45

backend/database/.gitignore

@@ -0,0 +1 @@
+*.sqlite*

backend/database/factories/UserFactory.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+
+/**
+ * @extends Factory<User>
+ */
+class UserFactory extends Factory
+{
+    /**
+     * The current password being used by the factory.
+     */
+    protected static ?string $password;
+
+    /**
+     * Define the model's default state.
+     *
+     * @return array<string, mixed>
+     */
+    public function definition(): array
+    {
+        return [
+            'name' => fake()->name(),
+            'email' => fake()->unique()->safeEmail(),
+            'email_verified_at' => now(),
+            'password' => static::$password ??= Hash::make('password'),
+            'remember_token' => Str::random(10),
+        ];
+    }
+
+    /**
+     * Indicate that the model's email address should be unverified.
+     */
+    public function unverified(): static
+    {
+        return $this->state(fn (array $attributes) => [
+            'email_verified_at' => null,
+        ]);
+    }
+}

backend/database/migrations/0001_01_01_000000_create_users_table.php

@@ -0,0 +1,49 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('users', function (Blueprint $table) {
+            $table->id();
+            $table->string('name');
+            $table->string('email')->unique();
+            $table->timestamp('email_verified_at')->nullable();
+            $table->string('password');
+            $table->rememberToken();
+            $table->timestamps();
+        });
+
+        Schema::create('password_reset_tokens', function (Blueprint $table) {
+            $table->string('email')->primary();
+            $table->string('token');
+            $table->timestamp('created_at')->nullable();
+        });
+
+        Schema::create('sessions', function (Blueprint $table) {
+            $table->string('id')->primary();
+            $table->foreignId('user_id')->nullable()->index();
+            $table->string('ip_address', 45)->nullable();
+            $table->text('user_agent')->nullable();
+            $table->longText('payload');
+            $table->integer('last_activity')->index();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('users');
+        Schema::dropIfExists('password_reset_tokens');
+        Schema::dropIfExists('sessions');
+    }
+};

backend/database/migrations/0001_01_01_000001_create_cache_table.php

@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('cache', function (Blueprint $table) {
+            $table->string('key')->primary();
+            $table->mediumText('value');
+            $table->bigInteger('expiration')->index();
+        });
+
+        Schema::create('cache_locks', function (Blueprint $table) {
+            $table->string('key')->primary();
+            $table->string('owner');
+            $table->bigInteger('expiration')->index();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('cache');
+        Schema::dropIfExists('cache_locks');
+    }
+};

backend/database/migrations/0001_01_01_000002_create_jobs_table.php

@@ -0,0 +1,59 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('jobs', function (Blueprint $table) {
+            $table->id();
+            $table->string('queue')->index();
+            $table->longText('payload');
+            $table->unsignedSmallInteger('attempts');
+            $table->unsignedInteger('reserved_at')->nullable();
+            $table->unsignedInteger('available_at');
+            $table->unsignedInteger('created_at');
+        });
+
+        Schema::create('job_batches', function (Blueprint $table) {
+            $table->string('id')->primary();
+            $table->string('name');
+            $table->integer('total_jobs');
+            $table->integer('pending_jobs');
+            $table->integer('failed_jobs');
+            $table->longText('failed_job_ids');
+            $table->mediumText('options')->nullable();
+            $table->integer('cancelled_at')->nullable();
+            $table->integer('created_at');
+            $table->integer('finished_at')->nullable();
+        });
+
+        Schema::create('failed_jobs', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->string('connection');
+            $table->string('queue');
+            $table->longText('payload');
+            $table->longText('exception');
+            $table->timestamp('failed_at')->useCurrent();
+
+            $table->index(['connection', 'queue', 'failed_at']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('jobs');
+        Schema::dropIfExists('job_batches');
+        Schema::dropIfExists('failed_jobs');
+    }
+};

backend/database/migrations/2026_10_01_000001_create_signature_tables.php

@@ -0,0 +1,208 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Modèle de données des signatures.
+ * Toutes les tables métier portent un tenant_id : c'est ce qui permettra
+ * d'accueillir une commune membre sans refonte.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('tenants', function (Blueprint $t) {
+            $t->id();
+            $t->string('name');
+            $t->uuid('entra_tenant_id')->unique();
+            $t->boolean('active')->default(true);
+            $t->text('users_delta_link')->nullable();
+            $t->timestamp('last_sync_at')->nullable();
+            $t->string('last_sync_status')->nullable();
+            $t->timestamps();
+        });
+
+        Schema::create('directory_users', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+            $t->uuid('entra_oid');
+            $t->string('display_name')->nullable();
+            $t->string('given_name')->nullable();
+            $t->string('surname')->nullable();
+            $t->string('job_title')->nullable();
+            $t->string('department')->nullable();
+            $t->string('company_name')->nullable();
+            $t->string('office_location')->nullable();
+            $t->string('business_phone')->nullable();
+            $t->string('mobile_phone')->nullable();
+            $t->string('mail')->nullable()->index();
+            $t->string('user_principal_name')->nullable()->index();
+            $t->string('street_address')->nullable();
+            $t->string('postal_code')->nullable();
+            $t->string('city')->nullable();
+            $t->boolean('account_enabled')->default(true);
+            $t->timestamp('synced_at')->nullable();
+            $t->softDeletes();
+            $t->timestamps();
+            $t->unique(['tenant_id', 'entra_oid']);
+        });
+
+        Schema::create('directory_groups', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+            $t->uuid('entra_oid');
+            $t->string('display_name');
+            $t->timestamp('synced_at')->nullable();
+            $t->timestamps();
+            $t->unique(['tenant_id', 'entra_oid']);
+        });
+
+        // Appartenance transitive (groupes imbriqués inclus).
+        Schema::create('group_members', function (Blueprint $t) {
+            $t->foreignId('directory_group_id')->constrained()->cascadeOnDelete();
+            $t->foreignId('directory_user_id')->constrained()->cascadeOnDelete();
+            $t->primary(['directory_group_id', 'directory_user_id']);
+        });
+
+        Schema::create('templates', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+            $t->string('name');
+            $t->text('description')->nullable();
+            // Contenu publié (celui que sert l'API).
+            $t->longText('html_full')->nullable();
+            $t->longText('html_short')->nullable();
+            // Brouillon en cours d'édition (éditeur visuel / HTML).
+            $t->longText('draft_html_full')->nullable();
+            $t->longText('draft_html_short')->nullable();
+            $t->json('editor_state')->nullable();
+            $t->boolean('is_default')->default(false);
+            $t->unsignedInteger('published_version')->default(0);
+            $t->timestamp('published_at')->nullable();
+            $t->timestamps();
+        });
+
+        Schema::create('template_versions', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('template_id')->constrained()->cascadeOnDelete();
+            $t->unsignedInteger('version');
+            $t->longText('html_full')->nullable();
+            $t->longText('html_short')->nullable();
+            $t->foreignId('published_by')->nullable()->constrained('users')->nullOnDelete();
+            $t->timestamps();
+            $t->unique(['template_id', 'version']);
+        });
+
+        // Template <-> groupe AD, avec priorité (la plus haute l'emporte).
+        Schema::create('assignments', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+            $t->foreignId('template_id')->constrained()->cascadeOnDelete();
+            $t->foreignId('directory_group_id')->constrained()->cascadeOnDelete();
+            $t->integer('priority')->default(10);
+            $t->timestamps();
+            $t->unique(['template_id', 'directory_group_id']);
+        });
+
+        // Champs ouverts à la modification par les agents (choix de l'admin).
+        Schema::create('editable_fields', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+            $t->string('field');        // clé de variable : mobile, telephone, bureau…
+            $t->string('label');
+            $t->boolean('enabled')->default(false);
+            $t->string('validation_rule')->nullable(); // règle Laravel, ex. "regex:/^[0-9 +.]{6,20}$/"
+            $t->timestamps();
+            $t->unique(['tenant_id', 'field']);
+        });
+
+        // Surcharges saisies par l'agent : publication immédiate, tracée dans audit_logs.
+        Schema::create('user_overrides', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('directory_user_id')->constrained()->cascadeOnDelete();
+            $t->string('field');
+            $t->string('value')->nullable();
+            $t->timestamps();
+            $t->unique(['directory_user_id', 'field']);
+        });
+
+        Schema::create('user_preferences', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('directory_user_id')->unique()->constrained()->cascadeOnDelete();
+            $t->string('reply_variant')->nullable(); // short | full | none (null = défaut du tenant)
+            $t->timestamps();
+        });
+
+        // Boîtes partagées : template dédié et choix d'afficher ou non l'agent expéditeur.
+        Schema::create('shared_mailboxes', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+            $t->string('address');
+            $t->string('display_name')->nullable();
+            $t->foreignId('template_id')->nullable()->constrained()->nullOnDelete();
+            $t->boolean('include_sender')->default(false);
+            $t->timestamps();
+            $t->unique(['tenant_id', 'address']);
+        });
+
+        Schema::create('campaigns', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+            $t->string('name');
+            $t->string('image_path');
+            $t->string('alt_text');
+            $t->string('link_url')->nullable();
+            $t->timestamp('starts_at');
+            $t->timestamp('ends_at');
+            $t->integer('priority')->default(0);
+            $t->boolean('active')->default(true);
+            $t->timestamps();
+        });
+
+        // Ciblage des campagnes (aucune ligne = tous les agents).
+        Schema::create('campaign_group', function (Blueprint $t) {
+            $t->foreignId('campaign_id')->constrained()->cascadeOnDelete();
+            $t->foreignId('directory_group_id')->constrained()->cascadeOnDelete();
+            $t->primary(['campaign_id', 'directory_group_id']);
+        });
+
+        Schema::create('audit_logs', function (Blueprint $t) {
+            $t->id();
+            $t->foreignId('tenant_id')->nullable()->constrained()->nullOnDelete();
+            $t->string('actor_type'); // admin | agent | system
+            $t->string('actor')->nullable();
+            $t->string('action');
+            $t->string('subject_type')->nullable();
+            $t->unsignedBigInteger('subject_id')->nullable();
+            $t->json('changes')->nullable();
+            $t->string('ip', 45)->nullable();
+            $t->timestamp('created_at')->useCurrent();
+            $t->index(['subject_type', 'subject_id']);
+        });
+
+        // Comptes du back-office (connexion SSO Entra, pas de mot de passe local).
+        Schema::table('users', function (Blueprint $t) {
+            $t->foreignId('tenant_id')->nullable()->after('id')->constrained()->nullOnDelete();
+            $t->uuid('entra_oid')->nullable()->unique()->after('tenant_id');
+            $t->string('role')->nullable()->after('email'); // superadmin | admin | editor | null
+            $t->string('password')->nullable()->change();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $t) {
+            $t->dropConstrainedForeignId('tenant_id');
+            $t->dropColumn(['entra_oid', 'role']);
+        });
+        foreach ([
+            'audit_logs', 'campaign_group', 'campaigns', 'shared_mailboxes', 'user_preferences',
+            'user_overrides', 'editable_fields', 'assignments', 'template_versions', 'templates',
+            'group_members', 'directory_groups', 'directory_users', 'tenants',
+        ] as $table) {
+            Schema::dropIfExists($table);
+        }
+    }
+};

backend/database/seeders/DatabaseSeeder.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Database\Seeders;
+
+use Illuminate\Database\Seeder;
+
+class DatabaseSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $this->call(SignatureSeeder::class);
+    }
+}

backend/database/seeders/SignatureSeeder.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\EditableField;
+use App\Models\Template;
+use App\Models\Tenant;
+use App\Signature\VariableMap;
+use Illuminate\Database\Seeder;
+use RuntimeException;
+
+/** Données initiales : tenant CABM, champs modifiables (tous fermés), template par défaut. */
+class SignatureSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $tid = config('signature.default_tenant.entra_tenant_id');
+        if (! $tid) {
+            throw new RuntimeException('ENTRA_TENANT_ID absent du .env');
+        }
+
+        $tenant = Tenant::firstOrCreate(
+            ['entra_tenant_id' => $tid],
+            ['name' => config('signature.default_tenant.name'), 'active' => true],
+        );
+
+        // L'admin choisira dans le back-office les champs ouverts aux agents.
+        foreach (['mobile', 'telephone', 'bureau', 'fonction'] as $field) {
+            EditableField::firstOrCreate(
+                ['tenant_id' => $tenant->id, 'field' => $field],
+                ['label' => VariableMap::FIELDS[$field]['label'], 'enabled' => false],
+            );
+        }
+
+        if (! Template::where('tenant_id', $tenant->id)->exists()) {
+            $template = Template::create([
+                'tenant_id' => $tenant->id,
+                'name' => 'Agents — défaut',
+                'description' => 'Template par défaut, appliqué aux agents hors groupe signature_mail_*.',
+                'draft_html_full' => file_get_contents(database_path('seeders/templates/agents-full.html')),
+                'draft_html_short' => file_get_contents(database_path('seeders/templates/agents-short.html')),
+                'is_default' => true,
+            ]);
+            $template->publish();
+        }
+    }
+}

backend/database/seeders/templates/agents-full.html

@@ -0,0 +1,17 @@
+<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="font-family:Arial,Helvetica,sans-serif;font-size:13px;line-height:18px;color:#1b1b1b;border-collapse:collapse">
+  <tr>
+    <td style="padding:0 16px 0 0;vertical-align:top;border-right:2px solid #0b5cad">
+      <img src="{{site_url}}/img/logo-cabm.png" alt="Agglo Béziers Méditerranée" width="120" style="display:block;border:0">
+    </td>
+    <td style="padding:0 0 0 16px;vertical-align:top">
+      <strong style="font-size:14px">{{prenom}} {{nom}}</strong><br>
+      {{#if fonction}}{{fonction}}<br>{{/if}}
+      {{#if service}}<span style="color:#5c5c5c">{{service}}</span><br>{{/if}}
+      {{#if telephone}}Tél. {{telephone}}<br>{{/if}}
+      {{#if mobile}}Mob. {{mobile}}<br>{{/if}}
+      {{#if adresse}}<span style="color:#5c5c5c">{{adresse}}{{#if code_postal}}, {{code_postal}} {{ville}}{{/if}}</span><br>{{/if}}
+      <a href="https://www.beziers-mediterranee.fr" style="color:#0b5cad;text-decoration:none">beziers-mediterranee.fr</a>
+    </td>
+  </tr>
+  {{#if banniere}}<tr><td colspan="2" style="padding:12px 0 0 0">{{{banniere}}}</td></tr>{{/if}}
+</table>

backend/database/seeders/templates/agents-short.html

@@ -0,0 +1,4 @@
+<p style="font-family:Arial,Helvetica,sans-serif;font-size:13px;line-height:18px;color:#1b1b1b;margin:0">
+  <strong>{{prenom}} {{nom}}</strong>{{#if fonction}} · {{fonction}}{{/if}}<br>
+  Agglo Béziers Méditerranée{{#if telephone}} · {{telephone}}{{/if}}
+</p>