Checkpoint: Ajout du secours de stockage réservé aux PDF de paie chiffrés : lorsque Forge est indisponible en recette, les octets AES-256-GCM sont stockés dans un volume hôte Docker persistant, jamais dans l'image ni la base. Import, réindexation et consultation passent par cette même abstraction, avec test de round-trip sans Forge. Compose transmet la clé AES et monte le volume dédié. Validation complète : 56 tests, TypeScript, build et format YAML.

server/payrollStorage.test.ts

@@ -0,0 +1,38 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const originalStorageDir = process.env.PAYROLL_STORAGE_DIR;
+const originalForgeUrl = process.env.BUILT_IN_FORGE_API_URL;
+const originalForgeKey = process.env.BUILT_IN_FORGE_API_KEY;
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  if (originalStorageDir === undefined) delete process.env.PAYROLL_STORAGE_DIR;
+  else process.env.PAYROLL_STORAGE_DIR = originalStorageDir;
+  if (originalForgeUrl === undefined) delete process.env.BUILT_IN_FORGE_API_URL;
+  else process.env.BUILT_IN_FORGE_API_URL = originalForgeUrl;
+  if (originalForgeKey === undefined) delete process.env.BUILT_IN_FORGE_API_KEY;
+  else process.env.BUILT_IN_FORGE_API_KEY = originalForgeKey;
+  vi.resetModules();
+});
+
+describe("stockage persistant des bulletins", () => {
+  it("conserve un PDF déjà chiffré dans le répertoire persistant quand Forge est indisponible", async () => {
+    const storageDir = await mkdtemp(join(tmpdir(), "itinova-payroll-storage-"));
+    process.env.PAYROLL_STORAGE_DIR = storageDir;
+    delete process.env.BUILT_IN_FORGE_API_URL;
+    delete process.env.BUILT_IN_FORGE_API_KEY;
+    vi.stubGlobal("fetch", vi.fn(() => { throw new Error("Forge ne doit pas être appelé"); }));
+
+    const { payrollStorageGetBuffer, payrollStoragePut } = await import("./storage");
+    const ciphertext = Buffer.from("octets-chiffres-de-test", "utf8");
+    const stored = await payrollStoragePut("salaires/test.pdf.enc", ciphertext, "application/octet-stream");
+
+    expect(stored.key).toMatch(/^salaires\/test\.pdf_[a-f0-9]{8}\.enc$/);
+    await expect(payrollStorageGetBuffer(stored.key)).resolves.toEqual(ciphertext);
+
+    await rm(storageDir, { recursive: true, force: true });
+  });
+});