validation) (#15) 8290ceabc4

feat: PIN self-service P3 (/admin/profile/pin) (#16) f63ac9873c

feat(admin): CRUD produits avec PIN conditionnel et audit (#17) 2756fb4080

feat(admin): throttle du PIN d action sensible par acteur (RG-T22) (#18) ad5203d3fc

ci: run DB integration tests against an ephemeral MariaDB service (#21) e3d08464bb

docs(journal): audit reel des livrables P2/P3 (2026-06-16) (#22) 6653a7419d

fix(db): moindre privilege pour le user applicatif (drop GRANT ALL) (#24) e62a9783b1

fix(admin): remove stale unauthenticated static admin mockups (#19) ee14186a19

fix(kiosk): escape data-derived strings in innerHTML (RG-T15) (#20) 9ddb4ccb27

fix(auth): leurre anti-enumeration sur la demande de reset (#26) 6557dd9c6c

fix(auth): retire le bouton mort PASSWORD_ALGO (argon2id fixe dans le code) (#29) 656c7a2f3d

feat(cron): purge de retention audit_log + throttle (mlt 13.4/13.5) (#25) 7d30f5481d

docs(catalogue): contrat exact des FK a la suppression produit (#27) 8ce1dc21de

fix(admin): retire les liens de nav vers des pages non construites (#23) c284c840d0

fix(admin): lien decouvrable vers la page de definition du PIN (#28) 2cc499dc71

fix(admin): chemin d'echec PIN atomique (pin.failed + throttle dans 1 transaction) (#30) 05da325d05

docs(borne): clarifie le repli JSON statique (fige, divergent de la DB) (#31) 7d24714d9b

feat(admin): CRUD menus composes avec slots (P3, mlt 8.4-8.6) (#32) c2a4854083

fix(admin): conflits HTTP 409 au lieu de 422 (delete FK-bloque + course unicite) (#33) 0666a22562

feat(admin): stock ingredients - CRUD, restock, inventaire PIN, mouvements (P3, mlt 8.8 + domaine 9) (#34) 1f4b9478ca

feat(admin): recettes produit - composition product_ingredient + dispo calculee RG-T21 (P3, ferme #27) (#35) ed392d4c14

feat(borne): modale allergenes generale (14 INCO) sur carte et fiche + harnais tests JS (P3) (#36) 1ecd78324c

feat(admin): tableau de bord statistiques (catalogue + sante stock RG-T21) (P3) (#37) 9c2844c116

feat(admin): gestion des comptes back-office (CRUD users + RGPD, PIN+audit) (P3) (#38) e430f54d85

feat(admin): RBAC - matrice roles/permissions + roles custom (PIN+audit diff) (P3) (#39) d880f2512a

chore: remplace le Makefile par un service compose wakdo-migrate (migrate + seed idempotents) (#40) e613adc24a

chore(docker): docker-compose.yml standalone portable + .env local-first (#41) 9d75fabdca

docs: socle de documentation (ARCHITECTURE + guide developpeur) (#42) 92c61e31f7

docs(adr): registre des decisions d'architecture (9 ADR) (#43) 33e6901e7c

docs(domaines): documentation par domaine fonctionnel (7 fiches) (#44) 32f9baacce

test(e2e): parcours borne Playwright (conteneur, stack jetable) (#45) aef6174b5b

test(e2e): parcours admin Playwright + fix cookie Secure conditionnel (ADR-0010) (#46) 68a2690b98

docs(journal): retro de session 2026-06-17 (infra, doc, E2E) (#47) 50415465a5

feat(admin): relooking des pages auth (login/forgot/reset) (#48) 7281d958b4

feat(admin): design system back-office (direction A+C, lot 1) (#49) 8d1a69f5cf

feat(admin): dashboard donnees reelles (lot 2) (#50) 1b29cd420f

fix(borne): logo d'en-tete centre (#51) 88e3cbc1bb

feat(admin): modal de re-autorisation PIN (#52) 60535bbe00

feat(admin): humanise les libelles restants (Reference/Variation/Auteur) (#54) 1697b94b62

feat(api): P4 chunk 1a - creation de commande + chevalet (#55) 29a191e506

fix(admin): logo reel dans la sidebar back-office (#56) a6ac3d6421

feat(api): P4 chunk 1b - encaissement + decrement stock (#57) 60ce3460a5

ci: retire le job auto-merge redondant (#58) 05eca6aea2

docs(journal): retro de session 2026-06-18 (#59) 7a2528a280

feat(admin): ecran Roles humanise (#53) 9bc0140b9a

feat(api): P4 chunk 2 - read API catalogue borne (categories/produits/menus) (#60) a35db88d2f

feat(borne): cablage de la borne sur l'API (CORS + data.js) (#61) 7a0702ff6e

fix(borne): passerelle /api same-origin sur le vhost kiosk (#62) 6c6a34db9f

docs(design): decomposition maquette borne + ecrans + tracabilite vs build (#63) f2fdaea89a

feat(borne): panneau commande persistant + bandeau categories (P5 L1) (#64) c73afdf471

feat(borne): composeur menu pilote par les slots /api/menus (P5 L2) (#65) 6e5a5f9334

feat(borne): modale options produit + grille en modales (P5 L3) (#66) 22a4bacc22

feat(stock): seed ingredients + recettes des 53 produits (P4) (#67) dfbf1bbe0f

feat(borne): soumission reelle de commande + ecran chevalet (P5 L4) (#68) 7575d0458a

chore(borne): memoisation loaders data.js + contraste a11y selection (#69) 6c431af197

feat(admin): liste des commandes + KPIs de vente (P4) (#70) 1d56d5b574

feat(api): endpoint public /api/allergens (P4 optionnel) (#71) 7ab9a5a8cf

feat(admin): page d'information RGPD sur le traitement des donnees (Cr 3.d.2) (#72) 121877ea65

feat(borne): police OpenDyslexic auto-hebergee + bascule accessibilite (RGAA Cr 1.c.2) (#73) 66aaa77f87

docs: aligner PROJECT_CONTEXT et README sur l'etat reel (#74) a1d4332714

chore(devops): hooks Git versionnes + scripts deploy et restore (Cr 4.f.2 / 7.b.2) (#75) 09ac9e5a3f

docs(architecture): schema fonctionnel des vues (Cr 4.a.4) (#76) 918420c497

feat(api): suivi public du statut commande GET /api/orders/{number} (P4) (#77) cb990404e3

feat(borne): SEO demonstratif + @supports + validation chevalet temps reel (Cr 1.e/1.b.3/2.b.1) (#78) 8af17842b9

docs: strategie de test (couverture + E2E hors CI) (#80) 9e3346181d

feat(orders): KDS cuisine + transition paid vers delivered (P3 operationnel) (#81) 80919f62c1

feat(stock): enrichissement nutritionnel via API externe OpenFoodFacts (Cr 3.a.3) (#79) 10705858ac

fix(devops): deploy.sh build depuis Dockerfiles + pull main Forgejo (#82) 4206452a7e

feat(orders): annulation de commande (CANCEL_ORDER) - PIN + audit + restock (mlt 7.1) (#83) 741cfdb02b

feat(menu): accompagnement Maxi en variante Grande automatique (variante en base) (#84) ea1654c21a

feat(orders): saisie commande comptoir/drive - fondation produits (mlt 4.1) (#85) 5cc879c3ea

feat(orders): composeur de menus (slots + format) saisie comptoir/drive (#86) 6347c66a7e

feat(orders): UI modificateurs composeur comptoir/drive (R3c) (#87) 034038a31f

feat(borne): tailles 30/50cl boissons a la carte (R4) (#88) 545aa19cf1

fix(borne): persiste + garde le mode de consommation (corrige 422 paiement) (#89) 042c30a5fe

fix(borne): affiche la Grande en menu Maxi (accompagnement) (#90) 82adc77879

fix(admin): racine du back-office redirige vers /login (#91) fe5ac06e04

fix(front): bouton police adaptee en bas-gauche (evite la collision panier) (#92) 193a15abf7

Corentin merged commit 3dee190a8c into main 2026-06-23 10:09:58 +02:00

Corentin referenced this pull request from a commit 2026-06-23 10:10:01 +02:00

Merge pull request 'release: dev -> main v0.2.0' (#93) from dev into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

auto-merge

Fusion automatique sur CI verte

No labels

auto-merge

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: AcadeNice/corentin_wakdo#93

No description provided.