From e4328ab65224e8df3ab65fb87b361c9a2f7ab1f7 Mon Sep 17 00:00:00 2001
From: Manus <dev-agent@manus.ai>
Date: Sat, 22 Aug 2026 19:03:59 +0000
Subject: [PATCH] =?UTF-8?q?Checkpoint:=20Pr=C3=A9paration=20du=20d=C3=A9pl?=
 =?UTF-8?q?oiement=20production=20apr=C3=A8s=20validation=20recette=20:=20?=
 =?UTF-8?q?manifeste=20Gitea=20production=20restaur=C3=A9,=20image=20runti?=
 =?UTF-8?q?me=20all=C3=A9g=C3=A9e,=20Vite=20exclu=20du=20bundle=20serveur?=
 =?UTF-8?q?=20et=20diagnostic=20OAuth2=20ImapFlow=20bas=C3=A9=20sur=20la?=
 =?UTF-8?q?=20configuration=20active=20ajout=C3=A9.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app.json                                |  2 +-
 scripts/test-imapflow-oauth-from-db.mjs | 70 +++++++++++++++++++++++++
 todo.md                                 |  3 +-
 3 files changed, 73 insertions(+), 2 deletions(-)
 create mode 100644 scripts/test-imapflow-oauth-from-db.mjs

diff --git a/app.json b/app.json
index c528ebf..9575a94 100644
--- a/app.json
+++ b/app.json
@@ -8,7 +8,7 @@
   },
   "containerName": "demat-facturation-app",
   "image": "images/demat-facturation-dsi.jpg",
-  "giteaRepo": "demat-facturation",
+  "giteaRepo": "demat-facturation-dsi",
   "giteaOwner": "manus-admin",
   "ci": {
     "required": true
diff --git a/scripts/test-imapflow-oauth-from-db.mjs b/scripts/test-imapflow-oauth-from-db.mjs
new file mode 100644
index 0000000..fde6564
--- /dev/null
+++ b/scripts/test-imapflow-oauth-from-db.mjs
@@ -0,0 +1,70 @@
+import { ImapFlow } from "imapflow";
+import mysql from "mysql2/promise";
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) throw new Error("Variable DATABASE_URL manquante");
+
+const connection = await mysql.createConnection(databaseUrl);
+try {
+  const [rows] = await connection.query(`
+    SELECT emailImportAddress, emailImportHost, emailImportPort,
+           azureTenantId, azureClientId, azureClientSecret
+      FROM importSettings
+     WHERE emailImportEnabled = 1
+       AND emailImportAuthMode = 'oauth2'
+     ORDER BY id
+     LIMIT 1
+  `);
+
+  const settings = rows[0];
+  if (!settings) throw new Error("Aucune configuration OAuth2 IMAP active");
+
+  const tenantId = settings.azureTenantId || process.env.AZURE_AD_TENANT_ID;
+  const clientId = settings.azureClientId || process.env.AZURE_AD_CLIENT_ID;
+  const clientSecret = settings.azureClientSecret || process.env.AZURE_AD_CLIENT_SECRET;
+  if (!tenantId || !clientId || !clientSecret) {
+    throw new Error("Configuration Azure AD incomplète");
+  }
+
+  const response = await fetch(
+    `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: clientId,
+        client_secret: clientSecret,
+        scope: "https://outlook.office365.com/.default",
+        grant_type: "client_credentials",
+      }),
+    },
+  );
+  const tokenResponse = await response.json();
+  if (!response.ok || !tokenResponse.access_token) {
+    throw new Error(`Échec OAuth2 : ${tokenResponse.error || response.status}`);
+  }
+
+  const host = settings.emailImportHost || "outlook.office365.com";
+  const client = new ImapFlow({
+    host,
+    port: settings.emailImportPort || 993,
+    secure: true,
+    auth: {
+      user: settings.emailImportAddress,
+      accessToken: tokenResponse.access_token,
+    },
+    tls: { servername: host, rejectUnauthorized: true },
+    verifyOnly: true,
+    logger: false,
+  });
+
+  try {
+    await client.connect();
+    console.log(`Authentification ImapFlow OAuth2 réussie pour ${settings.emailImportAddress}`);
+  } finally {
+    if (client.usable) await client.logout().catch(() => client.close());
+    else client.close();
+  }
+} finally {
+  await connection.end();
+}
diff --git a/todo.md b/todo.md
index dd13310..f9669f3 100644
--- a/todo.md
+++ b/todo.md
@@ -736,6 +736,7 @@
 - [x] Pousser la version ImapFlow vers le dépôt Gitea de recette
 - [x] Réduire l’image runtime Docker pour fiabiliser le build sur le serveur de recette
 - [x] Charger Vite uniquement en développement pour l’exclure de l’image runtime
-- [ ] Déployer et valider HTTP, conteneurs et OAuth2 ImapFlow en recette
+- [x] Déployer et valider HTTP et conteneurs ImapFlow en recette (aucune source OAuth2 active à tester)
+- [x] Corriger les règles Docker orphelines qui bloquaient MySQL en recette
 - [ ] Pousser la version validée vers le dépôt Gitea de production
 - [ ] Déployer et valider HTTP, conteneurs et OAuth2 ImapFlow en production