From b103a09a251d8da217657b36f5a7c7dec452f51a Mon Sep 17 00:00:00 2001 From: senke Date: Tue, 17 Feb 2026 16:43:21 +0100 Subject: [PATCH] chore: consolidate CI, E2E, backend and frontend updates - CI: workflows updates (cd, ci), remove playwright.yml - E2E: global-setup, auth/playlists/profile specs - Remove playwright-report and test-results artifacts from tracking - Backend: auth, handlers, services, workers, migrations - Frontend: components, features, vite config - Add e2e-results.json to gitignore - Docs: REMEDIATION_PROGRESS, audit archive - Rust: chat-server, stream-server updates --- .github/workflows/cd.yml | 21 +- .github/workflows/ci.yml | 1 + .github/workflows/playwright.yml | 30 - .gitignore | 1 + 103_RAPPORT_ETAT_FEATURES_2026_02_16.md | 370 +++ 103_audit_global_features_states.md | 737 +++++ Untitled | 2 + apps/web/Dockerfile.production | 2 +- apps/web/e2e/global-setup.ts | 17 +- apps/web/e2e/tests/auth.spec.ts | 19 +- .../dashboard-iphone12-msedge-linux.png | Bin 0 -> 231856 bytes apps/web/e2e/tests/playlists.spec.ts | 20 +- apps/web/e2e/tests/profile.spec.ts | 4 + .../404-page-chromium-linux.png | Bin 0 -> 477226 bytes .../404-page-msedge-linux.png | Bin 0 -> 474880 bytes .../dashboard-full-chromium-linux.png | Bin 0 -> 542739 bytes .../dashboard-full-msedge-linux.png | Bin 0 -> 544645 bytes .../dashboard-header-chromium-linux.png | Bin 0 -> 37452 bytes .../dashboard-header-msedge-linux.png | Bin 0 -> 37388 bytes .../dashboard-mobile-chromium-linux.png | Bin 0 -> 178718 bytes .../dashboard-mobile-msedge-linux.png | Bin 0 -> 178757 bytes .../dashboard-sidebar-chromium-linux.png | Bin 0 -> 122747 bytes .../dashboard-sidebar-msedge-linux.png | Bin 0 -> 122747 bytes .../dashboard-tablet-chromium-linux.png | Bin 0 -> 557384 bytes .../dashboard-tablet-msedge-linux.png | Bin 0 -> 557445 bytes .../playlists-page-chromium-linux.png | Bin 0 -> 472171 bytes .../playlists-page-msedge-linux.png | Bin 0 -> 471950 bytes .../register-page-chromium-linux.png | Bin 0 -> 544861 bytes .../register-page-msedge-linux.png | Bin 0 -> 547406 bytes apps/web/scripts/audit-storybook.js | 29 +- .../AdminDashboardView.test.tsx | 88 + .../useCreateProductView.ts | 2 +- .../two-factor-setup/TwoFactorSetup.tsx | 2 +- .../two-factor-setup/useTwoFactorSetup.ts | 1 - .../web/src/components/social/ExploreView.tsx | 1 - .../group-detail-view/useGroupDetailView.ts | 4 +- apps/web/src/config/features.ts | 4 +- apps/web/src/context/ToastContext.test.tsx | 23 + .../auth/components/LoginForm.stories.tsx | 2 +- .../dashboard/components/StatsSection.tsx | 2 +- .../marketplace/components/Cart.test.tsx | 87 + .../NotificationsPage.test.tsx | 63 + .../src/features/player/store/playerStore.ts | 24 +- .../playlists/services/playlistService.ts | 38 +- .../roles/components/AssignRoleModal.test.tsx | 195 ++ .../roles/components/AssignRoleModal.tsx | 2 - .../search-page/SearchPage.test.tsx | 77 + .../tracks/components/LikeButton.test.tsx | 19 +- .../src/features/webhooks/api/webhookApi.ts | 114 - apps/web/src/hooks/useFormValidation.ts | 62 +- apps/web/src/mocks/handlers-admin.ts | 187 ++ apps/web/src/mocks/handlers-common.ts | 30 + apps/web/src/mocks/handlers-marketplace.ts | 178 ++ apps/web/src/mocks/handlers-playlists.ts | 108 + apps/web/src/mocks/handlers-tracks.ts | 237 ++ apps/web/src/services/analyticsService.ts | 37 +- apps/web/src/stores/cartStore.test.ts | 203 +- apps/web/vite.config.ts | 2 +- docker/haproxy/certs/README.md | 42 + docs/AUDIT_103_CORRECTIONS.md | 131 + docs/MONITORING_SETUP.md | 93 + docs/REMEDIATION_PROGRESS.md | 1 + .../AUDIT_TECHNIQUE_INTEGRAL_2026_02_16.md | 591 ++-- go.work | 2 +- go.work.sum | 1 + k8s/network-policies/README.md | 38 + k8s/network-policies/backend-api-allow.yaml | 45 + k8s/network-policies/chat-server-allow.yaml | 44 + k8s/network-policies/default-deny.yaml | 23 + k8s/network-policies/frontend-allow.yaml | 22 + loadtests/stream/hls.js | 112 + loadtests/stream/ramp.js | 61 + scripts/validate-light.sh | 40 + veza-backend-api/Dockerfile.production | 2 +- .../docs/archive/AUDIT_BACKEND_GO.md | 1017 +++++++ veza-backend-api/docs/archive/AUDIT_CONFIG.md | 201 ++ .../archive/AUDIT_EXHAUSTIF_VEZA_BACKEND.md | 1185 ++++++++ .../archive/AUDIT_MODULE_VEZA_BACKEND_API.md | 1296 ++++++++ ...E_VEZA_BACKEND_API_2025-12-15_EXHAUSTIF.md | 1191 ++++++++ ...AUDIT_MODULE_VEZA_BACKEND_API_EXHAUSTIF.md | 1140 +++++++ ...MODULE_VEZA_BACKEND_API_ULTRA_EXHAUSTIF.md | 1332 ++++++++ .../docs/archive/AUDIT_POST_REMEDIATION.md | 315 ++ .../AUDIT_POST_REMEDIATION_2025-01-27.md | 379 +++ veza-backend-api/docs/archive/README.md | 10 + .../archive/REMEDIATION_COMPLETE_REPORT.md | 329 ++ .../archive/REMEDIATION_COMPLETE_SUMMARY.md | 244 ++ .../archive/REMEDIATION_FINAL_100_PERCENT.md | 193 ++ .../docs/archive/REMEDIATION_FINAL_REPORT.md | 237 ++ .../REMEDIATION_FINAL_REPORT_2025-01-27.md | 308 ++ .../REMEDIATION_FINAL_REPORT_2025-12-15.md | 215 ++ .../docs/archive/REMEDIATION_FINAL_STATUS.md | 311 ++ .../REMEDIATION_MASTER_REPORT_FINAL.md | 325 ++ .../archive/REMEDIATION_MASTER_SUMMARY.md | 219 ++ .../REMEDIATION_PROGRESS_2025-12-15.md | 156 + .../archive/REMEDIATION_STATUS_2025-12-15.md | 161 + veza-backend-api/go.mod | 18 +- veza-backend-api/go.sum | 35 +- .../internal/api/admin/service.go | 76 +- .../api/handlers/two_factor_handlers.go | 3 +- veza-backend-api/internal/api/router.go | 3 + .../internal/api/routes_analytics.go | 2 + veza-backend-api/internal/api/routes_core.go | 7 + .../internal/api/routes_search.go | 15 + .../internal/api/routes_tracks.go | 13 +- veza-backend-api/internal/api/routes_users.go | 5 + .../internal/core/analytics/handler.go | 61 + .../internal/core/track/handler.go | 12 + veza-backend-api/internal/handlers/auth.go | 20 +- .../internal/handlers/auth_handler_test.go | 2 +- .../internal/handlers/comment_handler.go | 22 +- .../internal/handlers/comment_handler_test.go | 5 + veza-backend-api/internal/handlers/common.go | 18 +- .../handlers/password_reset_handler.go | 2 +- .../internal/handlers/profile_handler.go | 24 +- .../internal/handlers/search_handlers_test.go | 4 +- veza-backend-api/internal/handlers/session.go | 18 +- .../internal/handlers/session_test.go | 18 +- .../handlers/stream_events_handler.go | 81 + .../internal/handlers/two_factor_handler.go | 20 +- .../handlers/two_factor_handler_test.go | 62 + veza-backend-api/internal/handlers/upload.go | 1 - veza-backend-api/internal/middleware/cors.go | 8 +- .../internal/middleware/ratelimit.go | 9 +- .../playlist_collaborator_repository.go | 3 +- .../internal/resilience/circuit_breaker.go | 122 + .../internal/services/comment_service.go | 16 +- .../internal/services/jwt_service.go | 19 +- .../internal/services/live_stream_service.go | 33 + .../internal/services/playlist_service.go | 4 - .../services/playlist_version_service.go | 5 +- .../internal/services/search_service.go | 35 +- .../internal/services/session_service.go | 18 +- .../internal/services/track_chunk_service.go | 24 +- .../track_chunk_service_resume_test.go | 10 +- .../services/track_history_service.go | 5 +- .../internal/services/upload_validator.go | 24 +- .../services/upload_validator_test.go | 79 + .../internal/workers/job_worker.go | 68 +- .../migrations/080_add_payment_fields.sql | 12 +- veza-chat-server/Dockerfile.production | 4 +- veza-chat-server/src/hub/channels.rs | 13 + veza-chat-server/src/jwt_manager.rs | 1 + veza-chat-server/src/message_handler.rs | 6 +- veza-chat-server/src/read_receipts.rs | 18 +- veza-docs/SECURITY.md | 7 + veza-stream-server/.env.example | 3 +- veza-stream-server/Dockerfile.production | 4 +- veza-stream-server/src/grpc/mod.rs | 82 +- veza-sumi-design-system.html | 2680 +++++++++++++++++ veza_full_feature_list.md | 137 + 150 files changed, 18172 insertions(+), 881 deletions(-) delete mode 100644 .github/workflows/playwright.yml create mode 100644 103_RAPPORT_ETAT_FEATURES_2026_02_16.md create mode 100644 103_audit_global_features_states.md create mode 100644 Untitled create mode 100644 apps/web/e2e/tests/mobile.spec.ts-snapshots/dashboard-iphone12-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/404-page-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/404-page-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-full-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-full-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-header-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-header-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-mobile-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-mobile-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-sidebar-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-sidebar-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-tablet-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/dashboard-tablet-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/playlists-page-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/playlists-page-msedge-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/register-page-chromium-linux.png create mode 100644 apps/web/e2e/tests/visual/visual-regression.spec.ts-snapshots/register-page-msedge-linux.png create mode 100644 apps/web/src/components/admin/admin-dashboard-view/AdminDashboardView.test.tsx create mode 100644 apps/web/src/features/marketplace/components/Cart.test.tsx create mode 100644 apps/web/src/features/notifications/components/notifications-page/NotificationsPage.test.tsx create mode 100644 apps/web/src/features/roles/components/AssignRoleModal.test.tsx create mode 100644 apps/web/src/features/search/components/search-page/SearchPage.test.tsx delete mode 100644 apps/web/src/features/webhooks/api/webhookApi.ts create mode 100644 apps/web/src/mocks/handlers-admin.ts create mode 100644 apps/web/src/mocks/handlers-common.ts create mode 100644 apps/web/src/mocks/handlers-marketplace.ts create mode 100644 apps/web/src/mocks/handlers-playlists.ts create mode 100644 apps/web/src/mocks/handlers-tracks.ts create mode 100644 docker/haproxy/certs/README.md create mode 100644 docs/AUDIT_103_CORRECTIONS.md create mode 100644 docs/MONITORING_SETUP.md create mode 100644 k8s/network-policies/README.md create mode 100644 k8s/network-policies/backend-api-allow.yaml create mode 100644 k8s/network-policies/chat-server-allow.yaml create mode 100644 k8s/network-policies/default-deny.yaml create mode 100644 k8s/network-policies/frontend-allow.yaml create mode 100644 loadtests/stream/hls.js create mode 100644 loadtests/stream/ramp.js create mode 100755 scripts/validate-light.sh create mode 100644 veza-backend-api/docs/archive/AUDIT_BACKEND_GO.md create mode 100644 veza-backend-api/docs/archive/AUDIT_CONFIG.md create mode 100644 veza-backend-api/docs/archive/AUDIT_EXHAUSTIF_VEZA_BACKEND.md create mode 100644 veza-backend-api/docs/archive/AUDIT_MODULE_VEZA_BACKEND_API.md create mode 100644 veza-backend-api/docs/archive/AUDIT_MODULE_VEZA_BACKEND_API_2025-12-15_EXHAUSTIF.md create mode 100644 veza-backend-api/docs/archive/AUDIT_MODULE_VEZA_BACKEND_API_EXHAUSTIF.md create mode 100644 veza-backend-api/docs/archive/AUDIT_MODULE_VEZA_BACKEND_API_ULTRA_EXHAUSTIF.md create mode 100644 veza-backend-api/docs/archive/AUDIT_POST_REMEDIATION.md create mode 100644 veza-backend-api/docs/archive/AUDIT_POST_REMEDIATION_2025-01-27.md create mode 100644 veza-backend-api/docs/archive/README.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_COMPLETE_REPORT.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_COMPLETE_SUMMARY.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_FINAL_100_PERCENT.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_FINAL_REPORT.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_FINAL_REPORT_2025-01-27.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_FINAL_REPORT_2025-12-15.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_FINAL_STATUS.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_MASTER_REPORT_FINAL.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_MASTER_SUMMARY.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_PROGRESS_2025-12-15.md create mode 100644 veza-backend-api/docs/archive/REMEDIATION_STATUS_2025-12-15.md create mode 100644 veza-backend-api/internal/api/routes_search.go create mode 100644 veza-backend-api/internal/handlers/stream_events_handler.go create mode 100644 veza-backend-api/internal/resilience/circuit_breaker.go create mode 100644 veza-sumi-design-system.html create mode 100644 veza_full_feature_list.md diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 6361be04b..893d3d626 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -48,7 +48,7 @@ jobs: docker build -t veza-stream-server:${{ github.sha }} . - name: Trivy vulnerability scan - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: image-ref: 'veza-backend-api:${{ github.sha }}' format: 'table' @@ -56,7 +56,7 @@ jobs: severity: 'CRITICAL,HIGH' - name: Trivy scan frontend - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: image-ref: 'veza-frontend:${{ github.sha }}' format: 'table' @@ -64,7 +64,7 @@ jobs: severity: 'CRITICAL,HIGH' - name: Trivy scan chat server - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: image-ref: 'veza-chat-server:${{ github.sha }}' format: 'table' @@ -72,7 +72,7 @@ jobs: severity: 'CRITICAL,HIGH' - name: Trivy scan stream server - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: image-ref: 'veza-stream-server:${{ github.sha }}' format: 'table' @@ -111,23 +111,26 @@ jobs: if: ${{ secrets.DOCKER_REGISTRY != '' && secrets.COSIGN_PRIVATE_KEY != '' }} env: COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} + COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} run: | - echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key for svc in veza-backend-api veza-frontend veza-chat-server veza-stream-server; do - cosign sign --key cosign.key --yes "${{ secrets.DOCKER_REGISTRY }}/${svc}:${{ github.sha }}" - cosign sign --key cosign.key --yes "${{ secrets.DOCKER_REGISTRY }}/${svc}:latest" + cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${{ secrets.DOCKER_REGISTRY }}/${svc}:${{ github.sha }}" + cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${{ secrets.DOCKER_REGISTRY }}/${svc}:latest" done - name: Deploy to Kubernetes if: ${{ secrets.KUBE_CONFIG != '' }} run: | - mkdir -p ~/.kube - echo "${{ secrets.KUBE_CONFIG }}" | base64 -d > ~/.kube/config + KUBECONFIG="${{ runner.temp }}/kubeconfig" + echo "${{ secrets.KUBE_CONFIG }}" | base64 -d > "$KUBECONFIG" + chmod 600 "$KUBECONFIG" + export KUBECONFIG for svc in veza-backend-api veza-chat-server veza-stream-server; do kubectl set image "deployment/${svc}" "${svc}=${{ secrets.DOCKER_REGISTRY }}/${svc}:${{ github.sha }}" \ -n veza --record || echo "Skipping ${svc} (deployment not found)" done kubectl rollout status deployment/veza-backend-api -n veza --timeout=300s || true + rm -f "$KUBECONFIG" - name: Deployment Summary run: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 84fd8dc7d..13dbc5c16 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -262,6 +262,7 @@ jobs: CORS_ALLOWED_ORIGINS: http://veza.fr:5173,http://veza.fr:5174,http://localhost:5173,http://localhost:5174 RABBITMQ_URL: amqp://veza:devpassword@localhost:15672/ DISABLE_RATE_LIMIT_FOR_TESTS: "true" + ACCOUNT_LOCKOUT_EXEMPT_EMAILS: "e2e@test.com" run: | cd veza-backend-api go build -o veza-api ./cmd/api/main.go diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml deleted file mode 100644 index 819c1a5a2..000000000 --- a/.github/workflows/playwright.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Playwright Tests -on: - push: - branches: [ main, master ] - pull_request: - branches: [ main, master ] -jobs: - test: - timeout-minutes: 60 - runs-on: ubuntu-latest - defaults: - run: - working-directory: apps/web - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 - with: - node-version: lts/* - - name: Install dependencies - run: npm ci - - name: Install Playwright Browsers - run: npx playwright install --with-deps - - name: Run Playwright tests - run: npx playwright test - - uses: actions/upload-artifact@v4 - if: ${{ !cancelled() }} - with: - name: playwright-report - path: playwright-report/ - retention-days: 30 diff --git a/.gitignore b/.gitignore index 08a6448af..7b228709c 100644 --- a/.gitignore +++ b/.gitignore @@ -108,6 +108,7 @@ config/incus/env/*.env # Playwright /test-results/ /playwright-report/ +apps/web/e2e-results.json /blob-report/ /playwright/.cache/ /playwright/.auth/ diff --git a/103_RAPPORT_ETAT_FEATURES_2026_02_16.md b/103_RAPPORT_ETAT_FEATURES_2026_02_16.md new file mode 100644 index 000000000..38030c5a8 --- /dev/null +++ b/103_RAPPORT_ETAT_FEATURES_2026_02_16.md @@ -0,0 +1,370 @@ +# Rapport d'état précis des features — Veza + +**Date** : 16 février 2026 +**Méthode** : Analyse du code source (backend routes, frontend services, migrations DB, tests) + +--- + +## 1. CARTOGRAPHIE GLOBALE — ÉTAT PRÉCIS + +### 1.1 Stack + +| Couche | Technologie | Version | Fichiers clés | +|--------|-------------|---------|---------------| +| Frontend | React + Vite | 18.2 / 7.1.5 | `apps/web/package.json` | +| Backend | Go + Gin | 1.24 / 1.11 | `veza-backend-api/go.mod` | +| Chat | Rust + Axum | 0.8 | `veza-chat-server/Cargo.toml` | +| Stream | Rust + Axum | 0.8 | `veza-stream-server/Cargo.toml` | +| DB | PostgreSQL | 16 | `docker-compose.prod.yml` | +| Cache | Redis | 7 | idem | +| Queue | RabbitMQ | 3 | idem | + +### 1.2 Organisation du repo + +- **apps/web** : Frontend React (features/, services/, mocks/) +- **veza-backend-api** : API REST (router principal : `internal/api/router.go`) +- **veza-chat-server** : WebSocket chat +- **veza-stream-server** : Streaming audio +- **veza-common** : Lib Rust partagée +- **packages/** : NPM packages partagés + +### 1.3 Point d'entrée API + +Le routeur **actif** est `APIRouter` dans `internal/api/router.go`. +Le fichier `api_manager.go` est **exclu de la compilation** (`//go:build ignore`) — tout ce qu'il contient (achievements, leaderboard, GraphQL, gRPC, etc.) est du **code mort**. + +--- + +## 2. ÉTAT PRÉCIS DE CHAQUE FEATURE + +### 2.1 Auth (register, login, JWT, refresh) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ Complet | `routes_auth.go` : register, login, refresh, logout, /me, 2FA, OAuth, password reset | +| Frontend | ✅ Complet | `authStore`, `LoginForm`, `TwoFactorVerify`, `ProtectedRoute` | +| DB | ✅ | Tables users, sessions, refresh_tokens, email_verification_tokens | +| Tests | ✅ | `auth_handler_test.go`, `auth_integration_test.go`, `LoginForm.stories` | +| Sécurité | ✅ | JWT iss/aud/exp, token version, bcrypt cost 12, rate limit login | + +**Verdict** : **Opérationnel** + +--- + +### 2.2 2FA (TOTP) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `TwoFactorHandler` : setup, verify, disable, status | +| Frontend | ✅ | `TwoFactorSetup.tsx`, `TwoFactorVerify.tsx` | +| DB | ✅ | Colonnes two_factor_enabled, two_factor_secret, backup_codes | +| Tests | ✅ | `two_factor_handler_test.go` | + +**Verdict** : **Opérationnel** + +--- + +### 2.3 OAuth (Google, GitHub, Discord) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `OAuthHandler` : providers, initiate, callback | +| Frontend | ✅ | Boutons OAuth, callback handling | +| DB | ✅ | oauth_accounts, users | + +**Verdict** : **Opérationnel** + +--- + +### 2.4 Profils utilisateur + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_users.go` : GET/PUT/DELETE /users/:id, settings, avatar, follow, block | +| Frontend | ✅ | `ProfileView`, `ProfilePage`, `useUser` | +| DB | ✅ | users, user_profiles, user_settings | + +**Verdict** : **Opérationnel** + +--- + +### 2.5 Upload de tracks (chunked) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_tracks.go` : initiate, chunk, complete, resume, quota | +| Frontend | ✅ | `trackService`, upload flow | +| DB | ✅ | tracks, track_uploads | +| Sécurité | ✅ | RequireContentCreatorRole, ClamAV optionnel | + +**Verdict** : **Opérationnel** + +--- + +### 2.6 CRUD Tracks + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | GET/PUT/DELETE tracks, comments, likes, share, versions, play | +| Frontend | ✅ | `trackService`, `LibraryPage`, `TrackDetailPage` | +| DB | ✅ | tracks, track_comments, track_likes | + +**Verdict** : **Opérationnel** + +--- + +### 2.7 Playlists (CRUD, collaboration) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_playlists.go` : CRUD, collaborators, tracks | +| Frontend | ✅ | `playlistService`, `PlaylistDetailPage` | +| DB | ✅ | playlists, playlist_collaborators, playlist_tracks | + +**Verdict** : **Opérationnel** + +--- + +### 2.8 Chat WebSocket + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_chat.go` : POST /chat/token, GET /chat/stats | +| Chat Server | ✅ | Rust, compile OK | +| Frontend | ✅ | `ChatView`, WebSocket client | +| DB | ✅ | chat_messages (Chat Server) | + +**Verdict** : **Opérationnel** (Chat Server doit être démarré) + +--- + +### 2.9 Dashboard + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_core.go:319` : GET /dashboard, `DashboardHandler` | +| Frontend | ✅ | `dashboardService.getDashboardData()` → apiClient.get('/dashboard') | +| MSW | ✅ | Mock dans `handlers-admin.ts` (fallback Storybook) | + +**Note** : FEATURE_STATUS.md indiquait "MSW" — **faux**. Le backend expose bien `/api/v1/dashboard`. + +**Verdict** : **Opérationnel** + +--- + +### 2.10 Recherche + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `TrackSearchService`, endpoints search | +| Frontend | ✅ | `SearchPage`, `searchService` | + +**Verdict** : **Opérationnel** + +--- + +### 2.11 Social (feed, posts, groups, follows, blocks) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_social.go` : feed, posts, groups, like, comments, join/leave | +| Frontend | ✅ | `SocialView`, `useSocialView` | +| DB | ✅ | posts, social_groups, user_follows, user_blocks | + +**Verdict** : **Opérationnel** + +--- + +### 2.12 Administration + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_core.go` : admin group, RequireAdmin | +| Frontend | ✅ | `AdminDashboardPage`, `adminService` | +| Audit | ✅ | audit/logs, audit/stats | + +**Verdict** : **Opérationnel** + +--- + +### 2.13 Marketplace + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_marketplace.go` : products, cart, orders, licenses | +| Frontend | ✅ | `MarketplacePage`, `Cart`, `PurchasesView` | +| Paiement | ✅ | Hyperswitch intégré | +| DB | ✅ | marketplace_products, orders, licenses | + +**Verdict** : **Opérationnel** + +--- + +### 2.14 Webhooks + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_webhooks.go` : CRUD, regenerate-key, test, stats | +| Frontend | ✅ | `webhookService.ts` (apiClient), `WebhooksView` | +| DB | ✅ | webhooks | + +**Note** : `webhookApi.ts` supprimé — remplacé par `webhookService.ts` qui appelle l'API directement. + +**Verdict** : **Opérationnel** + +--- + +### 2.15 Inventory / Gear + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_gear.go` : GET/POST/PUT/DELETE /inventory/gear | +| Frontend | ✅ | `gearService.ts`, `GearView`, `GearPage` | +| DB | ✅ | Migration 076 : `gear_items` | +| MSW | ✅ | Mock dans `handlers-misc.ts` (Storybook) | + +**Note** : FEATURE_STATUS.md indiquait "UI + mocks, pas de backend" — **faux**. Backend complet. + +**Verdict** : **Opérationnel** + +--- + +### 2.16 Live Streaming + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_live.go` : GET /live/streams, GET /live/streams/:id, POST (auth) | +| Frontend | ✅ | `liveService.ts`, `LiveView`, `LivePage` | +| DB | ✅ | Migration 077 : `live_streams` | +| MSW | ✅ | Mock dans `handlers-misc.ts` | + +**Note** : Le streaming vidéo réel (WebRTC/HLS) est géré par le Stream Server. Les routes backend gèrent les **métadonnées** des streams (titre, description, is_live). + +**Verdict** : **Opérationnel** (métadonnées). Stream vidéo dépend du Stream Server. + +--- + +### 2.17 Analytics + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_analytics.go` : tracks plays, top, dashboard | +| Frontend | ✅ | `AnalyticsView`, `useAnalyticsView` | +| DB | ✅ | track_plays, analytics events | + +**Verdict** : **Opérationnel** + +--- + +### 2.18 Roles + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `setupRoleRoutes` : assign, revoke | +| Frontend | ✅ | `AssignRoleModal`, `RolesPage` | +| DB | ✅ | roles, user_roles | + +**Verdict** : **Opérationnel** + +--- + +### 2.19 Notifications + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ✅ | `routes_core.go` : GET/POST/DELETE /api/v1/notifications, unread-count, read, read-all. Création auto pour follow, like, comment (Phase 2.2) | +| Frontend | ✅ | `NotificationsPage`, `notificationService` | +| DB | ✅ | Table `notifications` (migration 047) | + +**Verdict** : **Opérationnel** + +--- + +### 2.20 Gamification (achievements, leaderboard) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ❌ Code mort | `api_manager.go` (build ignore) : handleGetAchievements, handleGetLeaderboard | +| Frontend | ⚠️ Composants | Storybook : AchievementCard, LeaderboardView, XPBar — pas de route /gamification | +| MSW | ? | Handlers gamification possibles dans mocks | + +**Verdict** : **Fantôme** — api_manager désactivé, pas de route active + +--- + +### 2.21 Studio (Cloud File Browser) + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ❌ | Aucune route | +| Frontend | ❌ | Dossier `features/studio/` **n'existe pas** (supprimé) | + +**Verdict** : **Supprimé** + +--- + +### 2.22 Education + +| Aspect | État | Preuve | +|--------|------|--------| +| Backend | ❌ | Aucune route | +| Frontend | ❌ | Dossier `features/education/` **n'existe pas** (supprimé) | + +**Verdict** : **Supprimé** + +--- + +## 3. RÉCAPITULATIF + +### Features opérationnelles (19) + +Auth, 2FA, OAuth, Profils, Upload tracks, CRUD tracks, Playlists, Chat, Dashboard, Recherche, Social, Admin, Marketplace, Webhooks, Gear, Live (métadonnées), Analytics, Roles, Notifications. + +### Features partielles (0) + +Aucune. + +### Features fantômes (1) + +Gamification — code dans api_manager (mort), composants Storybook. + +### Features supprimées (2) + +Studio, Education — dossiers supprimés. + +--- + +## 4. INCOHÉRENCES DOCUMENTATION / CODE + +| Document | Affirmation | Réalité | +|----------|-------------|---------| +| FEATURE_STATUS.md | Dashboard : MSW | Backend réel GET /dashboard | +| FEATURE_STATUS.md | Inventory : pas de backend | Backend complet /inventory/gear | +| FEATURE_STATUS.md | Live : contenu minimal | Backend complet /live/streams | +| FEATURE_STATUS.md | Studio : UI seule | Dossier supprimé | +| FEATURE_STATUS.md | Education : MSW | Dossier supprimé | + +**Recommandation** : Mettre à jour `docs/FEATURE_STATUS.md` et `apps/web/docs/FEATURE_STATUS.md`. + +--- + +## 5. FICHIERS CRITIQUES PAR FEATURE + +| Feature | Backend | Frontend service | Route | +|---------|---------|------------------|-------| +| Auth | routes_auth.go | authStore | /auth/* | +| Tracks | routes_tracks.go | trackService | /tracks/* | +| Playlists | routes_playlists.go | playlistService | /playlists/* | +| Chat | routes_chat.go | - | /chat/* | +| Dashboard | routes_core.go | dashboardService | /dashboard | +| Social | routes_social.go | - | /social/* | +| Marketplace | routes_marketplace.go | - | /marketplace/* | +| Webhooks | routes_webhooks.go | webhookService | /webhooks/* | +| Gear | routes_gear.go | gearService | /inventory/gear | +| Live | routes_live.go | liveService | /live/streams | +| Analytics | routes_analytics.go | - | /analytics/* | +| Roles | routes_users.go | - | /users/:id/roles | + +--- + +*Rapport généré le 16 février 2026* diff --git a/103_audit_global_features_states.md b/103_audit_global_features_states.md new file mode 100644 index 000000000..52cebd0e2 --- /dev/null +++ b/103_audit_global_features_states.md @@ -0,0 +1,737 @@ +I now have all the data needed. Let me write the comprehensive audit report. + +--- + +# 🔍 AUDIT COMPLET DU MONOREPO VEZA + +**Date** : 16 février 2026 +**Auditeur** : Architecte IA senior +**Scope** : Monorepo complet (`veza-backend-api`, `veza-chat-server`, `veza-stream-server`, `veza-common`, `apps/web`) + +--- + +## PARTIE 1 — ÉTAT DE STABILITÉ + +--- + +### 1.1 Santé du code + +#### Go Backend (`veza-backend-api/`) ✅ + +| Critère | Statut | Détail | +|---------|--------|--------| +| Compilation (`go build ./...`) | ✅ Passe | 0 erreur, 0 warning | +| Vet (`go vet ./...`) | ✅ Passe | 0 issue | +| Imports cassés | ✅ Aucun | — | +| `.env.template` | ✅ Documenté | Complet avec validation rules | +| Secrets hardcodés | ✅ Aucun | Tous via env vars, masqués dans logs | + +**TODOs/FIXMEs critiques (P1) — 7 items :** + +| Fichier | Ligne | Description | +|---------|-------|-------------| +| `internal/core/track/handler.go` | ~340 | `TODO(P2-GO-004)`: `trackUploadService` attend `int64`, reçoit `uuid.UUID` — migration UUID incomplète | +| `internal/core/track/handler.go` | ~355 | `TODO(P2-GO-004)`: même problème, `GetUploadProgress()` incompatible UUID | +| `internal/repositories/playlist_collaborator_repository.go` | ~67 | `FIXME`: modèle `PlaylistCollaborator` doit utiliser UUID | +| `internal/services/playlist_version_service.go` | ~73 | `FIXME`: `PlaylistVersion` ID types à vérifier | +| `internal/services/track_history_service.go` | ~74 | `FIXME`: `TrackHistory` needs UUID migration | +| `internal/services/playlist_service.go` | ~216 | `FIXME`: `PlaylistVersionService` needs UUID update | +| `internal/handlers/auth_handler_test.go` | 225 | `FIXME`: test attend `StatusForbidden` mais l'implémentation permet login non-vérifié | + +**TODOs P2 (18 items)** — les plus notables : + +| Fichier | Description | +|---------|-------------| +| `internal/services/job_service.go` | Job queue non connectée (5 TODOs BE-SVC-003) — pas d'async processing | +| `internal/database/database.go` | OAuth user lookup non implémenté (3 TODOs) | +| `internal/handlers/oauth_handlers.go` | `frontendURL` fallback hardcodé `http://localhost:5173` | +| `internal/config/middlewares_init.go:75` | Configuration CORS à améliorer | +| `internal/api/admin/service.go` | Admin service partiellement implémenté (3 TODOs) | + +#### Rust Chat Server (`veza-chat-server/`) ✅ + +| Critère | Statut | Détail | +|---------|--------|--------| +| Compilation (`cargo check`) | ✅ Passe | 0 erreur, 0 warning | +| Protobuf | ✅ | Utilise fichiers pré-générés | +| `.env.lab.example` | ⚠️ Minimal | Seul un template lab, pas de `.env.example` standard | + +**TODOs (3 items) :** +- `src/read_receipts.rs:230` — TODO: tracking "delivered" non implémenté +- `src/presence.rs:226` — TODO: intégration push notifications (FCM, APNs) +- `src/message_handler.rs:327` — TODO: recherche de salon par nom + +#### Rust Stream Server (`veza-stream-server/`) ✅ + +| Critère | Statut | Détail | +|---------|--------|--------| +| Compilation (`cargo check`) | ✅ Passe | 0 erreur, 0 warning | +| Protobuf | ✅ | Utilise fichiers pré-générés | +| `.env.example` | ✅ Documenté | Variables bien documentées | +| `#![allow(dead_code)]` | ⚠️ | Code mort autorisé dans `lib.rs` | + +**Point critique** : le client gRPC vers le backend Go (`src/grpc/mod.rs`) est un **stub** — `attempt_send()` fait juste un `sleep`, il n'envoie rien réellement. + +#### Rust Common (`veza-common/`) ✅ + +| Critère | Statut | +|---------|--------| +| Compilation | ✅ Passe | +| TODOs | ✅ Aucun | + +#### Frontend React (`apps/web/`) ✅ + +| Critère | Statut | Détail | +|---------|--------|--------| +| TypeScript (`tsc --noEmit`) | ✅ Passe | 0 erreur | +| Build Vite | ✅ Passe | — | +| `.env.example` | ✅ Documenté | Complet avec feature flags | + +**TODOs notables :** +- `src/services/analyticsService.ts:92-97` — endpoints analytics non implémentés côté backend, retournent des valeurs vides +- `src/config/features.ts:50` — HLS endpoints marqués "NOT IMPLEMENTED" +- `src/features/user/components/profile/ProfileSecurity.tsx:12` — "Placeholder for profile security" + +--- + +### 1.2 Points bloquants fonctionnels + +| Module | Statut | Détail | +|--------|--------|--------| +| **Auth** | ✅ Fonctionnel | Register → verify email → login → refresh → logout → 2FA TOTP : flow complet. OAuth Google/GitHub opérationnel. Sessions management complet (list/revoke/logout-all). | +| **Profils** | ✅ Fonctionnel | Création, édition, avatar upload, profil public (`/u/:username`), social links, paramètres. Toutes les routes connectées frontend ↔ backend. | +| **Upload & Fichiers** | ⚠️ Partiel | Upload simple ✅, upload chunked ✅, validation MIME/taille ✅, métadonnées extraites ✅. **Manque** : transcoding async (job queue stub), HLS transcoding désactivé (feature flag `false`). | +| **Streaming/Lecteur** | ⚠️ Partiel | Play/pause/seek/next/volume/shuffle/repeat ✅ via `