From 17a331b31d661145048c2278ab46e37a14381b63 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 09:58:10 +0200
Subject: [PATCH 1/8] feat(frontend) : ERP-27 - sidebar entry + i18n keys for
 admin users

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 config/sidebar.php            |  6 ++++++
 frontend/i18n/locales/fr.json | 29 ++++++++++++++++++++++++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/config/sidebar.php b/config/sidebar.php
index 54018b8..edad75c 100644
--- a/config/sidebar.php
+++ b/config/sidebar.php
@@ -38,6 +38,12 @@ return [
                 'icon'   => 'mdi:shield-account-outline',
                 'module' => 'core',
             ],
+            [
+                'label'  => 'sidebar.core.users',
+                'to'     => '/admin/users',
+                'icon'   => 'mdi:account-group-outline',
+                'module' => 'core',
+            ],
             [
                 'label'  => 'sidebar.general.logout',
                 'to'     => '/logout',
diff --git a/frontend/i18n/locales/fr.json b/frontend/i18n/locales/fr.json
index eaf2273..8d4c92e 100644
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -24,7 +24,8 @@
             "suppliers": "Répertoire fournisseurs"
         },
         "core": {
-            "roles": "Gestion des roles"
+            "roles": "Gestion des roles",
+            "users": "Utilisateurs"
         }
     },
     "dashboard": {
@@ -94,6 +95,32 @@
                 "selectAll": "Tout selectionner",
                 "noPermissions": "Aucune permission disponible"
             }
+        },
+        "users": {
+            "title": "Gestion des utilisateurs",
+            "noUsers": "Aucun utilisateur",
+            "table": {
+                "username": "Nom d'utilisateur",
+                "admin": "Administrateur",
+                "roles": "Roles",
+                "directPermissions": "Permissions directes",
+                "actions": "Actions"
+            },
+            "drawer": {
+                "title": "Permissions de {username}",
+                "selfWarning": "Vous modifiez vos propres droits",
+                "adminToggle": "Administrateur (bypass total)",
+                "rolesSection": "Roles",
+                "directPermissionsSection": "Permissions directes",
+                "summarySection": "Resume des permissions effectives",
+                "noEffectivePermissions": "Aucune permission effective",
+                "sourceRole": "via {role}",
+                "sourceDirect": "Direct",
+                "lastAdminWarning": "Impossible de retirer le statut administrateur du dernier admin"
+            },
+            "toast": {
+                "updated": "Permissions mises a jour avec succes"
+            }
         }
     }
 }
-- 
2.39.5


From d0ee109afbd2887bf67cab7b9b7e36e03d865e13 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 09:59:26 +0200
Subject: [PATCH 2/8] feat(frontend) : ERP-27 - EffectivePermissions component

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../core/components/EffectivePermissions.vue  | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 frontend/modules/core/components/EffectivePermissions.vue

diff --git a/frontend/modules/core/components/EffectivePermissions.vue b/frontend/modules/core/components/EffectivePermissions.vue
new file mode 100644
index 0000000..98646ec
--- /dev/null
+++ b/frontend/modules/core/components/EffectivePermissions.vue
@@ -0,0 +1,73 @@
+<template>
+    <div>
+        <div v-if="permissions.length === 0" class="text-sm text-neutral-400">
+            {{ t('admin.users.drawer.noEffectivePermissions') }}
+        </div>
+        <div v-else class="divide-y divide-neutral-100 rounded-lg border border-neutral-200">
+            <div
+                v-for="perm in groupedPermissions"
+                :key="perm.module"
+                class="px-4 py-2"
+            >
+                <!-- En-tête du module -->
+                <p class="text-xs font-semibold uppercase text-neutral-400 mb-1">
+                    {{ perm.module }}
+                </p>
+                <div
+                    v-for="item in perm.items"
+                    :key="item.code"
+                    class="flex items-center justify-between py-1"
+                >
+                    <span class="text-sm text-neutral-700">{{ item.label }}</span>
+                    <div class="flex gap-1">
+                        <span
+                            v-for="source in item.sources"
+                            :key="source"
+                            :class="[
+                                'inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium',
+                                source === t('admin.users.drawer.sourceDirect')
+                                    ? 'bg-green-100 text-green-800'
+                                    : 'bg-blue-100 text-blue-800'
+                            ]"
+                        >
+                            {{ source }}
+                        </span>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+const { t } = useI18n()
+
+interface EffectivePermission {
+    code: string
+    label: string
+    module: string
+    sources: string[]
+}
+
+const props = defineProps<{
+    permissions: EffectivePermission[]
+}>()
+
+// Grouper par module pour l'affichage
+interface PermissionModuleGroup {
+    module: string
+    items: EffectivePermission[]
+}
+
+const groupedPermissions = computed<PermissionModuleGroup[]>(() => {
+    const groups = new Map<string, EffectivePermission[]>()
+    for (const perm of props.permissions) {
+        const list = groups.get(perm.module) || []
+        list.push(perm)
+        groups.set(perm.module, list)
+    }
+    return Array.from(groups.entries())
+        .map(([module, items]) => ({ module, items }))
+        .sort((a, b) => a.module.localeCompare(b.module))
+})
+</script>
-- 
2.39.5


From c36b8b6c095f27044a94c7807d87f36a99a467ea Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 10:01:46 +0200
Subject: [PATCH 3/8] feat(frontend) : ERP-27 - UserRbacDrawer component

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../core/components/UserRbacDrawer.vue        | 285 ++++++++++++++++++
 1 file changed, 285 insertions(+)
 create mode 100644 frontend/modules/core/components/UserRbacDrawer.vue

diff --git a/frontend/modules/core/components/UserRbacDrawer.vue b/frontend/modules/core/components/UserRbacDrawer.vue
new file mode 100644
index 0000000..a215f6a
--- /dev/null
+++ b/frontend/modules/core/components/UserRbacDrawer.vue
@@ -0,0 +1,285 @@
+<template>
+    <MalioDrawer
+        :model-value="modelValue"
+        :title="t('admin.users.drawer.title', { username: user?.username ?? '' })"
+        drawer-class="w-full max-w-lg"
+        @update:model-value="emit('update:modelValue', $event)"
+    >
+        <div class="flex flex-col gap-6 p-4">
+            <!-- Avertissement auto-edition -->
+            <div
+                v-if="isSelfEdit"
+                class="flex items-center gap-2 rounded-lg border border-yellow-300 bg-yellow-50 px-4 py-3 text-sm text-yellow-800"
+            >
+                <Icon name="mdi:alert-outline" class="size-5 shrink-0" />
+                {{ t('admin.users.drawer.selfWarning') }}
+            </div>
+
+            <!-- Toggle Administrateur -->
+            <MalioCheckbox
+                id="admin-toggle"
+                :label="t('admin.users.drawer.adminToggle')"
+                :model-value="form.isAdmin"
+                label-class="font-semibold text-sm text-neutral-700"
+                @update:model-value="form.isAdmin = $event"
+            />
+
+            <!-- Section Roles -->
+            <div>
+                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
+                    {{ t('admin.users.drawer.rolesSection') }}
+                </h4>
+                <div class="flex flex-col gap-2">
+                    <MalioCheckbox
+                        v-for="role in allRoles"
+                        :key="role.id"
+                        :id="`role-${role.id}`"
+                        :label="role.label"
+                        :model-value="selectedRoleIds.has(role.id)"
+                        label-class="text-sm text-neutral-600"
+                        @update:model-value="(val: boolean) => toggleRole(role.id, val)"
+                    />
+                </div>
+            </div>
+
+            <!-- Section Permissions directes -->
+            <div>
+                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
+                    {{ t('admin.users.drawer.directPermissionsSection') }}
+                </h4>
+                <div v-if="permissionsByModule.length === 0" class="text-sm text-neutral-400">
+                    {{ t('admin.roles.permissions.noPermissions') }}
+                </div>
+                <div class="flex flex-col gap-4">
+                    <PermissionGroup
+                        v-for="group in permissionsByModule"
+                        :key="group.module"
+                        :module="group.module"
+                        :module-label="group.module"
+                        :permissions="group.permissions"
+                        :selected-ids="selectedDirectPermissionIds"
+                        @toggle="handleTogglePermission"
+                        @toggle-all="handleToggleAll"
+                    />
+                </div>
+            </div>
+
+            <!-- Section Resume permissions effectives -->
+            <div>
+                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
+                    {{ t('admin.users.drawer.summarySection') }}
+                </h4>
+                <EffectivePermissions :permissions="effectivePermissions" />
+            </div>
+
+            <!-- Boutons -->
+            <div class="flex justify-end gap-3 border-t border-neutral-200 pt-4">
+                <MalioButton
+                    :label="t('common.cancel')"
+                    variant="secondary"
+                    @click="emit('update:modelValue', false)"
+                />
+                <MalioButton
+                    :label="t('common.save')"
+                    variant="primary"
+                    :disabled="saving"
+                    @click="handleSave"
+                />
+            </div>
+        </div>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
+
+interface UserListItem {
+    id: number
+    username: string
+    isAdmin: boolean
+    roles: string[]
+    directPermissions: string[]
+}
+
+interface EffectivePermission {
+    code: string
+    label: string
+    module: string
+    sources: string[]
+}
+
+interface PermissionModule {
+    module: string
+    permissions: Permission[]
+}
+
+const { t } = useI18n()
+const api = useApi()
+const auth = useAuthStore()
+
+const props = defineProps<{
+    modelValue: boolean
+    user: UserListItem | null
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    saved: []
+}>()
+
+const saving = ref(false)
+const allRoles = ref<Role[]>([])
+const allPermissions = ref<Permission[]>([])
+
+const form = ref({ isAdmin: false })
+const selectedRoleIds = ref(new Set<number>())
+const selectedDirectPermissionIds = ref(new Set<number>())
+
+// Detecter l'auto-edition
+const isSelfEdit = computed(() => props.user?.id === auth.user?.id)
+
+// Extraire un ID depuis une IRI API Platform
+function iriToId(iri: string): number {
+    return Number(iri.split('/').pop())
+}
+
+// Grouper les permissions par module (pour les checkboxes)
+const permissionsByModule = computed<PermissionModule[]>(() => {
+    const groups = new Map<string, Permission[]>()
+    for (const perm of allPermissions.value) {
+        if (perm.orphan) continue
+        const list = groups.get(perm.module) || []
+        list.push(perm)
+        groups.set(perm.module, list)
+    }
+    return Array.from(groups.entries())
+        .map(([module, permissions]) => ({ module, permissions }))
+        .sort((a, b) => a.module.localeCompare(b.module))
+})
+
+// Calculer les permissions effectives avec leurs sources
+const effectivePermissions = computed<EffectivePermission[]>(() => {
+    const permMap = new Map<number, Permission>()
+    for (const p of allPermissions.value) {
+        if (!p.orphan) permMap.set(p.id, p)
+    }
+
+    // Construire la map permissionId -> sources[]
+    const result = new Map<number, string[]>()
+
+    // Permissions heritees des roles
+    for (const roleId of selectedRoleIds.value) {
+        const role = allRoles.value.find(r => r.id === roleId)
+        if (!role) continue
+        for (const p of role.permissions) {
+            const pid = typeof p === 'string' ? iriToId(p) : p.id
+            const sources = result.get(pid) || []
+            sources.push(t('admin.users.drawer.sourceRole', { role: role.label }))
+            result.set(pid, sources)
+        }
+    }
+
+    // Permissions directes
+    for (const pid of selectedDirectPermissionIds.value) {
+        const sources = result.get(pid) || []
+        sources.push(t('admin.users.drawer.sourceDirect'))
+        result.set(pid, sources)
+    }
+
+    // Construire la liste finale
+    return Array.from(result.entries())
+        .map(([pid, sources]) => {
+            const perm = permMap.get(pid)
+            if (!perm) return null
+            return { code: perm.code, label: perm.label, module: perm.module, sources }
+        })
+        .filter((p): p is EffectivePermission => p !== null)
+        .sort((a, b) => a.code.localeCompare(b.code))
+})
+
+// Charger roles et permissions
+async function loadData() {
+    const [rolesData, permsData] = await Promise.all([
+        api.get<{ member: Role[] }>('/roles', {}, { toast: false }),
+        api.get<{ member: Permission[] }>('/permissions', { orphan: false, itemsPerPage: 200 }, { toast: false }),
+    ])
+    allRoles.value = rolesData.member
+    allPermissions.value = permsData.member
+}
+
+// Remplir le formulaire quand le user change
+watch(() => props.user, (user) => {
+    if (user) {
+        form.value.isAdmin = user.isAdmin
+        selectedRoleIds.value = new Set(user.roles.map(iriToId))
+        selectedDirectPermissionIds.value = new Set(user.directPermissions.map(iriToId))
+    } else {
+        form.value.isAdmin = false
+        selectedRoleIds.value = new Set()
+        selectedDirectPermissionIds.value = new Set()
+    }
+}, { immediate: true })
+
+// Charger les donnees quand le drawer s'ouvre
+watch(() => props.modelValue, (open) => {
+    if (open) loadData()
+})
+
+function toggleRole(id: number, selected: boolean) {
+    const ids = new Set(selectedRoleIds.value)
+    if (selected) ids.add(id)
+    else ids.delete(id)
+    selectedRoleIds.value = ids
+}
+
+function handleTogglePermission(id: number, selected: boolean) {
+    const ids = new Set(selectedDirectPermissionIds.value)
+    if (selected) ids.add(id)
+    else ids.delete(id)
+    selectedDirectPermissionIds.value = ids
+}
+
+function handleToggleAll(module: string, selected: boolean) {
+    const ids = new Set(selectedDirectPermissionIds.value)
+    const group = permissionsByModule.value.find(g => g.module === module)
+    if (!group) return
+    for (const perm of group.permissions) {
+        if (selected) ids.add(perm.id)
+        else ids.delete(perm.id)
+    }
+    selectedDirectPermissionIds.value = ids
+}
+
+async function handleSave() {
+    if (!props.user) return
+    saving.value = true
+    try {
+        await api.patch(`/users/${props.user.id}/rbac`, {
+            isAdmin: form.value.isAdmin,
+            roles: Array.from(selectedRoleIds.value).map(id => `/api/roles/${id}`),
+            directPermissions: Array.from(selectedDirectPermissionIds.value).map(id => `/api/permissions/${id}`),
+        }, {
+            toastSuccessMessage: t('admin.users.toast.updated'),
+        })
+        emit('saved')
+        emit('update:modelValue', false)
+    } finally {
+        saving.value = false
+    }
+}
+</script>
-- 
2.39.5


From 580ea019411142f6114d4ae10975dcfaec11069c Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 10:03:14 +0200
Subject: [PATCH 4/8] feat(frontend) : ERP-27 - admin users page with DataTable
 and RBAC drawer

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend/modules/core/pages/admin/users.vue | 126 ++++++++++++++++++++
 1 file changed, 126 insertions(+)
 create mode 100644 frontend/modules/core/pages/admin/users.vue

diff --git a/frontend/modules/core/pages/admin/users.vue b/frontend/modules/core/pages/admin/users.vue
new file mode 100644
index 0000000..8f496dd
--- /dev/null
+++ b/frontend/modules/core/pages/admin/users.vue
@@ -0,0 +1,126 @@
+<template>
+    <div>
+        <!-- En-tete -->
+        <div class="flex items-center justify-between">
+            <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">
+                {{ t('admin.users.title') }}
+            </h1>
+        </div>
+
+        <!-- Table des utilisateurs -->
+        <MalioDataTable
+            class="mt-6"
+            :columns="columns"
+            :items="userItems"
+            :total-items="users.length"
+            :row-clickable="canManage"
+            :empty-message="t('admin.users.noUsers')"
+            @row-click="onRowClick"
+        >
+            <template #cell-admin="{ item }">
+                <span
+                    v-if="item.admin"
+                    class="inline-flex items-center rounded-full bg-purple-100 px-2.5 py-0.5 text-xs font-medium text-purple-800"
+                >
+                    {{ t('admin.users.table.admin') }}
+                </span>
+            </template>
+            <template #cell-actions="{ item }">
+                <div class="flex items-center justify-end gap-2" @click.stop>
+                    <MalioButtonIcon
+                        v-if="canManage"
+                        icon="mdi:shield-edit-outline"
+                        :aria-label="t('common.edit')"
+                        variant="ghost"
+                        @click="openDrawer(getUserById(item.id as number)!)"
+                    />
+                </div>
+            </template>
+        </MalioDataTable>
+
+        <!-- Drawer RBAC -->
+        <UserRbacDrawer
+            v-model="drawerOpen"
+            :user="selectedUser"
+            @saved="onUserSaved"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+interface UserListItem {
+    id: number
+    username: string
+    isAdmin: boolean
+    roles: string[]
+    directPermissions: string[]
+}
+
+const { t } = useI18n()
+const api = useApi()
+const { can } = usePermissions()
+
+useHead({ title: t('admin.users.title') })
+
+const canManage = can('core.users.manage')
+
+const users = ref<UserListItem[]>([])
+const loading = ref(false)
+const drawerOpen = ref(false)
+const selectedUser = ref<UserListItem | null>(null)
+
+const columns = [
+    { key: 'username', label: t('admin.users.table.username') },
+    { key: 'admin', label: t('admin.users.table.admin') },
+    { key: 'roles', label: t('admin.users.table.roles') },
+    { key: 'directPermissions', label: t('admin.users.table.directPermissions') },
+    { key: 'actions', label: t('admin.users.table.actions') },
+]
+
+const userItems = computed(() =>
+    users.value.map(user => ({
+        id: user.id,
+        username: user.username,
+        admin: user.isAdmin,
+        roles: user.roles.length,
+        directPermissions: user.directPermissions.length,
+        actions: '',
+    }))
+)
+
+async function loadUsers() {
+    loading.value = true
+    try {
+        const data = await api.get<{ member: UserListItem[] }>(
+            '/users',
+            {},
+            { toast: false },
+        )
+        users.value = data.member
+    } finally {
+        loading.value = false
+    }
+}
+
+function getUserById(id: number): UserListItem | undefined {
+    return users.value.find(u => u.id === id)
+}
+
+function openDrawer(user: UserListItem) {
+    selectedUser.value = user
+    drawerOpen.value = true
+}
+
+function onRowClick(item: Record<string, unknown>) {
+    const user = getUserById(item.id as number)
+    if (user) openDrawer(user)
+}
+
+function onUserSaved() {
+    loadUsers()
+}
+
+onMounted(() => {
+    loadUsers()
+})
+</script>
-- 
2.39.5


From d49c317c49c4c20a945fdbe0084eb043ca06d8d1 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 10:45:21 +0200
Subject: [PATCH 5/8] fix(frontend) : ERP-26/27 - review fixes: shared types,
 accents i18n, escape key, self-edit refresh, row-clickable guard

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend/i18n/locales/fr.json                 | 36 +++++++++----------
 .../core/components/EffectivePermissions.vue  |  9 ++---
 .../core/components/PermissionGroup.vue       |  8 +----
 .../core/components/RoleDeleteModal.vue       |  8 +++++
 .../modules/core/components/RoleDrawer.vue    | 17 +--------
 .../core/components/UserRbacDrawer.vue        | 36 +++----------------
 frontend/modules/core/pages/admin/roles.vue   | 20 ++---------
 frontend/modules/core/pages/admin/users.vue   |  8 +----
 frontend/shared/types/rbac.ts                 | 31 ++++++++++++++++
 9 files changed, 70 insertions(+), 103 deletions(-)
 create mode 100644 frontend/shared/types/rbac.ts

diff --git a/frontend/i18n/locales/fr.json b/frontend/i18n/locales/fr.json
index 8d4c92e..998f3dc 100644
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -24,7 +24,7 @@
             "suppliers": "Répertoire fournisseurs"
         },
         "core": {
-            "roles": "Gestion des roles",
+            "roles": "Gestion des rôles",
             "users": "Utilisateurs"
         }
     },
@@ -63,33 +63,33 @@
     },
     "admin": {
         "roles": {
-            "title": "Gestion des roles",
-            "newRole": "Nouveau role",
-            "editRole": "Modifier le role",
-            "createRole": "Creer un role",
-            "noRoles": "Aucun role configure",
+            "title": "Gestion des rôles",
+            "newRole": "Nouveau rôle",
+            "editRole": "Modifier le rôle",
+            "createRole": "Créer un rôle",
+            "noRoles": "Aucun rôle configuré",
             "table": {
-                "label": "Libelle",
+                "label": "Libellé",
                 "code": "Code",
                 "permissions": "Permissions",
-                "system": "Systeme",
+                "system": "Système",
                 "actions": "Actions"
             },
             "form": {
-                "label": "Libelle",
+                "label": "Libellé",
                 "code": "Code",
                 "description": "Description",
                 "permissions": "Permissions"
             },
             "delete": {
-                "title": "Supprimer le role",
-                "message": "Etes-vous sur de vouloir supprimer le role \"{label}\" ? Cette action est irreversible.",
-                "systemTooltip": "Role systeme non supprimable"
+                "title": "Supprimer le rôle",
+                "message": "Êtes-vous sûr de vouloir supprimer le rôle \"{label}\" ? Cette action est irréversible.",
+                "systemTooltip": "Rôle système non supprimable"
             },
             "toast": {
-                "created": "Role cree avec succes",
-                "updated": "Role mis a jour avec succes",
-                "deleted": "Role supprime avec succes"
+                "created": "Rôle créé avec succès",
+                "updated": "Rôle mis à jour avec succès",
+                "deleted": "Rôle supprimé avec succès"
             },
             "permissions": {
                 "selectAll": "Tout selectionner",
@@ -110,16 +110,16 @@
                 "title": "Permissions de {username}",
                 "selfWarning": "Vous modifiez vos propres droits",
                 "adminToggle": "Administrateur (bypass total)",
-                "rolesSection": "Roles",
+                "rolesSection": "Rôles",
                 "directPermissionsSection": "Permissions directes",
-                "summarySection": "Resume des permissions effectives",
+                "summarySection": "Résumé des permissions effectives",
                 "noEffectivePermissions": "Aucune permission effective",
                 "sourceRole": "via {role}",
                 "sourceDirect": "Direct",
                 "lastAdminWarning": "Impossible de retirer le statut administrateur du dernier admin"
             },
             "toast": {
-                "updated": "Permissions mises a jour avec succes"
+                "updated": "Permissions mises à jour avec succès"
             }
         }
     }
diff --git a/frontend/modules/core/components/EffectivePermissions.vue b/frontend/modules/core/components/EffectivePermissions.vue
index 98646ec..1e6bcab 100644
--- a/frontend/modules/core/components/EffectivePermissions.vue
+++ b/frontend/modules/core/components/EffectivePermissions.vue
@@ -40,14 +40,9 @@
 </template>
 
 <script setup lang="ts">
-const { t } = useI18n()
+import type { EffectivePermission } from '~/shared/types/rbac'
 
-interface EffectivePermission {
-    code: string
-    label: string
-    module: string
-    sources: string[]
-}
+const { t } = useI18n()
 
 const props = defineProps<{
     permissions: EffectivePermission[]
diff --git a/frontend/modules/core/components/PermissionGroup.vue b/frontend/modules/core/components/PermissionGroup.vue
index 1288a22..8eb589f 100644
--- a/frontend/modules/core/components/PermissionGroup.vue
+++ b/frontend/modules/core/components/PermissionGroup.vue
@@ -30,13 +30,7 @@
 </template>
 
 <script setup lang="ts">
-interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
+import type { Permission } from '~/shared/types/rbac'
 
 const props = defineProps<{
     module: string
diff --git a/frontend/modules/core/components/RoleDeleteModal.vue b/frontend/modules/core/components/RoleDeleteModal.vue
index 5f611bd..f9be735 100644
--- a/frontend/modules/core/components/RoleDeleteModal.vue
+++ b/frontend/modules/core/components/RoleDeleteModal.vue
@@ -55,6 +55,14 @@ function cancel() {
 function confirm() {
     emit('confirm')
 }
+
+// Fermer la modale avec la touche Escape
+function onKeydown(e: KeyboardEvent) {
+    if (e.key === 'Escape') cancel()
+}
+
+onMounted(() => document.addEventListener('keydown', onKeydown))
+onUnmounted(() => document.removeEventListener('keydown', onKeydown))
 </script>
 
 <style scoped>
diff --git a/frontend/modules/core/components/RoleDrawer.vue b/frontend/modules/core/components/RoleDrawer.vue
index a774fbf..7933ef8 100644
--- a/frontend/modules/core/components/RoleDrawer.vue
+++ b/frontend/modules/core/components/RoleDrawer.vue
@@ -70,22 +70,7 @@
 </template>
 
 <script setup lang="ts">
-interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
-
-interface Role {
-    id: number
-    code: string
-    label: string
-    description: string | null
-    isSystem: boolean
-    permissions: (Permission | string)[]
-}
+import type { Permission, Role } from '~/shared/types/rbac'
 
 interface PermissionModule {
     module: string
diff --git a/frontend/modules/core/components/UserRbacDrawer.vue b/frontend/modules/core/components/UserRbacDrawer.vue
index a215f6a..2ec4ce1 100644
--- a/frontend/modules/core/components/UserRbacDrawer.vue
+++ b/frontend/modules/core/components/UserRbacDrawer.vue
@@ -91,37 +91,7 @@
 </template>
 
 <script setup lang="ts">
-interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
-
-interface Role {
-    id: number
-    code: string
-    label: string
-    description: string | null
-    isSystem: boolean
-    permissions: (Permission | string)[]
-}
-
-interface UserListItem {
-    id: number
-    username: string
-    isAdmin: boolean
-    roles: string[]
-    directPermissions: string[]
-}
-
-interface EffectivePermission {
-    code: string
-    label: string
-    module: string
-    sources: string[]
-}
+import type { Permission, Role, UserListItem, EffectivePermission } from '~/shared/types/rbac'
 
 interface PermissionModule {
     module: string
@@ -276,6 +246,10 @@ async function handleSave() {
         }, {
             toastSuccessMessage: t('admin.users.toast.updated'),
         })
+        // Rafraichir les donnees du user courant si auto-edition
+        if (isSelfEdit.value) {
+            await auth.refreshUser()
+        }
         emit('saved')
         emit('update:modelValue', false)
     } finally {
diff --git a/frontend/modules/core/pages/admin/roles.vue b/frontend/modules/core/pages/admin/roles.vue
index ec81460..a1d3699 100644
--- a/frontend/modules/core/pages/admin/roles.vue
+++ b/frontend/modules/core/pages/admin/roles.vue
@@ -19,7 +19,7 @@
             :columns="columns"
             :items="roleItems"
             :total-items="roles.length"
-            :row-clickable="true"
+            :row-clickable="canManage"
             :empty-message="t('admin.roles.noRoles')"
             @row-click="onRowClick"
         >
@@ -76,26 +76,12 @@
 </template>
 
 <script setup lang="ts">
-interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
-
-interface Role {
-    id: number
-    code: string
-    label: string
-    description: string | null
-    isSystem: boolean
-    permissions: (Permission | string)[]
-}
+import type { Role } from '~/shared/types/rbac'
 
 const { t } = useI18n()
 const api = useApi()
 const { can } = usePermissions()
+const canManage = can('core.roles.manage')
 
 useHead({ title: t('admin.roles.title') })
 
diff --git a/frontend/modules/core/pages/admin/users.vue b/frontend/modules/core/pages/admin/users.vue
index 8f496dd..e0905cd 100644
--- a/frontend/modules/core/pages/admin/users.vue
+++ b/frontend/modules/core/pages/admin/users.vue
@@ -48,13 +48,7 @@
 </template>
 
 <script setup lang="ts">
-interface UserListItem {
-    id: number
-    username: string
-    isAdmin: boolean
-    roles: string[]
-    directPermissions: string[]
-}
+import type { UserListItem } from '~/shared/types/rbac'
 
 const { t } = useI18n()
 const api = useApi()
diff --git a/frontend/shared/types/rbac.ts b/frontend/shared/types/rbac.ts
new file mode 100644
index 0000000..d80a4d1
--- /dev/null
+++ b/frontend/shared/types/rbac.ts
@@ -0,0 +1,31 @@
+export interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+export interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
+
+export interface UserListItem {
+    id: number
+    username: string
+    isAdmin: boolean
+    roles: string[]
+    directPermissions: string[]
+}
+
+export interface EffectivePermission {
+    code: string
+    label: string
+    module: string
+    sources: string[]
+}
-- 
2.39.5


From 793c58a4a8c963af3516f4d44c9a466c9cbd9dbb Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 11:17:13 +0200
Subject: [PATCH 6/8] fix(core) : RBAC review fixes - code readonly in edit,
 TOCTOU doc, canManage reactive, itemsPerPage 999

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../modules/core/components/RoleDrawer.vue    | 26 +++++++++++--------
 .../core/components/UserRbacDrawer.vue        |  2 +-
 frontend/modules/core/pages/admin/roles.vue   |  2 +-
 frontend/modules/core/pages/admin/users.vue   |  2 +-
 .../Domain/Security/AdminHeadcountGuard.php   |  7 +++++
 5 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/frontend/modules/core/components/RoleDrawer.vue b/frontend/modules/core/components/RoleDrawer.vue
index 7933ef8..6b054f6 100644
--- a/frontend/modules/core/components/RoleDrawer.vue
+++ b/frontend/modules/core/components/RoleDrawer.vue
@@ -19,8 +19,7 @@
                 :label="t('admin.roles.form.code')"
                 input-class="w-full"
                 required
-                :readonly="isEditMode && role?.isSystem"
-                :hint="isEditMode && role?.isSystem ? t('admin.roles.delete.systemTooltip') : ''"
+                :readonly="isEditMode"
             />
 
             <MalioInputTextArea
@@ -121,7 +120,7 @@ const permissionsByModule = computed<PermissionModule[]>(() => {
 async function loadPermissions() {
     const data = await api.get<{ member: Permission[] }>(
         '/permissions',
-        { 'orphan': false, itemsPerPage: 200 },
+        { 'orphan': false, itemsPerPage: 999 },
         { toast: false },
     )
     allPermissions.value = data.member
@@ -183,19 +182,24 @@ function handleToggleAll(module: string, selected: boolean) {
 async function handleSave() {
     saving.value = true
     try {
-        const body = {
-            label: form.value.label,
-            code: form.value.code,
-            description: form.value.description || null,
-            permissions: Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`),
-        }
+        const permissions = Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`)
 
         if (isEditMode.value && props.role) {
-            await api.patch(`/roles/${props.role.id}`, body, {
+            // Le code est immuable apres creation (garde backend RoleProcessor)
+            await api.patch(`/roles/${props.role.id}`, {
+                label: form.value.label,
+                description: form.value.description || null,
+                permissions,
+            }, {
                 toastSuccessMessage: t('admin.roles.toast.updated'),
             })
         } else {
-            await api.post('/roles', body, {
+            await api.post('/roles', {
+                label: form.value.label,
+                code: form.value.code,
+                description: form.value.description || null,
+                permissions,
+            }, {
                 toastSuccessMessage: t('admin.roles.toast.created'),
             })
         }
diff --git a/frontend/modules/core/components/UserRbacDrawer.vue b/frontend/modules/core/components/UserRbacDrawer.vue
index 2ec4ce1..15d3b4c 100644
--- a/frontend/modules/core/components/UserRbacDrawer.vue
+++ b/frontend/modules/core/components/UserRbacDrawer.vue
@@ -186,7 +186,7 @@ const effectivePermissions = computed<EffectivePermission[]>(() => {
 async function loadData() {
     const [rolesData, permsData] = await Promise.all([
         api.get<{ member: Role[] }>('/roles', {}, { toast: false }),
-        api.get<{ member: Permission[] }>('/permissions', { orphan: false, itemsPerPage: 200 }, { toast: false }),
+        api.get<{ member: Permission[] }>('/permissions', { orphan: false, itemsPerPage: 999 }, { toast: false }),
     ])
     allRoles.value = rolesData.member
     allPermissions.value = permsData.member
diff --git a/frontend/modules/core/pages/admin/roles.vue b/frontend/modules/core/pages/admin/roles.vue
index a1d3699..505e0da 100644
--- a/frontend/modules/core/pages/admin/roles.vue
+++ b/frontend/modules/core/pages/admin/roles.vue
@@ -81,7 +81,7 @@ import type { Role } from '~/shared/types/rbac'
 const { t } = useI18n()
 const api = useApi()
 const { can } = usePermissions()
-const canManage = can('core.roles.manage')
+const canManage = computed(() => can('core.roles.manage'))
 
 useHead({ title: t('admin.roles.title') })
 
diff --git a/frontend/modules/core/pages/admin/users.vue b/frontend/modules/core/pages/admin/users.vue
index e0905cd..990aaa2 100644
--- a/frontend/modules/core/pages/admin/users.vue
+++ b/frontend/modules/core/pages/admin/users.vue
@@ -56,7 +56,7 @@ const { can } = usePermissions()
 
 useHead({ title: t('admin.users.title') })
 
-const canManage = can('core.users.manage')
+const canManage = computed(() => can('core.users.manage'))
 
 const users = ref<UserListItem[]>([])
 const loading = ref(false)
diff --git a/src/Module/Core/Domain/Security/AdminHeadcountGuard.php b/src/Module/Core/Domain/Security/AdminHeadcountGuard.php
index 8978398..cd244a7 100644
--- a/src/Module/Core/Domain/Security/AdminHeadcountGuard.php
+++ b/src/Module/Core/Domain/Security/AdminHeadcountGuard.php
@@ -53,6 +53,13 @@ final class AdminHeadcountGuard implements AdminHeadcountGuardInterface
      * La verification est volontairement conservative (<=1) pour couvrir
      * le cas defensif ou la base serait deja dans un etat incoherent (0 admin).
      *
+     * TOCTOU accepte : la verification n'utilise pas de verrou pessimiste
+     * (SELECT ... FOR UPDATE). Deux demotions concurrentes pourraient donc
+     * passer le garde simultanement. Ce risque est accepte dans le contexte
+     * PME/CRM ou les operations d'administration sont rares et mono-operateur.
+     * Si la concurrence admin devient un enjeu, ajouter un verrou pessimiste
+     * sur countAdmins() ou une contrainte CHECK en base.
+     *
      * @throws LastAdminProtectionException si le nombre d'admins est inferieur ou egal a 1
      */
     private function checkAdminHeadcount(): void
-- 
2.39.5


From 6395f4ccedb839497d59e45b6312c7f65044e2ff Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 15:08:58 +0200
Subject: [PATCH 7/8] feat(core) : RBAC - filtrage sidebar par permission

Les items sidebar peuvent declarer une cle `permission` optionnelle.
Le SidebarProvider verifie isGranted() et masque les items dont
l'utilisateur ne possede pas la permission requise.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 config/sidebar.php                            | 20 +++++++++++--------
 .../ApiPlatform/State/SidebarProvider.php     | 17 ++++++++++++++--
 2 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/config/sidebar.php b/config/sidebar.php
index edad75c..0b11e48 100644
--- a/config/sidebar.php
+++ b/config/sidebar.php
@@ -8,6 +8,8 @@ declare(strict_types=1);
  * This file defines the sidebar sections displayed in the frontend.
  * Each item references the module that owns it via the `module` key.
  * Items whose module is not active (see config/modules.php) are filtered out.
+ * Items may also declare a `permission` key (RBAC permission code) : the item
+ * is hidden from users who do not hold that permission.
  *
  * This config is decoupled from the modules themselves: you can freely
  * move an item from one section to another without touching the module code.
@@ -33,16 +35,18 @@ return [
                 'module' => 'core',
             ],
             [
-                'label'  => 'sidebar.core.roles',
-                'to'     => '/admin/roles',
-                'icon'   => 'mdi:shield-account-outline',
-                'module' => 'core',
+                'label'      => 'sidebar.core.roles',
+                'to'         => '/admin/roles',
+                'icon'       => 'mdi:shield-account-outline',
+                'module'     => 'core',
+                'permission' => 'core.roles.view',
             ],
             [
-                'label'  => 'sidebar.core.users',
-                'to'     => '/admin/users',
-                'icon'   => 'mdi:account-group-outline',
-                'module' => 'core',
+                'label'      => 'sidebar.core.users',
+                'to'         => '/admin/users',
+                'icon'       => 'mdi:account-group-outline',
+                'module'     => 'core',
+                'permission' => 'core.users.view',
             ],
             [
                 'label'  => 'sidebar.general.logout',
diff --git a/src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php b/src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php
index 87fa16e..8600ae9 100644
--- a/src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php
+++ b/src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php
@@ -7,6 +7,7 @@ namespace App\Shared\Infrastructure\ApiPlatform\State;
 use ApiPlatform\Metadata\Operation;
 use ApiPlatform\State\ProviderInterface;
 use App\Shared\Infrastructure\ApiPlatform\Resource\SidebarResource;
+use Symfony\Bundle\SecurityBundle\Security;
 
 /**
  * @implements ProviderInterface<object>
@@ -16,10 +17,10 @@ class SidebarProvider implements ProviderInterface
     /** @var list<string> */
     private readonly array $activeModuleIds;
 
-    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string}>}> */
+    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string, permission?: string}>}> */
     private readonly array $sidebarConfig;
 
-    public function __construct()
+    public function __construct(private readonly Security $security)
     {
         $configDir = dirname(__DIR__, 5).'/config';
 
@@ -58,6 +59,18 @@ class SidebarProvider implements ProviderInterface
                     continue;
                 }
 
+                // Filtrage par permission RBAC : si l'item declare une permission
+                // requise et que l'utilisateur courant ne la possede pas, l'item
+                // est masque et sa route ajoutee aux routes desactivees.
+                $requiredPermission = $item['permission'] ?? null;
+                if (null !== $requiredPermission && !$this->security->isGranted($requiredPermission)) {
+                    if (isset($item['to'])) {
+                        $disabledRoutes[] = $item['to'];
+                    }
+
+                    continue;
+                }
+
                 $items[] = [
                     'label' => $item['label'],
                     'to'    => $item['to'],
-- 
2.39.5


From 60e424393c33214f840a20a387a3547b83e7d2fc Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 16 Apr 2026 16:27:32 +0200
Subject: [PATCH 8/8] refactor(core) : RBAC - rendre le catalogue permissions
 accessible a tout user authentifie

La permission core.permissions.view est supprimee du CoreModule.
Le endpoint GET /api/permissions est desormais protege par ROLE_USER
au lieu d'une permission RBAC specifique, car c'est un catalogue
de metadonnees necessaire aux drawers de gestion des roles et users.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/Module/Core/CoreModule.php               |  1 -
 src/Module/Core/Domain/Entity/Permission.php |  4 +-
 tests/Module/Core/Api/PermissionApiTest.php  | 43 ++------------------
 3 files changed, 6 insertions(+), 42 deletions(-)

diff --git a/src/Module/Core/CoreModule.php b/src/Module/Core/CoreModule.php
index e8a4e30..5b9b3d8 100644
--- a/src/Module/Core/CoreModule.php
+++ b/src/Module/Core/CoreModule.php
@@ -34,7 +34,6 @@ final class CoreModule
             ['code' => 'core.users.manage', 'label' => 'Gerer les utilisateurs (creer, editer, supprimer)'],
             ['code' => 'core.roles.view', 'label' => 'Voir les roles RBAC'],
             ['code' => 'core.roles.manage', 'label' => 'Gerer les roles et permissions'],
-            ['code' => 'core.permissions.view', 'label' => 'Voir le catalogue des permissions'],
         ];
     }
 }
diff --git a/src/Module/Core/Domain/Entity/Permission.php b/src/Module/Core/Domain/Entity/Permission.php
index 7ef7278..e780ff3 100644
--- a/src/Module/Core/Domain/Entity/Permission.php
+++ b/src/Module/Core/Domain/Entity/Permission.php
@@ -19,11 +19,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
     operations: [
         new GetCollection(
             normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('core.permissions.view')",
+            security: "is_granted('ROLE_USER')",
         ),
         new Get(
             normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('core.permissions.view')",
+            security: "is_granted('ROLE_USER')",
         ),
     ],
 )]
diff --git a/tests/Module/Core/Api/PermissionApiTest.php b/tests/Module/Core/Api/PermissionApiTest.php
index d9c6609..dc06f3d 100644
--- a/tests/Module/Core/Api/PermissionApiTest.php
+++ b/tests/Module/Core/Api/PermissionApiTest.php
@@ -166,51 +166,16 @@ final class PermissionApiTest extends AbstractApiTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testNonAdminReturns403(): void
+    public function testStandardUserCanListPermissions(): void
     {
+        // Le catalogue de permissions est accessible a tout utilisateur authentifie.
         $client = $this->authenticatedClient('alice', 'alice');
         $client->request('GET', '/api/permissions');
 
-        self::assertResponseStatusCodeSame(403);
-    }
-
-    // --- Tests voter RBAC : non-admin avec / sans permission ---
-
-    public function testListPermissionsAsUserWithViewPermissionReturns200(): void
-    {
-        // Un non-admin portant core.permissions.view doit pouvoir lister.
-        $credentials = $this->createUserWithPermission('core.permissions.view');
-        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
-        $client->request('GET', '/api/permissions');
-
         self::assertResponseIsSuccessful();
     }
 
-    public function testListPermissionsAsStandardUserReturns403(): void
-    {
-        // alice n'a aucune permission RBAC : acces refuse.
-        $client = $this->authenticatedClient('alice', 'alice');
-        $client->request('GET', '/api/permissions');
-
-        self::assertResponseStatusCodeSame(403);
-    }
-
-    public function testGetPermissionAsUserWithViewPermissionReturns200(): void
-    {
-        // Recupere l'id d'une permission existante pour construire l'URL GET item.
-        $permission = $this->getEm()->getRepository(Permission::class)
-            ->findOneBy(['code' => 'test.core.users.view'])
-        ;
-        self::assertNotNull($permission);
-
-        $credentials = $this->createUserWithPermission('core.permissions.view');
-        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
-        $client->request('GET', '/api/permissions/'.$permission->getId());
-
-        self::assertResponseIsSuccessful();
-    }
-
-    public function testGetPermissionAsStandardUserReturns403(): void
+    public function testStandardUserCanGetPermission(): void
     {
         $permission = $this->getEm()->getRepository(Permission::class)
             ->findOneBy(['code' => 'test.core.users.view'])
@@ -220,7 +185,7 @@ final class PermissionApiTest extends AbstractApiTestCase
         $client = $this->authenticatedClient('alice', 'alice');
         $client->request('GET', '/api/permissions/'.$permission->getId());
 
-        self::assertResponseStatusCodeSame(403);
+        self::assertResponseIsSuccessful();
     }
 
     private function cleanupTestPermissions(): void
-- 
2.39.5