Initial commit: Import existing Laravel project

app/Http/Controllers/AttachmentController.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Attachment;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Gate;
+
+class AttachmentController extends Controller
+{
+    /**
+     * Affiche/télécharge de manière sécurisée une pièce jointe.
+     */
+    public function show(Attachment $attachment)
+    {
+        // On vérifie si l'utilisateur a le droit de voir la commande liée à cette pièce jointe
+        $order = $attachment->order;
+        
+        Gate::authorize('view', $order);
+
+        // Si le fichier n'existe pas dans le stockage public
+        if (!Storage::disk('public')->exists($attachment->file_path)) {
+            abort(404, 'Fichier non trouvé.');
+        }
+
+        $path = Storage::disk('public')->path($attachment->file_path);
+
+        // On renvoie le fichier pour affichage inline (utile pour les PDF/images)
+        return response()->file($path, [
+            'Content-Disposition' => 'inline; filename="' . basename($attachment->file_name) . '"'
+        ]);
+    }
+}

app/Http/Controllers/Auth/AuthenticatedSessionController.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Auth\LoginRequest;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Route;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class AuthenticatedSessionController extends Controller
+{
+    /**
+     * Display the login view.
+     */
+    public function create(): Response
+    {
+        return Inertia::render('Auth/Login', [
+            'canResetPassword' => Route::has('password.request'),
+            'status' => session('status'),
+        ]);
+    }
+
+    /**
+     * Handle an incoming authentication request.
+     */
+    public function store(LoginRequest $request): RedirectResponse
+    {
+        $request->authenticate();
+
+        $request->session()->regenerate();
+
+        return redirect()->intended(route('dashboard', absolute: false));
+    }
+
+    /**
+     * Destroy an authenticated session.
+     */
+    public function destroy(Request $request): RedirectResponse
+    {
+        Auth::guard('web')->logout();
+
+        $request->session()->invalidate();
+
+        $request->session()->regenerateToken();
+
+        return redirect('/');
+    }
+}

app/Http/Controllers/Auth/ConfirmablePasswordController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\ValidationException;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class ConfirmablePasswordController extends Controller
+{
+    /**
+     * Show the confirm password view.
+     */
+    public function show(): Response
+    {
+        return Inertia::render('Auth/ConfirmPassword');
+    }
+
+    /**
+     * Confirm the user's password.
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        if (! Auth::guard('web')->validate([
+            'email' => $request->user()->email,
+            'password' => $request->password,
+        ])) {
+            throw ValidationException::withMessages([
+                'password' => __('auth.password'),
+            ]);
+        }
+
+        $request->session()->put('auth.password_confirmed_at', time());
+
+        return redirect()->intended(route('dashboard', absolute: false));
+    }
+}

app/Http/Controllers/Auth/EmailVerificationNotificationController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class EmailVerificationNotificationController extends Controller
+{
+    /**
+     * Send a new email verification notification.
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        if ($request->user()->hasVerifiedEmail()) {
+            return redirect()->intended(route('dashboard', absolute: false));
+        }
+
+        $request->user()->sendEmailVerificationNotification();
+
+        return back()->with('status', 'verification-link-sent');
+    }
+}

app/Http/Controllers/Auth/EmailVerificationPromptController.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class EmailVerificationPromptController extends Controller
+{
+    /**
+     * Display the email verification prompt.
+     */
+    public function __invoke(Request $request): RedirectResponse|Response
+    {
+        return $request->user()->hasVerifiedEmail()
+                    ? redirect()->intended(route('dashboard', absolute: false))
+                    : Inertia::render('Auth/VerifyEmail', ['status' => session('status')]);
+    }
+}

app/Http/Controllers/Auth/NewPasswordController.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rules;
+use Illuminate\Validation\ValidationException;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class NewPasswordController extends Controller
+{
+    /**
+     * Display the password reset view.
+     */
+    public function create(Request $request): Response
+    {
+        return Inertia::render('Auth/ResetPassword', [
+            'email' => $request->email,
+            'token' => $request->route('token'),
+        ]);
+    }
+
+    /**
+     * Handle an incoming new password request.
+     *
+     * @throws ValidationException
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'token' => 'required',
+            'email' => 'required|email',
+            'password' => ['required', 'confirmed', Rules\Password::defaults()],
+        ]);
+
+        // Here we will attempt to reset the user's password. If it is successful we
+        // will update the password on an actual user model and persist it to the
+        // database. Otherwise we will parse the error and return the response.
+        $status = Password::reset(
+            $request->only('email', 'password', 'password_confirmation', 'token'),
+            function ($user) use ($request) {
+                $user->forceFill([
+                    'password' => Hash::make($request->password),
+                    'remember_token' => Str::random(60),
+                ])->save();
+
+                event(new PasswordReset($user));
+            }
+        );
+
+        // If the password was successfully reset, we will redirect the user back to
+        // the application's home authenticated view. If there is an error we can
+        // redirect them back to where they came from with their error message.
+        if ($status == Password::PASSWORD_RESET) {
+            return redirect()->route('login')->with('status', __($status));
+        }
+
+        throw ValidationException::withMessages([
+            'email' => [trans($status)],
+        ]);
+    }
+}

app/Http/Controllers/Auth/PasswordController.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules\Password;
+
+class PasswordController extends Controller
+{
+    /**
+     * Update the user's password.
+     */
+    public function update(Request $request): RedirectResponse
+    {
+        $validated = $request->validate([
+            'current_password' => ['required', 'current_password'],
+            'password' => ['required', Password::defaults(), 'confirmed'],
+        ]);
+
+        $request->user()->update([
+            'password' => Hash::make($validated['password']),
+        ]);
+
+        return back();
+    }
+}

app/Http/Controllers/Auth/PasswordResetLinkController.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Validation\ValidationException;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class PasswordResetLinkController extends Controller
+{
+    /**
+     * Display the password reset link request view.
+     */
+    public function create(): Response
+    {
+        return Inertia::render('Auth/ForgotPassword', [
+            'status' => session('status'),
+        ]);
+    }
+
+    /**
+     * Handle an incoming password reset link request.
+     *
+     * @throws ValidationException
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'email' => 'required|email',
+        ]);
+
+        // We will send the password reset link to this user. Once we have attempted
+        // to send the link, we will examine the response then see the message we
+        // need to show to the user. Finally, we'll send out a proper response.
+        $status = Password::sendResetLink(
+            $request->only('email')
+        );
+
+        if ($status == Password::RESET_LINK_SENT) {
+            return back()->with('status', __($status));
+        }
+
+        throw ValidationException::withMessages([
+            'email' => [trans($status)],
+        ]);
+    }
+}

app/Http/Controllers/Auth/RegisteredUserController.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Auth\Events\Registered;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules;
+use Illuminate\Validation\ValidationException;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class RegisteredUserController extends Controller
+{
+    /**
+     * Display the registration view.
+     */
+    public function create(): Response
+    {
+        return Inertia::render('Auth/Register');
+    }
+
+    /**
+     * Handle an incoming registration request.
+     *
+     * @throws ValidationException
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'name' => 'required|string|max:255',
+            'email' => 'required|string|lowercase|email|max:255|unique:'.User::class,
+            'password' => ['required', 'confirmed', Rules\Password::defaults()],
+        ]);
+
+        $user = User::create([
+            'name' => $request->name,
+            'email' => $request->email,
+            'password' => Hash::make($request->password),
+        ]);
+
+        event(new Registered($user));
+
+        Auth::login($user);
+
+        return redirect(route('dashboard', absolute: false));
+    }
+}

app/Http/Controllers/Auth/VerifyEmailController.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Auth\Events\Verified;
+use Illuminate\Foundation\Auth\EmailVerificationRequest;
+use Illuminate\Http\RedirectResponse;
+
+class VerifyEmailController extends Controller
+{
+    /**
+     * Mark the authenticated user's email address as verified.
+     */
+    public function __invoke(EmailVerificationRequest $request): RedirectResponse
+    {
+        if ($request->user()->hasVerifiedEmail()) {
+            return redirect()->intended(route('dashboard', absolute: false).'?verified=1');
+        }
+
+        if ($request->user()->markEmailAsVerified()) {
+            event(new Verified($request->user()));
+        }
+
+        return redirect()->intended(route('dashboard', absolute: false).'?verified=1');
+    }
+}

app/Http/Controllers/Controller.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Http\Controllers;
+
+abstract class Controller
+{
+    //
+}

app/Http/Controllers/HardwareController.php

@@ -0,0 +1,208 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\StoreHardwareRequest;
+use App\Http\Requests\UpdateHardwareRequest;
+use App\Http\Resources\HardwareResource;
+use App\Models\Hardware;
+use App\Models\Order;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
+use Inertia\Inertia;
+
+class HardwareController extends Controller
+{
+    /**
+     * Affiche la liste des matériels avec recherche et filtrage.
+     */
+    public function index(Request $request)
+    {
+        Gate::authorize('viewAny', Hardware::class);
+
+        $query = Hardware::query()->with('order')->orderBy('created_at', 'desc');
+
+        // Moteur de recherche multicritère
+        if ($request->filled('search')) {
+            $query->search($request->input('search'));
+        }
+
+        // Filtre par statut
+        if ($request->filled('status')) {
+            $query->byStatus($request->input('status'));
+        }
+
+        // Filtre par type/catégorie
+        if ($request->filled('type')) {
+            $query->byType($request->input('type'));
+        }
+
+        // Export CSV si demandé
+        if ($request->has('export')) {
+            $hardwares = $query->get();
+            $headers = [
+                "Content-type" => "text/csv; charset=UTF-8",
+                "Content-Disposition" => "attachment; filename=inventaire_materiels_" . now()->format('Y-m-d_H-i') . ".csv",
+                "Pragma" => "no-cache",
+                "Cache-Control" => "must-revalidate, post-check=0, pre-check=0",
+                "Expires" => "0"
+            ];
+
+            $callback = function () use ($hardwares) {
+                $file = fopen('php://output', 'w');
+                // Ajouter le BOM UTF-8 pour Excel
+                fprintf($file, chr(0xEF).chr(0xBB).chr(0xBF));
+                
+                // En-têtes CSV
+                fputcsv($file, [
+                    'Nom', 'Catégorie', 'Marque', 'Modèle', 'Numéro de série', 
+                    'Statut', 'Emplacement', 'Adresse IP', 'Date d\'achat', 
+                    'Mise en service', 'Fin de garantie', 'Garantie active', 'Commande liée'
+                ], ';');
+
+                foreach ($hardwares as $hw) {
+                    fputcsv($file, [
+                        $hw->name,
+                        match ($hw->type) {
+                            'serveur' => 'Serveur',
+                            'switch' => 'Switch',
+                            'routeur' => 'Routeur',
+                            'onduleur' => 'Onduleur',
+                            'stockage' => 'Stockage (NAS/SAN)',
+                            'pare-feu' => 'Pare-feu',
+                            'poste_travail' => 'Poste de travail',
+                            'autre' => 'Autre',
+                            default => $hw->type
+                        },
+                        $hw->brand,
+                        $hw->model,
+                        $hw->serial_number,
+                        match ($hw->status) {
+                            'en_stock' => 'En stock',
+                            'en_service' => 'En service',
+                            'en_panne' => 'En panne',
+                            'au_rebut' => 'Au rebut',
+                            default => $hw->status
+                        },
+                        $hw->location,
+                        $hw->ip_address,
+                        $hw->purchase_date?->format('d/m/Y'),
+                        $hw->commissioning_date?->format('d/m/Y'),
+                        $hw->warranty_expiration_date?->format('d/m/Y'),
+                        $hw->is_under_warranty ? 'Oui' : 'Non',
+                        $hw->order?->number
+                    ], ';');
+                }
+
+                fclose($file);
+            };
+
+            return response()->stream($callback, 200, $headers);
+        }
+
+        // Pagination classique
+        $hardwares = $query->paginate(10)->withQueryString();
+
+        // Calcul des KPIs
+        $counts = [
+            'total' => Hardware::count(),
+            'en_service' => Hardware::where('status', 'en_service')->count(),
+            'en_stock' => Hardware::where('status', 'en_stock')->count(),
+            'en_panne' => Hardware::where('status', 'en_panne')->count(),
+            'au_rebut' => Hardware::where('status', 'au_rebut')->count(),
+            'under_warranty' => Hardware::get()->filter->is_under_warranty->count(),
+        ];
+
+        return Inertia::render('Materiels/Index', [
+            'hardwares' => HardwareResource::collection($hardwares),
+            'metrics' => $counts,
+            'filters' => $request->only(['search', 'status', 'type']),
+        ]);
+    }
+
+    /**
+     * Formulaire de création d'un matériel.
+     */
+    public function create()
+    {
+        Gate::authorize('create', Hardware::class);
+
+        // Liste des commandes pour pouvoir lier l'équipement (id et numéro de commande)
+        $orders = Order::orderBy('created_at', 'desc')->get(['id', 'number', 'label']);
+
+        return Inertia::render('Materiels/Form', [
+            'isEdit' => false,
+            'orders' => $orders,
+        ]);
+    }
+
+    /**
+     * Enregistre un nouveau matériel en base de données.
+     */
+    public function store(StoreHardwareRequest $request)
+    {
+        Gate::authorize('create', Hardware::class);
+
+        $hardware = Hardware::create($request->validated());
+
+        return redirect()->route('materiels.show', $hardware->id)
+            ->with('success', 'L\'équipement matériel a été enregistré avec succès dans l\'inventaire.');
+    }
+
+    /**
+     * Affiche les détails d'un équipement.
+     */
+    public function show(Hardware $materiel)
+    {
+        Gate::authorize('view', $materiel);
+
+        $materiel->load('order');
+
+        return Inertia::render('Materiels/Show', [
+            'hardware' => new HardwareResource($materiel),
+        ]);
+    }
+
+    /**
+     * Formulaire d'édition d'un équipement.
+     */
+    public function edit(Hardware $materiel)
+    {
+        Gate::authorize('update', $materiel);
+
+        $materiel->load('order');
+        $orders = Order::orderBy('created_at', 'desc')->get(['id', 'number', 'label']);
+
+        return Inertia::render('Materiels/Form', [
+            'hardware' => new HardwareResource($materiel),
+            'isEdit' => true,
+            'orders' => $orders,
+        ]);
+    }
+
+    /**
+     * Met à jour les informations d'un équipement.
+     */
+    public function update(UpdateHardwareRequest $request, Hardware $materiel)
+    {
+        Gate::authorize('update', $materiel);
+
+        $materiel->update($request->validated());
+
+        return redirect()->route('materiels.show', $materiel->id)
+            ->with('success', 'Les informations de l\'équipement ont été mises à jour.');
+    }
+
+    /**
+     * Supprime un équipement de la base de données.
+     */
+    public function destroy(Hardware $materiel)
+    {
+        Gate::authorize('delete', $materiel);
+
+        $materiel->delete();
+
+        return redirect()->route('materiels.index')
+            ->with('success', 'L\'équipement a été retiré définitivement de l\'inventaire.');
+    }
+}

app/Http/Controllers/OrderController.php

@@ -0,0 +1,316 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\StoreOrderRequest;
+use App\Http\Requests\UpdateOrderRequest;
+use App\Http\Resources\OrderResource;
+use App\Models\Order;
+use App\Models\Attachment;
+use App\Models\OrderStatusLog;
+use App\Services\OrderService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Storage;
+use Inertia\Inertia;
+
+class OrderController extends Controller
+{
+    /**
+     * Affiche la liste des commandes avec recherche, filtrage et option d'export CSV.
+     */
+    public function index(Request $request)
+    {
+        Gate::authorize('viewAny', Order::class);
+
+        $query = Order::query()->orderBy('created_at', 'desc');
+
+        // Recherche full-text sur libellé / fournisseur / numéro
+        if ($request->filled('search')) {
+            $search = $request->input('search');
+            $query->where(function ($q) use ($search) {
+                $q->where('number', 'like', "%{$search}%")
+                  ->orWhere('label', 'like', "%{$search}%")
+                  ->orWhere('supplier', 'like', "%{$search}%");
+            });
+        }
+
+        // Filtre par statut
+        if ($request->filled('status')) {
+            $query->byStatus($request->input('status'));
+        }
+
+        // Filtre par demandeur
+        if ($request->filled('requested_by')) {
+            $query->byDemandeur($request->input('requested_by'));
+        }
+
+        // Filtre par type
+        if ($request->filled('type')) {
+            $query->where('type', $request->input('type'));
+        }
+
+        // Filtre par période (date souhaitée de livraison)
+        if ($request->filled('date_start')) {
+            $query->whereDate('delivery_deadline', '>=', $request->input('date_start'));
+        }
+        if ($request->filled('date_end')) {
+            $query->whereDate('delivery_deadline', '<=', $request->input('date_end'));
+        }
+
+        // Export CSV si demandé
+        if ($request->has('export')) {
+            $orders = $query->get();
+            $headers = [
+                "Content-type" => "text/csv; charset=UTF-8",
+                "Content-Disposition" => "attachment; filename=commandes_" . now()->format('Y-m-d_H-i') . ".csv",
+                "Pragma" => "no-cache",
+                "Cache-Control" => "must-revalidate, post-check=0, pre-check=0",
+                "Expires" => "0"
+            ];
+
+            $callback = function () use ($orders) {
+                $file = fopen('php://output', 'w');
+                // Ajouter le BOM UTF-8 pour Excel
+                fprintf($file, chr(0xEF).chr(0xBB).chr(0xBF));
+                
+                // En-têtes CSV en français
+                fputcsv($file, [
+                    'Numéro', 'Libellé / Réf Article', 'Type', 'Fournisseur', 'N° Devis', 
+                    'Montant HT (€)', 'Montant TTC (€)', 'Demandeur', 'Prescripteur',
+                    'Date livraison souhaitée', 'Statut', 'Date création'
+                ], ';');
+
+                foreach ($orders as $order) {
+                    fputcsv($file, [
+                        $order->number,
+                        $order->label,
+                        $order->type,
+                        $order->supplier,
+                        $order->quote_number,
+                        number_format($order->amount_ht, 2, ',', ''),
+                        number_format($order->amount_ttc, 2, ',', ''),
+                        $order->requested_by,
+                        $order->prescriber,
+                        $order->delivery_deadline?->format('d/m/Y'),
+                        match ($order->status) {
+                            'draft' => 'Brouillon',
+                            'validated' => 'Validée',
+                            'ordered' => 'Commandée',
+                            'delivered' => 'Livrée',
+                            'closed' => 'Clôturée',
+                            default => $order->status
+                        },
+                        $order->created_at?->format('d/m/Y H:i')
+                    ], ';');
+                }
+
+                fclose($file);
+            };
+
+            return response()->stream($callback, 200, $headers);
+        }
+
+        // Pagination classique
+        $orders = $query->paginate(10)->withQueryString();
+
+        return Inertia::render('Commandes/Index', [
+            'orders' => OrderResource::collection($orders),
+            'filters' => $request->only(['search', 'status', 'requested_by', 'type', 'date_start', 'date_end']),
+        ]);
+    }
+
+    /**
+     * Formulaire de création.
+     */
+    public function create()
+    {
+        Gate::authorize('create', Order::class);
+
+        return Inertia::render('Commandes/Form', [
+            'isEdit' => false,
+        ]);
+    }
+
+    /**
+     * Enregistre une nouvelle commande en base de données.
+     */
+    public function store(StoreOrderRequest $request, OrderService $orderService)
+    {
+        return DB::transaction(function () use ($request, $orderService) {
+            $validated = $request->validated();
+            
+            // Calcul automatique de la TVA 20% (sauf si exonéré)
+            $excludeVat = (bool) ($validated['exclude_vat'] ?? false);
+            $validated['amount_ttc'] = $excludeVat ? $validated['amount_ht'] : $validated['amount_ht'] * 1.20;
+            
+            // Génération unique et sécurisée du numéro CMD
+            $validated['number'] = $orderService->generateOrderNumber();
+            $validated['status'] = 'draft'; // Statut initial
+
+            $order = Order::create($validated);
+
+            // Gestion de l'historique initial
+            OrderStatusLog::create([
+                'order_id' => $order->id,
+                'user_id' => $request->user()->id,
+                'old_status' => null,
+                'new_status' => 'draft',
+                'changed_at' => now(),
+            ]);
+
+            // Gestion de l'upload des fichiers
+            $fileTypes = [
+                'quote_file' => 'quote',
+                'delivery_note_file' => 'delivery_note',
+                'invoice_file' => 'invoice',
+            ];
+
+            foreach ($fileTypes as $inputName => $type) {
+                if ($request->hasFile($inputName)) {
+                    $file = $request->file($inputName);
+                    // Stockage dans storage/app/public/commandes/{id}/
+                    $path = $file->storeAs("commandes/{$order->id}", $file->getClientOriginalName(), 'public');
+                    
+                    Attachment::create([
+                        'order_id' => $order->id,
+                        'file_path' => $path,
+                        'file_name' => $file->getClientOriginalName(),
+                        'file_type' => $type,
+                    ]);
+                }
+            }
+
+            return redirect()->route('commandes.show', $order->id)
+                ->with('success', 'La demande de commande a été créée avec succès au statut Brouillon.');
+        });
+    }
+
+    /**
+     * Affiche les détails d'une commande.
+     */
+    public function show(Order $order)
+    {
+        Gate::authorize('view', $order);
+
+        $order->load(['attachments', 'statusLogs.user']);
+
+        return Inertia::render('Commandes/Show', [
+            'order' => new OrderResource($order),
+        ]);
+    }
+
+    /**
+     * Formulaire d'édition.
+     */
+    public function edit(Order $order)
+    {
+        Gate::authorize('update', $order);
+
+        $order->load('attachments');
+
+        return Inertia::render('Commandes/Form', [
+            'order' => new OrderResource($order),
+            'isEdit' => true,
+        ]);
+    }
+
+    /**
+     * Met à jour les informations d'une commande.
+     */
+    public function update(UpdateOrderRequest $request, Order $order)
+    {
+        return DB::transaction(function () use ($request, $order) {
+            $validated = $request->validated();
+            
+            // Recalcul de la TVA (sauf si exonéré)
+            $excludeVat = (bool) ($validated['exclude_vat'] ?? false);
+            $validated['amount_ttc'] = $excludeVat ? $validated['amount_ht'] : $validated['amount_ht'] * 1.20;
+
+            $order->update($validated);
+
+            // Gestion de l'upload de nouvelles pièces jointes (ou mise à jour)
+            $fileTypes = [
+                'quote_file' => 'quote',
+                'delivery_note_file' => 'delivery_note',
+                'invoice_file' => 'invoice',
+            ];
+
+            foreach ($fileTypes as $inputName => $type) {
+                if ($request->hasFile($inputName)) {
+                    $file = $request->file($inputName);
+                    
+                    // On supprime l'ancienne pièce jointe de ce type si elle existe
+                    $existingAttachment = $order->attachments()->where('file_type', $type)->first();
+                    if ($existingAttachment) {
+                        Storage::disk('public')->delete($existingAttachment->file_path);
+                        $existingAttachment->delete();
+                    }
+
+                    // Stockage du nouveau fichier
+                    $path = $file->storeAs("commandes/{$order->id}", $file->getClientOriginalName(), 'public');
+                    
+                    Attachment::create([
+                        'order_id' => $order->id,
+                        'file_path' => $path,
+                        'file_name' => $file->getClientOriginalName(),
+                        'file_type' => $type,
+                    ]);
+                }
+            }
+
+            return redirect()->route('commandes.show', $order->id)
+                ->with('success', 'La commande a été mise à jour.');
+        });
+    }
+
+    /**
+     * Supprime une commande de la base de données.
+     */
+    public function destroy(Order $order)
+    {
+        Gate::authorize('delete', $order);
+
+        return DB::transaction(function () use ($order) {
+            // Suppression physique du répertoire contenant les pièces jointes
+            Storage::disk('public')->deleteDirectory("commandes/{$order->id}");
+            
+            $order->delete();
+
+            return redirect()->route('commandes.index')
+                ->with('success', 'La commande et toutes ses pièces jointes ont été supprimées définitivement.');
+        });
+    }
+
+    /**
+     * Gère les changements de statut (transitions).
+     */
+    public function transition(Request $request, Order $order, OrderService $orderService)
+    {
+        $request->validate([
+            'new_status' => ['required', 'string', 'in:validated,ordered,delivered,closed'],
+        ]);
+
+        $newStatus = $request->input('new_status');
+
+        // Autorisation de la transition selon le rôle et le statut cible
+        Gate::authorize('transition', [$order, $newStatus]);
+
+        try {
+            $orderService->transitionStatus($order, $newStatus, $request->user());
+            
+            $statusLabel = match ($newStatus) {
+                'validated' => 'Validée',
+                'ordered' => 'Commandée',
+                'delivered' => 'Livrée',
+                'closed' => 'Clôturée',
+                default => $newStatus
+            };
+
+            return redirect()->back()->with('success', "Le statut de la commande a été mis à jour avec succès : {$statusLabel}.");
+        } catch (\InvalidArgumentException $e) {
+            return redirect()->back()->withErrors(['error' => $e->getMessage()]);
+        }
+    }
+}

app/Http/Controllers/ProfileController.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\ProfileUpdateRequest;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Redirect;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class ProfileController extends Controller
+{
+    /**
+     * Display the user's profile form.
+     */
+    public function edit(Request $request): Response
+    {
+        return Inertia::render('Profile/Edit', [
+            'mustVerifyEmail' => $request->user() instanceof MustVerifyEmail,
+            'status' => session('status'),
+        ]);
+    }
+
+    /**
+     * Update the user's profile information.
+     */
+    public function update(ProfileUpdateRequest $request): RedirectResponse
+    {
+        $request->user()->fill($request->validated());
+
+        if ($request->user()->isDirty('email')) {
+            $request->user()->email_verified_at = null;
+        }
+
+        $request->user()->save();
+
+        return Redirect::route('profile.edit');
+    }
+
+    /**
+     * Delete the user's account.
+     */
+    public function destroy(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'password' => ['required', 'current_password'],
+        ]);
+
+        $user = $request->user();
+
+        Auth::logout();
+
+        $user->delete();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return Redirect::to('/');
+    }
+}

app/Http/Middleware/HandleInertiaRequests.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Request;
+use Inertia\Middleware;
+
+class HandleInertiaRequests extends Middleware
+{
+    /**
+     * The root template that is loaded on the first page visit.
+     *
+     * @var string
+     */
+    protected $rootView = 'app';
+
+    /**
+     * Determine the current asset version.
+     */
+    public function version(Request $request): ?string
+    {
+        return parent::version($request);
+    }
+
+    /**
+     * Define the props that are shared by default.
+     *
+     * @return array<string, mixed>
+     */
+    public function share(Request $request): array
+    {
+        return [
+            ...parent::share($request),
+            'auth' => [
+                'user' => $request->user(),
+            ],
+            'flash' => [
+                'success' => fn () => $request->session()->get('success'),
+                'error' => fn () => $request->session()->get('error'),
+            ],
+        ];
+    }
+}

app/Http/Requests/Auth/LoginRequest.php

@@ -0,0 +1,86 @@
+<?php
+
+namespace App\Http\Requests\Auth;
+
+use Illuminate\Auth\Events\Lockout;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+class LoginRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'string', 'email'],
+            'password' => ['required', 'string'],
+        ];
+    }
+
+    /**
+     * Attempt to authenticate the request's credentials.
+     *
+     * @throws ValidationException
+     */
+    public function authenticate(): void
+    {
+        $this->ensureIsNotRateLimited();
+
+        if (! Auth::attempt($this->only('email', 'password'), $this->boolean('remember'))) {
+            RateLimiter::hit($this->throttleKey());
+
+            throw ValidationException::withMessages([
+                'email' => trans('auth.failed'),
+            ]);
+        }
+
+        RateLimiter::clear($this->throttleKey());
+    }
+
+    /**
+     * Ensure the login request is not rate limited.
+     *
+     * @throws ValidationException
+     */
+    public function ensureIsNotRateLimited(): void
+    {
+        if (! RateLimiter::tooManyAttempts($this->throttleKey(), 5)) {
+            return;
+        }
+
+        event(new Lockout($this));
+
+        $seconds = RateLimiter::availableIn($this->throttleKey());
+
+        throw ValidationException::withMessages([
+            'email' => trans('auth.throttle', [
+                'seconds' => $seconds,
+                'minutes' => ceil($seconds / 60),
+            ]),
+        ]);
+    }
+
+    /**
+     * Get the rate limiting throttle key for the request.
+     */
+    public function throttleKey(): string
+    {
+        return Str::transliterate(Str::lower($this->string('email')).'|'.$this->ip());
+    }
+}

app/Http/Requests/ProfileUpdateRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\User;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class ProfileUpdateRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'email' => [
+                'required',
+                'string',
+                'lowercase',
+                'email',
+                'max:255',
+                Rule::unique(User::class)->ignore($this->user()->id),
+            ],
+        ];
+    }
+}

app/Http/Requests/StoreHardwareRequest.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreHardwareRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true; // L'autorisation est déléguée à la Policy
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', 'string', 'in:serveur,switch,routeur,onduleur,stockage,pare-feu,poste_travail,autre'],
+            'brand' => ['required', 'string', 'max:255'],
+            'model' => ['required', 'string', 'max:255'],
+            'serial_number' => ['required', 'string', 'max:255', 'unique:hardwares,serial_number'],
+            'status' => ['required', 'string', 'in:en_stock,en_service,en_panne,au_rebut'],
+            'purchase_date' => ['nullable', 'date'],
+            'commissioning_date' => ['nullable', 'date', 'after_or_equal:purchase_date'],
+            'warranty_expiration_date' => ['nullable', 'date', 'after_or_equal:purchase_date'],
+            'location' => ['required', 'string', 'max:255'],
+            'ip_address' => ['nullable', 'string', 'max:45'], // max length for IPv6
+            'order_id' => ['nullable', 'exists:orders,id'],
+            'notes' => ['nullable', 'string'],
+        ];
+    }
+
+    /**
+     * Messages d'erreur personnalisés en français.
+     */
+    public function messages(): array
+    {
+        return [
+            'name.required' => 'Le nom de l\'équipement est requis.',
+            'type.required' => 'Le type d\'équipement est requis.',
+            'type.in' => 'Le type d\'équipement sélectionné est invalide.',
+            'brand.required' => 'La marque est requise.',
+            'model.required' => 'Le modèle est requis.',
+            'serial_number.required' => 'Le numéro de série est requis.',
+            'serial_number.unique' => 'Ce numéro de série existe déjà dans la base.',
+            'status.required' => 'Le statut est requis.',
+            'status.in' => 'Le statut sélectionné est invalide.',
+            'purchase_date.date' => 'La date d\'achat doit être une date valide.',
+            'commissioning_date.date' => 'La date de mise en service doit être une date valide.',
+            'commissioning_date.after_or_equal' => 'La date de mise en service doit être postérieure ou égale à la date d\'achat.',
+            'warranty_expiration_date.date' => 'La date de fin de garantie doit être une date valide.',
+            'warranty_expiration_date.after_or_equal' => 'La date de fin de garantie doit être postérieure ou égale à la date d\'achat.',
+            'location.required' => 'L\'emplacement est requis.',
+            'order_id.exists' => 'La commande sélectionnée est invalide.',
+        ];
+    }
+}

app/Http/Requests/StoreOrderRequest.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreOrderRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user()->can('create', \App\Models\Order::class);
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     */
+    public function rules(): array
+    {
+        return [
+            'label' => ['required', 'string', 'max:255'],
+            'type' => ['required', 'string', 'in:Matériel réseau / serveur,Licences logicielles,Consommables / câblage,Prestations / services'],
+            'supplier' => ['required', 'string', 'max:255'],
+            'quote_number' => ['required', 'string', 'max:255'],
+            'amount_ht' => ['required', 'numeric', 'min:0'],
+            'exclude_vat' => ['nullable', 'boolean'],
+            'requested_by' => ['required', 'string', 'in:Jérémy,Sylvain,Kévin'],
+            'prescriber' => ['required', 'string', 'max:255'],
+            'delivery_deadline' => ['required', 'date'],
+            'notes' => ['nullable', 'string'],
+            'quote_file' => ['nullable', 'file', 'mimes:pdf,png,jpg,jpeg,doc,docx,xls,xlsx', 'max:10240'],
+            'delivery_note_file' => ['nullable', 'file', 'mimes:pdf,png,jpg,jpeg,doc,docx,xls,xlsx', 'max:10240'],
+            'invoice_file' => ['nullable', 'file', 'mimes:pdf,png,jpg,jpeg,doc,docx,xls,xlsx', 'max:10240'],
+        ];
+    }
+}

app/Http/Requests/UpdateHardwareRequest.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateHardwareRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true; // L'autorisation est déléguée à la Policy
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     */
+    public function rules(): array
+    {
+        $hardwareId = $this->route('materiel')?->id ?? $this->route('materiel');
+
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'type' => ['required', 'string', 'in:serveur,switch,routeur,onduleur,stockage,pare-feu,poste_travail,autre'],
+            'brand' => ['required', 'string', 'max:255'],
+            'model' => ['required', 'string', 'max:255'],
+            'serial_number' => ['required', 'string', 'max:255', 'unique:hardwares,serial_number,' . $hardwareId],
+            'status' => ['required', 'string', 'in:en_stock,en_service,en_panne,au_rebut'],
+            'purchase_date' => ['nullable', 'date'],
+            'commissioning_date' => ['nullable', 'date', 'after_or_equal:purchase_date'],
+            'warranty_expiration_date' => ['nullable', 'date', 'after_or_equal:purchase_date'],
+            'location' => ['required', 'string', 'max:255'],
+            'ip_address' => ['nullable', 'string', 'max:45'],
+            'order_id' => ['nullable', 'exists:orders,id'],
+            'notes' => ['nullable', 'string'],
+        ];
+    }
+
+    /**
+     * Messages d'erreur personnalisés en français.
+     */
+    public function messages(): array
+    {
+        return [
+            'name.required' => 'Le nom de l\'équipement est requis.',
+            'type.required' => 'Le type d\'équipement est requis.',
+            'type.in' => 'Le type d\'équipement sélectionné est invalide.',
+            'brand.required' => 'La marque est requise.',
+            'model.required' => 'Le modèle est requis.',
+            'serial_number.required' => 'Le numéro de série est requis.',
+            'serial_number.unique' => 'Ce numéro de série existe déjà dans la base.',
+            'status.required' => 'Le statut est requis.',
+            'status.in' => 'Le statut sélectionné est invalide.',
+            'purchase_date.date' => 'La date d\'achat doit être une date valide.',
+            'commissioning_date.date' => 'La date de mise en service doit être une date valide.',
+            'commissioning_date.after_or_equal' => 'La date de mise en service doit être postérieure ou égale à la date d\'achat.',
+            'warranty_expiration_date.date' => 'La date de fin de garantie doit être une date valide.',
+            'warranty_expiration_date.after_or_equal' => 'La date de fin de garantie doit être postérieure ou égale à la date d\'achat.',
+            'location.required' => 'L\'emplacement est requis.',
+            'order_id.exists' => 'La commande sélectionnée est invalide.',
+        ];
+    }
+}

app/Http/Requests/UpdateOrderRequest.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateOrderRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        $order = $this->route('commande');
+        return $this->user()->can('update', $order);
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     */
+    public function rules(): array
+    {
+        return [
+            'label' => ['required', 'string', 'max:255'],
+            'type' => ['required', 'string', 'in:Matériel réseau / serveur,Licences logicielles,Consommables / câblage,Prestations / services'],
+            'supplier' => ['required', 'string', 'max:255'],
+            'quote_number' => ['required', 'string', 'max:255'],
+            'amount_ht' => ['required', 'numeric', 'min:0'],
+            'exclude_vat' => ['nullable', 'boolean'],
+            'requested_by' => ['required', 'string', 'in:Jérémy,Sylvain,Kévin'],
+            'prescriber' => ['required', 'string', 'max:255'],
+            'delivery_deadline' => ['required', 'date'],
+            'notes' => ['nullable', 'string'],
+            'quote_file' => ['nullable', 'file', 'mimes:pdf,png,jpg,jpeg,doc,docx,xls,xlsx', 'max:10240'],
+            'delivery_note_file' => ['nullable', 'file', 'mimes:pdf,png,jpg,jpeg,doc,docx,xls,xlsx', 'max:10240'],
+            'invoice_file' => ['nullable', 'file', 'mimes:pdf,png,jpg,jpeg,doc,docx,xls,xlsx', 'max:10240'],
+        ];
+    }
+}

app/Http/Resources/AttachmentResource.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class AttachmentResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'order_id' => $this->order_id,
+            'file_name' => $this->file_name,
+            'file_type' => $this->file_type,
+            'url' => $this->url,
+            'created_at' => $this->created_at?->format('d/m/Y H:i'),
+        ];
+    }
+}

app/Http/Resources/HardwareResource.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class HardwareResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'type' => $this->type,
+            'brand' => $this->brand,
+            'model' => $this->model,
+            'serial_number' => $this->serial_number,
+            'status' => $this->status,
+            
+            // Format brut pour les inputs date HTML (YYYY-MM-DD)
+            'purchase_date' => $this->purchase_date?->format('Y-m-d'),
+            'commissioning_date' => $this->commissioning_date?->format('Y-m-d'),
+            'warranty_expiration_date' => $this->warranty_expiration_date?->format('Y-m-d'),
+            
+            // Format français pour l'affichage (DD/MM/YYYY)
+            'purchase_date_formatted' => $this->purchase_date?->format('d/m/Y') ?? 'Non spécifiée',
+            'commissioning_date_formatted' => $this->commissioning_date?->format('d/m/Y') ?? 'Non spécifiée',
+            'warranty_expiration_date_formatted' => $this->warranty_expiration_date?->format('d/m/Y') ?? 'Non spécifiée',
+            
+            'location' => $this->location,
+            'ip_address' => $this->ip_address,
+            'order_id' => $this->order_id,
+            
+            // Relation éventuelle avec la commande
+            'order' => $this->relationLoaded('order') && $this->order ? [
+                'id' => $this->order->id,
+                'number' => $this->order->number,
+                'label' => $this->order->label,
+            ] : null,
+            
+            'notes' => $this->notes,
+            
+            // Propriétés calculées
+            'is_under_warranty' => $this->is_under_warranty,
+            'warranty_status_label' => $this->warranty_status_label,
+            'warranty_remaining_days' => $this->warranty_remaining_days,
+            
+            'created_at' => $this->created_at?->format('d/m/Y H:i'),
+        ];
+    }
+}

app/Http/Resources/OrderResource.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class OrderResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        $now = now()->startOfDay();
+        $deadline = $this->delivery_deadline ? \Carbon\Carbon::parse($this->delivery_deadline)->startOfDay() : null;
+        $isOverdue = $deadline && $deadline->lt($now) && !in_array($this->status, ['delivered', 'closed']);
+
+        return [
+            'id' => $this->id,
+            'number' => $this->number,
+            'label' => $this->label,
+            'type' => $this->type,
+            'supplier' => $this->supplier,
+            'quote_number' => $this->quote_number,
+            'amount_ht' => (float) $this->amount_ht,
+            'amount_ttc' => (float) $this->amount_ttc,
+            'exclude_vat' => (bool) $this->exclude_vat,
+            'requested_by' => $this->requested_by,
+            'prescriber' => $this->prescriber,
+            'delivery_deadline' => $this->delivery_deadline?->format('Y-m-d'),
+            'delivery_deadline_formatted' => $this->delivery_deadline?->format('d/m/Y'),
+            'status' => $this->status,
+            'notes' => $this->notes,
+            'is_overdue' => $isOverdue,
+            'created_at' => $this->created_at?->format('d/m/Y H:i'),
+            'attachments' => AttachmentResource::collection($this->whenLoaded('attachments')),
+            'status_logs' => OrderStatusLogResource::collection($this->whenLoaded('statusLogs')),
+            'can' => [
+                'update' => $request->user()?->can('update', $this->resource),
+                'delete' => $request->user()?->can('delete', $this->resource),
+            ],
+            'can_transition_to' => [
+                'validated' => $this->status === 'draft' && ($request->user()?->can('transition', [$this->resource, 'validated']) ?? false),
+                'ordered' => $this->status === 'validated' && ($request->user()?->can('transition', [$this->resource, 'ordered']) ?? false),
+                'delivered' => $this->status === 'ordered' && ($request->user()?->can('transition', [$this->resource, 'delivered']) ?? false),
+                'closed' => $this->status === 'delivered' && ($request->user()?->can('transition', [$this->resource, 'closed']) ?? false),
+            ],
+        ];
+    }
+}

app/Http/Resources/OrderStatusLogResource.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class OrderStatusLogResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'order_id' => $this->order_id,
+            'user' => [
+                'id' => $this->user?->id,
+                'name' => $this->user?->name,
+                'role' => $this->user?->role,
+            ],
+            'old_status' => $this->old_status,
+            'new_status' => $this->new_status,
+            'changed_at' => $this->changed_at?->format('d/m/Y H:i'),
+        ];
+    }
+}

app/Models/Attachment.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+use Illuminate\Support\Facades\Storage;
+
+class Attachment extends Model
+{
+    protected $fillable = [
+        'order_id',
+        'file_path',
+        'file_name',
+        'file_type',
+    ];
+
+    protected $appends = ['url'];
+
+    /**
+     * Relation avec la commande.
+     */
+    public function order()
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    /**
+     * Accesseur pour obtenir l'URL de téléchargement sécurisée.
+     */
+    public function getUrlAttribute()
+    {
+        return route('attachments.show', $this->id);
+    }
+}

app/Models/Hardware.php

@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Carbon\Carbon;
+
+class Hardware extends Model
+{
+    protected $table = 'hardwares';
+
+    protected $fillable = [
+        'name',
+        'type',
+        'brand',
+        'model',
+        'serial_number',
+        'status',
+        'purchase_date',
+        'commissioning_date',
+        'warranty_expiration_date',
+        'location',
+        'ip_address',
+        'order_id',
+        'notes',
+    ];
+
+    protected $casts = [
+        'purchase_date' => 'date',
+        'commissioning_date' => 'date',
+        'warranty_expiration_date' => 'date',
+    ];
+
+    protected $appends = [
+        'is_under_warranty',
+        'warranty_status_label',
+        'warranty_remaining_days',
+    ];
+
+    /**
+     * Relation avec la commande d'achat.
+     */
+    public function order()
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    /**
+     * Accesseur : l'équipement est-il sous garantie ?
+     */
+    public function getIsUnderWarrantyAttribute(): bool
+    {
+        if (!$this->warranty_expiration_date) {
+            return false;
+        }
+
+        return $this->warranty_expiration_date->isAfter(Carbon::today());
+    }
+
+    /**
+     * Accesseur : label en français du statut de garantie.
+     */
+    public function getWarrantyStatusLabelAttribute(): string
+    {
+        if (!$this->warranty_expiration_date) {
+            return 'Non spécifiée';
+        }
+
+        if ($this->is_under_warranty) {
+            $days = $this->warranty_remaining_days;
+            return "Sous garantie ($days j. restants)";
+        }
+
+        return 'Garantie expirée';
+    }
+
+    /**
+     * Accesseur : nombre de jours de garantie restants.
+     */
+    public function getWarrantyRemainingDaysAttribute(): ?int
+    {
+        if (!$this->warranty_expiration_date) {
+            return null;
+        }
+
+        if ($this->warranty_expiration_date->isBefore(Carbon::today())) {
+            return 0;
+        }
+
+        return (int) Carbon::today()->diffInDays($this->warranty_expiration_date);
+    }
+
+    /**
+     * Scope : Moteur de recherche multicritère
+     */
+    public function scopeSearch($query, $search)
+    {
+        return $query->where(function ($q) use ($search) {
+            $q->where('name', 'like', "%{$search}%")
+              ->orWhere('brand', 'like', "%{$search}%")
+              ->orWhere('model', 'like', "%{$search}%")
+              ->orWhere('serial_number', 'like', "%{$search}%")
+              ->orWhere('location', 'like', "%{$search}%")
+              ->orWhere('ip_address', 'like', "%{$search}%");
+        });
+    }
+
+    /**
+     * Scope : Filtrer par type
+     */
+    public function scopeByType($query, $type)
+    {
+        return $query->where('type', $type);
+    }
+
+    /**
+     * Scope : Filtrer par statut
+     */
+    public function scopeByStatus($query, $status)
+    {
+        return $query->where('status', $status);
+    }
+}

app/Models/Order.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class Order extends Model
+{
+    protected $fillable = [
+        'number',
+        'label',
+        'type',
+        'supplier',
+        'quote_number',
+        'amount_ht',
+        'amount_ttc',
+        'exclude_vat',
+        'requested_by',
+        'prescriber',
+        'delivery_deadline',
+        'status',
+        'notes',
+    ];
+
+    protected $casts = [
+        'delivery_deadline' => 'date',
+        'amount_ht' => 'decimal:2',
+        'amount_ttc' => 'decimal:2',
+        'exclude_vat' => 'boolean',
+    ];
+
+    /**
+     * Relation avec l'historique des changements de statut.
+     */
+    public function statusLogs()
+    {
+        return $this->hasMany(OrderStatusLog::class)->orderBy('changed_at', 'desc');
+    }
+
+    /**
+     * Relation avec les pièces jointes.
+     */
+    public function attachments()
+    {
+        return $this->hasMany(Attachment::class);
+    }
+
+    /**
+     * Scope par statut(s).
+     */
+    public function scopeByStatus($query, $status)
+    {
+        if (empty($status)) {
+            return $query;
+        }
+        if (is_array($status)) {
+            return $query->whereIn('status', $status);
+        }
+        return $query->where('status', $status);
+    }
+
+    /**
+     * Scope par demandeur(s).
+     */
+    public function scopeByDemandeur($query, $demandeur)
+    {
+        if (empty($demandeur)) {
+            return $query;
+        }
+        if (is_array($demandeur)) {
+            return $query->whereIn('requested_by', $demandeur);
+        }
+        return $query->where('requested_by', $demandeur);
+    }
+
+    /**
+     * Scope pour les commandes en retard de livraison (date dépassée et non livrée/clôturée).
+     */
+    public function scopeOverdue($query)
+    {
+        return $query->where('delivery_deadline', '<', now()->toDateString())
+            ->whereNotIn('status', ['delivered', 'closed']);
+    }
+}

app/Models/OrderStatusLog.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class OrderStatusLog extends Model
+{
+    public $timestamps = false;
+
+    protected $fillable = [
+        'order_id',
+        'user_id',
+        'old_status',
+        'new_status',
+        'changed_at',
+    ];
+
+    protected $casts = [
+        'changed_at' => 'datetime',
+    ];
+
+    /**
+     * Relation avec la commande.
+     */
+    public function order()
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    /**
+     * Relation avec l'utilisateur qui a fait la transition.
+     */
+    public function user()
+    {
+        return $this->belongsTo(User::class);
+    }
+}

app/Models/User.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Models;
+
+// use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Database\Factories\UserFactory;
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Attributes\Hidden;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Notifications\Notifiable;
+
+#[Fillable(['name', 'email', 'password', 'role'])]
+#[Hidden(['password', 'remember_token'])]
+class User extends Authenticatable
+{
+    /** @use HasFactory<UserFactory> */
+    use HasFactory, Notifiable;
+
+    /**
+     * Vérifie si l'utilisateur est le Chef de Service.
+     */
+    public function isChefService(): bool
+    {
+        return $this->role === 'chef_service';
+    }
+
+    /**
+     * Vérifie si l'utilisateur est un Administrateur Réseau.
+     */
+    public function isAdminReseau(): bool
+    {
+        return $this->role === 'admin_reseau';
+    }
+
+    /**
+     * Get the attributes that should be cast.
+     *
+     * @return array<string, string>
+     */
+    protected function casts(): array
+    {
+        return [
+            'email_verified_at' => 'datetime',
+            'password' => 'hashed',
+        ];
+    }
+}

app/Policies/HardwarePolicy.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Hardware;
+use App\Models\User;
+
+class HardwarePolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true; // Tous les agents connectés peuvent voir la liste du matériel
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Hardware $hardware): bool
+    {
+        return true; // Tous les agents connectés peuvent voir les détails d'un équipement
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return true; // Sylvain, Kévin et Jérémy peuvent enregistrer du matériel
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Hardware $hardware): bool
+    {
+        return true; // Tous les agents du service technique peuvent modifier une fiche matériel
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Hardware $hardware): bool
+    {
+        return true; // Tous les agents du service technique peuvent supprimer un équipement
+    }
+}

app/Policies/OrderPolicy.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Order;
+use App\Models\User;
+use Illuminate\Auth\Access\Response;
+
+class OrderPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true; // Tous les agents authentifiés peuvent lister les commandes
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Order $order): bool
+    {
+        return true; // Tous les agents authentifiés peuvent voir le détail d'une commande
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return true; // Sylvain, Kévin et le chef de service peuvent créer des demandes (brouillons)
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Order $order): bool
+    {
+        // Si la commande est encore au statut Brouillon, tout le monde peut la modifier
+        if ($order->status === 'draft') {
+            return true;
+        }
+
+        // Si elle est validée ou plus loin dans le cycle, seul le chef de service peut la modifier
+        return $user->isChefService();
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Order $order): bool
+    {
+        // Seul le chef de service peut supprimer une commande
+        return $user->isChefService();
+    }
+
+    /**
+     * Détermine si l'utilisateur peut effectuer une transition spécifique.
+     */
+    public function transition(User $user, Order $order, string $newStatus): bool
+    {
+        if ($newStatus === 'validated') {
+            // Seul le chef de service peut valider un brouillon
+            return $user->isChefService();
+        }
+
+        if ($newStatus === 'closed') {
+            // Seul le chef de service peut clôturer / archiver le dossier
+            return $user->isChefService();
+        }
+
+        // Pour les autres transitions (validated -> ordered et ordered -> delivered),
+        // tout agent connecté peut l'effectuer (réception de colis, transmission au fournisseur)
+        return true;
+    }
+}

app/Providers/AppServiceProvider.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Providers;
+
+use Illuminate\Support\Facades\Vite;
+use Illuminate\Support\ServiceProvider;
+
+class AppServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        Vite::prefetch(concurrency: 3);
+        \Illuminate\Support\Facades\Route::model('commande', \App\Models\Order::class);
+        \Illuminate\Support\Facades\Route::model('materiel', \App\Models\Hardware::class);
+    }
+}

app/Services/OrderService.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Order;
+use App\Models\OrderStatusLog;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+
+class OrderService
+{
+    /**
+     * Génère un numéro de commande unique et séquentiel sous la forme CMD-YYYY-XXXX.
+     * Utilise lockForUpdate() pour éviter les race conditions.
+     */
+    public function generateOrderNumber(): string
+    {
+        return DB::transaction(function () {
+            $year = now()->year;
+
+            // Verrouille la ligne de la dernière commande de cette année pour éviter la lecture simultanée
+            $lastOrder = Order::where('number', 'like', "CMD-{$year}-%")
+                ->lockForUpdate()
+                ->orderBy('number', 'desc')
+                ->first();
+
+            if ($lastOrder) {
+                // Extrait la séquence de la dernière commande (ex: CMD-2026-0005 -> 0005)
+                $parts = explode('-', $lastOrder->number);
+                $sequence = intval(end($parts)) + 1;
+            } else {
+                $sequence = 1;
+            }
+
+            $paddedSequence = str_pad($sequence, 4, '0', STR_PAD_LEFT);
+
+            return "CMD-{$year}-{$paddedSequence}";
+        });
+    }
+
+    /**
+     * Effectue la transition de statut d'une commande d'un statut à un autre.
+     * Valide la transition et l'enregistre dans l'historique des statuts.
+     */
+    public function transitionStatus(Order $order, string $newStatus, User $user): Order
+    {
+        $statuses = ['draft', 'validated', 'ordered', 'delivered', 'closed'];
+
+        $currentIndex = array_search($order->status, $statuses);
+        $newIndex = array_search($newStatus, $statuses);
+
+        if ($currentIndex === false || $newIndex === false) {
+            throw new \InvalidArgumentException("Statut invalide.");
+        }
+
+        // Vérification de la transition linéaire (uniquement le statut suivant dans la liste)
+        if ($newIndex !== $currentIndex + 1) {
+            throw new \InvalidArgumentException("La transition de statut de '{$order->status}' vers '{$newStatus}' n'est pas autorisée. Le cycle de vie doit être respecté séquentiellement.");
+        }
+
+        return DB::transaction(function () use ($order, $newStatus, $user) {
+            $oldStatus = $order->status;
+            
+            $order->status = $newStatus;
+            $order->save();
+
+            // Journalisation de la transition
+            OrderStatusLog::create([
+                'order_id' => $order->id,
+                'user_id' => $user->id,
+                'old_status' => $oldStatus,
+                'new_status' => $newStatus,
+                'changed_at' => now(),
+            ]);
+
+            return $order;
+        });
+    }
+}