Checkpoint: Ajout du secours de stockage réservé aux PDF de paie chiffrés : lorsque Forge est indisponible en recette, les octets AES-256-GCM sont stockés dans un volume hôte Docker persistant, jamais dans l'image ni la base. Import, réindexation et consultation passent par cette même abstraction, avec test de round-trip sans Forge. Compose transmet la clé AES et monte le volume dédié. Validation complète : 56 tests, TypeScript, build et format YAML.

docker-compose.yml

@@ -4,32 +4,35 @@ services:
     container_name: itinova-budget-si-app
     restart: unless-stopped
     environment:
-    - NODE_ENV=production
-    - DATABASE_URL=mysql://budget_user:BudgetSI2027!@db:3306/budget_si
-    - JWT_SECRET=${JWT_SECRET:-budget-si-recette-jwt-secret-2027}
-    - VITE_APP_ID=${VITE_APP_ID:-}
-    - OAUTH_SERVER_URL=${OAUTH_SERVER_URL:-}
-    - VITE_OAUTH_PORTAL_URL=${VITE_OAUTH_PORTAL_URL:-}
-    - OWNER_OPEN_ID=${OWNER_OPEN_ID:-}
-    - OWNER_NAME=${OWNER_NAME:-Administrateur}
-    - BUILT_IN_FORGE_API_URL=${BUILT_IN_FORGE_API_URL:-}
-    - BUILT_IN_FORGE_API_KEY=${BUILT_IN_FORGE_API_KEY:-}
-    - VITE_FRONTEND_FORGE_API_KEY=${VITE_FRONTEND_FORGE_API_KEY:-}
-    - VITE_FRONTEND_FORGE_API_URL=${VITE_FRONTEND_FORGE_API_URL:-}
-    - VITE_ANALYTICS_ENDPOINT=${VITE_ANALYTICS_ENDPOINT:-}
-    - VITE_ANALYTICS_WEBSITE_ID=${VITE_ANALYTICS_WEBSITE_ID:-}
-    - PAYROLL_ENCRYPTION_KEY=${PAYROLL_ENCRYPTION_KEY:-}
+      - NODE_ENV=production
+      - DATABASE_URL=mysql://budget_user:BudgetSI2027!@db:3306/budget_si
+      - JWT_SECRET=${JWT_SECRET:-budget-si-recette-jwt-secret-2027}
+      - VITE_APP_ID=${VITE_APP_ID:-}
+      - OAUTH_SERVER_URL=${OAUTH_SERVER_URL:-}
+      - VITE_OAUTH_PORTAL_URL=${VITE_OAUTH_PORTAL_URL:-}
+      - OWNER_OPEN_ID=${OWNER_OPEN_ID:-}
+      - OWNER_NAME=${OWNER_NAME:-Administrateur}
+      - BUILT_IN_FORGE_API_URL=${BUILT_IN_FORGE_API_URL:-}
+      - BUILT_IN_FORGE_API_KEY=${BUILT_IN_FORGE_API_KEY:-}
+      - VITE_FRONTEND_FORGE_API_KEY=${VITE_FRONTEND_FORGE_API_KEY:-}
+      - VITE_FRONTEND_FORGE_API_URL=${VITE_FRONTEND_FORGE_API_URL:-}
+      - VITE_ANALYTICS_ENDPOINT=${VITE_ANALYTICS_ENDPOINT:-}
+      - VITE_ANALYTICS_WEBSITE_ID=${VITE_ANALYTICS_WEBSITE_ID:-}
+      - PAYROLL_ENCRYPTION_KEY=${PAYROLL_ENCRYPTION_KEY:-}
+      - PAYROLL_STORAGE_DIR=/var/lib/itinova-budget-si/payroll
+    volumes:
+      - ${PAYROLL_STORAGE_HOST_DIR:-/opt/manus-deploy/data/itinova-budget-si/payroll}:/var/lib/itinova-budget-si/payroll
     depends_on:
       db:
         condition: service_healthy
     networks:
-    - web
+      - web
     labels:
-    - "traefik.enable=true"
-    - "traefik.http.routers.budget-si.rule=Host(`budget-si.recette.santinova-soft.org`)"
-    - "traefik.http.routers.budget-si.entrypoints=websecure"
-    - "traefik.http.routers.budget-si.tls.certresolver=letsencrypt"
-    - "traefik.http.services.budget-si.loadbalancer.server.port=3000"
+      - "traefik.enable=true"
+      - "traefik.http.routers.budget-si.rule=Host(`budget-si.recette.santinova-soft.org`)"
+      - "traefik.http.routers.budget-si.entrypoints=websecure"
+      - "traefik.http.routers.budget-si.tls.certresolver=letsencrypt"
+      - "traefik.http.services.budget-si.loadbalancer.server.port=3000"
 
   db:
     image: mysql:8.0
@@ -41,14 +44,25 @@ services:
       MYSQL_USER: budget_user
       MYSQL_PASSWORD: BudgetSI2027!
     volumes:
-    - db_data:/var/lib/mysql
+      - db_data:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-pBudgetSI2027!"]
+      test:
+        [
+          "CMD",
+          "mysqladmin",
+          "ping",
+          "-h",
+          "localhost",
+          "-u",
+          "root",
+          "-pBudgetSI2027!",
+        ]
       interval: 10s
       timeout: 5s
       retries: 5
     networks:
-    - web
+      - web
+
 volumes:
   db_data: