fix(backend): corrige une assertion tautologique dans test_list_all_returns_the_sites_sorted_by_identifier

L'assertion comparait le résultat à lui-même trié, donc vraie quel que
soit l'ordre réellement renvoyé par SiteRepository.list_all(). Compare
désormais à des identifiants connus à l'avance.

apps/backend/README.md

@@ -103,6 +103,8 @@ Le sens de dependance est unique : `endpoints` vers `services` vers `repositorie
 | `/api/v1/users` | Liste et crée des comptes | `admin` |
 | `/api/v1/users/{id}` | Change le rôle ou l'activation | `admin` |
 | `/api/v1/users/{id}/password-reset` | Réinitialise et ferme les sessions | `admin` |
+| `/api/v1/sites` | Liste les sites | `lecteur` |
+| `/api/v1/sites/{site_id}` | Décrit un site | `lecteur` |
 | `/metrics` | Métriques au format Prometheus | jeton si `APP_METRICS_TOKEN` |
 | `/docs`, `/openapi.json` | Documentation, fermée en `staging` et `prod` | public sinon |
 

apps/backend/app/api/deps.py

@@ -24,8 +24,10 @@ from app.db.session import get_session
 from app.repositories.audit_log import AuditLogRepository
 from app.repositories.login_attempt import LoginAttemptRepository
 from app.repositories.refresh_token import RefreshTokenRepository
+from app.repositories.site import SiteRepository
 from app.repositories.user import UserRepository
 from app.services.auth import AuthService, LoginPolicy
+from app.services.site import SiteService
 from app.services.user import UserService
 
 SessionDep = Annotated[AsyncSession, Depends(get_session)]
@@ -131,6 +133,13 @@ def get_user_service(
 UserServiceDep = Annotated[UserService, Depends(get_user_service)]
 
 
+def get_site_service(session: SessionDep) -> SiteService:
+    return SiteService(sites=SiteRepository(session))
+
+
+SiteServiceDep = Annotated[SiteService, Depends(get_site_service)]
+
+
 async def get_current_principal(
     credentials: CredentialsDep,
     session: SessionDep,

apps/backend/app/api/v1/endpoints/health.py

@@ -26,7 +26,9 @@ async def liveness(settings: SettingsDep) -> LivenessStatus:
 async def readiness(session: SessionDep) -> ReadinessStatus:
     try:
         version: str | None = await session.scalar(TIMESCALEDB_VERSION)
-    except SQLAlchemyError, OSError:
+    # `# fmt: skip` contourne un bug de ruff format 0.16.7 : il retire les parenthèses de ce
+    # `except` à deux types, ce qui produit une syntaxe invalide (`except A, B:`).
+    except (SQLAlchemyError, OSError):  # fmt: skip
         logger.exception("Base de données injoignable")
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,

apps/backend/app/api/v1/endpoints/sites.py

@@ -0,0 +1,24 @@
+from fastapi import APIRouter, HTTPException, status
+
+from app.api.deps import LecteurDep, SiteServiceDep
+from app.schemas.site import SiteResponse
+from app.services.site import SiteNotFoundError
+
+router = APIRouter()
+
+
+@router.get("", response_model=list[SiteResponse], summary="Liste les sites")
+async def list_sites(_: LecteurDep, service: SiteServiceDep) -> list[SiteResponse]:
+    sites = await service.list_all()
+    return [SiteResponse.model_validate(site) for site in sites]
+
+
+@router.get("/{site_id}", response_model=SiteResponse, summary="Décrit un site")
+async def get_site(site_id: str, _: LecteurDep, service: SiteServiceDep) -> SiteResponse:
+    try:
+        site = await service.get_by_id(site_id)
+    except SiteNotFoundError as erreur:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Site introuvable"
+        ) from erreur
+    return SiteResponse.model_validate(site)

apps/backend/app/api/v1/router.py

@@ -1,8 +1,9 @@
 from fastapi import APIRouter
 
-from app.api.v1.endpoints import auth, health, users
+from app.api.v1.endpoints import auth, health, sites, users
 
 api_router = APIRouter()
 api_router.include_router(health.router, prefix="/health", tags=["health"])
 api_router.include_router(auth.router, prefix="/auth", tags=["auth"])
 api_router.include_router(users.router, prefix="/users", tags=["users"])
+api_router.include_router(sites.router, prefix="/sites", tags=["sites"])

apps/backend/app/repositories/site.py

@@ -0,0 +1,20 @@
+from collections.abc import Sequence
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.energy import Site
+
+
+class SiteRepository:
+    def __init__(self, session: AsyncSession) -> None:
+        self._session = session
+
+    async def list_all(self) -> Sequence[Site]:
+        requete = select(Site).order_by(Site.site_id)
+        return (await self._session.scalars(requete)).all()
+
+    async def get_by_id(self, site_id: str) -> Site | None:
+        requete = select(Site).where(Site.site_id == site_id)
+        site: Site | None = await self._session.scalar(requete)
+        return site

apps/backend/app/schemas/site.py

@@ -0,0 +1,12 @@
+from pydantic import BaseModel, ConfigDict
+
+
+class SiteResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    site_id: str
+    site_name: str
+    site_type: str
+    location: str | None
+    capacity_kw: float | None
+    status: str | None

apps/backend/app/services/site.py

@@ -0,0 +1,26 @@
+from collections.abc import Sequence
+
+from app.models.energy import Site
+from app.repositories.site import SiteRepository
+
+
+class SiteError(Exception):
+    pass
+
+
+class SiteNotFoundError(SiteError):
+    pass
+
+
+class SiteService:
+    def __init__(self, *, sites: SiteRepository) -> None:
+        self._sites = sites
+
+    async def list_all(self) -> Sequence[Site]:
+        return await self._sites.list_all()
+
+    async def get_by_id(self, site_id: str) -> Site:
+        site = await self._sites.get_by_id(site_id)
+        if site is None:
+            raise SiteNotFoundError(site_id)
+        return site

apps/backend/tests/api/test_sites.py

@@ -0,0 +1,141 @@
+from collections.abc import Callable, Iterator
+from uuid import uuid4
+
+import pytest
+from fastapi import FastAPI
+from httpx import AsyncClient
+
+from app.api.deps import get_current_principal, get_site_service
+from app.core.principal import Principal
+from app.core.roles import AccountKind, Role
+from app.models.energy import Site
+from app.services.site import SiteNotFoundError
+
+
+def principal(role: Role = Role.LECTEUR) -> Principal:
+    return Principal(
+        id=uuid4(),
+        email=f"{role.value}@enervision.fr",
+        role=role,
+        kind=AccountKind.HUMAIN,
+        must_change_password=False,
+    )
+
+
+def site(site_id: str = "site-1") -> Site:
+    return Site(
+        site_id=site_id,
+        site_name="Site de test",
+        site_type="industriel",
+        location="Toulouse",
+        capacity_kw=42.0,
+        status="actif",
+    )
+
+
+class FauxService:
+    def __init__(self, erreur: Exception | None = None) -> None:
+        self._erreur = erreur
+        self.site = site()
+
+    async def list_all(self) -> list[Site]:
+        return [self.site]
+
+    async def get_by_id(self, site_id: str) -> Site:
+        if self._erreur is not None:
+            raise self._erreur
+        return self.site
+
+
+@pytest.fixture
+def lecteur_connecte(app: FastAPI) -> Iterator[None]:
+    app.dependency_overrides[get_current_principal] = lambda: principal()
+    yield
+    app.dependency_overrides.pop(get_current_principal, None)
+
+
+@pytest.fixture
+def servi(
+    app: FastAPI, lecteur_connecte: None
+) -> Iterator[Callable[[Exception | None], FauxService]]:
+    def installe(erreur: Exception | None = None) -> FauxService:
+        service = FauxService(erreur)
+        app.dependency_overrides[get_site_service] = lambda: service
+        return service
+
+    yield installe
+    app.dependency_overrides.pop(get_site_service, None)
+
+
+async def test_list_sites_returns_the_sites(
+    servi: Callable[..., FauxService], client: AsyncClient
+) -> None:
+    servi()
+
+    response = await client.get("/api/v1/sites")
+
+    assert response.status_code == 200
+    corps = response.json()
+    assert corps == [
+        {
+            "site_id": "site-1",
+            "site_name": "Site de test",
+            "site_type": "industriel",
+            "location": "Toulouse",
+            "capacity_kw": 42.0,
+            "status": "actif",
+        }
+    ]
+
+
+async def test_get_site_returns_the_matching_site(
+    servi: Callable[..., FauxService], client: AsyncClient
+) -> None:
+    servi()
+
+    response = await client.get("/api/v1/sites/site-1")
+
+    assert response.status_code == 200
+    assert response.json()["site_id"] == "site-1"
+
+
+async def test_get_site_returns_404_for_an_unknown_site(
+    servi: Callable[..., FauxService], client: AsyncClient
+) -> None:
+    servi(SiteNotFoundError("site-inconnu"))
+
+    response = await client.get("/api/v1/sites/site-inconnu")
+
+    assert response.status_code == 404
+
+
+async def test_list_sites_reaches_the_repository_through_the_session(
+    lecteur_connecte: None, fake_session: Callable[..., None], client: AsyncClient
+) -> None:
+    fake_session(result=[site("a"), site("b")])
+
+    response = await client.get("/api/v1/sites")
+
+    assert response.status_code == 200
+    assert [s["site_id"] for s in response.json()] == ["a", "b"]
+
+
+async def test_get_site_reaches_the_repository_through_the_session(
+    lecteur_connecte: None, fake_session: Callable[..., None], client: AsyncClient
+) -> None:
+    fake_session(result=site("a"))
+
+    response = await client.get("/api/v1/sites/a")
+
+    assert response.status_code == 200
+    assert response.json()["site_id"] == "a"
+
+
+async def test_get_site_returns_404_when_the_session_finds_nothing(
+    lecteur_connecte: None, fake_session: Callable[..., None], client: AsyncClient
+) -> None:
+    fake_session(result=None)
+
+    response = await client.get("/api/v1/sites/inconnu")
+
+    assert response.status_code == 404

apps/backend/tests/factories.py

@@ -1,3 +1,4 @@
+from collections.abc import Sequence
 from typing import Any
 
 from app.core.config import Settings
@@ -12,6 +13,16 @@ SETTINGS_DE_TEST: dict[str, Any] = {
 }
 
 
+class FakeScalars:
+    """Resultat factice pour `.scalars()` : `.all()` renvoie les lignes fournies."""
+
+    def __init__(self, rows: Sequence[object]) -> None:
+        self._rows = rows
+
+    def all(self) -> Sequence[object]:
+        return self._rows
+
+
 class FakeSession:
     """Session factice : renvoie `result`, ou leve `failure` si elle est fournie."""
 
@@ -25,6 +36,9 @@ class FakeSession:
     async def execute(self, *_: object, **__: object) -> object:
         return self._repondre()
 
+    async def scalars(self, *_: object, **__: object) -> FakeScalars:
+        return FakeScalars(self._repondre() or [])
+
     def _repondre(self) -> object:
         if self._failure is not None:
             raise self._failure

apps/backend/tests/repositories/test_site.py

@@ -0,0 +1,59 @@
+import uuid
+
+import pytest
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.energy import Site
+from app.repositories.site import SiteRepository
+
+pytestmark = pytest.mark.integration
+
+
+def identifiant() -> str:
+    return f"site-{uuid.uuid4().hex[:12]}"
+
+
+async def creer(session: AsyncSession, **overrides: object) -> Site:
+    site = Site(
+        site_id=overrides.get("site_id", identifiant()),
+        site_name=overrides.get("site_name", "Site de test"),
+        site_type=overrides.get("site_type", "industriel"),
+        location=overrides.get("location", "Toulouse"),
+        capacity_kw=overrides.get("capacity_kw", 42.0),
+        status=overrides.get("status", "actif"),
+    )
+    session.add(site)
+    await session.flush()
+    return site
+
+
+async def test_get_by_id_returns_the_matching_site(session: AsyncSession) -> None:
+    depot = SiteRepository(session)
+    cree = await creer(session)
+
+    trouve = await depot.get_by_id(cree.site_id)
+    nom = trouve.site_name if trouve else None
+    await session.rollback()
+
+    assert nom == "Site de test"
+
+
+async def test_get_by_id_returns_nothing_for_an_unknown_identifier(
+    session: AsyncSession,
+) -> None:
+    trouve = await SiteRepository(session).get_by_id(identifiant())
+
+    assert trouve is None
+
+
+async def test_list_all_returns_the_sites_sorted_by_identifier(session: AsyncSession) -> None:
+    depot = SiteRepository(session)
+    premier, second = sorted([f"zz-{identifiant()}", f"aa-{identifiant()}"])
+    await creer(session, site_id=second)
+    await creer(session, site_id=premier)
+
+    sites = await depot.list_all()
+    identifiants = [site.site_id for site in sites if site.site_id in (premier, second)]
+    await session.rollback()
+
+    assert identifiants == [premier, second]

apps/backend/tests/services/test_site.py

@@ -0,0 +1,49 @@
+import pytest
+
+from app.models.energy import Site
+from app.services.site import SiteNotFoundError, SiteService
+
+
+def site(site_id: str = "site-1") -> Site:
+    return Site(
+        site_id=site_id,
+        site_name="Site de test",
+        site_type="industriel",
+        location="Toulouse",
+        capacity_kw=42.0,
+        status="actif",
+    )
+
+
+class FakeRepository:
+    def __init__(self, sites: list[Site]) -> None:
+        self._sites = sites
+
+    async def list_all(self) -> list[Site]:
+        return self._sites
+
+    async def get_by_id(self, site_id: str) -> Site | None:
+        return next((s for s in self._sites if s.site_id == site_id), None)
+
+
+async def test_list_all_returns_the_repository_sites() -> None:
+    service = SiteService(sites=FakeRepository([site("a"), site("b")]))
+
+    sites = await service.list_all()
+
+    assert [s.site_id for s in sites] == ["a", "b"]
+
+
+async def test_get_by_id_returns_the_matching_site() -> None:
+    service = SiteService(sites=FakeRepository([site("a")]))
+
+    trouve = await service.get_by_id("a")
+
+    assert trouve.site_id == "a"
+
+
+async def test_get_by_id_raises_when_the_site_is_unknown() -> None:
+    service = SiteService(sites=FakeRepository([]))
+
+    with pytest.raises(SiteNotFoundError):
+        await service.get_by_id("inconnu")

apps/frontend/angular.json

@@ -2,8 +2,7 @@
   "$schema": "./node_modules/@angular/cli/lib/config/schema.json",
   "version": 1,
   "cli": {
-    "packageManager": "npm",
-    "analytics": false
+    "packageManager": "npm"
   },
   "newProjectRoot": "projects",
   "projects": {
@@ -81,7 +80,6 @@
           "builder": "@angular/build:unit-test",
           "options": {
             "coverage": true,
-            "isolate": true,
             "coverageReporters": [
               "text-summary",
               "lcov",

apps/frontend/src/app/app.config.ts

@@ -1,21 +1,13 @@
-import {ApplicationConfig, inject, provideAppInitializer, provideBrowserGlobalErrorListeners} from '@angular/core';
+import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core';
 import { provideRouter } from '@angular/router';
 import { routes } from './app.routes';
 import { mockApiInterceptor } from './core/interceptors/mock-api-interceptor';
 import { provideHttpClient, withInterceptors } from '@angular/common/http';
-import {catchError, firstValueFrom, of} from 'rxjs';
-import {AuthService} from './core/services/auth.service';
-import {authInterceptor} from './core/interceptors/auth-interceptor';
 
 export const appConfig: ApplicationConfig = {
   providers: [
     provideBrowserGlobalErrorListeners(),
     provideRouter(routes),
-    provideHttpClient(withInterceptors([authInterceptor, mockApiInterceptor])),
-    provideAppInitializer(() => {
-      const auth = inject(AuthService);
-      // Un 401 ici est normal : ça veut juste dire qu'il n'y a pas de session.
-      return firstValueFrom(auth.refreshShared().pipe(catchError(() => of(null))));
-    }),
+    provideHttpClient(withInterceptors([mockApiInterceptor])),
   ],
 };

apps/frontend/src/app/app.routes.ts

@@ -1,13 +1,9 @@
 import { Routes } from '@angular/router';
-import {authGuard} from './core/guards/auth-guard';
 
 export const routes: Routes = [
   { path: '', redirectTo: 'dashboard', pathMatch: 'full' },
-  { path: 'login', loadComponent: () => import('./features/auth/login/login').then(m => m.Login) },
-  { path: 'change-password', loadComponent: () => import('./features/auth/change-password/change-password').then(m => m.ChangePassword) },
   {
     path: 'dashboard',
-    canActivate: [authGuard],
-    loadComponent: () => import('./features/dashboard/dashboard').then(m => m.Dashboard),
+    loadComponent: () => import('./features/dashboard/dashboard').then((m) => m.Dashboard),
   },
 ];

apps/frontend/src/app/core/guards/auth-guard.spec.ts

@@ -1,67 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { Router, ActivatedRouteSnapshot } from '@angular/router';
-import { vi } from 'vitest';
-import { authGuard } from './auth-guard';
-import { AuthService } from '../services/auth.service';
-
-describe('authGuard', () => {
-  let authMock: { isAuthenticated: ReturnType<typeof vi.fn>; principal: ReturnType<typeof vi.fn> };
-  let routerMock: { navigate: ReturnType<typeof vi.fn> };
-
-  beforeEach(() => {
-    authMock = { isAuthenticated: vi.fn(), principal: vi.fn() };
-    routerMock = { navigate: vi.fn() };
-
-    TestBed.configureTestingModule({
-      providers: [
-        { provide: AuthService, useValue: authMock },
-        { provide: Router, useValue: routerMock },
-      ],
-    });
-  });
-
-  it('redirige vers /login si non authentifié', () => {
-    authMock.isAuthenticated.mockReturnValue(false);
-
-    const result = TestBed.runInInjectionContext(() =>
-      authGuard({ data: {} } as ActivatedRouteSnapshot, {} as any)
-    );
-
-    expect(result).toBe(false);
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/login']);
-  });
-
-  it('redirige vers /login si le rôle ne correspond pas', () => {
-    authMock.isAuthenticated.mockReturnValue(true);
-    authMock.principal.mockReturnValue({ role: 'lecteur' });
-
-    const result = TestBed.runInInjectionContext(() =>
-      authGuard({ data: { role: 'admin' } } as unknown as ActivatedRouteSnapshot, {} as any)
-    );
-
-    expect(result).toBe(false);
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/login']);
-  });
-
-  it('autorise si authentifié et rôle correspondant', () => {
-    authMock.isAuthenticated.mockReturnValue(true);
-    authMock.principal.mockReturnValue({ role: 'admin' });
-
-    const result = TestBed.runInInjectionContext(() =>
-      authGuard({ data: { role: 'admin' } } as unknown as ActivatedRouteSnapshot, {} as any)
-    );
-
-    expect(result).toBe(true);
-  });
-
-  it('autorise si authentifié et aucun rôle requis', () => {
-    authMock.isAuthenticated.mockReturnValue(true);
-    authMock.principal.mockReturnValue({ role: 'lecteur' });
-
-    const result = TestBed.runInInjectionContext(() =>
-      authGuard({ data: {} } as ActivatedRouteSnapshot, {} as any)
-    );
-
-    expect(result).toBe(true);
-  });
-});

apps/frontend/src/app/core/guards/auth-guard.ts

@@ -1,21 +0,0 @@
-import { inject } from '@angular/core';
-import { CanActivateFn, Router } from '@angular/router';
-import { AuthService } from '../services/auth.service';
-
-export const authGuard: CanActivateFn = (route) => {
-  const auth = inject(AuthService);
-  const router = inject(Router);
-
-  if (!auth.isAuthenticated()) {
-    router.navigate(['/login']);
-    return false;
-  }
-
-  const requiredRole = route.data['role'] as string | undefined;
-  if (requiredRole && auth.principal()?.role !== requiredRole) {
-    router.navigate(['/login']);
-    return false;
-  }
-
-  return true;
-};

apps/frontend/src/app/core/interceptors/auth-interceptor.spec.ts

@@ -1,161 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import {
-  HttpClient,
-  HttpHandlerFn,
-  HttpHeaders,
-  HttpRequest,
-  provideHttpClient,
-  withInterceptors
-} from '@angular/common/http';
-import { provideHttpClientTesting, HttpTestingController } from '@angular/common/http/testing';
-import { Router } from '@angular/router';
-import { of, throwError } from 'rxjs';
-import { vi } from 'vitest';
-import { authInterceptor } from './auth-interceptor';
-import { AuthService } from '../services/auth.service';
-
-describe('authInterceptor', () => {
-  let http: HttpClient;
-  let httpMock: HttpTestingController;
-  let authMock: { getAccessToken: ReturnType<typeof vi.fn>; clearSession: ReturnType<typeof vi.fn>; refreshShared: ReturnType<typeof vi.fn> };
-  let routerMock: { navigate: ReturnType<typeof vi.fn> };
-
-  beforeEach(() => {
-    authMock = {
-      getAccessToken: vi.fn().mockReturnValue('fake-token'),
-      clearSession: vi.fn(),
-      refreshShared: vi.fn(),
-    };
-    routerMock = { navigate: vi.fn() };
-
-    TestBed.configureTestingModule({
-      providers: [
-        provideHttpClient(withInterceptors([authInterceptor])),
-        provideHttpClientTesting(),
-        { provide: AuthService, useValue: authMock },
-        { provide: Router, useValue: routerMock },
-      ],
-    });
-
-    http = TestBed.inject(HttpClient);
-    httpMock = TestBed.inject(HttpTestingController);
-  });
-
-  afterEach(() => httpMock.verify());
-
-  it('ajoute le header Authorization quand un token est disponible', () => {
-    http.get('/api/v1/stats/summary').subscribe();
-    const req = httpMock.expectOne('/api/v1/stats/summary');
-    expect(req.request.headers.get('Authorization')).toBe('Bearer fake-token');
-    req.flush({});
-  });
-
-  it("n'ajoute pas le header Authorization sur /auth/login", () => {
-    http.post('/api/v1/auth/login', {}).subscribe();
-    const req = httpMock.expectOne('/api/v1/auth/login');
-    expect(req.request.headers.has('Authorization')).toBe(false);
-    req.flush({});
-  });
-
-  it('ajoute withCredentials sur les routes /auth/*', () => {
-    http.post('/api/v1/auth/login', {}).subscribe();
-    const req = httpMock.expectOne('/api/v1/auth/login');
-    expect(req.request.withCredentials).toBe(true);
-    req.flush({});
-  });
-
-  it('redirige vers /change-password sur un 403 avec ce detail précis', () => {
-    http.get('/api/v1/dashboard').subscribe({ error: () => {} });
-    const req = httpMock.expectOne('/api/v1/dashboard');
-    req.flush({ detail: 'password_change_required' }, { status: 403, statusText: 'Forbidden' });
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/change-password']);
-  });
-
-  it('ne redirige pas sur un 403 avec un autre detail', () => {
-    http.get('/api/v1/dashboard').subscribe({ error: () => {} });
-    const req = httpMock.expectOne('/api/v1/dashboard');
-    req.flush({ detail: 'Droits insuffisants' }, { status: 403, statusText: 'Forbidden' });
-    expect(routerMock.navigate).not.toHaveBeenCalled();
-  });
-
-  it('déconnecte et redirige vers /login sur un 401 avec error="invalid_token"', () => {
-    http.get('/api/v1/dashboard').subscribe({ error: () => {} });
-    const req = httpMock.expectOne('/api/v1/dashboard');
-    req.flush(
-      {},
-      { status: 401, statusText: 'Unauthorized', headers: new HttpHeaders({ 'WWW-Authenticate': 'Bearer error="invalid_token"' }) }
-    );
-    expect(authMock.clearSession).toHaveBeenCalled();
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/login']);
-  });
-
-  it('déconnecte directement sur un 401 provenant de /auth/refresh, sans tenter de rafraîchir', () => {
-    http.post('/api/v1/auth/refresh', {}).subscribe({ error: () => {} });
-    const req = httpMock.expectOne('/api/v1/auth/refresh');
-    req.flush({}, { status: 401, statusText: 'Unauthorized' });
-    expect(authMock.clearSession).toHaveBeenCalled();
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/login']);
-  });
-
-  it('rafraîchit puis rejoue la requête sur un 401 avec error="expired"', () => {
-    authMock.refreshShared.mockReturnValue(of({ access_token: 'new-token' }));
-    authMock.getAccessToken.mockReturnValueOnce('old-token').mockReturnValue('new-token');
-
-    let result: unknown;
-    http.get('/api/v1/dashboard').subscribe((r) => (result = r));
-
-    const firstReq = httpMock.expectOne('/api/v1/dashboard');
-    firstReq.flush({}, { status: 401, statusText: 'Unauthorized', headers: new HttpHeaders({ 'WWW-Authenticate': 'Bearer error="expired"' }) });
-
-    const retriedReq = httpMock.expectOne('/api/v1/dashboard');
-    expect(retriedReq.request.headers.get('Authorization')).toBe('Bearer new-token');
-    retriedReq.flush({ ok: true });
-
-    expect(result).toEqual({ ok: true });
-  });
-
-  it('déconnecte si le rafraîchissement échoue après un 401 "expired"', () => {
-    authMock.refreshShared.mockReturnValue(throwError(() => new Error('refresh failed')));
-
-    http.get('/api/v1/dashboard').subscribe({ error: () => {} });
-    const req = httpMock.expectOne('/api/v1/dashboard');
-    req.flush({}, { status: 401, statusText: 'Unauthorized', headers: new HttpHeaders({ 'WWW-Authenticate': 'Bearer error="expired"' }) });
-
-    expect(authMock.clearSession).toHaveBeenCalled();
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/login']);
-  });
-
-  it("propage l'erreur telle quelle si ce n'est pas une HttpErrorResponse", () => {
-  const req = new HttpRequest('GET', '/api/v1/dashboard');
-  const boom = new Error('erreur inattendue, pas HTTP');
-  const next: HttpHandlerFn = () => throwError(() => boom);
-
-  let captured: unknown;
-  TestBed.runInInjectionContext(() => {
-    authInterceptor(req, next).subscribe({ error: (e) => (captured = e) });
-  });
-
-  expect(captured).toBe(boom);
-});
-
-it('propage un 401 sur /auth/login sans tenter de rafraîchir ni déconnecter', () => {
-  http.post('/api/v1/auth/login', {}).subscribe({ error: () => {} });
-  const req = httpMock.expectOne('/api/v1/auth/login');
-  req.flush({}, { status: 401, statusText: 'Unauthorized' });
-
-  expect(authMock.refreshShared).not.toHaveBeenCalled();
-  expect(authMock.clearSession).not.toHaveBeenCalled();
-});
-
-it("propage un 401 dont le WWW-Authenticate ne correspond à aucun cas connu", () => {
-  http.get('/api/v1/dashboard').subscribe({ error: () => {} });
-  const req = httpMock.expectOne('/api/v1/dashboard');
-  req.flush(
-    {},
-    { status: 401, statusText: 'Unauthorized', headers: new HttpHeaders({ 'WWW-Authenticate': 'Bearer error="unknown_case"' }) }
-  );
-
-  expect(authMock.refreshShared).not.toHaveBeenCalled();
-  expect(authMock.clearSession).not.toHaveBeenCalled();
-});
-});

apps/frontend/src/app/core/interceptors/auth-interceptor.ts

@@ -1,77 +0,0 @@
-import { HttpErrorResponse, HttpInterceptorFn } from '@angular/common/http';
-import { inject } from '@angular/core';
-import { Router } from '@angular/router';
-import { Observable, catchError, switchMap, throwError } from 'rxjs';
-import { AuthService } from '../services/auth.service';
-import { TokenResponse } from '../../shared/models/auth.model';
-
-function parseAuthError(response: HttpErrorResponse): string | null {
-  const header = response.headers?.get('WWW-Authenticate') ?? '';
-  const match = header.match(/error="([^"]+)"/);
-  return match ? match[1] : null;
-}
-
-export const authInterceptor: HttpInterceptorFn = (req, next) => {
-  const auth = inject(AuthService);
-  const router = inject(Router);
-
-  const isAuthRoute = req.url.includes('/auth/');
-  let request = isAuthRoute ? req.clone({ withCredentials: true }) : req;
-
-  const token = auth.getAccessToken();
-  if (token && !req.url.endsWith('/auth/login')) {
-    request = request.clone({ setHeaders: { Authorization: `Bearer ${token}` } });
-  }
-
-  return next(request).pipe(
-    catchError((error: unknown) => {
-      if (!(error instanceof HttpErrorResponse)) {
-        return throwError(() => error);
-      }
-
-      if (error.status === 403) {
-        const detail = (error.error as { detail?: string })?.detail;
-        if (detail === 'password_change_required') {
-          router.navigate(['/change-password']);
-        }
-        return throwError(() => error);
-      }
-
-      if (error.status !== 401 || req.url.endsWith('/auth/login')) {
-        return throwError(() => error);
-      }
-
-      if (req.url.endsWith('/auth/refresh')) {
-        auth.clearSession();
-        router.navigate(['/login']);
-        return throwError(() => error);
-      }
-
-      const kind = parseAuthError(error);
-
-      if (kind === 'invalid_token') {
-        auth.clearSession();
-        router.navigate(['/login']);
-        return throwError(() => error);
-      }
-
-      if (kind === 'expired' || kind === 'token_stale') {
-        return (auth.refreshShared() as Observable<TokenResponse>).pipe(
-          switchMap(() => {
-            const retried = request.clone({
-              setHeaders: { Authorization: `Bearer ${auth.getAccessToken()}` },
-            });
-            return next(retried);
-          }),
-          catchError((refreshError) => {
-            auth.clearSession();
-            router.navigate(['/login']);
-            return throwError(() => refreshError);
-          })
-        );
-      }
-
-      return throwError(() => error);
-    })
-  );
-};

apps/frontend/src/app/core/services/auth.service.spec.ts

@@ -1,86 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { provideHttpClient } from '@angular/common/http';
-import { provideHttpClientTesting, HttpTestingController } from '@angular/common/http/testing';
-import { AuthService } from './auth.service';
-import { environment } from '../../../environments/environment';
-
-describe('AuthService', () => {
-  let service: AuthService;
-  let httpMock: HttpTestingController;
-
-  const tokenResponse = {
-    access_token: 'abc123',
-    token_type: 'bearer',
-    expires_in: 900,
-    principal: {
-      id: '1',
-      email: 'a@a.com',
-      role: 'admin' as const,
-      kind: 'human' as const,
-      must_change_password: false,
-    },
-  };
-
-  beforeEach(() => {
-    TestBed.configureTestingModule({
-      providers: [provideHttpClient(), provideHttpClientTesting()],
-    });
-    service = TestBed.inject(AuthService);
-    httpMock = TestBed.inject(HttpTestingController);
-  });
-
-  afterEach(() => httpMock.verify());
-
-  it('stocke le token et le principal après un login réussi', () => {
-    service.login({ email: 'a@a.com', password: 'secret' }).subscribe();
-
-    const req = httpMock.expectOne(`${environment.apiUrl}/auth/login`);
-    expect(req.request.withCredentials).toBe(true);
-    req.flush(tokenResponse);
-
-    expect(service.getAccessToken()).toBe('abc123');
-    expect(service.principal()?.email).toBe('a@a.com');
-    expect(service.isAuthenticated()).toBe(true);
-  });
-
-  it('efface la session au logout', () => {
-    service.login({ email: 'a@a.com', password: 'secret' }).subscribe();
-    httpMock.expectOne(`${environment.apiUrl}/auth/login`).flush(tokenResponse);
-
-    service.logout().subscribe();
-    httpMock.expectOne(`${environment.apiUrl}/auth/logout`).flush(null);
-
-    expect(service.getAccessToken()).toBeNull();
-    expect(service.isAuthenticated()).toBe(false);
-  });
-
-  it("ne déclenche qu'un seul appel réseau si refreshShared est appelé plusieurs fois avant la réponse", () => {
-    service.refreshShared().subscribe();
-    service.refreshShared().subscribe();
-    service.refreshShared().subscribe();
-
-    const requests = httpMock.match(`${environment.apiUrl}/auth/refresh`);
-    expect(requests.length).toBe(1);
-    requests[0].flush(tokenResponse);
-  });
-
-  it('met à jour la session après un changement de mot de passe réussi', () => {
-    service.changePassword({ current_password: 'old', new_password: 'new-password-1234' }).subscribe();
-
-    const req = httpMock.expectOne(`${environment.apiUrl}/auth/password`);
-    req.flush(tokenResponse);
-
-    expect(service.getAccessToken()).toBe('abc123');
-  });
-
-  it('récupère le principal courant via /auth/me', () => {
-  let result: unknown;
-  service.me().subscribe((r) => (result = r));
-
-  const req = httpMock.expectOne(`${environment.apiUrl}/auth/me`);
-  expect(req.request.method).toBe('GET');
-  req.flush(tokenResponse.principal);
-
-  expect(result).toEqual(tokenResponse.principal);
-});
-});

apps/frontend/src/app/core/services/auth.service.ts

@@ -1,69 +0,0 @@
-import { Service, signal, computed, inject } from '@angular/core';
-import { HttpClient } from '@angular/common/http';
-import { Observable, tap, finalize, shareReplay } from 'rxjs';
-import { LoginRequest, PasswordChangeRequest, Principal, TokenResponse } from '../../shared/models/auth.model';
-import { environment } from '../../../environments/environment';
-
-@Service()
-export class AuthService {
-  private http = inject(HttpClient);
-
-  // Jamais de localStorage/sessionStorage/cookie côté JS : juste un signal en
-  // mémoire. Un rechargement de page le perd, c'est voulu par le contrat.
-  private accessTokenSignal = signal<string | null>(null);
-  private principalSignal = signal<Principal | null>(null);
-
-  readonly principal = this.principalSignal.asReadonly();
-  readonly isAuthenticated = computed(() => this.principalSignal() !== null);
-
-  private rotation$?: Observable<TokenResponse>;
-
-  getAccessToken(): string | null {
-    return this.accessTokenSignal();
-  }
-
-  private setSession(response: TokenResponse): void {
-    this.accessTokenSignal.set(response.access_token);
-    this.principalSignal.set(response.principal);
-  }
-
-  clearSession(): void {
-    this.accessTokenSignal.set(null);
-    this.principalSignal.set(null);
-  }
-
-  login(credentials: LoginRequest): Observable<TokenResponse> {
-    return this.http
-      .post<TokenResponse>(`${environment.apiUrl}/auth/login`, credentials, { withCredentials: true })
-      .pipe(tap((response) => this.setSession(response)));
-  }
-
-  // Un seul rafraîchissement en vol à la fois, partagé entre tous les
-  // appelants (sinon le serveur révoque toute la session sur des rotations concurrentes).
-  refreshShared(): Observable<TokenResponse> {
-    this.rotation$ ??= this.http
-      .post<TokenResponse>(`${environment.apiUrl}/auth/refresh`, {}, { withCredentials: true })
-      .pipe(
-        tap((response) => this.setSession(response)),
-        finalize(() => (this.rotation$ = undefined)),
-        shareReplay(1)
-      );
-    return this.rotation$;
-  }
-
-  logout(): Observable<void> {
-    return this.http
-      .post<void>(`${environment.apiUrl}/auth/logout`, {}, { withCredentials: true })
-      .pipe(tap(() => this.clearSession()));
-  }
-
-  changePassword(payload: PasswordChangeRequest): Observable<TokenResponse> {
-    return this.http
-      .post<TokenResponse>(`${environment.apiUrl}/auth/password`, payload, { withCredentials: true })
-      .pipe(tap((response) => this.setSession(response)));
-  }
-
-  me(): Observable<Principal> {
-    return this.http.get<Principal>(`${environment.apiUrl}/auth/me`);
-  }
-}

apps/frontend/src/app/features/auth/change-password/change-password.html

@@ -1,31 +0,0 @@
-<div class="auth-page">
-  <form class="auth-card" [formGroup]="form" (ngSubmit)="onSubmit()">
-    <h1>Nouveau mot de passe</h1>
-    <p class="auth-subtitle">Votre mot de passe est provisoire, vous devez le modifier avant de continuer</p>
-
-    <label for="current_password">Mot de passe actuel</label>
-    <input
-      id="current_password"
-      type="password"
-      formControlName="current_password"
-      autocomplete="current-password"
-    />
-
-    <label for="new_password">Nouveau mot de passe</label>
-    <input
-      id="new_password"
-      type="password"
-      formControlName="new_password"
-      autocomplete="new-password"
-    />
-    <span class="auth-hint">12 à 128 caractères</span>
-
-    @if (errorMessage()) {
-      <p class="auth-error">{{ errorMessage() }}</p>
-    }
-
-    <button type="submit" [disabled]="form.invalid || isLoading()">
-      {{ isLoading() ? 'Modification...' : 'Valider' }}
-    </button>
-  </form>
-</div>

apps/frontend/src/app/features/auth/change-password/change-password.scss

@@ -1,88 +0,0 @@
-:host {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  min-height: 100vh;
-  background: #f3f4f6;
-  font-family: 'Segoe UI', system-ui, sans-serif;
-}
-
-.auth-card {
-  background: #ffffff;
-  border: 1px solid #e5e7eb;
-  border-radius: 12px;
-  padding: 2.5rem;
-  width: 100%;
-  max-width: 360px;
-  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);
-  display: flex;
-  flex-direction: column;
-
-  h1 {
-    margin: 0;
-    font-size: 1.5rem;
-    font-weight: 700;
-    color: #1f2937;
-  }
-
-  .auth-subtitle {
-    margin: 0.25rem 0 1.5rem;
-    color: #6b7280;
-    font-size: 0.9rem;
-    line-height: 1.4;
-  }
-
-  label {
-    font-size: 0.85rem;
-    font-weight: 600;
-    color: #374151;
-    margin-bottom: 0.35rem;
-    margin-top: 1rem;
-  }
-
-  input {
-    padding: 0.6rem 0.75rem;
-    border: 1px solid #d1d5db;
-    border-radius: 8px;
-    font-size: 0.95rem;
-
-    &:focus {
-      outline: none;
-      border-color: #3b82f6;
-      box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.15);
-    }
-  }
-
-  button {
-    margin-top: 1.5rem;
-    padding: 0.7rem;
-    background: #3b82f6;
-    color: #fff;
-    border: none;
-    border-radius: 8px;
-    font-size: 0.95rem;
-    font-weight: 600;
-    cursor: pointer;
-
-    &:disabled {
-      background: #9ca3af;
-      cursor: not-allowed;
-    }
-
-    &:not(:disabled):hover {
-      background: #2563eb;
-    }
-  }
-}
-
-.auth-hint {
-  font-size: 0.75rem;
-  color: #9ca3af;
-  margin-top: 0.25rem;
-}
-
-.auth-error {
-  margin: 0.75rem 0 0;
-  color: #dc2626;
-  font-size: 0.85rem;
-}

apps/frontend/src/app/features/auth/change-password/change-password.spec.ts

@@ -1,88 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { ReactiveFormsModule } from '@angular/forms';
-import { Router } from '@angular/router';
-import { of, throwError } from 'rxjs';
-import { vi } from 'vitest';
-import { ChangePassword } from './change-password';
-import { AuthService } from '../../../core/services/auth.service';
-
-describe('ChangePassword', () => {
-  let authMock: { changePassword: ReturnType<typeof vi.fn> };
-  let routerMock: { navigate: ReturnType<typeof vi.fn> };
-
-  beforeEach(async () => {
-    authMock = { changePassword: vi.fn() };
-    routerMock = { navigate: vi.fn() };
-
-    await TestBed.configureTestingModule({
-      imports: [ChangePassword, ReactiveFormsModule],
-      providers: [
-        { provide: AuthService, useValue: authMock },
-        { provide: Router, useValue: routerMock },
-      ],
-    }).compileComponents();
-  });
-
-  it('ne soumet pas si le formulaire est invalide (mot de passe trop court)', () => {
-    const fixture = TestBed.createComponent(ChangePassword);
-    const component = fixture.componentInstance;
-    component.form.setValue({ current_password: 'old', new_password: 'trop-court' });
-
-    component.onSubmit();
-    expect(authMock.changePassword).not.toHaveBeenCalled();
-  });
-
-  it('redirige vers /dashboard après un changement réussi', () => {
-    const fixture = TestBed.createComponent(ChangePassword);
-    const component = fixture.componentInstance;
-    component.form.setValue({ current_password: 'ancien-mot-de-passe', new_password: 'un-nouveau-mot-de-passe-valide' });
-
-    authMock.changePassword.mockReturnValue(of({ principal: { role: 'admin' } }));
-
-    component.onSubmit();
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/dashboard']);
-  });
-
-  it("affiche un message d'erreur si le mot de passe actuel est incorrect", () => {
-  const fixture = TestBed.createComponent(ChangePassword);
-  const component = fixture.componentInstance;
-  component.form.setValue({ current_password: 'mauvais-mot-de-passe', new_password: 'un-nouveau-mot-de-passe-valide' });
-
-  authMock.changePassword.mockReturnValue(throwError(() => new Error('401')));
-
-  component.onSubmit();
-  fixture.detectChanges(); // rend le bloc @if (errorMessage())
-
-  expect(component.errorMessage()).toContain('incorrect');
-  const errorEl = fixture.nativeElement.querySelector('.auth-error');
-  expect(errorEl?.textContent).toContain('incorrect');
-  });
-
-  it('désactive le bouton tant que le formulaire est invalide', () => {
-  const fixture = TestBed.createComponent(ChangePassword);
-  fixture.detectChanges();
-
-  const button = fixture.nativeElement.querySelector('button[type="submit"]');
-  expect(button.disabled).toBe(true);
-  expect(fixture.nativeElement.querySelector('.auth-error')).toBeNull();
-  });
-
-  it('déclenche onSubmit via la soumission réelle du formulaire (ngSubmit)', () => {
-  const fixture = TestBed.createComponent(ChangePassword);
-  const component = fixture.componentInstance;
-  component.form.setValue({ current_password: 'ancien-mot-de-passe', new_password: 'un-nouveau-mot-de-passe-valide' });
-  fixture.detectChanges();
-
-  authMock.changePassword.mockReturnValue(of({ principal: { role: 'admin' } }));
-
-  const form = fixture.nativeElement.querySelector('form');
-  form.dispatchEvent(new Event('submit'));
-  fixture.detectChanges();
-
-  expect(authMock.changePassword).toHaveBeenCalledWith({
-    current_password: 'ancien-mot-de-passe',
-    new_password: 'un-nouveau-mot-de-passe-valide',
-  });
-});
-
-});

apps/frontend/src/app/features/auth/change-password/change-password.ts

@@ -1,41 +0,0 @@
-import { Component, inject, signal } from '@angular/core';
-import { ReactiveFormsModule, FormBuilder, Validators } from '@angular/forms';
-import { Router } from '@angular/router';
-import { AuthService } from '../../../core/services/auth.service';
-
-@Component({
-  selector: 'app-change-password',
-  standalone: true,
-  imports: [ReactiveFormsModule],
-  templateUrl: './change-password.html',
-  styleUrl: './change-password.scss',
-})
-export class ChangePassword {
-  private fb = inject(FormBuilder);
-  private auth = inject(AuthService);
-  private router = inject(Router);
-
-  errorMessage = signal<string | null>(null);
-  isLoading = signal(false);
-
-  form = this.fb.nonNullable.group({
-    current_password: ['', Validators.required],
-    new_password: ['', [Validators.required, Validators.minLength(12), Validators.maxLength(128)]],
-  });
-
-  onSubmit(): void {
-    if (this.form.invalid) return;
-    this.isLoading.set(true);
-    this.errorMessage.set(null);
-
-    this.auth.changePassword(this.form.getRawValue()).subscribe({
-      next: (response) => {
-        this.router.navigate(['/dashboard']);
-      },
-      error: () => {
-        this.isLoading.set(false);
-        this.errorMessage.set('Mot de passe actuel incorrect, ou nouveau mot de passe invalide (12 à 128 caractères).');
-      },
-    });
-  }
-}

apps/frontend/src/app/features/auth/login/login.html

@@ -1,36 +0,0 @@
-<div class="auth-page">
-  <form class="auth-card" [formGroup]="form" (ngSubmit)="onSubmit()">
-    <h1>Connexion</h1>
-    <p class="auth-subtitle">Accédez à votre espace EnerVision</p>
-
-    <label for="email">Email</label>
-    <input
-      id="email"
-      type="email"
-      formControlName="email"
-      autocomplete="username"
-      placeholder="vous@enervision.fr"
-    />
-
-    <label for="password">Mot de passe</label>
-    <input
-      id="password"
-      type="password"
-      formControlName="password"
-      autocomplete="current-password"
-    />
-
-    @if (errorMessage()) {
-      <p class="auth-error">
-        {{ errorMessage() }}
-        @if (retryAfterSeconds(); as seconds) {
-          (réessayez dans {{ seconds }}s)
-        }
-      </p>
-    }
-
-    <button type="submit" [disabled]="form.invalid || isLoading()">
-      {{ isLoading() ? 'Connexion...' : 'Se connecter' }}
-    </button>
-  </form>
-</div>

apps/frontend/src/app/features/auth/login/login.scss

@@ -1,81 +0,0 @@
-:host {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  min-height: 100vh;
-  background: #f3f4f6;
-  font-family: 'Segoe UI', system-ui, sans-serif;
-}
-
-.auth-card {
-  background: #ffffff;
-  border: 1px solid #e5e7eb;
-  border-radius: 12px;
-  padding: 2.5rem;
-  width: 100%;
-  max-width: 360px;
-  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);
-  display: flex;
-  flex-direction: column;
-
-  h1 {
-    margin: 0;
-    font-size: 1.5rem;
-    font-weight: 700;
-    color: #1f2937;
-  }
-
-  .auth-subtitle {
-    margin: 0.25rem 0 1.5rem;
-    color: #6b7280;
-    font-size: 0.9rem;
-  }
-
-  label {
-    font-size: 0.85rem;
-    font-weight: 600;
-    color: #374151;
-    margin-bottom: 0.35rem;
-    margin-top: 1rem;
-  }
-
-  input {
-    padding: 0.6rem 0.75rem;
-    border: 1px solid #d1d5db;
-    border-radius: 8px;
-    font-size: 0.95rem;
-
-    &:focus {
-      outline: none;
-      border-color: #3b82f6;
-      box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.15);
-    }
-  }
-
-  button {
-    margin-top: 1.5rem;
-    padding: 0.7rem;
-    background: #3b82f6;
-    color: #fff;
-    border: none;
-    border-radius: 8px;
-    font-size: 0.95rem;
-    font-weight: 600;
-    cursor: pointer;
-
-    &:disabled {
-      background: #9ca3af;
-      cursor: not-allowed;
-    }
-
-    &:not(:disabled):hover {
-      background: #2563eb;
-    }
-  }
-}
-
-.auth-error {
-  margin: 0.75rem 0 0;
-  color: #dc2626;
-  font-size: 0.85rem;
-}

apps/frontend/src/app/features/auth/login/login.spec.ts

@@ -1,110 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { ReactiveFormsModule } from '@angular/forms';
-import { Router } from '@angular/router';
-import { HttpErrorResponse, HttpHeaders } from '@angular/common/http';
-import { of, throwError } from 'rxjs';
-import { vi } from 'vitest';
-import { Login } from './login';
-import { AuthService } from '../../../core/services/auth.service';
-
-describe('Login', () => {
-  let authMock: { login: ReturnType<typeof vi.fn> };
-  let routerMock: { navigate: ReturnType<typeof vi.fn> };
-
-  beforeEach(async () => {
-    authMock = { login: vi.fn() };
-    routerMock = { navigate: vi.fn() };
-
-    await TestBed.configureTestingModule({
-      imports: [Login, ReactiveFormsModule],
-      providers: [
-        { provide: AuthService, useValue: authMock },
-        { provide: Router, useValue: routerMock },
-      ],
-    }).compileComponents();
-  });
-
-  it('ne soumet pas si le formulaire est invalide', () => {
-    const fixture = TestBed.createComponent(Login);
-    fixture.componentInstance.onSubmit();
-    expect(authMock.login).not.toHaveBeenCalled();
-  });
-
-  it('redirige vers /change-password si must_change_password est vrai', () => {
-    const fixture = TestBed.createComponent(Login);
-    const component = fixture.componentInstance;
-    component.form.setValue({ email: 'a@a.com', password: 'secret' });
-
-    authMock.login.mockReturnValue(of({ principal: { role: 'admin', must_change_password: true } }));
-
-    component.onSubmit();
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/change-password']);
-  });
-
-  it('redirige vers /dashboard si le mot de passe est déjà à jour', () => {
-    const fixture = TestBed.createComponent(Login);
-    const component = fixture.componentInstance;
-    component.form.setValue({ email: 'a@a.com', password: 'secret' });
-
-    authMock.login.mockReturnValue(of({ principal: { role: 'lecteur', must_change_password: false } }));
-
-    component.onSubmit();
-    expect(routerMock.navigate).toHaveBeenCalledWith(['/dashboard']);
-  });
-
-  it('affiche un message générique sur un 401', () => {
-  const fixture = TestBed.createComponent(Login);
-  const component = fixture.componentInstance;
-  component.form.setValue({ email: 'a@a.com', password: 'wrong' });
-
-  authMock.login.mockReturnValue(throwError(() => new HttpErrorResponse({ status: 401 })));
-
-  component.onSubmit();
-  fixture.detectChanges(); // rend le bloc @if (errorMessage()) du template
-
-  expect(component.errorMessage()).toBe('Email ou mot de passe incorrect.');
-  const errorEl = fixture.nativeElement.querySelector('.auth-error');
-  expect(errorEl?.textContent).toContain('Email ou mot de passe incorrect.');
-  });
-
-  it("affiche le délai d'attente sur un 429 avec Retry-After", () => {
-    const fixture = TestBed.createComponent(Login);
-    const component = fixture.componentInstance;
-    component.form.setValue({ email: 'a@a.com', password: 'wrong' });
-
-    authMock.login.mockReturnValue(
-      throwError(() => new HttpErrorResponse({ status: 429, headers: new HttpHeaders({ 'Retry-After': '30' }) }))
-    );
-
-    component.onSubmit();
-    fixture.detectChanges(); // rend aussi le sous-bloc @if (retryAfterSeconds(); as seconds)
-
-    expect(component.retryAfterSeconds()).toBe(30);
-    const errorEl = fixture.nativeElement.querySelector('.auth-error');
-    expect(errorEl?.textContent).toContain('30s');
-  });
-
-  it('désactive le bouton tant que le formulaire est invalide', () => {
-    const fixture = TestBed.createComponent(Login);
-    fixture.detectChanges();
-
-    const button = fixture.nativeElement.querySelector('button[type="submit"]');
-    expect(button.disabled).toBe(true);
-    expect(fixture.nativeElement.querySelector('.auth-error')).toBeNull();
-  });
-
- it('déclenche onSubmit via la soumission réelle du formulaire (ngSubmit)', () => {
-  const fixture = TestBed.createComponent(Login);
-  const component = fixture.componentInstance;
-  component.form.setValue({ email: 'a@a.com', password: 'secret' });
-  fixture.detectChanges();
-
-  authMock.login.mockReturnValue(of({ principal: { role: 'lecteur', must_change_password: false } }));
-
-  const form = fixture.nativeElement.querySelector('form');
-  form.dispatchEvent(new Event('submit'));
-  fixture.detectChanges();
-
-  expect(authMock.login).toHaveBeenCalledWith({ email: 'a@a.com', password: 'secret' });
-  });
-});

apps/frontend/src/app/features/auth/login/login.ts

@@ -1,55 +0,0 @@
-import { Component, inject, signal } from '@angular/core';
-import { ReactiveFormsModule, FormBuilder, Validators } from '@angular/forms';
-import { Router } from '@angular/router';
-import { HttpErrorResponse } from '@angular/common/http';
-import { AuthService } from '../../../core/services/auth.service';
-
-@Component({
-  selector: 'app-login',
-  standalone: true,
-  imports: [ReactiveFormsModule],
-  templateUrl: './login.html',
-  styleUrl: './login.scss',
-})
-export class Login {
-  private fb = inject(FormBuilder);
-  private auth = inject(AuthService);
-  private router = inject(Router);
-
-  errorMessage = signal<string | null>(null);
-  retryAfterSeconds = signal<number | null>(null);
-  isLoading = signal(false);
-
-  form = this.fb.nonNullable.group({
-    email: ['', [Validators.required, Validators.email]],
-    password: ['', Validators.required],
-  });
-
-  onSubmit(): void {
-    if (this.form.invalid) return;
-
-    this.isLoading.set(true);
-    this.errorMessage.set(null);
-    this.retryAfterSeconds.set(null);
-
-    this.auth.login(this.form.getRawValue()).subscribe({
-      next: (response) => {
-        if (response.principal.must_change_password) {
-          this.router.navigate(['/change-password']);
-          return;
-        }
-        this.router.navigate(['/dashboard']);
-      },
-      error: (error: HttpErrorResponse) => {
-        this.isLoading.set(false);
-        if (error.status === 429) {
-          const retryAfter = error.headers.get('Retry-After');
-          this.retryAfterSeconds.set(retryAfter ? Number(retryAfter) : null);
-          this.errorMessage.set('Trop de tentatives, réessayez plus tard.');
-          return;
-        }
-        this.errorMessage.set('Email ou mot de passe incorrect.');
-      },
-    });
-  }
-}

apps/frontend/src/app/features/dashboard/dashboard.html

@@ -1,10 +1,7 @@
 <div class="dashboard">
   <header class="dashboard__header">
-    <div>
-      <h1>Vue d'ensemble</h1>
-      <p class="dashboard__subtitle">Consommation instantanée du parc</p>
-    </div>
-    <button type="button" class="logout-button" (click)="onLogout()">Déconnexion</button>
+    <h1>Vue d'ensemble</h1>
+    <p class="dashboard__subtitle">Consommation instantanée du parc</p>
   </header>
 
   @if (error(); as message) {

apps/frontend/src/app/features/dashboard/dashboard.scss

@@ -144,30 +144,3 @@ h2 {
 .alert-item__message {
   font-size: 0.9rem;
 }
-.dashboard__header {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  margin-bottom: 2rem;
-
-  h1 {
-    margin: 0;
-    font-size: 1.75rem;
-    font-weight: 700;
-  }
-}
-
-.logout-button {
-  padding: 0.5rem 1rem;
-  background: #ffffff;
-  border: 1px solid #d1d5db;
-  border-radius: 8px;
-  font-size: 0.85rem;
-  font-weight: 600;
-  color: #374151;
-  cursor: pointer;
-
-  &:hover {
-    background: #f3f4f6;
-  }
-}

apps/frontend/src/app/features/dashboard/dashboard.spec.ts

@@ -4,8 +4,6 @@ import { of, throwError } from 'rxjs';
 import { Dashboard } from './dashboard';
 import { StatsService } from '../../core/services/stats.service';
 import { AlertsService } from '../../core/services/alerts.service';
-import {AuthService} from '../../core/services/auth.service';
-import {Router} from '@angular/router';
 
 vi.mock('chart.js', () => {
   class ChartMock {
@@ -94,58 +92,4 @@ describe('Dashboard', () => {
 
     expect(fixture.componentInstance.alerts().length).toBe(0);
   });
-
-  it('appelle logout et redirige vers /login au clic sur le bouton de déconnexion', () => {
-  const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-  const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-  const authMock = { logout: vi.fn().mockReturnValue(of(undefined)), clearSession: vi.fn() };
-  const routerMock = { navigate: vi.fn() };
-
-  TestBed.configureTestingModule({
-    imports: [Dashboard],
-    providers: [
-      { provide: StatsService, useValue: statsMock },
-      { provide: AlertsService, useValue: alertsMock },
-      { provide: AuthService, useValue: authMock },
-      { provide: Router, useValue: routerMock },
-    ],
-  });
-
-  const fixture = TestBed.createComponent(Dashboard);
-  fixture.detectChanges();
-
-  const button = fixture.nativeElement.querySelector('.logout-button');
-  button.click();
-
-  expect(authMock.logout).toHaveBeenCalled();
-  expect(routerMock.navigate).toHaveBeenCalledWith(['/login']);
-  });
-  it('déconnecte localement et redirige vers /login même si logout échoue côté réseau', () => {
-  const statsMock = { getSummary: vi.fn().mockReturnValue(of({ total_sites: 7, sites: [] })) };
-  const alertsMock = { getAlerts: vi.fn().mockReturnValue(of([])) };
-  const authMock = {
-    logout: vi.fn().mockReturnValue(throwError(() => new Error('réseau indisponible'))),
-    clearSession: vi.fn(),
-  };
-  const routerMock = { navigate: vi.fn() };
-
-  TestBed.configureTestingModule({
-    imports: [Dashboard],
-    providers: [
-      { provide: StatsService, useValue: statsMock },
-      { provide: AlertsService, useValue: alertsMock },
-      { provide: AuthService, useValue: authMock },
-      { provide: Router, useValue: routerMock },
-    ],
-  });
-
-  const fixture = TestBed.createComponent(Dashboard);
-  fixture.detectChanges();
-
-  const button = fixture.nativeElement.querySelector('.logout-button');
-  button.click();
-
-  expect(authMock.clearSession).toHaveBeenCalled();
-  expect(routerMock.navigate).toHaveBeenCalledWith(['/login']);
-});
 });

apps/frontend/src/app/features/dashboard/dashboard.ts

@@ -2,12 +2,10 @@ import { Component, OnInit, inject, signal, DestroyRef } from '@angular/core';
 import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
 import { timer, switchMap, catchError, EMPTY, Observable } from 'rxjs';
 import { DecimalPipe } from '@angular/common';
-import { Router } from '@angular/router';
 import { StatsService } from '../../core/services/stats.service';
 import { ConsumptionGauge } from '../../shared/components/consumption-gauge/consumption-gauge';
 import { SiteLoadChart } from '../../shared/components/site-load-chart/site-load-chart';
 import { AlertsService } from '../../core/services/alerts.service';
-import { AuthService } from '../../core/services/auth.service';
 import { StatsSummary } from '../../shared/models/stats.model';
 import { Alert } from '../../shared/models/alert.model';
 
@@ -25,8 +23,6 @@ const UNAVAILABLE_MESSAGE =
 export class Dashboard implements OnInit {
   private statsService = inject(StatsService);
   private alertsService = inject(AlertsService);
-  private auth = inject(AuthService);
-  private router = inject(Router);
   private destroyRef = inject(DestroyRef);
 
   stats = signal<StatsSummary | null>(null);
@@ -54,17 +50,6 @@ export class Dashboard implements OnInit {
       });
   }
 
-  onLogout(): void {
-    this.auth.logout().subscribe({
-      next: () => this.router.navigate(['/login']),
-      error: () => {
-        // Même si l'appel réseau échoue, on considère l'utilisateur déconnecté localement.
-        this.auth.clearSession();
-        this.router.navigate(['/login']);
-      },
-    });
-  }
-
   private reportUnavailable(): Observable<never> {
     this.error.set(UNAVAILABLE_MESSAGE);
     return EMPTY;

apps/frontend/src/app/shared/models/auth.model.ts

@@ -1,26 +0,0 @@
-export type Role = 'lecteur' | 'operateur' | 'admin';
-
-export interface LoginRequest {
-  email: string;
-  password: string;
-}
-
-export interface PasswordChangeRequest {
-  current_password: string;
-  new_password: string;
-}
-
-export interface Principal {
-  id: string;
-  email: string;
-  role: Role;
-  kind: 'human';
-  must_change_password: boolean;
-}
-
-export interface TokenResponse {
-  access_token: string;
-  token_type: string;
-  expires_in: number;
-  principal: Principal;
-}

apps/frontend/src/environments/environment.ts

@@ -1,5 +1,5 @@
 export const environment = {
   production: true,
-  apiUrl: '/api/v1',
+  apiUrl: 'http://localhost:8000/api/v1',
   useMockFixtures: false,
 };

docs/architecture/00-vue-ensemble.md

@@ -74,9 +74,9 @@ collecteur ne vient le lire.
 
 | Domaine | Technologie | Emplacement | Statut | Ce qui existe réellement |
 |---|---|---|---|---|
-| Backend | FastAPI, Python 3.14 | `apps/backend` | `En cours` | Factory, configuration, journalisation, 2 sondes de santé, `/metrics`. Aucune couche métier |
+| Backend | FastAPI, Python 3.14 | `apps/backend` | `En cours` | Factory, configuration, journalisation, 2 sondes de santé, `/metrics`, `GET /sites` et `GET /sites/{site_id}` (première couche métier, endpoints → services → repositories → models) |
 | Frontend | Angular 22, Node 24 | `apps/frontend` | `En cours` | Tableau de bord sur route `/dashboard`, deux services HTTP, graphiques Chart.js, données servies par des fixtures |
-| Base | PostgreSQL 17 + TimescaleDB | `db` | `Fait` | Bootstrap de l'extension, base de test, chaîne Alembic. Aucune table applicative |
+| Base | PostgreSQL 17 + TimescaleDB | `db` | `Fait` | Bootstrap de l'extension, base de test, chaîne Alembic. Schéma applicatif créé (`site`, `dataset`, `reading` en hypertable, `prediction`, `alert`, `recommendation`) |
 | Infra | Terraform, k3s single-node | `infra/terraform` | `En cours` | Module d'installation du cluster. Jamais appliqué, aucune ressource Kubernetes déclarée |
 | Monitoring | Prometheus, Grafana, Alertmanager | `monitoring` | `Cible` | Rien, hors le `/metrics` exposé par l'API |
 | ETL | Apache Airflow | `etl/airflow` | `Cible` | Rien |

docs/architecture/20-backend.md

@@ -12,11 +12,11 @@ Les quatre couches existent désormais, portées par l'authentification.
 
 ```mermaid
 flowchart TB
-  ep["endpoints<br/>health, auth, users"]
+  ep["endpoints<br/>health, auth, users, sites"]
   sc["schemas<br/>Pydantic"]
-  sv["services<br/>AuthService, UserService"]
-  rp["repositories<br/>user, refresh_token,<br/>login_attempt, audit_log"]
-  md["models<br/>4 tables"]
+  sv["services<br/>AuthService, UserService,<br/>SiteService"]
+  rp["repositories<br/>user, refresh_token,<br/>login_attempt, audit_log,<br/>site"]
+  md["models<br/>10 tables"]
   db[("PostgreSQL")]
 
   ep --> sc
@@ -140,6 +140,8 @@ Deux fichiers d'environnement, deux usages : `.env` à la racine alimente `docke
 | POST | `/api/v1/users` | oui | Crée un compte, rend un mot de passe provisoire. `admin` |
 | PATCH | `/api/v1/users/{id}` | oui | Change le rôle ou l'activation. `admin` |
 | POST | `/api/v1/users/{id}/password-reset` | oui | Réinitialise et ferme les sessions. `admin` |
+| GET | `/api/v1/sites` | oui | Liste les sites. `lecteur` |
+| GET | `/api/v1/sites/{site_id}` | oui | Décrit un site. `lecteur` |
 | GET | `/metrics` | non | Format Prometheus. Jeton requis si `APP_METRICS_TOKEN` est posé |
 | GET | `/docs`, `/redoc`, `/openapi.json` | non | Fermés en `staging` et en `prod` |
 
@@ -148,7 +150,14 @@ Deux fichiers d'environnement, deux usages : `.env` à la racine alimente `docke
 échoue si l'une d'elles répond autre chose qu'un 401 ou un 403. Rendre une route publique impose
 donc de modifier la liste dans ce fichier de test.
 
-Aucune route métier n'existe à ce jour. Le contrat détaillé pour le frontend est dans
+`GET /sites` et `GET /sites/{site_id}` sont la première route métier, et le gabarit à réutiliser
+pour les suivantes (`reading`, `dataset`, `prediction`, `alert`, `recommendation`) : les quatre
+couches `endpoints → services → repositories → models` y sont toutes présentes, sur des tables
+déjà créées par la révision Alembic `e6d2026091501`. Elles n'exigent que le rôle `lecteur`,
+contrairement aux routes d'administration qui exigent `admin`. `SiteRepository` lit par
+`AsyncSession.scalar()` (une ligne) et `AsyncSession.scalars()` (plusieurs lignes) plutôt que par
+`execute()`, ce qui la rend testable par la fixture `fake_session` au niveau endpoint sans base
+réelle. Le contrat détaillé pour le frontend est dans
 [31-contrat-authentification.md](31-contrat-authentification.md).
 
 ### `/health/ready`

docs/architecture/owasp-traceabilite.md

@@ -8,8 +8,9 @@ de réponse honnête.
 Ce qui est défendable, c'est une ligne par contrôle réellement implémenté, l'item qu'il adresse,
 et une section qui dit ce qui n'est pas couvert et pourquoi.
 
-Statut : `Fait` pour le périmètre authentification et autorisation. Les endpoints métier
-n'existent pas encore, donc plusieurs lignes resteront à compléter.
+Statut : `Fait` pour le périmètre authentification et autorisation. `GET /sites` et
+`GET /sites/{site_id}` sont les premiers endpoints métier, en lecture seule ; plusieurs lignes
+resteront à compléter une fois les endpoints d'écriture posés.
 
 ## Contrôles en place
 
@@ -48,7 +49,7 @@ règles Bandit. Ajouter Bandit à la CI serait redondant, contrairement à ce qu
 
 | Item | État | Raison |
 |---|---|---|
-| **API1 Broken Object Level Authorization** | **ouvert** | Les rôles sont globaux, il n'y a pas de portée par site. Un opérateur du site A pourra agir sur le site B dès que les endpoints métier existeront. Correctif prévu : table d'affectation compte-site, contrôle d'appartenance dans la même dépendance que le contrôle de rôle. |
+| **API1 Broken Object Level Authorization** | **ouvert** | Les rôles sont globaux, il n'y a pas de portée par site : `GET /sites/{site_id}` répond à tout compte `lecteur` pour n'importe quel site, sans vérifier une affectation compte-site qui n'existe pas encore. Un opérateur du site A pourra agir sur le site B dès que les endpoints d'écriture métier existeront. Correctif prévu : table d'affectation compte-site, contrôle d'appartenance dans la même dépendance que le contrôle de rôle. |
 | **API4, lectures de séries temporelles** | **ouvert** | Pas encore d'endpoint métier, donc ni pagination plafonnée, ni fenêtre temporelle maximale, ni `statement_timeout`. C'est la façon la plus probable dont la démonstration tombera : une requête sur dix ans d'historique suffit. |
 | **API8 Security Misconfiguration, transport** | **ouvert** | Pas de TLS, donc ni HSTS, ni cookie `Secure` réellement posé en production. Ils appartiennent au terminateur TLS, qui n'existe pas. |
 | **API10 Unsafe Consumption of APIs** | **ouvert, et spécifique à ce projet** | L'API Mock de l'école n'a aucune authentification, tourne en HTTP clair sur le réseau de l'école, et expose un endpoint mutatif à quiconque. Sa réponse doit être traitée comme une entrée hostile : bornes physiques, taille de tableau plafonnée, timeout, et frontière d'anti-corruption. La conséquence la plus sérieuse n'est pas la fausse alerte, c'est l'empoisonnement du jeu d'entraînement du modèle de prédiction. |