pour prod

2026-08-07 16:13:43 +02:00
commit 5fbf76868f
157 changed files with 24085 additions and 0 deletions
--- a/app/Core/Access.php
+++ b/app/Core/Access.php
@@ -0,0 +1,368 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+use PDO;
+
+final class Access
+{
+    public const ROLE_AGENT = 'AGENT';
+    public const ROLE_RESPONSABLE = 'RESPONSABLE_STRUCTURE';
+    public const ROLE_SERVICE = 'SERVICE_ENFANCE';
+
+    private const SESSION_KEY = 'pta_access';
+
+    public function __construct(private PDO $pdo)
+    {
+        if (session_status() !== PHP_SESSION_ACTIVE) {
+            session_start();
+        }
+    }
+
+    public function isConfigured(): bool
+    {
+        $role = $this->role();
+        if ($role === self::ROLE_AGENT) {
+            return $this->agentId() !== null && $this->agentRecord() !== null;
+        }
+        if ($role === self::ROLE_RESPONSABLE) {
+            return $this->structureId() !== null && $this->structureRecord() !== null;
+        }
+        return $role === self::ROLE_SERVICE;
+    }
+
+    public function role(): ?string
+    {
+        $role = strtoupper(trim((string) ($_SESSION[self::SESSION_KEY]['role'] ?? '')));
+        return in_array($role, [self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE], true)
+            ? $role
+            : null;
+    }
+
+    public function agentId(): ?int
+    {
+        $value = filter_var($_SESSION[self::SESSION_KEY]['agent_id'] ?? null, FILTER_VALIDATE_INT, [
+            'options' => ['min_range' => 1],
+        ]);
+        return $value === false ? null : (int) $value;
+    }
+
+    public function structureId(): ?int
+    {
+        if ($this->role() === self::ROLE_AGENT) {
+            $agent = $this->agentRecord();
+            return isset($agent['id_structure']) && $agent['id_structure'] !== null
+                ? (int) $agent['id_structure']
+                : null;
+        }
+
+        $value = filter_var($_SESSION[self::SESSION_KEY]['structure_id'] ?? null, FILTER_VALIDATE_INT, [
+            'options' => ['min_range' => 1],
+        ]);
+        return $value === false ? null : (int) $value;
+    }
+
+    public function select(string $role, ?int $agentId = null, ?int $structureId = null): void
+    {
+        $role = strtoupper(trim($role));
+        if (!in_array($role, [self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE], true)) {
+            throw new \DomainException('Rôle invalide.');
+        }
+
+        $selection = ['role' => $role, 'agent_id' => null, 'structure_id' => null];
+
+        if ($role === self::ROLE_AGENT) {
+            if (!$agentId || !$this->activeAgentExists($agentId)) {
+                throw new \DomainException('Sélectionnez un agent actif.');
+            }
+            $selection['agent_id'] = $agentId;
+        } elseif ($role === self::ROLE_RESPONSABLE) {
+            if (!$structureId || !$this->activeStructureExists($structureId)) {
+                throw new \DomainException('Sélectionnez un lieu d’affectation actif.');
+            }
+            $selection['structure_id'] = $structureId;
+        }
+
+        $_SESSION[self::SESSION_KEY] = $selection;
+        session_regenerate_id(true);
+    }
+
+    public function clear(): void
+    {
+        unset($_SESSION[self::SESSION_KEY]);
+        session_regenerate_id(true);
+    }
+
+    public function profile(): array
+    {
+        $role = $this->role();
+        $permissions = $this->permissions();
+        $profile = [
+            'role' => $role,
+            'role_label' => $this->roleLabel(),
+            'label' => $this->roleLabel(),
+            'agent_id' => $this->agentId(),
+            'structure_id' => $this->structureId(),
+            'permissions' => $permissions,
+        ];
+
+        if ($role === self::ROLE_AGENT) {
+            $agent = $this->agentRecord();
+            if ($agent !== null) {
+                $profile['label'] = trim((string) $agent['prenom'] . ' ' . (string) $agent['nom']);
+                $profile['matricule'] = $agent['matricule'];
+                $profile['structure_name'] = $agent['structure_nom'];
+                $profile['structure_id'] = $agent['id_structure'] !== null ? (int) $agent['id_structure'] : null;
+            }
+        } elseif ($role === self::ROLE_RESPONSABLE) {
+            $structure = $this->structureRecord();
+            if ($structure !== null) {
+                $profile['label'] = (string) $structure['nom'];
+                $profile['structure_name'] = (string) $structure['nom'];
+                $profile['structure_code'] = (string) $structure['code'];
+            }
+        }
+
+        return $profile;
+    }
+
+    public function permissions(): array
+    {
+        $role = $this->role();
+        $service = $role === self::ROLE_SERVICE;
+        $responsable = $role === self::ROLE_RESPONSABLE;
+
+        return [
+            'read_only' => $role === self::ROLE_AGENT,
+            'can_edit_draft' => $service || $responsable,
+            'can_edit_cross_structure' => $service,
+            'can_validate' => $service,
+            'can_reopen' => $service || $responsable,
+            'can_use_templates' => $service,
+            'can_copy_full_week' => $service,
+            'can_view_pending' => $service,
+            'can_manage_coverage' => $service,
+            'can_manage_agents' => $service,
+            'can_manage_structures' => $service,
+            'can_manage_vacations' => $service,
+            'can_manage_teams' => $service,
+            'can_manage_pta' => $service,
+            'can_forecast_next_year' => $service,
+        ];
+    }
+
+    public function allowedPages(): array
+    {
+        return match ($this->role()) {
+            self::ROLE_AGENT => ['agents', 'structures'],
+            self::ROLE_RESPONSABLE => ['planning', 'structures', 'agents', 'coverage'],
+            self::ROLE_SERVICE => ['planning', 'pending', 'coverage', 'structures', 'agents', 'annual', 'pta', 'teams', 'vacations', 'administration'],
+            default => [],
+        };
+    }
+
+    public function canAccessPage(string $page): bool
+    {
+        return in_array($page, $this->allowedPages(), true);
+    }
+
+    public function homeUrl(): string
+    {
+        return match ($this->role()) {
+            self::ROLE_AGENT => 'agents.php?agent_id=' . (int) $this->agentId(),
+            self::ROLE_RESPONSABLE => 'planning.php?structure_id=' . (int) $this->structureId(),
+            self::ROLE_SERVICE => 'planning.php',
+            default => 'role.php',
+        };
+    }
+
+    public function requirePage(string $page): void
+    {
+        if (!$this->isConfigured()) {
+            header('Location: role.php', true, 302);
+            exit;
+        }
+        if (!$this->canAccessPage($page)) {
+            header('Location: ' . $this->homeUrl() . (str_contains($this->homeUrl(), '?') ? '&' : '?') . 'access_denied=1', true, 302);
+            exit;
+        }
+    }
+
+    public function requireRoles(array $roles): void
+    {
+        if (!$this->isConfigured()) {
+            JsonResponse::send(401, ['error' => 'Choisissez votre rôle avant de continuer.', 'code' => 'ROLE_REQUIRED']);
+        }
+        if (!in_array($this->role(), $roles, true)) {
+            JsonResponse::send(403, ['error' => 'Votre rôle ne permet pas cette action.', 'code' => 'ACCESS_DENIED']);
+        }
+    }
+
+    public function requireService(): void
+    {
+        $this->requireRoles([self::ROLE_SERVICE]);
+    }
+
+    public function requireDraftEditor(): void
+    {
+        $this->requireRoles([self::ROLE_RESPONSABLE, self::ROLE_SERVICE]);
+    }
+
+    public function requireStructureView(int $structureId): void
+    {
+        $this->requireRoles([self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE]);
+        if ($this->role() !== self::ROLE_SERVICE && $this->structureId() !== $structureId) {
+            JsonResponse::send(403, ['error' => 'Vous ne pouvez consulter que le planning de votre lieu de rattachement.', 'code' => 'STRUCTURE_SCOPE']);
+        }
+    }
+
+    public function requireStructureEdit(int $structureId): void
+    {
+        $this->requireDraftEditor();
+        if ($this->role() === self::ROLE_RESPONSABLE && $this->structureId() !== $structureId) {
+            JsonResponse::send(403, ['error' => 'Vous ne pouvez modifier que les brouillons de votre lieu.', 'code' => 'STRUCTURE_SCOPE']);
+        }
+    }
+
+    public function requireAgentView(int $agentId): void
+    {
+        $this->requireRoles([self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE]);
+        if ($this->role() === self::ROLE_SERVICE) {
+            return;
+        }
+        if ($this->role() === self::ROLE_AGENT && $this->agentId() === $agentId) {
+            return;
+        }
+        if ($this->role() === self::ROLE_RESPONSABLE && $this->responsibleCanViewAgent($agentId)) {
+            return;
+        }
+        JsonResponse::send(403, ['error' => 'Vous ne pouvez pas consulter le planning de cet agent.', 'code' => 'AGENT_SCOPE']);
+    }
+
+    public function requireEntryEdit(int $entryId): void
+    {
+        $this->requireDraftEditor();
+        if ($this->role() === self::ROLE_SERVICE) {
+            return;
+        }
+        $stmt = $this->pdo->prepare(
+            'SELECT p.id_structure
+             FROM creneau_horaire c
+             INNER JOIN planning p ON p.id_planning = c.id_planning
+             WHERE c.id_creneau = :id LIMIT 1'
+        );
+        $stmt->execute(['id' => $entryId]);
+        $structureId = $stmt->fetchColumn();
+        if ($structureId === false) {
+            JsonResponse::send(404, ['error' => 'Créneau introuvable.']);
+        }
+        $this->requireStructureEdit((int) $structureId);
+    }
+
+    public function requirePlanningEdit(int $planningId): void
+    {
+        $this->requireDraftEditor();
+        if ($this->role() === self::ROLE_SERVICE) {
+            return;
+        }
+        $stmt = $this->pdo->prepare('SELECT id_structure FROM planning WHERE id_planning = :id LIMIT 1');
+        $stmt->execute(['id' => $planningId]);
+        $structureId = $stmt->fetchColumn();
+        if ($structureId === false) {
+            JsonResponse::send(404, ['error' => 'Planning introuvable.']);
+        }
+        $this->requireStructureEdit((int) $structureId);
+    }
+
+    public function editableStructureId(): ?int
+    {
+        return $this->role() === self::ROLE_RESPONSABLE ? $this->structureId() : null;
+    }
+
+    private function roleLabel(): string
+    {
+        return match ($this->role()) {
+            self::ROLE_AGENT => 'Agent',
+            self::ROLE_RESPONSABLE => 'Responsable de structure',
+            self::ROLE_SERVICE => 'Service Enfance',
+            default => 'Rôle non sélectionné',
+        };
+    }
+
+    private function activeAgentExists(int $agentId): bool
+    {
+        $stmt = $this->pdo->prepare('SELECT 1 FROM agent WHERE id_agent = :id AND actif = TRUE LIMIT 1');
+        $stmt->execute(['id' => $agentId]);
+        return $stmt->fetchColumn() !== false;
+    }
+
+    private function activeStructureExists(int $structureId): bool
+    {
+        $stmt = $this->pdo->prepare('SELECT 1 FROM structure WHERE id_structure = :id AND actif = TRUE LIMIT 1');
+        $stmt->execute(['id' => $structureId]);
+        return $stmt->fetchColumn() !== false;
+    }
+
+    private function agentRecord(): ?array
+    {
+        $agentId = $this->agentId();
+        if ($agentId === null) {
+            return null;
+        }
+        $stmt = $this->pdo->prepare(
+            'SELECT a.id_agent, a.matricule, a.nom, a.prenom, a.id_structure,
+                    s.nom AS structure_nom
+             FROM agent a
+             LEFT JOIN structure s ON s.id_structure = a.id_structure
+             WHERE a.id_agent = :id AND a.actif = TRUE LIMIT 1'
+        );
+        $stmt->execute(['id' => $agentId]);
+        return $stmt->fetch() ?: null;
+    }
+
+    private function structureRecord(): ?array
+    {
+        $structureId = $this->structureId();
+        if ($structureId === null) {
+            return null;
+        }
+        $stmt = $this->pdo->prepare(
+            'SELECT id_structure, code, nom
+             FROM structure
+             WHERE id_structure = :id AND actif = TRUE LIMIT 1'
+        );
+        $stmt->execute(['id' => $structureId]);
+        return $stmt->fetch() ?: null;
+    }
+
+    private function responsibleCanViewAgent(int $agentId): bool
+    {
+        $structureId = $this->structureId();
+        if ($structureId === null) {
+            return false;
+        }
+        $stmt = $this->pdo->prepare(
+            'SELECT 1
+             FROM agent a
+             WHERE a.id_agent = :agent_id
+               AND a.actif = TRUE
+               AND (
+                    a.id_structure = :structure_id_default
+                    OR EXISTS (
+                        SELECT 1 FROM planning p
+                        WHERE p.id_agent = a.id_agent
+                          AND p.id_structure = :structure_id_planning
+                    )
+               )
+             LIMIT 1'
+        );
+        $stmt->execute([
+            'agent_id' => $agentId,
+            'structure_id_default' => $structureId,
+            'structure_id_planning' => $structureId,
+        ]);
+        return $stmt->fetchColumn() !== false;
+    }
+}
--- a/app/Core/Controller.php
+++ b/app/Core/Controller.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+abstract class Controller
+{
+    protected function render(string $view, array $data = []): void
+    {
+        $viewFile = dirname(__DIR__) . '/Views/' . $view . '.php';
+        if (!is_file($viewFile)) {
+            throw new \RuntimeException('Vue introuvable : ' . $view);
+        }
+
+        extract($data, EXTR_SKIP);
+        require $viewFile;
+    }
+}
--- a/app/Core/Csrf.php
+++ b/app/Core/Csrf.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+final class Csrf
+{
+    public static function ensureToken(): string
+    {
+        if (session_status() !== PHP_SESSION_ACTIVE) {
+            session_start();
+        }
+
+        if (empty($_SESSION['csrf_token'])) {
+            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+        }
+
+        return (string) $_SESSION['csrf_token'];
+    }
+
+    public static function assertPayload(array $payload): void
+    {
+        $expected = self::ensureToken();
+        $provided = (string) ($payload['csrf_token'] ?? '');
+
+        if ($provided === '' || !hash_equals($expected, $provided)) {
+            JsonResponse::send(403, ['error' => 'Jeton de sécurité invalide. Rechargez la page.']);
+        }
+    }
+}
--- a/app/Core/JsonResponse.php
+++ b/app/Core/JsonResponse.php
@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+final class JsonResponse
+{
+    public static function bootstrap(): void
+    {
+        ini_set('display_errors', '0');
+        ini_set('html_errors', '0');
+        error_reporting(E_ALL);
+
+        set_error_handler(static function (int $severity, string $message, string $file, int $line): bool {
+            if (!(error_reporting() & $severity)) {
+                return false;
+            }
+
+            throw new \ErrorException($message, 0, $severity, $file, $line);
+        });
+
+        set_exception_handler(static function (\Throwable $exception): void {
+            error_log(sprintf(
+                '[PTA API] %s: %s in %s:%d',
+                get_class($exception),
+                $exception->getMessage(),
+                $exception->getFile(),
+                $exception->getLine()
+            ));
+
+            $payload = ['error' => 'Une erreur serveur est survenue.'];
+            if ((getenv('PTA_DEBUG') ?: '1') !== '0') {
+                $payload['details'] = $exception->getMessage();
+            }
+
+            self::send(500, $payload);
+        });
+    }
+
+    public static function send(int $status, array $payload): void
+    {
+        if (!headers_sent()) {
+            header('Content-Type: application/json; charset=utf-8');
+        }
+
+        http_response_code($status);
+        echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_INVALID_UTF8_SUBSTITUTE);
+        exit;
+    }
+}
--- a/app/Core/PdfResponse.php
+++ b/app/Core/PdfResponse.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+final class PdfResponse
+{
+    public static function inline(string $content, string $filename): void
+    {
+        $safeFilename = preg_replace('/[^A-Za-z0-9._-]+/', '_', $filename) ?: 'planning.pdf';
+        if (!str_ends_with(strtolower($safeFilename), '.pdf')) {
+            $safeFilename .= '.pdf';
+        }
+
+        if (!headers_sent()) {
+            header('Content-Type: application/pdf');
+            header('Content-Disposition: inline; filename="' . $safeFilename . '"');
+            header('Content-Length: ' . strlen($content));
+            header('Cache-Control: private, max-age=0, must-revalidate');
+            header('Pragma: public');
+        }
+
+        echo $content;
+        exit;
+    }
+}
--- a/app/Core/Request.php
+++ b/app/Core/Request.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+final class Request
+{
+    public static function json(): array
+    {
+        $payload = json_decode((string) file_get_contents('php://input'), true);
+        if (!is_array($payload)) {
+            JsonResponse::send(400, ['error' => 'Corps JSON invalide.']);
+        }
+
+        return $payload;
+    }
+
+    public static function requireMethod(string $method): void
+    {
+        if (strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET') !== strtoupper($method)) {
+            JsonResponse::send(405, ['error' => 'Méthode non autorisée.']);
+        }
+    }
+}