veza/REAL_ISSUES_TODOLIST.json

{
  "meta": {
    "title": "Veza Real Issues TodoList",
    "description": "Problèmes RÉELS identifiés par tests concrets",
    "generated_at": "2025-12-26T15:18:00Z",
    "test_method": "curl + playwright",
    "backend_url": "http://localhost:8080",
    "frontend_url": "http://localhost:3000"
  },
  "summary": {
    "total_tests": 19,
    "passed": 11,
    "failed": 6,
    "skipped": 3,
    "pass_rate": "58%",
    "blocking_issues": 0,
    "by_priority": {
      "P0_blocker": 0,
      "P1_critical": 4,
      "P2_major": 1,
      "P3_minor": 0
    },
    "by_category": {
      "auth": 2,
      "users": 0,
      "tracks": 1,
      "playlists": 3,
      "sessions": 1,
      "frontend": 0
    }
  },
  "working_features": [
    {
      "id": "WORK-001",
      "category": "infrastructure",
      "feature": "Health Check Root",
      "endpoint": "GET /health",
      "tested_at": "2025-12-26T15:18:00Z",
      "http_code": 200,
      "notes": "Fonctionne correctement"
    },
    {
      "id": "WORK-002",
      "category": "infrastructure",
      "feature": "Health Check API",
      "endpoint": "GET /api/v1/health",
      "tested_at": "2025-12-26T15:18:00Z",
      "http_code": 200,
      "notes": "Fonctionne correctement"
    },
    {
      "id": "WORK-003",
      "category": "auth",
      "feature": "Register",
      "endpoint": "POST /api/v1/auth/register",
      "tested_at": "2025-12-26T15:18:14Z",
      "http_code": 201,
      "notes": "Création utilisateur OK mais tokens vides (voir ISSUE-002)"
    },
    {
      "id": "WORK-004",
      "category": "users",
      "feature": "List Users",
      "endpoint": "GET /api/v1/users",
      "tested_at": "2025-12-26T15:18:25Z",
      "http_code": 200,
      "notes": "Fonctionne sans authentification, retourne 49 utilisateurs"
    },
    {
      "id": "WORK-005",
      "category": "users",
      "feature": "Search Users",
      "endpoint": "GET /api/v1/users/search?q=test",
      "tested_at": "2025-12-26T15:18:26Z",
      "http_code": 200,
      "notes": "Fonctionne sans authentification, retourne 46 résultats"
    },
    {
      "id": "WORK-006",
      "category": "tracks",
      "feature": "List Tracks",
      "endpoint": "GET /api/v1/tracks",
      "tested_at": "2025-12-26T15:18:28Z",
      "http_code": 200,
      "notes": "Fonctionne sans authentification, liste vide"
    },
    {
      "id": "WORK-007",
      "category": "tracks",
      "feature": "Search Tracks",
      "endpoint": "GET /api/v1/tracks/search?q=test",
      "tested_at": "2025-12-26T15:18:30Z",
      "http_code": 200,
      "notes": "Fonctionne sans authentification, retourne 34 résultats"
    },
    {
      "id": "WORK-008",
      "category": "frontend",
      "feature": "Home Page",
      "endpoint": "GET /",
      "tested_at": "2025-12-26T15:18:45Z",
      "http_code": 200,
      "notes": "Page accessible"
    },
    {
      "id": "WORK-009",
      "category": "frontend",
      "feature": "Login Page",
      "endpoint": "GET /login",
      "tested_at": "2025-12-26T15:18:45Z",
      "http_code": 200,
      "notes": "Page accessible"
    },
    {
      "id": "WORK-010",
      "category": "frontend",
      "feature": "Register Page",
      "endpoint": "GET /register",
      "tested_at": "2025-12-26T15:18:45Z",
      "http_code": 200,
      "notes": "Page accessible"
    }
  ],
  "issues": [
    {
      "id": "ISSUE-001",
      "category": "auth",
      "title": "Login échoue - Email non vérifié",
      "priority": "P0",
      "priority_rank": 1,
      "status": "fixed",
      "fixed_at": "2025-12-26T15:32:00Z",
      "fix_description": "Auto-vérification de l'email activée à l'inscription (IsVerified: true) pour permettre le login immédiat en MVP",
      "blocking": true,
      "endpoint": "POST /api/v1/auth/login",
      "test_command": "curl -X POST 'http://localhost:8080/api/v1/auth/login' -H 'Content-Type: application/json' -d '{\"email\":\"test1766762294@example.com\",\"password\":\"TestPass123!\"}'",
      "expected_result": "HTTP 200 avec access_token et refresh_token",
      "actual_result": "HTTP 403 avec erreur 'Email not verified'",
      "error_message": "Email not verified",
      "error_code": 1003,
      "http_code": 403,
      "user_impact": "Impossible de se connecter après inscription. L'utilisateur doit vérifier son email, mais le système de vérification n'est peut-être pas configuré.",
      "tested_at": "2025-12-26T15:18:22Z",
      "root_cause": "À déterminer - vérification d'email activée mais système de vérification non fonctionnel",
      "fix_suggestion": "1. Désactiver temporairement la vérification d'email en développement, 2. Ou implémenter un système de vérification d'email fonctionnel, 3. Ou permettre la connexion sans vérification en mode dev",
      "files_to_check": [
        "veza-backend-api/internal/core/auth/service.go",
        "veza-backend-api/internal/handlers/auth_handlers.go"
      ],
      "estimated_hours": 3
    },
    {
      "id": "ISSUE-002",
      "category": "auth",
      "title": "Register retourne des tokens vides",
      "priority": "P0",
      "priority_rank": 2,
      "status": "fixed",
      "fixed_at": "2025-12-26T15:32:00Z",
      "fix_description": "Génération de tokens JWT ajoutée dans Register() - retourne maintenant TokenPair avec access_token et refresh_token valides. Signature modifiée pour retourner (*User, *TokenPair, error). Handlers mis à jour pour utiliser les tokens.",
      "blocking": true,
      "endpoint": "POST /api/v1/auth/register",
      "test_command": "curl -X POST 'http://localhost:8080/api/v1/auth/register' -H 'Content-Type: application/json' -d '{\"email\":\"test1766762294@example.com\",\"username\":\"user1766762294\",\"password\":\"TestPass123!\",\"password_confirm\":\"TestPass123!\"}'",
      "expected_result": "HTTP 201 avec access_token et refresh_token valides",
      "actual_result": "HTTP 201 mais access_token et refresh_token sont des chaînes vides",
      "error_message": "Tokens vides dans la réponse",
      "error_code": null,
      "http_code": 201,
      "user_impact": "L'utilisateur est créé mais ne peut pas s'authentifier immédiatement après l'inscription.",
      "tested_at": "2025-12-26T15:18:14Z",
      "root_cause": "À déterminer - le service de génération de tokens n'est peut-être pas appelé ou retourne des valeurs vides",
      "fix_suggestion": "Vérifier que le service GenerateTokens est appelé correctement après la création d'utilisateur avec les bons paramètres",
      "files_to_check": [
        "veza-backend-api/internal/core/auth/service.go",
        "veza-backend-api/internal/core/auth/token.go"
      ],
      "estimated_hours": 2
    },
    {
      "id": "ISSUE-003",
      "category": "tracks",
      "title": "Créer un track nécessite une authentification",
      "priority": "P1",
      "priority_rank": 3,
      "status": "open",
      "blocking": false,
      "endpoint": "POST /api/v1/tracks",
      "test_command": "curl -X POST 'http://localhost:8080/api/v1/tracks' -H 'Content-Type: application/json' -d '{\"title\":\"Test Track\",\"genre\":\"Electronic\"}'",
      "expected_result": "HTTP 201 avec track créé OU HTTP 401 si comportement attendu",
      "actual_result": "HTTP 401 - Authorization header required",
      "error_message": "Authorization header required",
      "error_code": 1000,
      "http_code": 401,
      "user_impact": "Impossible de créer un track sans être authentifié (comportement attendu, mais bloque les tests car login échoue).",
      "tested_at": "2025-12-26T15:18:33Z",
      "root_cause": "Endpoint protégé, nécessite authentification. Ne peut pas être testé car login échoue (ISSUE-001)",
      "fix_suggestion": "Une fois ISSUE-001 et ISSUE-002 fixés, réexécuter ce test avec un token valide",
      "files_to_check": [
        "veza-backend-api/internal/handlers/track_handlers.go"
      ],
      "estimated_hours": 0.5,
      "depends_on": ["ISSUE-001", "ISSUE-002"]
    },
    {
      "id": "ISSUE-004",
      "category": "playlists",
      "title": "Liste des playlists nécessite une authentification",
      "priority": "P1",
      "priority_rank": 4,
      "status": "open",
      "blocking": false,
      "endpoint": "GET /api/v1/playlists",
      "test_command": "curl -X GET 'http://localhost:8080/api/v1/playlists'",
      "expected_result": "HTTP 200 avec liste des playlists OU HTTP 401 si comportement attendu",
      "actual_result": "HTTP 401 - Authorization header required",
      "error_message": "Authorization header required",
      "error_code": 1000,
      "http_code": 401,
      "user_impact": "Impossible de voir ses playlists sans être authentifié (comportement attendu, mais bloque les tests car login échoue).",
      "tested_at": "2025-12-26T15:18:37Z",
      "root_cause": "Endpoint protégé, nécessite authentification. Ne peut pas être testé car login échoue (ISSUE-001)",
      "fix_suggestion": "Une fois ISSUE-001 et ISSUE-002 fixés, réexécuter ce test avec un token valide",
      "files_to_check": [
        "veza-backend-api/internal/handlers/playlist_handlers.go"
      ],
      "estimated_hours": 0.5,
      "depends_on": ["ISSUE-001", "ISSUE-002"]
    },
    {
      "id": "ISSUE-005",
      "category": "playlists",
      "title": "Créer une playlist nécessite une authentification",
      "priority": "P1",
      "priority_rank": 5,
      "status": "open",
      "blocking": false,
      "endpoint": "POST /api/v1/playlists",
      "test_command": "curl -X POST 'http://localhost:8080/api/v1/playlists' -H 'Content-Type: application/json' -d '{\"name\":\"Test Playlist\",\"description\":\"Test\",\"visibility\":\"private\"}'",
      "expected_result": "HTTP 201 avec playlist créée OU HTTP 401 si comportement attendu",
      "actual_result": "HTTP 401 - Authorization header required",
      "error_message": "Authorization header required",
      "error_code": 1000,
      "http_code": 401,
      "user_impact": "Impossible de créer une playlist sans être authentifié (comportement attendu, mais bloque les tests car login échoue).",
      "tested_at": "2025-12-26T15:18:38Z",
      "root_cause": "Endpoint protégé, nécessite authentification. Ne peut pas être testé car login échoue (ISSUE-001)",
      "fix_suggestion": "Une fois ISSUE-001 et ISSUE-002 fixés, réexécuter ce test avec un token valide",
      "files_to_check": [
        "veza-backend-api/internal/handlers/playlist_handlers.go"
      ],
      "estimated_hours": 0.5,
      "depends_on": ["ISSUE-001", "ISSUE-002"]
    },
    {
      "id": "ISSUE-006",
      "category": "playlists",
      "title": "Rechercher des playlists nécessite une authentification",
      "priority": "P1",
      "priority_rank": 6,
      "status": "open",
      "blocking": false,
      "endpoint": "GET /api/v1/playlists/search?q=test",
      "test_command": "curl -X GET 'http://localhost:8080/api/v1/playlists/search?q=test'",
      "expected_result": "HTTP 200 avec résultats de recherche OU HTTP 401 si comportement attendu",
      "actual_result": "HTTP 401 - Authorization header required",
      "error_message": "Authorization header required",
      "error_code": 1000,
      "http_code": 401,
      "user_impact": "Impossible de rechercher des playlists sans être authentifié (comportement attendu, mais bloque les tests car login échoue).",
      "tested_at": "2025-12-26T15:18:40Z",
      "root_cause": "Endpoint protégé, nécessite authentification. Ne peut pas être testé car login échoue (ISSUE-001)",
      "fix_suggestion": "Une fois ISSUE-001 et ISSUE-002 fixés, réexécuter ce test avec un token valide",
      "files_to_check": [
        "veza-backend-api/internal/handlers/playlist_handlers.go"
      ],
      "estimated_hours": 0.5,
      "depends_on": ["ISSUE-001", "ISSUE-002"]
    },
    {
      "id": "ISSUE-007",
      "category": "sessions",
      "title": "Endpoint sessions redirige au lieu de retourner JSON",
      "priority": "P2",
      "priority_rank": 7,
      "status": "open",
      "blocking": false,
      "endpoint": "GET /api/v1/sessions",
      "test_command": "curl -X GET 'http://localhost:8080/api/v1/sessions'",
      "expected_result": "HTTP 200 avec liste des sessions OU HTTP 401 si authentification requise",
      "actual_result": "HTTP 301 (Moved Permanently) vers /api/v1/sessions/ (avec trailing slash)",
      "error_message": "Redirection au lieu de réponse JSON",
      "error_code": null,
      "http_code": 301,
      "user_impact": "L'endpoint redirige au lieu de retourner des données. Problème de configuration de route.",
      "tested_at": "2025-12-26T15:18:42Z",
      "root_cause": "Configuration de route incorrecte - trailing slash manquant ou en trop",
      "fix_suggestion": "Vérifier la configuration des routes dans le routeur pour gérer correctement les trailing slashes",
      "files_to_check": [
        "veza-backend-api/cmd/api/main.go",
        "veza-backend-api/internal/router/router.go"
      ],
      "estimated_hours": 0.5
    }
  ],
  "test_results": {
    "health": {
      "root": {"status": "pass", "http_code": 200, "error": null},
      "api": {"status": "pass", "http_code": 200, "error": null}
    },
    "auth": {
      "register": {"status": "partial_pass", "http_code": 201, "error": "Tokens vides", "issue_id": "ISSUE-002"},
      "login": {"status": "fail", "http_code": 403, "error": "Email not verified", "issue_id": "ISSUE-001"},
      "me": {"status": "skip", "reason": "No token available (login fails)"},
      "refresh": {"status": "skip", "reason": "No refresh token (register returns empty tokens)"},
      "logout": {"status": "skip", "reason": "No tokens available"}
    },
    "users": {
      "list": {"status": "pass", "http_code": 200, "error": null, "note": "Works without auth"},
      "search": {"status": "pass", "http_code": 200, "error": null, "note": "Works without auth"}
    },
    "tracks": {
      "list": {"status": "pass", "http_code": 200, "error": null, "note": "Works without auth"},
      "create": {"status": "fail", "http_code": 401, "error": "Authorization header required", "issue_id": "ISSUE-003"},
      "search": {"status": "pass", "http_code": 200, "error": null, "note": "Works without auth"}
    },
    "playlists": {
      "list": {"status": "fail", "http_code": 401, "error": "Authorization header required", "issue_id": "ISSUE-004"},
      "create": {"status": "fail", "http_code": 401, "error": "Authorization header required", "issue_id": "ISSUE-005"},
      "search": {"status": "fail", "http_code": 401, "error": "Authorization header required", "issue_id": "ISSUE-006"}
    },
    "sessions": {
      "list": {"status": "fail", "http_code": 301, "error": "Redirects to /api/v1/sessions/", "issue_id": "ISSUE-007"}
    },
    "frontend": {
      "home": {"status": "pass", "http_code": 200, "error": null},
      "login_page": {"status": "pass", "http_code": 200, "error": null},
      "register_page": {"status": "pass", "http_code": 200, "error": null}
    }
  },
  "user_journey_status": {
    "can_register": true,
    "can_login": false,
    "can_view_profile": false,
    "can_create_track": false,
    "can_view_tracks": true,
    "can_create_playlist": false,
    "can_view_playlists": false,
    "can_search": true,
    "can_logout": false,
    "can_search_tracks": true,
    "can_search_users": true,
    "can_search_playlists": false
  },
  "next_actions": [
    {
      "priority": 1,
      "action": "Fix login endpoint - Email verification blocking",
      "issue_id": "ISSUE-001",
      "estimated_hours": 3,
      "blocking": true
    },
    {
      "priority": 2,
      "action": "Fix register endpoint - Empty tokens",
      "issue_id": "ISSUE-002",
      "estimated_hours": 2,
      "blocking": true
    },
    {
      "priority": 3,
      "action": "Re-test protected endpoints with valid tokens",
      "issue_ids": ["ISSUE-003", "ISSUE-004", "ISSUE-005", "ISSUE-006"],
      "estimated_hours": 0.5,
      "depends_on": ["ISSUE-001", "ISSUE-002"]
    },
    {
      "priority": 4,
      "action": "Fix sessions endpoint redirect",
      "issue_id": "ISSUE-007",
      "estimated_hours": 0.5,
      "blocking": false
    }
  ],
  "recommendations": {
    "immediate": [
      "Fix authentication workflow (ISSUE-001, ISSUE-002) - This is blocking all user interactions",
      "Add automated tests for authentication flow to prevent regressions"
    ],
    "short_term": [
      "Once auth is fixed, test all protected endpoints",
      "Verify token refresh mechanism works correctly"
    ],
    "medium_term": [
      "Fix sessions endpoint redirect (ISSUE-007)",
      "Consider making some endpoints public (users list, tracks search) or document which require auth"
    ]
  }
}