From 8c0c75fb17f12fe63ddb5afe7877ca91d2c54588 Mon Sep 17 00:00:00 2001
From: Manus <dev-agent@manus.ai>
Date: Tue, 21 Apr 2026 13:00:55 -0400
Subject: [PATCH] =?UTF-8?q?Checkpoint:=20v9c=20:=20Correction=20d=C3=A9plo?=
 =?UTF-8?q?iement=20VPS=20-=20migration=20DB=20(colonnes=20login/firstName?=
 =?UTF-8?q?/lastName/isActive),=20correction=20JWT=20name=20vide,=20protec?=
 =?UTF-8?q?tion=20OAuth=20Invalid=20URL,=20seed-admin=20avec=20openId=20au?=
 =?UTF-8?q?tomatique?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Dockerfile                      |  68 ++++++++++++++++++++++++++++++++
 client/public/logoFEHAP.PNG     | Bin 0 -> 3754 bytes
 client/src/const.ts             |   4 ++
 client/src/pages/Login.tsx      |  50 ++++++++++++-----------
 client/src/pages/LoginLocal.tsx |   2 +-
 seed-admin.mjs                  |  25 ++++++++----
 server/routers.ts               |   8 +++-
 7 files changed, 126 insertions(+), 31 deletions(-)
 create mode 100644 Dockerfile
 create mode 100644 client/public/logoFEHAP.PNG

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..97f672e
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,68 @@
+FROM node:22-alpine AS builder
+
+WORKDIR /app
+
+# Installer pnpm
+RUN npm install -g pnpm
+
+# Copier les fichiers de dépendances
+COPY package.json pnpm-lock.yaml ./
+COPY patches/ ./patches/
+
+# Installer toutes les dépendances (y compris devDependencies pour le build)
+RUN pnpm install --frozen-lockfile
+
+# Copier les sources
+COPY . .
+
+# Variables d'environnement pour le build Vite (frontend)
+# Ces valeurs sont overridées par les ARG du docker-compose au moment du build
+ARG VITE_APP_ID=""
+ARG VITE_OAUTH_PORTAL_URL=""
+ARG VITE_APP_TITLE="SONUM"
+ARG VITE_APP_LOGO=""
+ARG VITE_ANALYTICS_ENDPOINT=""
+ARG VITE_ANALYTICS_WEBSITE_ID=""
+ARG VITE_FRONTEND_FORGE_API_KEY=""
+ARG VITE_FRONTEND_FORGE_API_URL=""
+
+ENV VITE_APP_ID=$VITE_APP_ID
+ENV VITE_OAUTH_PORTAL_URL=$VITE_OAUTH_PORTAL_URL
+ENV VITE_APP_TITLE=$VITE_APP_TITLE
+ENV VITE_APP_LOGO=$VITE_APP_LOGO
+ENV VITE_ANALYTICS_ENDPOINT=$VITE_ANALYTICS_ENDPOINT
+ENV VITE_ANALYTICS_WEBSITE_ID=$VITE_ANALYTICS_WEBSITE_ID
+ENV VITE_FRONTEND_FORGE_API_KEY=$VITE_FRONTEND_FORGE_API_KEY
+ENV VITE_FRONTEND_FORGE_API_URL=$VITE_FRONTEND_FORGE_API_URL
+
+# Build : Vite (frontend → dist/public) + esbuild (serveur → dist/index.js)
+RUN pnpm build
+
+# ── Stage production ──────────────────────────────────────────────────────────
+FROM node:22-alpine AS production
+
+WORKDIR /app
+
+RUN npm install -g pnpm
+
+# Copier les fichiers nécessaires
+COPY package.json pnpm-lock.yaml ./
+COPY patches/ ./patches/
+
+# Installer toutes les dépendances (vite est requis au runtime par le serveur Express)
+RUN pnpm install --frozen-lockfile
+
+# Copier les artefacts de build
+COPY --from=builder /app/dist ./dist
+
+# Copier les fichiers de configuration et le seed
+COPY drizzle.config.ts ./
+COPY drizzle/ ./drizzle/
+COPY seed-admin.mjs ./
+COPY shared/ ./shared/
+COPY server/ ./server/
+
+EXPOSE 3000
+
+# Démarrer le serveur et exécuter le seed admin
+CMD node seed-admin.mjs && node dist/index.js
diff --git a/client/public/logoFEHAP.PNG b/client/public/logoFEHAP.PNG
new file mode 100644
index 0000000000000000000000000000000000000000..bbf606cce4874298fe2e75c15b1efc0c197afae8
GIT binary patch
literal 3754
zcmb7Hc{CL8x2Lj4gh5kemo>YjNQ}f-${NNxw#ME}cFMjdAv=wjWE;znHJPzyA7*4J
zCML^RL&o;}-XHI;_x^b2eDC+3d(XM&+<VXGbMLtcCPsR!%-5J{XlPjVAL%?f*Lmln
z&Pad$mkUbuo-5jbCwkg6)x+0U&W%fM55Ny-XwYda$BuO8Hk0oo>i`;>t1tc|wDYb4
zfiyI1n)*5q%mN{l{2&;2?~UGx2+6%7P^RQwO+`fGs%EC7`T6slRH+*0QudPVV~rMO
zc;!paxDe~B#=gO;eOt9BvMaKSjXu=rYY%T;H+=vn@G>os^EHLMa<rajokrN5pP6$j
zES^sLn=zkPkTX|sGVC)vC$6KV^_CF}c%yUyO(&9~1*6p$X1CEA|9`lGbzqbmf~K|+
zpzojhuGXh|@c>5v2_#jy#3M?TLM&)aM)2B8Mn6O}d*%qE>6}fxO~^L}b)jBPhb|tz
z#R7Cua2+4ZR3Dy$jZ1)YGgYxydAjdb5^j<T%2EH;pUbj%!c=5!0dFyi?IF(`{Y+r0
zx3oI+p6xJ>ZE?m?3+$?&FV1FKgnQo!K5pPu2!~{A<o9eh{DqB;{!1}jN{PlHsQb$D
zl@j2#oTkz|R*g5F3B$|JD%k0abE}Ti7RC{04u;1i1P6PBom3lIQB$=i0XlO47{GG`
zZmkj*&26CWp+=LChKZB%Gc~?zMT<ytg!<g_$Ff1*?VQHI0{Jxe{q212MWcWuLrQ8i
z7IC-%9*a0rK#soKo9i@thbJ)lIo4UbwA`RVvAc&@Gl}i>!&jUxtBerbel|~R;)I)A
zKc3^Q3?_{n>R3KO`83}RP5u|i4cuQWPSf3;3sH#s_YYu$LOx8EnseZKKS5oR0Z=}6
z%Cmg;Q1%&A4Ahfj>`b1(V%#D=UEYh8#fW;$xVVQN$5XnZEDW|J=jJcQ;S_69FlPdv
z)I^<oKs+-oUSAX%q+VQEmNRZ5ITn?9zttm=Y+z8;)#Pu9u1nm=p+$x1sI?vG`B9cG
zxfZv<4O;X)*a%4A>Bo{9ChDP^tnKp{Tz3kQOG<U4j&yqXMR4)-<(1#*#D9R9<p5ET
zsc!w>x*S)>oJx6vLL9Jy=5}YOnsZKp9%5dQZ<Y1LQI5K^keEUn^Ed;&7Rim+_-1~0
zeKTxU`6C3oZ%52KrF?Wm96y9k?mU8pCV3gyeKIv0gF*D0r*fj9b!)&S>$Vba{@p>6
zhzftpe6-4Zi*Op__Hks|`qsF!IMn?`TRdxQsM62WPBG`2%PA>7XztLk9}*SrS&O<b
zaNPfd<C8ZCxuXw|<i1fxg9!zSvv=;38mByU&7o9d&0*FK+|+Ea=Efs4Rf3b$iMiT=
z$!`&Ucb_ZMs%ecFOuz8_AEpsZs9jb;?}tpA^PZpMq;}%oj9dq?XXKf8@6R`fnU_<F
z$$M$pdhsR_h@4>VnZI<ODgR30Q9kIdmRxOQt)WVlL$$T7(Q{uyiSl_(&Ts3Eb--pM
z$M>Up$iXR?YMD8}i&zt)QYLEX0l(|Fnx8qG<c55DTJB4>#rZUkg$=}O;J3$jh+q#P
zr+~Xf*>8wHzBNKYhbjh!&H+z#_oui&_)`>2+dUJ!LI5K?og+lC!fAlBwxu=2B&S{z
zKh)ZI{E%A#Dh^qmriR~sShkudtI`C@py<MaVxWlG@b2y?xr>!3lv=zn0D@C-{qf}P
zX?7lBaFi$_qT=r3!<lU%$5R!>kT7+6lDtpC3vI6{FDzq4YHMQ>BLv4;%9AEuZVcL<
zlz7iq-ElkZN+NzxhKFN&cHZ%zQ_e&tQ(M)emO3`fV(*nDa{9a`d?p6B%lD-ER5XZP
z<+LHzH-0STr7HtE9eMn)bn;(5vRm)|p8kPQ7PF{l4@eNV;O8)|mf>jxpVF0k^CN#^
zAErUel<&9meLQo0TrT~iRIb;I|HW*<iXmdfGwL}Sz5GeFB)dkpC>yWK@%h%C5XO9E
z8ezLU{cPh)h$~Y<RhU7nsjX3nw`HcNnCgD(jqSLVF%!DT!zDl7l;vfCMpC=FOT}g7
zj5-+dhN{KWRS*oGT@Bwx@gA%K&YW5U^cvU#2PI_7?{%(4n_7)kq86$(5>)?cZw-=e
zs+?Rq+oQUZ*jS-*tcC8qVHF1q3UM21xYz@HcDrFuDv#Vb*CjN6N=Rn}anE3PKL0lf
zzsaSw5c9z(OQ~C*-`;`aZebM3vT%K}Qq!P=`YA3e6Uvp<PjzYa0iiqS$p3*iPpm!v
zUQA#+)1LEK?vo5RWIw)L<Y;%wYiOnJ$pYP((_p_m^Po${K^9P#d#FsHQ*30haC5M9
z<NZnjfsEm^X%+1?+9mMBC15a!pi)k`i<dgjGt;vxFtrl9+g$$joJ^Rb#LiqKGs|vL
zM{T=s`4K)I$Zw$-yg75U?<ZY@vgJ=0s+s}YjiaZ>`-Npx-19X0C91u%6fBQJC;X7L
z`TH~9J-2WE_DO1n6o-$o6o_TwylXTnU6oYN;=^Vs-fXxn{iOAViRJSCQ6v5!G#rnQ
zpL%d{=)#2byL!v(9xx6~TR2|gHdJ%QM6kM{c?Jm8<_0YDU{?MdHlwEvrUvmG{8?@j
zZj_wyt=IDe<SqD4UlObOa1oCe62zw)8?z6WWf!RQ0ccvktjy~RXUEXS@L(wnb4OPp
zCNVLGF{yr=P2%u=sY3boVq{WPIfhr>uOihEyLaJka1PaEB`G!kjh>JOz^R@wMh8`D
z)ex2|^uu)oKmkrAnONtrgTV^g;zLywCny*xS`GQq=mddBHNPNqs!o*ben&A~dBZ5}
zUo+p<do64QiFRLxNd}2KqC#6MsL4m^dvjSn6b*6>QTm~9?YH98v9_aEkBfJ{POQ8$
zFGSB5QXR&%{TBS&FH@|8K`>fc+5cs02fE;T5G$Kf$r?4`VGmD_&IAR~6e;O?NQ=Yk
zv9&g1>A;{U!Dc3eQ?1tbJYpj}8;S~%tnhRW=Z(=wvnWhIo9(LOm|$*e3sLI<{uy4O
z=lmXb(z<CyQpVeNie^<0H<Tg9>vvpGe3w2ij}!F=k4rN4{FW!0<*Liew`4FCiewzi
zMRBW|1L4SW`x~NZfl<0nWLvHn56SDpdjqXcE3>VwnnG2MP1>}(2!)+OXYjbtc4>Lq
zT}U2gv%XEfX7o;Ha_O&yo{*5xgO0bTR`7cPl9YBnnR11k=rw(~^XO%>G5iMBISkKq
zH0hL%-i<8x3Bq<a5$pVuS`0P(cUNPpr&OOQZ(5nVJ?+DAVaiQ@4G3>rjIC`N*LTEc
z*ay!tBlq7<HN*r>q-vzMAmWb2v3cFDM4PwMx&!ya$$F4L`DlhdA(h&qwZ+W7Qqi@-
zK(|X}Sc)EO{ngW<)48mWsaVj>hz+_Lh5?{p8Bo>7rt?+6TQ=s$Qn=;H6N@`)CE8NP
zQG{nGibU6Q*Nt1Xn<NMQav~z!97Y~d6pE1S)l_D9B`%VD0N@G^H>COttX3&4n$E*{
z<~B#SWiYw54pwD;8(!L4a-E9PSFZrq{n<beHGcV^bn`Xys^5!;W|OrEES1y2-T)H#
zc`6#*dpLI0dn@yxEZ%2BY48oBk{zr`&?gtpeC;2IkL*SZbi4rW_#rb!F3`82)AIek
zA7wvMhNW-&$W|01MausOTz3wYPl(gI^9PdP${F7ZJ$Ue$3EJ9J|AovC9ug-EBP80a
z&p3*#99!H-_u{1%?%y0)-7A@>%6gUfSp&Fq08+b7`_#4K5XZ5VJZyjZqXn^Os^1L4
z82Q<U+UvZOL_b1}#AfqqxK_V^S2w=zsoLpL*ZC48<1onP+dY7+C00Ss7Kc3H0d1nu
zYxJ{C0Ye<9!{53O=DibP0^~Wv$=-#0WSK0wjk)NiiD6FDfakXt=#|Y>A&qenNfq_|
zk#_DoHBX}-!+MPi8?*D(hA+}Xj7)zu=HHFkUaWK!x?o;Xt*n$tE9_?7>G-!n)S?M1
zqN1~diyeMR|Be_48SuENlWCNYvXRsR3X}@Hzn8q7>pdtXh`zOTxuUq)-TSnCd$;mh
zT=@k%81>>L4wOR9v;PZbN6P}l@h**4;FR(!Ok9#Nuh_v(leivblVaF=EYLJk49(47
z-9X@yCx5-P;484c_0?d^@RM%_QEN~2PWCDi%~(C$wO#N9XVJ`=tE0g?be-^FfVY_~
z+Vv_h)7sv}(&=GsVE7bh+sxC;ng__H```;3ukuWbk&4Wpp&;qdq?EW1Iv4WaU&FcU
zD{}-tXyyRU8{L!O47}%A`1-<!8c>n`p0XMP9Y_FtHd=H|MhZRVascG_@Ymw5Jcj^1
zV+*@;0tM+CkmeR9Giy7aHFx2D20Lq;EWd46b`&wNc*F9Q#GlPvEJz?pHc2}nMPZ@U
zJCcwhu99oJG~M>g2KF~<3lhoGRX<ipDw`%7MMUKxYv{+YJ&@a?M$}7qD=JJwgxmgs
zdZqyX-xW(xV%aj_`Dig!;j%5BOtYmBC`t_+$dEv9f4NYd!*iFNu>i{7Vvk<=@C17m
z7zL2bJyp5;p+q~K{-J~V8AWq`cym{IMt6V=q_eyD&BKXL1JzNe4+|ZNCn@cj`A%Av
zp6PyhlR8$tO4Z>6ju`Gu-)<_p3r6uRmHZl$5E132dMg=3Pn^#gI!3LOuYcAAnTy3Z
zct&V!x=)xr0gmyLOmyGnqm3eHiMbDpUi*SDjO-GO)vP3qNOC1A^|&l6BbLOa@Q1Jr
zkmUWT6QKRiTE;fQ!B#QMpdDW9FOM=ItY2qbV47~hDl4)-IgzINL_2zF^=N^^V6k<U
zeuv>q+kX~+-KI$&BM4vj>E{t!$k2UWRp)XW6{163GV^^VGu~X_Oi90QqZJAKKaMme
c!Bd9LQblL2tis&$`;taq*GQ*Y+u`+p0bZVN+5i9m

literal 0
HcmV?d00001

diff --git a/client/src/const.ts b/client/src/const.ts
index 9999063..335a171 100644
--- a/client/src/const.ts
+++ b/client/src/const.ts
@@ -4,6 +4,10 @@ export { COOKIE_NAME, ONE_YEAR_MS } from "@shared/const";
 export const getLoginUrl = () => {
   const oauthPortalUrl = import.meta.env.VITE_OAUTH_PORTAL_URL;
   const appId = import.meta.env.VITE_APP_ID;
+
+  // Si OAUTH_PORTAL_URL n'est pas configuré (déploiement sans OAuth Manus), retourner chaîne vide
+  if (!oauthPortalUrl) return "";
+
   const redirectUri = `${window.location.origin}/api/oauth/callback`;
   const state = btoa(redirectUri);
 
diff --git a/client/src/pages/Login.tsx b/client/src/pages/Login.tsx
index 8f657b4..db5dbac 100644
--- a/client/src/pages/Login.tsx
+++ b/client/src/pages/Login.tsx
@@ -2,11 +2,13 @@ import { getLoginUrl } from "@/const";
 import { useLocation } from "wouter";
 import { KeyRound, ExternalLink } from "lucide-react";
 
-const FEHAP_LOGO = "/manus-storage/logoFEHAP_69ddd0ee.PNG";
+const FEHAP_LOGO = "/logoFEHAP.PNG";
 const SANTINOVA_LOGO_TEXT = "Santinova Soft";
 
 export default function Login() {
   const [, navigate] = useLocation();
+  const loginUrl = getLoginUrl();
+  const oauthEnabled = !!loginUrl;
 
   return (
     <div className="min-h-screen flex bg-background">
@@ -78,29 +80,33 @@ export default function Login() {
           </p>
 
           <div className="space-y-4">
-            {/* Connexion via espace adhérent FEHAP */}
-            <a
-              href={getLoginUrl()}
-              className="group flex items-center gap-4 p-5 bg-primary text-white rounded-2xl shadow-md hover:bg-primary/90 transition-all hover:shadow-lg hover:-translate-y-0.5"
-            >
-              <div className="w-10 h-10 rounded-xl bg-white/20 flex items-center justify-center flex-shrink-0">
-                <ExternalLink size={20} className="text-white" />
-              </div>
-              <div className="flex-1 text-left">
-                <div className="font-semibold text-base">Espace adhérent FEHAP</div>
-                <div className="text-sm text-white/75 mt-0.5">
-                  Connexion via votre compte FEHAP existant
+            {/* Connexion via espace adhérent FEHAP — masqué si OAuth non configuré */}
+            {oauthEnabled && (
+              <a
+                href={loginUrl}
+                className="group flex items-center gap-4 p-5 bg-primary text-white rounded-2xl shadow-md hover:bg-primary/90 transition-all hover:shadow-lg hover:-translate-y-0.5"
+              >
+                <div className="w-10 h-10 rounded-xl bg-white/20 flex items-center justify-center flex-shrink-0">
+                  <ExternalLink size={20} className="text-white" />
                 </div>
-              </div>
-              <span className="text-white/50 group-hover:text-white/80 transition-colors text-lg">→</span>
-            </a>
+                <div className="flex-1 text-left">
+                  <div className="font-semibold text-base">Espace adhérent FEHAP</div>
+                  <div className="text-sm text-white/75 mt-0.5">
+                    Connexion via votre compte FEHAP existant
+                  </div>
+                </div>
+                <span className="text-white/50 group-hover:text-white/80 transition-colors text-lg">→</span>
+              </a>
+            )}
 
-            {/* Séparateur */}
-            <div className="flex items-center gap-3 py-1">
-              <div className="flex-1 h-px bg-border" />
-              <span className="text-xs text-muted-foreground font-medium">ou</span>
-              <div className="flex-1 h-px bg-border" />
-            </div>
+            {/* Séparateur — affiché seulement si OAuth activé */}
+            {oauthEnabled && (
+              <div className="flex items-center gap-3 py-1">
+                <div className="flex-1 h-px bg-border" />
+                <span className="text-xs text-muted-foreground font-medium">ou</span>
+                <div className="flex-1 h-px bg-border" />
+              </div>
+            )}
 
             {/* Connexion locale */}
             <button
diff --git a/client/src/pages/LoginLocal.tsx b/client/src/pages/LoginLocal.tsx
index 8ca23de..ed23e4b 100644
--- a/client/src/pages/LoginLocal.tsx
+++ b/client/src/pages/LoginLocal.tsx
@@ -5,7 +5,7 @@ import { useLocation } from "wouter";
 import { toast } from "sonner";
 import { Eye, EyeOff, Lock, User, ArrowLeft, ExternalLink } from "lucide-react";
 
-const FEHAP_LOGO = "/manus-storage/logoFEHAP_69ddd0ee.PNG";
+const FEHAP_LOGO = "/logoFEHAP.PNG";
 const SANTINOVA_LOGO_TEXT = "Santinova Soft";
 
 export default function LoginLocal() {
diff --git a/seed-admin.mjs b/seed-admin.mjs
index 18d8655..95835fb 100644
--- a/seed-admin.mjs
+++ b/seed-admin.mjs
@@ -4,22 +4,33 @@
  */
 import mysql from 'mysql2/promise';
 import bcrypt from 'bcrypt';
+import { randomUUID } from 'crypto';
 
 const conn = await mysql.createConnection(process.env.DATABASE_URL);
 
 // Vérifier si adminItinova existe déjà
-const [rows] = await conn.execute("SELECT id FROM users WHERE login = 'adminItinova' LIMIT 1");
+const [rows] = await conn.execute("SELECT id, openId FROM users WHERE login = 'adminItinova' LIMIT 1");
 if (rows.length > 0) {
-  console.log('Compte adminItinova déjà existant, seed ignoré.');
+  const existing = rows[0];
+  // Si openId est null, le corriger pour permettre la connexion JWT
+  if (!existing.openId) {
+    const openId = `local:adminItinova:${randomUUID()}`;
+    await conn.execute("UPDATE users SET openId = ? WHERE id = ?", [openId, existing.id]);
+    console.log(`Compte adminItinova : openId corrigé (id=${existing.id})`);
+  } else {
+    console.log('Compte adminItinova déjà existant, seed ignoré.');
+  }
   await conn.end();
   process.exit(0);
 }
 
-// Créer l'utilisateur adminItinova
+// Créer l'utilisateur adminItinova avec un openId local unique
+const openId = `local:adminItinova:${randomUUID()}`;
+
 const [result] = await conn.execute(
-  `INSERT INTO users (login, email, firstName, lastName, name, role, sonumRole, isActive, loginMethod, cguAccepted, lastSignedIn, createdAt, updatedAt)
-   VALUES (?, ?, ?, ?, ?, 'admin', 'gestionnaire', 1, 'local', 1, NOW(), NOW(), NOW())`,
-  ['adminItinova', 'adminItinova@santinova-soft.org', 'Admin', 'SONUM', 'Admin SONUM']
+  `INSERT INTO users (login, email, firstName, lastName, name, openId, role, sonumRole, isActive, loginMethod, cguAccepted, lastSignedIn, createdAt, updatedAt)
+   VALUES (?, ?, ?, ?, ?, ?, 'admin', 'gestionnaire', 1, 'local', 1, NOW(), NOW(), NOW())`,
+  ['adminItinova', 'adminItinova@santinova-soft.org', 'Admin', 'SONUM', 'Admin SONUM', openId]
 );
 
 const userId = result.insertId;
@@ -31,5 +42,5 @@ await conn.execute(
   [userId, hash]
 );
 
-console.log(`Compte adminItinova créé avec succès (id=${userId})`);
+console.log(`Compte adminItinova créé avec succès (id=${userId}, openId=${openId})`);
 await conn.end();
diff --git a/server/routers.ts b/server/routers.ts
index b430e79..1bf6ed8 100644
--- a/server/routers.ts
+++ b/server/routers.ts
@@ -105,8 +105,14 @@ export const appRouter = router({
         }
 
         // Créer un token de session avec l'openId de l'utilisateur local
+        // Le champ name doit être non vide pour passer la vérification JWT
+        const displayName = user.name
+          || [user.firstName, user.lastName].filter(Boolean).join(' ')
+          || user.login
+          || user.email
+          || 'Utilisateur';
         const sessionToken = await sdk.createSessionToken(user.openId!, {
-          name: user.name ?? "",
+          name: displayName,
         });
 
         const cookieOptions = getSessionCookieOptions(ctx.req);