Checkpoint: Connexion Microsoft 365 (Azure AD OAuth2) : migration DB azureAdId, helpers backend, route callback, bouton Login, page AzureCallback, tests OK

server/db.ts

@@ -116,6 +116,51 @@ export async function deleteLocalUser(id: number) {
   await db.delete(localUsers).where(eq(localUsers.id, id));
 }
 
+export async function getLocalUserByAzureAdId(azureAdId: string) {
+  const db = await getDb();
+  if (!db) return null;
+  const results = await db.select().from(localUsers).where(eq(localUsers.azureAdId, azureAdId)).limit(1);
+  return results[0] ?? null;
+}
+
+export async function getLocalUserByEmail(email: string) {
+  const db = await getDb();
+  if (!db) return null;
+  const results = await db.select().from(localUsers).where(eq(localUsers.email, email)).limit(1);
+  return results[0] ?? null;
+}
+
+export async function upsertLocalUserAzure(data: {
+  email: string;
+  name?: string;
+  azureAdId: string;
+  role?: "admin" | "user" | "readonly";
+}) {
+  const db = await getDb();
+  if (!db) throw new Error("DB unavailable");
+  // Chercher si l'utilisateur existe déjà par email
+  const existing = await getLocalUserByEmail(data.email);
+  if (existing) {
+    // Lier le compte existant à Azure AD
+    await db.update(localUsers)
+      .set({ azureAdId: data.azureAdId, ...(data.name && { name: data.name }) })
+      .where(eq(localUsers.id, existing.id));
+    return existing.id;
+  } else {
+    // Créer un nouveau compte (sans mot de passe — connexion Azure uniquement)
+    const result = await db.insert(localUsers).values({
+      name: data.name ?? data.email,
+      username: data.email,
+      email: data.email,
+      passwordHash: "", // Pas de mot de passe local
+      role: data.role ?? "user",
+      isActive: true,
+      azureAdId: data.azureAdId,
+    });
+    return (result as any)[0]?.insertId ?? null;
+  }
+}
+
 // ─── Veille Items ─────────────────────────────────────────────────────────────
 
 export interface VeilleFilters {