ci : fix release artefact

ci : auto tag + release artefact
2026-01-21 20:43:35 +01:00 · 2026-01-21 20:01:22 +01:00 · 2026-01-21 19:57:09 +01:00 · 2026-01-21 19:56:06 +01:00 · 2026-01-21 19:14:54 +01:00 · 2026-01-21 17:56:53 +01:00
48 changed files with 1438 additions and 204 deletions
--- a/.env
+++ b/.env
@@ -1,41 +1,22 @@
-# In all environments, the following files are loaded if they exist,
-# the latter taking precedence over the former:
-#
-#  * .env                contains default values for the environment variables needed by the app
-#  * .env.local          uncommitted file with local overrides
-#  * .env.$APP_ENV       committed environment-specific defaults
-#  * .env.$APP_ENV.local uncommitted environment-specific overrides
-#
-# Real environment variables win over .env files.
-#
-# DO NOT DEFINE PRODUCTION SECRETS IN THIS FILE NOR IN ANY OTHER COMMITTED FILES.
-# https://symfony.com/doc/current/configuration/secrets.html
-#
-# Run "composer dump-env prod" to compile .env files for production use (requires symfony/flex >=1.2).
-# https://symfony.com/doc/current/best_practices.html#use-environment-variables-for-infrastructure-configuration
-
-###> symfony/framework-bundle ###
-APP_ENV=dev
+APP_ENV=
+APP_DEBUG=
 APP_SECRET=
-APP_SHARE_DIR=var/share
-###< symfony/framework-bundle ###

-###> symfony/routing ###
-# Configure how to generate URLs in non-HTTP contexts, such as CLI commands.
-# See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
-DEFAULT_URI=http://localhost
-###< symfony/routing ###
-
-###> doctrine/doctrine-bundle ###
-# Format described at https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
-# IMPORTANT: You MUST configure your server version, either here or in config/packages/doctrine.yaml
-#
-# DATABASE_URL="sqlite:///%kernel.project_dir%/var/data_%kernel.environment%.db"
-# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=8.0.32&charset=utf8mb4"
-# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=10.11.2-MariaDB&charset=utf8mb4"
-#DATABASE_URL="postgresql://app:!ChangeMe!@127.0.0.1:5432/app?serverVersion=16&charset=utf8"
-###< doctrine/doctrine-bundle ###
+DEFAULT_URI=

 ###> nelmio/cors-bundle ###
-CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
+CORS_ALLOW_ORIGIN=
 ###< nelmio/cors-bundle ###
+
+###> lexik/jwt-authentication-bundle ###
+JWT_SECRET_KEY=
+JWT_PUBLIC_KEY=
+JWT_PASSPHRASE=
+COOKIE_SECURE=
+###< lexik/jwt-authentication-bundle ###
+
+# ADAPTER avec la vraie BDD (pas de variables docker)
+DATABASE_URL=
+
+PONT_BASCULE_BYPASS=
+PONT_BASCULE_URL=
--- a/.gitea/workflows/auto-tag-develop.yml
+++ b/.gitea/workflows/auto-tag-develop.yml
@@ -0,0 +1,45 @@
+name: Auto Tag Develop
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_TOKEN }}
+          persist-credentials: true
+
+      - name: Create next tag v0.0.X
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Skip if current commit already has a v0.0.* tag
+          if git tag --points-at HEAD | grep -qE '^v0\.0\.'; then
+            echo "Tag already exists on this commit. Skipping."
+            exit 0
+          fi
+
+          last_tag="$(git tag -l 'v0.0.*' --sort=-v:refname | head -n1 || true)"
+          if [ -z "$last_tag" ]; then
+            next_tag="v0.0.1"
+          else
+            patch="${last_tag##v0.0.}"
+            if ! [[ "$patch" =~ ^[0-9]+$ ]]; then
+              echo "Unexpected tag format: $last_tag" >&2
+              exit 1
+            fi
+            next_tag="v0.0.$((patch + 1))"
+          fi
+
+          git config user.name "gitea-actions"
+          git config user.email "gitea-actions@local"
+          git tag "$next_tag"
+          git push origin "$next_tag"
--- a/.gitea/workflows/release-artefact.yml
+++ b/.gitea/workflows/release-artefact.yml
@@ -0,0 +1,64 @@
+name: Build Release Artefact
+
+on:
+  push:
+    tags:
+      - "v0.0.*"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.4"
+          extensions: mbstring, intl, pdo_pgsql, xml, curl, zip, gd
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "lts/*"
+
+      - name: Install backend deps (prod)
+        env:
+          APP_ENV: prod
+          APP_DEBUG: "0"
+        run: composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
+
+      - name: Build frontend (static)
+        run: |
+          cd frontend
+          npm ci
+          NUXT_PUBLIC_API_BASE=/api NUXT_PUBLIC_APP_BASE=/ npm run generate
+
+      - name: Build artefact
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p release
+          tar -czf "release/ferme-${GITHUB_REF_NAME}.tar.gz" \
+            bin \
+            config \
+            migrations \
+            public \
+            src \
+            templates \
+            vendor \
+            composer.json \
+            composer.lock \
+            symfony.lock \
+            frontend/.output/public
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: release/ferme-${{ github.ref_name }}.tar.gz
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@

 ###> symfony/framework-bundle ###
 /.env.local
+/.env.prod
 /.env.local.php
 /.env.*.local
 /config/secrets/prod/prod.decrypt.private.php
@@ -8,6 +9,7 @@
 /var/
 /vendor/
 /LOG/
+/config/jwt/*.pem
 ###< symfony/framework-bundle ###

 ###> friendsofphp/php-cs-fixer ###
@@ -23,3 +25,7 @@
 ###> docker ###
 docker/.env.docker.local
 ###< docker ###
+
+###> lexik/jwt-authentication-bundle ###
+/config/jwt/*.pem
+###< lexik/jwt-authentication-bundle ###
--- a/.idea/dataSources.xml
+++ b/.idea/dataSources.xml
@@ -8,5 +8,12 @@
      <jdbc-url>jdbc:postgresql://localhost:5432/ferme</jdbc-url>
      <working-dir>$ProjectFileDir$</working-dir>
    </data-source>
+    <data-source source="LOCAL" name="Ferme recette" uuid="ae622167-c834-4e7b-87a5-c1721036f5dc">
+      <driver-ref>postgresql</driver-ref>
+      <synchronize>true</synchronize>
+      <jdbc-driver>org.postgresql.Driver</jdbc-driver>
+      <jdbc-url>jdbc:postgresql://localhost:5432/postgres</jdbc-url>
+      <working-dir>$ProjectFileDir$</working-dir>
+    </data-source>
  </component>
 </project>
--- a/.idea/data_source_mapping.xml
+++ b/.idea/data_source_mapping.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="DataSourcePerFileMappings">
+    <file url="file://$APPLICATION_CONFIG_DIR$/consoles/db/ae622167-c834-4e7b-87a5-c1721036f5dc/console.sql" value="ae622167-c834-4e7b-87a5-c1721036f5dc" />
+    <file url="file://$APPLICATION_CONFIG_DIR$/consoles/db/f407a514-c6b4-4b26-9555-445a85892502/console.sql" value="f407a514-c6b4-4b26-9555-445a85892502" />
+  </component>
+</project>
--- a/.idea/db-forest-config.xml
+++ b/.idea/db-forest-config.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="db-tree-configuration">
+    <option name="data" value="----------------------------------------&#10;1:0:f407a514-c6b4-4b26-9555-445a85892502&#10;2:0:ae622167-c834-4e7b-87a5-c1721036f5dc&#10;" />
+  </component>
+</project>
--- a/.idea/ferme.iml
+++ b/.idea/ferme.iml
@@ -145,6 +145,9 @@
      <excludeFolder url="file://$MODULE_DIR$/vendor/masterminds/html5" />
      <excludeFolder url="file://$MODULE_DIR$/vendor/sabberworm/php-css-parser" />
      <excludeFolder url="file://$MODULE_DIR$/vendor/thecodingmachine/safe" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/lcobucci/jwt" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/lexik/jwt-authentication-bundle" />
+      <excludePattern pattern="reference.php" />
    </content>
    <orderEntry type="inheritedJdk" />
    <orderEntry type="sourceFolder" forTests="false" />
--- a/.idea/php.xml
+++ b/.idea/php.xml
@@ -151,6 +151,8 @@
      <path value="$PROJECT_DIR$/vendor/dompdf/php-svg-lib" />
      <path value="$PROJECT_DIR$/vendor/sabberworm/php-css-parser" />
      <path value="$PROJECT_DIR$/vendor/dompdf/php-font-lib" />
+      <path value="$PROJECT_DIR$/vendor/lexik/jwt-authentication-bundle" />
+      <path value="$PROJECT_DIR$/vendor/lcobucci/jwt" />
    </include_path>
  </component>
  <component name="PhpProjectSharedConfiguration" php_language_level="8.4" />
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -4,13 +4,9 @@
    <option name="autoReloadType" value="SELECTIVE" />
  </component>
  <component name="ChangeListManager">
-    <list default="true" id="7c107abe-5995-4428-8429-b146aaca8386" name="Changes" comment="feat : ajout d'une gestion d'erreur au global côté front avec la lib toaster et I18n pour centraliser les messages d'erreur">
+    <list default="true" id="7c107abe-5995-4428-8429-b146aaca8386" name="Changes" comment="ci : fix release artefact">
+      <change beforePath="$PROJECT_DIR$/.gitignore" beforeDir="false" afterPath="$PROJECT_DIR$/.gitignore" afterDir="false" />
      <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/config/reference.php" beforeDir="false" afterPath="$PROJECT_DIR$/config/reference.php" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/frontend/components/reception/reception-form.vue" beforeDir="false" afterPath="$PROJECT_DIR$/frontend/components/reception/reception-form.vue" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/frontend/package-lock.json" beforeDir="false" afterPath="$PROJECT_DIR$/frontend/package-lock.json" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/frontend/package.json" beforeDir="false" afterPath="$PROJECT_DIR$/frontend/package.json" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/frontend/pages/reception/[[id]].vue" beforeDir="false" afterPath="$PROJECT_DIR$/frontend/pages/reception/[[id]].vue" afterDir="false" />
    </list>
    <option name="SHOW_DIALOG" value="false" />
    <option name="HIGHLIGHT_CONFLICTS" value="true" />
@@ -36,7 +32,7 @@
  <component name="Git.Settings">
    <option name="RECENT_BRANCH_BY_REPOSITORY">
      <map>
-        <entry key="$PROJECT_DIR$" value="develop" />
+        <entry key="$PROJECT_DIR$" value="feat/202-connexion-utilisateur" />
      </map>
    </option>
    <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
@@ -195,6 +191,8 @@
      <path value="$PROJECT_DIR$/vendor/dompdf/php-svg-lib" />
      <path value="$PROJECT_DIR$/vendor/sabberworm/php-css-parser" />
      <path value="$PROJECT_DIR$/vendor/dompdf/php-font-lib" />
+      <path value="$PROJECT_DIR$/vendor/lexik/jwt-authentication-bundle" />
+      <path value="$PROJECT_DIR$/vendor/lcobucci/jwt" />
    </include_path>
  </component>
  <component name="ProjectColorInfo">{
@@ -207,28 +205,34 @@
    <option name="hideEmptyMiddlePackages" value="true" />
    <option name="showLibraryContents" value="true" />
  </component>
-  <component name="PropertiesComponent">{
-  &quot;keyToString&quot;: {
-    &quot;RunOnceActivity.MCP Project settings loaded&quot;: &quot;true&quot;,
-    &quot;RunOnceActivity.ShowReadmeOnStart&quot;: &quot;true&quot;,
-    &quot;RunOnceActivity.TerminalTabsStorage.copyFrom.TerminalArrangementManager.252&quot;: &quot;true&quot;,
-    &quot;RunOnceActivity.git.unshallow&quot;: &quot;true&quot;,
-    &quot;RunOnceActivity.typescript.service.memoryLimit.init&quot;: &quot;true&quot;,
-    &quot;git-widget-placeholder&quot;: &quot;feat/reception-generation-bon&quot;,
-    &quot;node.js.detected.package.eslint&quot;: &quot;true&quot;,
-    &quot;node.js.detected.package.tslint&quot;: &quot;true&quot;,
-    &quot;node.js.selected.package.eslint&quot;: &quot;(autodetect)&quot;,
-    &quot;node.js.selected.package.tslint&quot;: &quot;(autodetect)&quot;,
-    &quot;nodejs_package_manager_path&quot;: &quot;npm&quot;,
-    &quot;settings.editor.selected.configurable&quot;: &quot;reference.webide.settings.project.settings.php.debug&quot;,
-    &quot;vue.rearranger.settings.migration&quot;: &quot;true&quot;
+  <component name="PropertiesComponent"><![CDATA[{
+  "keyToString": {
+    "RunOnceActivity.MCP Project settings loaded": "true",
+    "RunOnceActivity.ShowReadmeOnStart": "true",
+    "RunOnceActivity.TerminalTabsStorage.copyFrom.TerminalArrangementManager.252": "true",
+    "RunOnceActivity.git.unshallow": "true",
+    "RunOnceActivity.typescript.service.memoryLimit.init": "true",
+    "git-widget-placeholder": "develop",
+    "node.js.detected.package.eslint": "true",
+    "node.js.detected.package.tslint": "true",
+    "node.js.selected.package.eslint": "(autodetect)",
+    "node.js.selected.package.tslint": "(autodetect)",
+    "nodejs_package_manager_path": "npm",
+    "settings.editor.selected.configurable": "preferences.keymap",
+    "vue.rearranger.settings.migration": "true"
  },
-  &quot;keyToStringList&quot;: {
-    &quot;vue.recent.templates&quot;: [
-      &quot;Vue Composition API Component&quot;
+  "keyToStringList": {
+    "DatabaseDriversLRU": [
+      "postgresql"
+    ],
+    "com.intellij.ide.scratch.ScratchImplUtil$2/New Scratch File": [
+      "TEXT"
+    ],
+    "vue.recent.templates": [
+      "Vue Composition API Component"
    ]
  }
-}</component>
+}]]></component>
  <component name="RecentsManager">
    <key name="MoveFile.RECENT_KEYS">
      <recent name="\\wsl.localhost\Ubuntu-24.04\home\tristan\workspace\ferme\templates" />
@@ -258,6 +262,7 @@
      <workItem from="1768374298711" duration="12403000" />
      <workItem from="1768460547451" duration="26946000" />
      <workItem from="1768547023783" duration="11371000" />
+      <workItem from="1768894030675" duration="33744000" />
    </task>
    <task id="LOCAL-00001" summary="feat : Ajout de pinia, création de la table weight et reception mise en place du système de step pour les receptions (WIP)">
      <option name="closed" value="true" />
@@ -331,7 +336,87 @@
      <option name="project" value="LOCAL" />
      <updated>1768555180530</updated>
    </task>
-    <option name="localTasksCounter" value="10" />
+    <task id="LOCAL-00010" summary="feat : ajout de l'authentification avec lexik">
+      <option name="closed" value="true" />
+      <created>1768832208350</created>
+      <option name="number" value="00010" />
+      <option name="presentableId" value="LOCAL-00010" />
+      <option name="project" value="LOCAL" />
+      <updated>1768832208350</updated>
+    </task>
+    <task id="LOCAL-00011" summary="feat : update du CHANGELOG.md">
+      <option name="closed" value="true" />
+      <created>1768832516587</created>
+      <option name="number" value="00011" />
+      <option name="presentableId" value="LOCAL-00011" />
+      <option name="project" value="LOCAL" />
+      <updated>1768832516587</updated>
+    </task>
+    <task id="LOCAL-00012" summary="fix : correction de l'accès au swagger en mode dev qui n'était plus accessible">
+      <option name="closed" value="true" />
+      <created>1768940104944</created>
+      <option name="number" value="00012" />
+      <option name="presentableId" value="LOCAL-00012" />
+      <option name="project" value="LOCAL" />
+      <updated>1768940104944</updated>
+    </task>
+    <task id="LOCAL-00013" summary="feat : ajout de la conf pour le déploiement en recette">
+      <option name="closed" value="true" />
+      <created>1769005220331</created>
+      <option name="number" value="00013" />
+      <option name="presentableId" value="LOCAL-00013" />
+      <option name="project" value="LOCAL" />
+      <updated>1769005220331</updated>
+    </task>
+    <task id="LOCAL-00014" summary="fix : fix de la conf pour le déploiement en recette">
+      <option name="closed" value="true" />
+      <created>1769008700008</created>
+      <option name="number" value="00014" />
+      <option name="presentableId" value="LOCAL-00014" />
+      <option name="project" value="LOCAL" />
+      <updated>1769008700008</updated>
+    </task>
+    <task id="LOCAL-00015" summary="fix : fix de la conf pour le déploiement en recette">
+      <option name="closed" value="true" />
+      <created>1769014602062</created>
+      <option name="number" value="00015" />
+      <option name="presentableId" value="LOCAL-00015" />
+      <option name="project" value="LOCAL" />
+      <updated>1769014602062</updated>
+    </task>
+    <task id="LOCAL-00016" summary="fix : migration apache vers nginx pour un déploiement plus simple">
+      <option name="closed" value="true" />
+      <created>1769019284586</created>
+      <option name="number" value="00016" />
+      <option name="presentableId" value="LOCAL-00016" />
+      <option name="project" value="LOCAL" />
+      <updated>1769019284586</updated>
+    </task>
+    <task id="LOCAL-00017" summary="fix : dernière modification pour le déploiement en recette et le changement de conf vers nginx">
+      <option name="closed" value="true" />
+      <created>1769021756823</created>
+      <option name="number" value="00017" />
+      <option name="presentableId" value="LOCAL-00017" />
+      <option name="project" value="LOCAL" />
+      <updated>1769021756823</updated>
+    </task>
+    <task id="LOCAL-00018" summary="ci : auto tag + release artefact">
+      <option name="closed" value="true" />
+      <created>1769021818384</created>
+      <option name="number" value="00018" />
+      <option name="presentableId" value="LOCAL-00018" />
+      <option name="project" value="LOCAL" />
+      <updated>1769021818384</updated>
+    </task>
+    <task id="LOCAL-00019" summary="ci : fix release artefact">
+      <option name="closed" value="true" />
+      <created>1769022071620</created>
+      <option name="number" value="00019" />
+      <option name="presentableId" value="LOCAL-00019" />
+      <option name="project" value="LOCAL" />
+      <updated>1769022071620</updated>
+    </task>
+    <option name="localTasksCounter" value="20" />
    <servers />
  </component>
  <component name="TypeScriptGeneratedFilesManager">
@@ -343,6 +428,11 @@
        <entry key="Branch">
          <value>
            <list>
+              <RecentGroup>
+                <option name="FILTER_VALUES">
+                  <option value="HEAD" />
+                </option>
+              </RecentGroup>
              <RecentGroup>
                <option name="FILTER_VALUES">
                  <option value="develop" />
@@ -363,7 +453,7 @@
                  <entry key="branch">
                    <value>
                      <list>
-                        <option value="develop" />
+                        <option value="HEAD" />
                      </list>
                    </value>
                  </entry>
@@ -387,6 +477,20 @@
    <MESSAGE value="test : ajout de TU sur les services et providers" />
    <MESSAGE value="feat : ajout de la génération du bon de reception, correction de la base du formulaire multi-etape de reception et ajout d'une gestion d'erreur global" />
    <MESSAGE value="feat : ajout d'une gestion d'erreur au global côté front avec la lib toaster et I18n pour centraliser les messages d'erreur" />
-    <option name="LAST_COMMIT_MESSAGE" value="feat : ajout d'une gestion d'erreur au global côté front avec la lib toaster et I18n pour centraliser les messages d'erreur" />
+    <MESSAGE value="feat : ajout de l'authentification avec lexik" />
+    <MESSAGE value="feat : update du CHANGELOG.md" />
+    <MESSAGE value="fix : correction de l'accès au swagger en mode dev qui n'était plus accessible" />
+    <MESSAGE value="feat : ajout de la conf pour le déploiement en recette" />
+    <MESSAGE value="fix : fix de la conf pour le déploiement en recette" />
+    <MESSAGE value="fix : migration apache vers nginx pour un déploiement plus simple" />
+    <MESSAGE value="fix : dernière modification pour le déploiement en recette et le changement de conf vers nginx" />
+    <MESSAGE value="ci: auto tag + release artefact" />
+    <MESSAGE value="ci : auto tag + release artefact" />
+    <MESSAGE value="ci : fix release artefact" />
+    <option name="LAST_COMMIT_MESSAGE" value="ci : fix release artefact" />
+  </component>
+  <component name="XSLT-Support.FileAssociations.UIState">
+    <expand />
+    <select />
  </component>
 </project>
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,12 +9,17 @@ Ajouter dans le fichier .env
 - DATABASE_URL
 - PONT_BASCULE_BYPASS (doit être à true en dev)
 - PONT_BASCULE_URL
+- JWT_SECRET_KEY (à générer avec la commande php bin/console lexik:jwt:generate-keypair)
+- JWT_PUBLIC_KEY
+- JWT_PASSPHRASE (à généré dans le conteneur avec la commande php -r "echo bin2hex(random_bytes(32));")
+- COOKIE_SECURE=0 (en dev 0 et en prod 1)

 Ajouter dans le fichier .env du frontend
 - NUXT_PUBLIC_API_BASE

 ### Added
 * [#203] Réceptions — Parcours de pesée multi-étapes (début)
+* [#202] Authentification — Connexion utilisateur (JWT)

 ### Changed

--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -0,0 +1,103 @@
+# Déploiement Ferme (recette)
+
+## 1) Premier déploiement
+
+### Pré-requis système (Ubuntu)
+1. Mettre à jour la machine
+   ```bash
+   sudo apt update
+   sudo apt install -y software-properties-common ca-certificates curl gnupg unzip git nginx
+   ```
+2. Installer PHP 8.4 + FPM + extensions
+   ```bash
+   sudo add-apt-repository -y ppa:ondrej/php
+   sudo apt update
+   sudo apt install -y \
+     php8.4 php8.4-fpm php8.4-cli php8.4-common \
+     php8.4-mbstring php8.4-xml php8.4-curl php8.4-intl \
+     php8.4-zip php8.4-gd php8.4-pgsql php8.4-opcache
+   ```
+3. Installer Composer
+   ```bash
+   php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
+   sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
+   rm composer-setup.php
+   ```
+4. Installer Node via NVM
+   ```bash
+   curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
+   source ~/.bashrc
+   nvm install --lts
+   ```
+5. Installer PostgreSQL (si la DB est locale)
+   ```bash
+   sudo apt install -y postgresql postgresql-contrib
+   sudo -u postgres psql
+   ```
+   Dans psql :
+   ```sql
+   CREATE USER ferme_user WITH PASSWORD 'motdepassefort';
+   CREATE DATABASE ferme OWNER ferme_user;
+   \q
+   ```
+
+### Déploiement applicatif
+1. Cloner le repo
+   ```bash
+   sudo mkdir -p /var/www
+   sudo git clone <repo> /var/www/ferme
+   sudo chown -R malio:malio /var/www/ferme
+   ```
+2. Variables d’environnement
+   - Backend : `/var/www/ferme/.env.local`
+     - `APP_ENV=prod`
+     - `APP_DEBUG=0`
+     - `APP_SECRET=...`
+     - `DATABASE_URL=postgresql://ferme_user:motdepassefort@127.0.0.1:5432/ferme?serverVersion=16&charset=utf8`
+     - `JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem`
+     - `JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem`
+     - `JWT_PASSPHRASE=...`
+     - `COOKIE_SECURE=1`
+     - `PONT_BASCULE_BYPASS=false`
+   - Frontend : `/var/www/ferme/frontend/.env`
+     - `NUXT_PUBLIC_APP_BASE=/`
+     - `NUXT_PUBLIC_API_BASE=/api`
+3. Générer les clés JWT
+   ```bash
+   cd /var/www/ferme
+   mkdir -p config/jwt
+   php bin/console lexik:jwt:generate-keypair
+   ```
+4. Config Nginx (sous-domaine)
+   ```bash
+   sudo cp /var/www/ferme/deploy/nginx/ferme.conf /etc/nginx/sites-available/ferme.conf
+   sudo ln -s /etc/nginx/sites-available/ferme.conf /etc/nginx/sites-enabled/ferme.conf
+   sudo nginx -t && sudo systemctl reload nginx
+   ```
+6. Déployer l’app
+   ```bash
+   cd /var/www/ferme
+   ./scripts/deploy-native.sh
+   ```
+7. Vérifications
+   - Front : `http://ferme.malio-dev.fr/`
+   - API : `http://ferme.malio-dev.fr/api/users`
+   - Login : `POST http://ferme.malio-dev.fr/api/login_check`
+
+## 2) Déployer une nouvelle version (app déjà en place)
+
+1. Mettre à jour le code + build + migrations
+   ```bash
+   cd /var/www/ferme
+   ./scripts/deploy-native.sh
+   ```
+2. Si changement de conf Nginx
+   ```bash
+   sudo cp /var/www/ferme/deploy/nginx/ferme.conf /etc/nginx/sites-available/ferme.conf
+   sudo nginx -t && sudo systemctl reload nginx
+   ```
+3. Si besoin, purger le cache Symfony
+   ```bash
+   php /var/www/ferme/bin/console cache:clear --env=prod
+   php /var/www/ferme/bin/console cache:warmup --env=prod
+   ```
--- a/README.md
+++ b/README.md
@@ -21,13 +21,17 @@ Dans le cas ou le `make start` plante à cause du port de la bdd, il faut modifi
 Pour les variables d'environnement, il faut demander un .env.local pour le backend et un .env pour le frontend à votre collègue.

 Vérifier que dans le .env.local, vous avez :
-* APP_SECRET (doit être différent de celui de votre collègue, puisque utilisé pour signer des tokens)
-* DATABASE_URL
+* APP_SECRET (à généré dans le conteneur avec la commande php -r "echo bin2hex(random_bytes(32));" et doit être différent de celui de votre collègue, puisque utilisé pour signer des tokens)
+* DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:${POSTGRES_PORT}/${POSTGRES_DB}?serverVersion=16&charset=utf8"
 * PONT_BASCULE_BYPASS (doit être à true en dev)
 * PONT_BASCULE_URL
+* JWT_SECRET_KEY (à générer avec la commande php bin/console lexik:jwt:generate-keypair)
+* JWT_PUBLIC_KEY 
+* JWT_PASSPHRASE (à généré dans le conteneur avec la commande php -r "echo bin2hex(random_bytes(32));")
+* COOKIE_SECURE=0 (en dev 0 et en prod 1)

 Vérifier que dans le .env du dossier frontend, vous avez :
-* NUXT_PUBLIC_API_BASE
+* NUXT_PUBLIC_API_BASE="http://localhost:8080/api"

 ### Configuration xdebug
 Pour configurer xdebug, il faut ajouter un serveur sur phpstorm. <br>
@@ -54,6 +58,19 @@ make dev-nuxt
 ```
 Le front sera accessible sur http://localhost:3000

+### Authentification
+Ce projet utilise l'authentification JWT avec un cookie httpOnly (LexikJWTAuthenticationBundle).
+Le frontend ne lit jamais directement le token, le navigateur envoie automatiquement le cookie.
+
+### Login flow
+- Frontend envoie les identifiants à:
+    - `POST /api/login_check`
+- Backend returns:
+    - `204 No Content` (normal)
+    - `Set-Cookie: BEARER=...; HttpOnly`
+- Le cookie est automatiquement envoyé pour les futures requêtes.
+- La déconnexion utilise `POST /api/logout` et redirige vers `/login`.
+
 ## Commandes utiles
 Pour restart le container
 ```bash
@@ -71,3 +88,17 @@ Pour clear le cache Symfony
 ```bash
 make cache-clear
 ```
+Faire une migration
+```bash
+make migration-migrate
+```
+Pour générer un password pour un user
+```bash
+make shell
+php bin/console security:hash-password
+```
+Sélectionner entity User, taper sont mdp, le copier et l'ajouter dans l'insert de bdd suivant :
+```sql
+INSERT INTO "user" (username, roles, password)
+VALUES ('Mon user', '["ROLE_USER"]', 'Mon mdp hashé');
+```
--- a/composer.json
+++ b/composer.json
@@ -13,6 +13,7 @@
        "doctrine/doctrine-migrations-bundle": "^4.0",
        "doctrine/orm": "^3.6",
        "dompdf/dompdf": "^3.1",
+        "lexik/jwt-authentication-bundle": "*",
        "nelmio/cors-bundle": "^2.6",
        "phpdocumentor/reflection-docblock": "^5.6",
        "phpstan/phpdoc-parser": "^2.3",
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "5cd56256b984963ecd4eaa17f2612f57",
+    "content-hash": "f619208e7dd3272e671e7c2b139afa87",
    "packages": [
        {
            "name": "api-platform/doctrine-common",
@@ -2516,6 +2516,195 @@
            },
            "time": "2026-01-02T16:01:13+00:00"
        },
+        {
+            "name": "lcobucci/jwt",
+            "version": "5.6.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/lcobucci/jwt.git",
+                "reference": "bb3e9f21e4196e8afc41def81ef649c164bca25e"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/lcobucci/jwt/zipball/bb3e9f21e4196e8afc41def81ef649c164bca25e",
+                "reference": "bb3e9f21e4196e8afc41def81ef649c164bca25e",
+                "shasum": ""
+            },
+            "require": {
+                "ext-openssl": "*",
+                "ext-sodium": "*",
+                "php": "~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0",
+                "psr/clock": "^1.0"
+            },
+            "require-dev": {
+                "infection/infection": "^0.29",
+                "lcobucci/clock": "^3.2",
+                "lcobucci/coding-standard": "^11.0",
+                "phpbench/phpbench": "^1.2",
+                "phpstan/extension-installer": "^1.2",
+                "phpstan/phpstan": "^1.10.7",
+                "phpstan/phpstan-deprecation-rules": "^1.1.3",
+                "phpstan/phpstan-phpunit": "^1.3.10",
+                "phpstan/phpstan-strict-rules": "^1.5.0",
+                "phpunit/phpunit": "^11.1"
+            },
+            "suggest": {
+                "lcobucci/clock": ">= 3.2"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Lcobucci\\JWT\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Luís Cobucci",
+                    "email": "lcobucci@gmail.com",
+                    "role": "Developer"
+                }
+            ],
+            "description": "A simple library to work with JSON Web Token and JSON Web Signature",
+            "keywords": [
+                "JWS",
+                "jwt"
+            ],
+            "support": {
+                "issues": "https://github.com/lcobucci/jwt/issues",
+                "source": "https://github.com/lcobucci/jwt/tree/5.6.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/lcobucci",
+                    "type": "github"
+                },
+                {
+                    "url": "https://www.patreon.com/lcobucci",
+                    "type": "patreon"
+                }
+            ],
+            "time": "2025-10-17T11:30:53+00:00"
+        },
+        {
+            "name": "lexik/jwt-authentication-bundle",
+            "version": "v3.2.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/lexik/LexikJWTAuthenticationBundle.git",
+                "reference": "60df75dc70ee6f597929cb2f0812adda591dfa4b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/lexik/LexikJWTAuthenticationBundle/zipball/60df75dc70ee6f597929cb2f0812adda591dfa4b",
+                "reference": "60df75dc70ee6f597929cb2f0812adda591dfa4b",
+                "shasum": ""
+            },
+            "require": {
+                "ext-openssl": "*",
+                "lcobucci/jwt": "^5.0",
+                "php": ">=8.2",
+                "symfony/clock": "^6.4|^7.0|^8.0",
+                "symfony/config": "^6.4|^7.0|^8.0",
+                "symfony/dependency-injection": "^6.4|^7.0|^8.0",
+                "symfony/deprecation-contracts": "^2.4|^3.0",
+                "symfony/event-dispatcher": "^6.4|^7.0|^8.0",
+                "symfony/http-foundation": "^6.4|^7.0|^8.0",
+                "symfony/http-kernel": "^6.4|^7.0|^8.0",
+                "symfony/property-access": "^6.4|^7.0|^8.0",
+                "symfony/security-bundle": "^6.4|^7.0|^8.0",
+                "symfony/translation-contracts": "^1.0|^2.0|^3.0"
+            },
+            "require-dev": {
+                "api-platform/core": "^3.0|^4.0",
+                "rector/rector": "^1.2",
+                "symfony/browser-kit": "^6.4|^7.0|^8.0",
+                "symfony/console": "^6.4|^7.0|^8.0",
+                "symfony/dom-crawler": "^6.4|^7.0|^8.0",
+                "symfony/filesystem": "^6.4|^7.0|^8.0",
+                "symfony/framework-bundle": "^6.4|^7.0|^8.0",
+                "symfony/phpunit-bridge": "^6.4|^7.0|^8.0",
+                "symfony/var-dumper": "^6.4|^7.0|^8.0",
+                "symfony/yaml": "^6.4|^7.0|^8.0"
+            },
+            "suggest": {
+                "gesdinet/jwt-refresh-token-bundle": "Implements a refresh token system over Json Web Tokens in Symfony",
+                "spomky-labs/lexik-jose-bridge": "Provides a JWT Token encoder with encryption support"
+            },
+            "type": "symfony-bundle",
+            "autoload": {
+                "psr-4": {
+                    "Lexik\\Bundle\\JWTAuthenticationBundle\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Jeremy Barthe",
+                    "email": "j.barthe@lexik.fr",
+                    "homepage": "https://github.com/jeremyb"
+                },
+                {
+                    "name": "Nicolas Cabot",
+                    "email": "n.cabot@lexik.fr",
+                    "homepage": "https://github.com/slashfan"
+                },
+                {
+                    "name": "Cedric Girard",
+                    "email": "c.girard@lexik.fr",
+                    "homepage": "https://github.com/cedric-g"
+                },
+                {
+                    "name": "Dev Lexik",
+                    "email": "dev@lexik.fr",
+                    "homepage": "https://github.com/lexik"
+                },
+                {
+                    "name": "Robin Chalas",
+                    "email": "robin.chalas@gmail.com",
+                    "homepage": "https://github.com/chalasr"
+                },
+                {
+                    "name": "Lexik Community",
+                    "homepage": "https://github.com/lexik/LexikJWTAuthenticationBundle/graphs/contributors"
+                }
+            ],
+            "description": "This bundle provides JWT authentication for your Symfony REST API",
+            "homepage": "https://github.com/lexik/LexikJWTAuthenticationBundle",
+            "keywords": [
+                "Authentication",
+                "JWS",
+                "api",
+                "bundle",
+                "jwt",
+                "rest",
+                "symfony"
+            ],
+            "support": {
+                "issues": "https://github.com/lexik/LexikJWTAuthenticationBundle/issues",
+                "source": "https://github.com/lexik/LexikJWTAuthenticationBundle/tree/v3.2.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/chalasr",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/lexik/jwt-authentication-bundle",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-12-20T17:47:00+00:00"
+        },
        {
            "name": "masterminds/html5",
            "version": "2.10.0",
--- a/config/bundles.php
+++ b/config/bundles.php
@@ -1,11 +1,23 @@
 <?php

+declare(strict_types=1);
+
+use ApiPlatform\Symfony\Bundle\ApiPlatformBundle;
+use Doctrine\Bundle\DoctrineBundle\DoctrineBundle;
+use Doctrine\Bundle\MigrationsBundle\DoctrineMigrationsBundle;
+use Lexik\Bundle\JWTAuthenticationBundle\LexikJWTAuthenticationBundle;
+use Nelmio\CorsBundle\NelmioCorsBundle;
+use Symfony\Bundle\FrameworkBundle\FrameworkBundle;
+use Symfony\Bundle\SecurityBundle\SecurityBundle;
+use Symfony\Bundle\TwigBundle\TwigBundle;
+
 return [
-    Symfony\Bundle\FrameworkBundle\FrameworkBundle::class => ['all' => true],
-    Symfony\Bundle\TwigBundle\TwigBundle::class => ['all' => true],
-    Symfony\Bundle\SecurityBundle\SecurityBundle::class => ['all' => true],
-    Doctrine\Bundle\DoctrineBundle\DoctrineBundle::class => ['all' => true],
-    Doctrine\Bundle\MigrationsBundle\DoctrineMigrationsBundle::class => ['all' => true],
-    Nelmio\CorsBundle\NelmioCorsBundle::class => ['all' => true],
-    ApiPlatform\Symfony\Bundle\ApiPlatformBundle::class => ['all' => true],
+    FrameworkBundle::class              => ['all' => true],
+    TwigBundle::class                   => ['all' => true],
+    SecurityBundle::class               => ['all' => true],
+    DoctrineBundle::class               => ['all' => true],
+    DoctrineMigrationsBundle::class     => ['all' => true],
+    NelmioCorsBundle::class             => ['all' => true],
+    LexikJWTAuthenticationBundle::class => ['all' => true],
+    ApiPlatformBundle::class            => ['all' => true],
 ];
--- a/config/packages/lexik_jwt_authentication.yaml
+++ b/config/packages/lexik_jwt_authentication.yaml
@@ -0,0 +1,20 @@
+lexik_jwt_authentication:
+    secret_key: '%kernel.project_dir%/config/jwt/private.pem'
+    public_key: '%kernel.project_dir%/config/jwt/public.pem'
+    pass_phrase: '%env(JWT_PASSPHRASE)%'
+    token_ttl: 86400
+    token_extractors:
+        authorization_header:
+            enabled: true
+            prefix: Bearer
+            name: Authorization
+        cookie:
+            enabled: true
+            name: BEARER
+    set_cookies:
+        BEARER:
+            lifetime: 86400
+            path: /
+            samesite: lax
+            secure: '%env(bool:COOKIE_SECURE)%'
+            httpOnly: true
--- a/config/packages/nelmio_cors.yaml
+++ b/config/packages/nelmio_cors.yaml
@@ -4,6 +4,7 @@ nelmio_cors:
        allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
        allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
        allow_headers: ['Content-Type', 'Authorization']
+        allow_credentials: true
        expose_headers: ['Link']
        max_age: 3600
    paths:
--- a/config/packages/prod/api_platform.yaml
+++ b/config/packages/prod/api_platform.yaml
@@ -0,0 +1,4 @@
+api_platform:
+    enable_docs: false
+    enable_swagger: false
+    enable_swagger_ui: false
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -1,20 +1,43 @@
 security:
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
+        App\Entity\User: 'auto'
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
-        users_in_memory: { memory: null }
+        app_user_provider:
+            entity:
+                class: App\Entity\User
+                property: username

    firewalls:
        dev:
            # Ensure dev tools and static assets are always allowed
            pattern: ^/(_profiler|_wdt|assets|build)/
            security: false
-        main:
-            lazy: true
-            provider: users_in_memory
+        login:
+            pattern: ^/login_check
+            stateless: true
+            provider: app_user_provider
+            json_login:
+                check_path: /login_check
+                username_path: username
+                password_path: password
+                success_handler: lexik_jwt_authentication.handler.authentication_success
+                failure_handler: lexik_jwt_authentication.handler.authentication_failure
+        api:
+            pattern: ^/
+            stateless: true
+            provider: app_user_provider
+            jwt: ~
+            logout:
+                path: /api/logout
+                target: /login
+                enable_csrf: false
+                delete_cookies:
+                    BEARER:
+                        path: /

            # Activate different ways to authenticate:
            # https://symfony.com/doc/current/security.html#the-firewall
@@ -24,8 +47,14 @@ security:

    # Note: Only the *first* matching rule is applied
    access_control:
-        # - { path: ^/admin, roles: ROLE_ADMIN }
-        # - { path: ^/profile, roles: ROLE_USER }
+        # Login JWT
+        - { path: ^/login_check, roles: PUBLIC_ACCESS }
+        # Liste des users en lecture publique
+        - { path: ^/api/users, roles: PUBLIC_ACCESS, methods: [GET] }
+        # Doc API (swagger) en public
+        - { path: ^/api/docs, roles: PUBLIC_ACCESS }
+        # Tout le reste nécessite un JWT
+        - { path: ^/, roles: IS_AUTHENTICATED_FULLY }

 when@test:
    security:
--- a/config/reference.php
+++ b/config/reference.php
@@ -770,6 +770,9 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *             property?: scalar|null|Param, // Default: null
 *             manager_name?: scalar|null|Param, // Default: null
 *         },
+ *         lexik_jwt?: array{
+ *             class?: scalar|null|Param, // Default: "Lexik\\Bundle\\JWTAuthenticationBundle\\Security\\User\\JWTUser"
+ *         },
 *     }>,
 *     firewalls: array<string, array{ // Default: []
 *         pattern?: scalar|null|Param,
@@ -828,6 +831,10 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *             provider?: scalar|null|Param,
 *             user?: scalar|null|Param, // Default: "REMOTE_USER"
 *         },
+ *         jwt?: array{
+ *             provider?: scalar|null|Param, // Default: null
+ *             authenticator?: scalar|null|Param, // Default: "lexik_jwt_authentication.security.jwt_authenticator"
+ *         },
 *         login_link?: array{
 *             check_route: scalar|null|Param, // Route that will validate the login link - e.g. "app_login_link_verify".
 *             check_post_only?: scalar|null|Param, // If true, only HTTP POST requests to "check_route" will be handled by the authenticator. // Default: false
@@ -1261,6 +1268,91 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *         skip_same_as_origin?: bool|Param,
 *     }>,
 * }
+ * @psalm-type LexikJwtAuthenticationConfig = array{
+ *     public_key?: scalar|null|Param, // The key used to sign tokens (useless for HMAC). If not set, the key will be automatically computed from the secret key. // Default: null
+ *     additional_public_keys?: list<scalar|null|Param>,
+ *     secret_key?: scalar|null|Param, // The key used to sign tokens. It can be a raw secret (for HMAC), a raw RSA/ECDSA key or the path to a file itself being plaintext or PEM. // Default: null
+ *     pass_phrase?: scalar|null|Param, // The key passphrase (useless for HMAC) // Default: ""
+ *     token_ttl?: scalar|null|Param, // Default: 3600
+ *     allow_no_expiration?: bool|Param, // Allow tokens without "exp" claim (i.e. indefinitely valid, no lifetime) to be considered valid. Caution: usage of this should be rare. // Default: false
+ *     clock_skew?: scalar|null|Param, // Default: 0
+ *     encoder?: array{
+ *         service?: scalar|null|Param, // Default: "lexik_jwt_authentication.encoder.lcobucci"
+ *         signature_algorithm?: scalar|null|Param, // Default: "RS256"
+ *     },
+ *     user_id_claim?: scalar|null|Param, // Default: "username"
+ *     token_extractors?: array{
+ *         authorization_header?: bool|array{
+ *             enabled?: bool|Param, // Default: true
+ *             prefix?: scalar|null|Param, // Default: "Bearer"
+ *             name?: scalar|null|Param, // Default: "Authorization"
+ *         },
+ *         cookie?: bool|array{
+ *             enabled?: bool|Param, // Default: false
+ *             name?: scalar|null|Param, // Default: "BEARER"
+ *         },
+ *         query_parameter?: bool|array{
+ *             enabled?: bool|Param, // Default: false
+ *             name?: scalar|null|Param, // Default: "bearer"
+ *         },
+ *         split_cookie?: bool|array{
+ *             enabled?: bool|Param, // Default: false
+ *             cookies?: list<scalar|null|Param>,
+ *         },
+ *     },
+ *     remove_token_from_body_when_cookies_used?: scalar|null|Param, // Default: true
+ *     set_cookies?: array<string, array{ // Default: []
+ *         lifetime?: scalar|null|Param, // The cookie lifetime. If null, the "token_ttl" option value will be used // Default: null
+ *         samesite?: "none"|"lax"|"strict"|Param, // Default: "lax"
+ *         path?: scalar|null|Param, // Default: "/"
+ *         domain?: scalar|null|Param, // Default: null
+ *         secure?: scalar|null|Param, // Default: true
+ *         httpOnly?: scalar|null|Param, // Default: true
+ *         partitioned?: scalar|null|Param, // Default: false
+ *         split?: list<scalar|null|Param>,
+ *     }>,
+ *     api_platform?: bool|array{ // API Platform compatibility: add check_path in OpenAPI documentation.
+ *         enabled?: bool|Param, // Default: false
+ *         check_path?: scalar|null|Param, // The login check path to add in OpenAPI. // Default: null
+ *         username_path?: scalar|null|Param, // The path to the username in the JSON body. // Default: null
+ *         password_path?: scalar|null|Param, // The path to the password in the JSON body. // Default: null
+ *     },
+ *     access_token_issuance?: bool|array{
+ *         enabled?: bool|Param, // Default: false
+ *         signature?: array{
+ *             algorithm: scalar|null|Param, // The algorithm use to sign the access tokens.
+ *             key: scalar|null|Param, // The signature key. It shall be JWK encoded.
+ *         },
+ *         encryption?: bool|array{
+ *             enabled?: bool|Param, // Default: false
+ *             key_encryption_algorithm: scalar|null|Param, // The key encryption algorithm is used to encrypt the token.
+ *             content_encryption_algorithm: scalar|null|Param, // The key encryption algorithm is used to encrypt the token.
+ *             key: scalar|null|Param, // The encryption key. It shall be JWK encoded.
+ *         },
+ *     },
+ *     access_token_verification?: bool|array{
+ *         enabled?: bool|Param, // Default: false
+ *         signature?: array{
+ *             header_checkers?: list<scalar|null|Param>,
+ *             claim_checkers?: list<scalar|null|Param>,
+ *             mandatory_claims?: list<scalar|null|Param>,
+ *             allowed_algorithms?: list<scalar|null|Param>,
+ *             keyset: scalar|null|Param, // The signature keyset. It shall be JWKSet encoded.
+ *         },
+ *         encryption?: bool|array{
+ *             enabled?: bool|Param, // Default: false
+ *             continue_on_decryption_failure?: bool|Param, // If enable, non-encrypted tokens or tokens that failed during decryption or verification processes are accepted. // Default: false
+ *             header_checkers?: list<scalar|null|Param>,
+ *             allowed_key_encryption_algorithms?: list<scalar|null|Param>,
+ *             allowed_content_encryption_algorithms?: list<scalar|null|Param>,
+ *             keyset: scalar|null|Param, // The encryption keyset. It shall be JWKSet encoded.
+ *         },
+ *     },
+ *     blocklist_token?: bool|array{
+ *         enabled?: bool|Param, // Default: false
+ *         cache?: scalar|null|Param, // Storage to track blocked tokens // Default: "cache.app"
+ *     },
+ * }
 * @psalm-type ApiPlatformConfig = array{
 *     title?: scalar|null|Param, // The title of the API. // Default: ""
 *     description?: scalar|null|Param, // The description of the API. // Default: ""
@@ -1526,6 +1618,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *     doctrine?: DoctrineConfig,
 *     doctrine_migrations?: DoctrineMigrationsConfig,
 *     nelmio_cors?: NelmioCorsConfig,
+ *     lexik_jwt_authentication?: LexikJwtAuthenticationConfig,
 *     api_platform?: ApiPlatformConfig,
 *     "when@dev"?: array{
 *         imports?: ImportsConfig,
@@ -1537,6 +1630,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *         doctrine?: DoctrineConfig,
 *         doctrine_migrations?: DoctrineMigrationsConfig,
 *         nelmio_cors?: NelmioCorsConfig,
+ *         lexik_jwt_authentication?: LexikJwtAuthenticationConfig,
 *         api_platform?: ApiPlatformConfig,
 *     },
 *     "when@prod"?: array{
@@ -1549,6 +1643,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *         doctrine?: DoctrineConfig,
 *         doctrine_migrations?: DoctrineMigrationsConfig,
 *         nelmio_cors?: NelmioCorsConfig,
+ *         lexik_jwt_authentication?: LexikJwtAuthenticationConfig,
 *         api_platform?: ApiPlatformConfig,
 *     },
 *     "when@test"?: array{
@@ -1561,6 +1656,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
 *         doctrine?: DoctrineConfig,
 *         doctrine_migrations?: DoctrineMigrationsConfig,
 *         nelmio_cors?: NelmioCorsConfig,
+ *         lexik_jwt_authentication?: LexikJwtAuthenticationConfig,
 *         api_platform?: ApiPlatformConfig,
 *     },
 *     ...<string, ExtensionType|array{ // extra keys must follow the when@%env% pattern or match an extension alias
--- a/config/routes/api_platform.yaml
+++ b/config/routes/api_platform.yaml
@@ -1,4 +1,4 @@
 api_platform:
    resource: .
    type: api_platform
-    prefix: /
+    prefix: /api
--- a/config/routes/security.yaml
+++ b/config/routes/security.yaml
@@ -1,3 +1,7 @@
 _security_logout:
    resource: security.route_loader.logout
    type: service
+
+api_login:
+    path: /login_check
+    methods: [POST]
--- a/deploy/nginx/ferme.conf
+++ b/deploy/nginx/ferme.conf
@@ -0,0 +1,43 @@
+server {
+  listen 80;
+server_name ferme.malio-dev.fr;
+
+  root /var/www/ferme/frontend/.output/public;
+  index index.html;
+
+    location ^~ /api/ {
+        root /var/www/ferme/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ^~ /bundles/ {
+        root /var/www/ferme/public;
+        try_files $uri =404;
+    }
+
+    location = /api/login_check {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/ferme/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/ferme/public;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param PATH_INFO /login_check;
+        fastcgi_param REQUEST_URI /login_check;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+    }
+
+    location ~ ^/index\.php(/|$) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/ferme/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/ferme/public;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+        internal;
+    }
+
+  location ~ \.php$ {
+      return 404;
+  }
+
+  location / {
+      try_files $uri $uri/ /index.html;
+  }
+}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
-  web:
-    container_name: php-${DOCKER_APP_NAME}-apache
+  php:
+    container_name: php-${DOCKER_APP_NAME}-fpm
    build:
      context: ./docker/php
      dockerfile: Dockerfile
@@ -20,18 +20,26 @@ services:
      - ~/.config:/var/www/.config # Pour la config de yarn
      - ~/.composer:/var/www/.composer # Pour la config de composer
      - ./docker/php/config/php.ini:/usr/local/etc/php/php.ini
-      - ./docker/php/config/vhost.conf:/etc/apache2/sites-available/000-default.conf
      - ./docker/php/config/docker-php-ext-xdebug.ini:/usr/local/etc/php/conf.d/docker-php-ext-xdebug.ini
      - ./LOG:/var/www/html/LOG
-      - ./LOG/logs_apache:/var/log/apache2/
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - db
    ports:
-        - "8080:80"
        - "3000:3000"
    restart: unless-stopped
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: nginx-${DOCKER_APP_NAME}
+    depends_on:
+      - php
+    ports:
+      - "8080:80"
+    volumes:
+      - ./:/var/www/html:ro
+      - ./docker/nginx/conf.d:/etc/nginx/conf.d:ro
+    restart: unless-stopped
  db:
    image: postgres:16-alpine
    environment:
--- a/docker/nginx/conf.d/ferme.conf
+++ b/docker/nginx/conf.d/ferme.conf
@@ -0,0 +1,42 @@
+server {
+    listen 80;
+    server_name localhost;
+
+    root /var/www/html/frontend/dist;
+    index index.html;
+
+    location ^~ /api/ {
+        root /var/www/html/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ^~ /bundles/ {
+        root /var/www/html/public;
+        try_files $uri =404;
+    }
+
+    location = /api/login_check {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/html/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/html/public;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param PATH_INFO /login_check;
+        fastcgi_param REQUEST_URI /login_check;
+        fastcgi_pass php:9000;
+    }
+
+    location ~ ^/index\.php(/|$) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/html/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/html/public;
+        fastcgi_pass php:9000;
+    }
+
+    location ~ \.php$ {
+        return 404;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
--- a/docker/php/Dockerfile
+++ b/docker/php/Dockerfile
@@ -1,6 +1,6 @@
 ARG DOCKER_PHP_VERSION

-FROM php:${DOCKER_PHP_VERSION}-apache-bullseye
+FROM php:${DOCKER_PHP_VERSION}-fpm-bullseye

 ARG DOCKER_NODE_VERSION
 ENV DOCKER_NODE_VERSION="${DOCKER_NODE_VERSION}"
@@ -105,10 +105,6 @@ RUN rm -rf /var/cache/apk/* && rm -rf /tmp/* && \
 # Création de la structure du projet
 RUN mkdir /var/www/html/LOG

-# Activation du module pour Apache2 proxy_http et rewrite
-RUN a2enmod proxy_http && \
-    a2enmod rewrite
-
 ###> User ###
 ARG CURRENT_UID
 ARG CURRENT_GID
--- a/docker/php/config/vhost.conf
+++ b/docker/php/config/vhost.conf
@@ -1,32 +0,0 @@
-<VirtualHost *:80>
-    DocumentRoot /var/www/html
-
-    AliasMatch "^/api(/.*)?" "/var/www/html/public$1"
-    <Directory /var/www/html/public>
-        Options FollowSymLinks
-        AllowOverride All
-        Require all granted
-
-        RewriteEngine On
-        RewriteRule ^index\.php$ - [L]
-        RewriteCond %{REQUEST_FILENAME} !-f
-        RewriteCond %{REQUEST_FILENAME} !-d
-        RewriteRule ^ /api/index.php [L]
-    </Directory>
-
-    AliasMatch "^/(?!api)(.*)$" "/var/www/html/frontend/dist/$1"
-    <Directory /var/www/html/frontend/dist>
-        AllowOverride All
-        Order allow,deny
-        Allow from All
-
-        RewriteEngine on
-        RewriteCond %{REQUEST_FILENAME} -f [OR]
-        RewriteCond %{REQUEST_FILENAME} -d
-        RewriteRule ^ - [L]
-        RewriteRule ^ index.html [L]
-    </Directory>
-
-    ErrorLog "${APACHE_LOG_DIR}/error.log"
-    CustomLog "${APACHE_LOG_DIR}/access.log" combined
-</VirtualHost>
--- a/frontend/composables/useApi.ts
+++ b/frontend/composables/useApi.ts
@@ -1,5 +1,6 @@
 import type { FetchOptions } from 'ofetch'
 import { $fetch, FetchError } from 'ofetch'
+import { useAuthStore } from '~/stores/auth'

 export type AnyObject = Record<string, unknown>

@@ -26,6 +27,7 @@ export const useApi = (): ApiClient => {
  const config = useRuntimeConfig()
  const baseURL = config.public.apiBase ?? '/api'
  const toast = useToast()
+  const auth = useAuthStore()
  const nuxtApp = useNuxtApp()
  const i18n = nuxtApp.$i18n as
    | {
@@ -70,12 +72,17 @@ export const useApi = (): ApiClient => {
  const client = $fetch.create({
    baseURL,
    retry: 0,
-    onResponse({ options }) {
+    credentials: 'include',
+    onResponse({ options, response }) {
      const apiOptions = options as ApiFetchOptions<'json'>
      if (apiOptions?.toast === false) {
        return
      }

+      if (response?.status && response.status >= 400) {
+        return
+      }
+
      const successKey = apiOptions?.toastSuccessKey
      const successMessage =
        apiOptions?.toastSuccessMessage ||
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -13,11 +13,20 @@
      "create": "Impossible de créer la réception.",
      "update": "Impossible de mettre à jour la réception.",
      "weigh": "Impossible de récupérer la pesée."
+    },
+    "auth": {
+      "login": "Identifiants invalides.",
+      "users": "Impossible de récupérer les utilisateurs.",
+      "logout": "Impossible de se déconnecter."
    }
  },
  "success": {
    "reception": {
      "update": "Réception mise à jour avec succès."
+    },
+    "auth": {
+      "login": "Connexion réussie.",
+      "logout": "Déconnexion réussie."
    }
  }
 }
--- a/frontend/layouts/auth.vue
+++ b/frontend/layouts/auth.vue
@@ -0,0 +1,7 @@
+<template>
+  <div class="min-h-screen bg-primary-500 from-primary-50 via-white to-neutral-100 text-neutral-900">
+    <main class="mx-auto flex min-h-screen w-full max-w-[720px] items-center px-6 py-12">
+      <slot />
+    </main>
+  </div>
+</template>
--- a/frontend/layouts/default.vue
+++ b/frontend/layouts/default.vue
@@ -9,7 +9,7 @@
            LOGO
          </span>
                </NuxtLink>
-                <nav class="mx-8 flex gap-8 text-2xl font-bold uppercase text-white">
+                <nav class="mx-8 flex flex-1 gap-8 text-2xl font-bold uppercase text-white">
                    <NuxtLink to="/" custom v-slot="{ href, navigate, isExactActive }">
                        <a
                            :href="href"
@@ -29,6 +29,13 @@
                        </a>
                    </NuxtLink>
                </nav>
+                <button
+                    type="button"
+                    class="ml-auto text-xl font-bold uppercase text-white transition hover:opacity-80"
+                    @click="handleLogout"
+                >
+                    Déconnexion
+                </button>
            </div>
        </header>
        <main class="mx-auto w-full max-w-[1050px] px-6 pt-[90px] pb-0">
@@ -38,6 +45,17 @@
 </template>

 <script setup lang="ts">
+import { useAuthStore } from '~/stores/auth'
+
 const route = useRoute()
+const auth = useAuthStore()
 const isReceptionActive = computed(() => route.path.startsWith('/reception'))
+
+const handleLogout = async () => {
+  try {
+    await auth.logout()
+  } finally {
+    await navigateTo('/login')
+  }
+}
 </script>
--- a/frontend/middleware/auth.global.ts
+++ b/frontend/middleware/auth.global.ts
@@ -0,0 +1,17 @@
+import { useAuthStore } from '~/stores/auth'
+
+export default defineNuxtRouteMiddleware(async (to) => {
+  const auth = useAuthStore()
+
+  if (to.path === '/login') {
+    return
+  }
+
+  if (!auth.isAuthenticated) {
+    await auth.ensureSession()
+  }
+
+  if (!auth.isAuthenticated) {
+    return navigateTo('/login')
+  }
+})
--- a/frontend/nuxt.config.ts
+++ b/frontend/nuxt.config.ts
@@ -2,6 +2,9 @@ export default defineNuxtConfig({
  compatibilityDate: '2025-07-15',
  devtools: { enabled: true },
  ssr: false,
+  app: {
+    baseURL: process.env.NUXT_PUBLIC_APP_BASE || '/'
+  },
  modules: [
    '@nuxtjs/tailwindcss',
    '@pinia/nuxt',
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -63,6 +63,7 @@
      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.28.5.tgz",
      "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.27.1",
        "@babel/generator": "^7.28.5",
@@ -1063,7 +1064,6 @@
      "version": "4.12.2",
      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
-      "peer": true,
      "engines": {
        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
      }
@@ -1072,7 +1072,6 @@
      "version": "0.21.1",
      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",
      "integrity": "sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==",
-      "peer": true,
      "dependencies": {
        "@eslint/object-schema": "^2.1.7",
        "debug": "^4.3.1",
@@ -1086,7 +1085,6 @@
      "version": "1.1.12",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
-      "peer": true,
      "dependencies": {
        "balanced-match": "^1.0.0",
        "concat-map": "0.0.1"
@@ -1096,7 +1094,6 @@
      "version": "3.1.2",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "peer": true,
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
@@ -1108,7 +1105,6 @@
      "version": "0.4.2",
      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
-      "peer": true,
      "dependencies": {
        "@eslint/core": "^0.17.0"
      },
@@ -1120,7 +1116,6 @@
      "version": "0.17.0",
      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
-      "peer": true,
      "dependencies": {
        "@types/json-schema": "^7.0.15"
      },
@@ -1132,7 +1127,6 @@
      "version": "3.3.3",
      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.3.tgz",
      "integrity": "sha512-Kr+LPIUVKz2qkx1HAMH8q1q6azbqBAsXJUxBl/ODDuVPX45Z9DfwB8tPjTi6nNZ8BuM3nbJxC5zCAg5elnBUTQ==",
-      "peer": true,
      "dependencies": {
        "ajv": "^6.12.4",
        "debug": "^4.3.2",
@@ -1155,7 +1149,6 @@
      "version": "1.1.12",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
-      "peer": true,
      "dependencies": {
        "balanced-match": "^1.0.0",
        "concat-map": "0.0.1"
@@ -1165,7 +1158,6 @@
      "version": "5.3.2",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
-      "peer": true,
      "engines": {
        "node": ">= 4"
      }
@@ -1174,7 +1166,6 @@
      "version": "3.1.2",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "peer": true,
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
@@ -1186,7 +1177,6 @@
      "version": "9.39.2",
      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.2.tgz",
      "integrity": "sha512-q1mjIoW1VX4IvSocvM/vbTiveKC4k9eLrajNEuSsmjymSDEbpGddtpfOoN7YGAqBK3NG+uqo8ia4PDTt8buCYA==",
-      "peer": true,
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
      },
@@ -1198,7 +1188,6 @@
      "version": "2.1.7",
      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
-      "peer": true,
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
      }
@@ -1207,7 +1196,6 @@
      "version": "0.4.1",
      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
-      "peer": true,
      "dependencies": {
        "@eslint/core": "^0.17.0",
        "levn": "^0.4.1"
@@ -1220,7 +1208,6 @@
      "version": "0.19.1",
      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
-      "peer": true,
      "engines": {
        "node": ">=18.18.0"
      }
@@ -1229,7 +1216,6 @@
      "version": "0.16.7",
      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
-      "peer": true,
      "dependencies": {
        "@humanfs/core": "^0.19.1",
        "@humanwhocodes/retry": "^0.4.0"
@@ -1242,7 +1228,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
-      "peer": true,
      "engines": {
        "node": ">=12.22"
      },
@@ -1255,7 +1240,6 @@
      "version": "0.4.3",
      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
-      "peer": true,
      "engines": {
        "node": ">=18.18"
      },
@@ -2967,6 +2951,7 @@
      "version": "0.95.0",
      "resolved": "https://registry.npmjs.org/oxc-parser/-/oxc-parser-0.95.0.tgz",
      "integrity": "sha512-Te8fE/SmiiKWIrwBwxz5Dod87uYvsbcZ9JAL5ylPg1DevyKgTkxCXnPEaewk1Su2qpfNmry5RHoN+NywWFCG+A==",
+      "peer": true,
      "dependencies": {
        "@oxc-project/types": "^0.95.0"
      },
@@ -4871,8 +4856,7 @@
    "node_modules/@types/json-schema": {
      "version": "7.0.15",
      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
-      "peer": true
+      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="
    },
    "node_modules/@types/parse-path": {
      "version": "7.0.3",
@@ -5222,6 +5206,7 @@
      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.26.tgz",
      "integrity": "sha512-egp69qDTSEZcf4bGOSsprUr4xI73wfrY5oRs6GSgXFTiHrWj4Y3X5Ydtip9QMqiCMCPVwLglB9GBxXtTadJ3mA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/parser": "^7.28.5",
        "@vue/compiler-core": "3.5.26",
@@ -5419,6 +5404,7 @@
      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
      "license": "MIT",
+      "peer": true,
      "bin": {
        "acorn": "bin/acorn"
      },
@@ -5456,7 +5442,6 @@
      "version": "6.12.6",
      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
-      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
        "fast-json-stable-stringify": "^2.0.0",
@@ -5829,6 +5814,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.9.0",
        "caniuse-lite": "^1.0.30001759",
@@ -5942,6 +5928,7 @@
      "resolved": "https://registry.npmjs.org/cac/-/cac-6.7.14.tgz",
      "integrity": "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=8"
      }
@@ -6018,7 +6005,6 @@
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
-      "peer": true,
      "engines": {
        "node": ">=6"
      }
@@ -6137,6 +6123,7 @@
      "resolved": "https://registry.npmjs.org/citty/-/citty-0.1.6.tgz",
      "integrity": "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "consola": "^3.2.3"
      }
@@ -6747,8 +6734,7 @@
    "node_modules/deep-is": {
      "version": "0.1.4",
      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
-      "peer": true
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="
    },
    "node_modules/deepmerge": {
      "version": "4.3.1",
@@ -7259,7 +7245,6 @@
      "version": "8.4.0",
      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
-      "peer": true,
      "dependencies": {
        "esrecurse": "^4.3.0",
        "estraverse": "^5.2.0"
@@ -7286,7 +7271,6 @@
      "version": "1.1.12",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
-      "peer": true,
      "dependencies": {
        "balanced-match": "^1.0.0",
        "concat-map": "0.0.1"
@@ -7296,7 +7280,6 @@
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
-      "peer": true,
      "engines": {
        "node": ">=10"
      },
@@ -7308,7 +7291,6 @@
      "version": "4.2.1",
      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
-      "peer": true,
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
      },
@@ -7320,7 +7302,6 @@
      "version": "6.0.2",
      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
-      "peer": true,
      "dependencies": {
        "is-glob": "^4.0.3"
      },
@@ -7332,7 +7313,6 @@
      "version": "5.3.2",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
-      "peer": true,
      "engines": {
        "node": ">= 4"
      }
@@ -7341,7 +7321,6 @@
      "version": "3.1.2",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "peer": true,
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
@@ -7353,7 +7332,6 @@
      "version": "10.4.0",
      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
-      "peer": true,
      "dependencies": {
        "acorn": "^8.15.0",
        "acorn-jsx": "^5.3.2",
@@ -7370,7 +7348,6 @@
      "version": "4.2.1",
      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
-      "peer": true,
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
      },
@@ -7394,7 +7371,6 @@
      "version": "1.7.0",
      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
-      "peer": true,
      "dependencies": {
        "estraverse": "^5.1.0"
      },
@@ -7406,7 +7382,6 @@
      "version": "4.3.0",
      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
-      "peer": true,
      "dependencies": {
        "estraverse": "^5.2.0"
      },
@@ -7504,8 +7479,7 @@
    "node_modules/fast-deep-equal": {
      "version": "3.1.3",
      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "peer": true
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="
    },
    "node_modules/fast-fifo": {
      "version": "1.3.2",
@@ -7532,14 +7506,12 @@
    "node_modules/fast-json-stable-stringify": {
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
-      "peer": true
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="
    },
    "node_modules/fast-levenshtein": {
      "version": "2.0.6",
      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
-      "peer": true
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="
    },
    "node_modules/fast-npm-meta": {
      "version": "0.4.7",
@@ -7580,7 +7552,6 @@
      "version": "8.0.0",
      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
-      "peer": true,
      "dependencies": {
        "flat-cache": "^4.0.0"
      },
@@ -7610,7 +7581,6 @@
      "version": "5.0.0",
      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
-      "peer": true,
      "dependencies": {
        "locate-path": "^6.0.0",
        "path-exists": "^4.0.0"
@@ -7626,7 +7596,6 @@
      "version": "4.0.1",
      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
-      "peer": true,
      "dependencies": {
        "flatted": "^3.2.9",
        "keyv": "^4.5.4"
@@ -7638,8 +7607,7 @@
    "node_modules/flatted": {
      "version": "3.3.3",
      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
-      "peer": true
+      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg=="
    },
    "node_modules/foreground-child": {
      "version": "3.3.1",
@@ -7906,7 +7874,6 @@
      "version": "14.0.0",
      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
-      "peer": true,
      "engines": {
        "node": ">=18"
      },
@@ -8207,7 +8174,6 @@
      "version": "3.3.1",
      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
-      "peer": true,
      "dependencies": {
        "parent-module": "^1.0.0",
        "resolve-from": "^4.0.0"
@@ -8223,7 +8189,6 @@
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
-      "peer": true,
      "engines": {
        "node": ">=4"
      }
@@ -8245,7 +8210,6 @@
      "version": "0.1.4",
      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
-      "peer": true,
      "engines": {
        "node": ">=0.8.19"
      }
@@ -8573,7 +8537,8 @@
    "node_modules/izitoast": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/izitoast/-/izitoast-1.4.0.tgz",
-      "integrity": "sha512-Oc1X2wiQtPp39i5VpIjf3GJf5sfCtHKXZ5szx7RareyEeFLUlcEW0FSfBni28+Ul6KNKZRKzhVuWzSP4Xngh0w=="
+      "integrity": "sha512-Oc1X2wiQtPp39i5VpIjf3GJf5sfCtHKXZ5szx7RareyEeFLUlcEW0FSfBni28+Ul6KNKZRKzhVuWzSP4Xngh0w==",
+      "peer": true
    },
    "node_modules/jackspeak": {
      "version": "3.4.3",
@@ -8631,20 +8596,17 @@
    "node_modules/json-buffer": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
-      "peer": true
+      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="
    },
    "node_modules/json-schema-traverse": {
      "version": "0.4.1",
      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "peer": true
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="
    },
    "node_modules/json-stable-stringify-without-jsonify": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
-      "peer": true
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw=="
    },
    "node_modules/json5": {
      "version": "2.2.3",
@@ -8722,7 +8684,6 @@
      "version": "4.5.4",
      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
-      "peer": true,
      "dependencies": {
        "json-buffer": "3.0.1"
      }
@@ -8996,7 +8957,6 @@
      "version": "0.4.1",
      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
-      "peer": true,
      "dependencies": {
        "prelude-ls": "^1.2.1",
        "type-check": "~0.4.0"
@@ -9081,7 +9041,6 @@
      "version": "6.0.0",
      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
-      "peer": true,
      "dependencies": {
        "p-locate": "^5.0.0"
      },
@@ -9119,8 +9078,7 @@
    "node_modules/lodash.merge": {
      "version": "4.6.2",
      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
-      "peer": true
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ=="
    },
    "node_modules/lodash.uniq": {
      "version": "4.5.0",
@@ -9466,8 +9424,7 @@
    "node_modules/natural-compare": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
-      "peer": true
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="
    },
    "node_modules/negotiator": {
      "version": "0.6.3",
@@ -10205,6 +10162,7 @@
      "resolved": "https://registry.npmjs.org/nuxt/-/nuxt-4.2.2.tgz",
      "integrity": "sha512-n6oYFikgLEb70J4+K19jAzfx4exZcRSRX7yZn09P5qlf2Z59VNOBqNmaZO5ObzvyGUZ308SZfL629/Q2v2FVjw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@dxup/nuxt": "^0.2.2",
        "@nuxt/cli": "^3.31.1",
@@ -10472,7 +10430,6 @@
      "version": "0.9.4",
      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
-      "peer": true,
      "dependencies": {
        "deep-is": "^0.1.3",
        "fast-levenshtein": "^2.0.6",
@@ -10519,6 +10476,7 @@
      "resolved": "https://registry.npmjs.org/oxc-parser/-/oxc-parser-0.102.0.tgz",
      "integrity": "sha512-xMiyHgr2FZsphQ12ZCsXRvSYzmKXCm1ejmyG4GDZIiKOmhyt5iKtWq0klOfFsEQ6jcgbwrUdwcCVYzr1F+h5og==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@oxc-project/types": "^0.102.0"
      },
@@ -10591,7 +10549,6 @@
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
-      "peer": true,
      "dependencies": {
        "yocto-queue": "^0.1.0"
      },
@@ -10606,7 +10563,6 @@
      "version": "5.0.0",
      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
-      "peer": true,
      "dependencies": {
        "p-limit": "^3.0.2"
      },
@@ -10633,7 +10589,6 @@
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
-      "peer": true,
      "dependencies": {
        "callsites": "^3.0.0"
      },
@@ -10682,7 +10637,6 @@
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "peer": true,
      "engines": {
        "node": ">=8"
      }
@@ -10797,6 +10751,7 @@
      "version": "3.0.4",
      "resolved": "https://registry.npmjs.org/pinia/-/pinia-3.0.4.tgz",
      "integrity": "sha512-l7pqLUFTI/+ESXn6k3nu30ZIzW5E2WZF/LaHJEpoq6ElcLD+wduZoB2kBN19du6K/4FDpPMazY2wJr+IndBtQw==",
+      "peer": true,
      "dependencies": {
        "@vue/devtools-api": "^7.7.7"
      },
@@ -10902,6 +10857,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "nanoid": "^3.3.11",
        "picocolors": "^1.1.1",
@@ -11451,6 +11407,7 @@
      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "cssesc": "^3.0.0",
        "util-deprecate": "^1.0.2"
@@ -11518,7 +11475,6 @@
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
-      "peer": true,
      "engines": {
        "node": ">= 0.8.0"
      }
@@ -11573,7 +11529,6 @@
      "version": "2.3.1",
      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "peer": true,
      "engines": {
        "node": ">=6"
      }
@@ -11925,6 +11880,7 @@
      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.55.1.tgz",
      "integrity": "sha512-wDv/Ht1BNHB4upNbK74s9usvl7hObDnvVzknxqY/E/O3X6rW1U1rV1aENEfJ54eFZDTNo7zv1f5N4edCluH7+A==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/estree": "1.0.8"
      },
@@ -12484,7 +12440,6 @@
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
-      "peer": true,
      "engines": {
        "node": ">=8"
      },
@@ -12747,6 +12702,7 @@
      "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@alloc/quick-lru": "^5.2.0",
        "arg": "^5.0.2",
@@ -13086,7 +13042,6 @@
      "version": "0.4.0",
      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
-      "peer": true,
      "dependencies": {
        "prelude-ls": "^1.2.1"
      },
@@ -13156,6 +13111,7 @@
      "version": "5.9.3",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -13597,7 +13553,6 @@
      "version": "4.4.1",
      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
-      "peer": true,
      "dependencies": {
        "punycode": "^2.1.0"
      }
@@ -13623,6 +13578,7 @@
      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.0.tgz",
      "integrity": "sha512-dZwN5L1VlUBewiP6H9s2+B3e3Jg96D0vzN+Ry73sOefebhYr9f94wwkMNN/9ouoU8pV1BqA1d1zGk8928cx0rg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "esbuild": "^0.27.0",
        "fdir": "^6.5.0",
@@ -13979,6 +13935,7 @@
      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.26.tgz",
      "integrity": "sha512-SJ/NTccVyAoNUJmkM9KUqPcYlY+u8OVL1X5EW9RIs3ch5H2uERxyyIUI4MRxVCSOiEcupX9xNGde1tL9ZKpimA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@vue/compiler-dom": "3.5.26",
        "@vue/compiler-sfc": "3.5.26",
@@ -14014,6 +13971,7 @@
      "version": "11.2.8",
      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-11.2.8.tgz",
      "integrity": "sha512-vJ123v/PXCZntd6Qj5Jumy7UBmIuE92VrtdX+AXr+1WzdBHojiBxnAxdfctUFL+/JIN+VQH4BhsfTtiGsvVObg==",
+      "peer": true,
      "dependencies": {
        "@intlify/core-base": "11.2.8",
        "@intlify/shared": "11.2.8",
@@ -14034,6 +13992,7 @@
      "resolved": "https://registry.npmjs.org/vue-router/-/vue-router-4.6.4.tgz",
      "integrity": "sha512-Hz9q5sa33Yhduglwz6g9skT8OBPii+4bFn88w6J+J4MfEo4KRRpmiNG/hHHkdbRFlLBOqxN8y8gf2Fb0MTUgVg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@vue/devtools-api": "^6.6.4"
      },
@@ -14085,7 +14044,6 @@
      "version": "1.2.5",
      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
-      "peer": true,
      "engines": {
        "node": ">=0.10.0"
      }
@@ -14351,7 +14309,6 @@
      "version": "0.1.0",
      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
-      "peer": true,
      "engines": {
        "node": ">=10"
      },
--- a/frontend/pages/login.vue
+++ b/frontend/pages/login.vue
@@ -0,0 +1,95 @@
+<template>
+  <div class="mx-auto w-full max-w-lg">
+          <span
+              class="flex items-center justify-center bg-white text-xl font-bold uppercase text-primary-500 p-4"
+          >
+            LOGO
+          </span>
+      <form
+      class="mt-8 space-y-6 rounded-lg border border-neutral-200 bg-white p-6 shadow-sm"
+      @submit.prevent="handleSubmit"
+    >
+      <div>
+        <label class="text-sm font-semibold text-neutral-700" for="user-select">
+          Utilisateur
+        </label>
+        <select
+          id="user-select"
+          v-model="selectedUsername"
+          class="mt-2 w-full rounded-md border border-neutral-300 bg-white px-3 py-2 text-base text-neutral-900 focus:border-primary-500 focus:outline-none focus:ring-2 focus:ring-primary-200"
+          :disabled="isLoadingUsers"
+        >
+          <option value="" disabled>Choisir un utilisateur</option>
+          <option v-for="user in users" :key="user.username" :value="user.username">
+            {{ user.username }}
+          </option>
+        </select>
+      </div>
+
+      <div>
+        <label class="text-sm font-semibold text-neutral-700" for="password">
+          Mot de passe
+        </label>
+        <input
+          id="password"
+          v-model="password"
+          type="password"
+          autocomplete="current-password"
+          class="mt-2 w-full rounded-md border border-neutral-300 bg-white px-3 py-2 text-base text-neutral-900 focus:border-primary-500 focus:outline-none focus:ring-2 focus:ring-primary-200"
+        />
+      </div>
+
+      <button
+        type="submit"
+        class="w-full rounded-md bg-primary-500 px-4 py-2 text-base font-semibold text-white transition hover:bg-primary-600 disabled:cursor-not-allowed disabled:opacity-60"
+        :disabled="isSubmitting"
+      >
+        Connexion
+      </button>
+    </form>
+  </div>
+</template>
+
+<script setup lang="ts">
+import type { UserData } from '~/services/dto/user-data'
+import { getUsers } from '~/services/auth'
+import { useAuthStore } from '~/stores/auth'
+
+const router = useRouter()
+const auth = useAuthStore()
+
+definePageMeta({
+  layout: 'auth'
+})
+
+const users = ref<UserData[]>([])
+const isLoadingUsers = ref(true)
+const selectedUsername = ref('')
+const password = ref('')
+
+const isSubmitting = computed(() => {
+  return auth.isLoading || !selectedUsername.value || !password.value
+})
+
+const loadUsers = async () => {
+  isLoadingUsers.value = true
+  try {
+    users.value = await getUsers()
+  } finally {
+    isLoadingUsers.value = false
+  }
+}
+
+const handleSubmit = async () => {
+  if (isSubmitting.value) {
+    return
+  }
+
+  await auth.login(selectedUsername.value, password.value)
+  await router.push('/')
+}
+
+onMounted(() => {
+  void loadUsers()
+})
+</script>
--- a/frontend/services/auth.ts
+++ b/frontend/services/auth.ts
@@ -0,0 +1,38 @@
+import { useApi } from '~/composables/useApi'
+import type { UserData } from '~/services/dto/user-data'
+
+export async function getUsers() {
+  const api = useApi()
+  const data = await api.get<UserData[] | { 'hydra:member': UserData[] }>('users', {}, {
+    toastErrorKey: 'errors.auth.users'
+  })
+  if (Array.isArray(data)) {
+    return data
+  }
+
+  return data['hydra:member'] ?? []
+}
+
+export async function getCurrentUser() {
+  const api = useApi()
+  return api.get<UserData>('me', {}, {
+    toast: false
+  })
+}
+
+export async function login(username: string, password: string) {
+  const api = useApi()
+  return api.post<{ token: string }>('login_check', { username, password }, {
+    toastErrorKey: 'errors.auth.login',
+    toastSuccessKey: 'success.auth.login'
+  })
+}
+
+export async function logout() {
+  const api = useApi()
+  return api.post<void>('logout', {}, {
+    toastErrorKey: 'errors.auth.logout',
+    toastSuccessKey: 'success.auth.logout',
+    redirect: 'manual'
+  })
+}
--- a/frontend/services/dto/user-data.ts
+++ b/frontend/services/dto/user-data.ts
@@ -0,0 +1,3 @@
+export interface UserData {
+  username: string
+}
--- a/frontend/stores/auth.ts
+++ b/frontend/stores/auth.ts
@@ -0,0 +1,58 @@
+import { defineStore } from 'pinia'
+import type { UserData } from '~/services/dto/user-data'
+import { getCurrentUser, login, logout } from '~/services/auth'
+
+export const useAuthStore = defineStore('auth', {
+  state: () => ({
+    user: null as UserData | null,
+    isLoading: false,
+    checked: false
+  }),
+  getters: {
+    isAuthenticated: (state) => Boolean(state.user)
+  },
+  actions: {
+    async ensureSession() {
+      if (this.checked) {
+        return this.user
+      }
+
+      this.checked = true
+
+      try {
+        const me = await getCurrentUser()
+        this.user = me
+        return me
+      } catch {
+        this.user = null
+        return null
+      }
+    },
+    async login(username: string, password: string) {
+      this.isLoading = true
+
+      try {
+        await login(username, password)
+        const me = await getCurrentUser()
+        this.user = me
+        this.checked = true
+        return me
+      } finally {
+        this.isLoading = false
+      }
+    },
+    async logout() {
+      this.isLoading = true
+
+      try {
+        await logout()
+      } catch {
+        // Ignore logout errors so we can still clear local auth state.
+      } finally {
+        this.user = null
+        this.checked = true
+        this.isLoading = false
+      }
+    }
+  }
+})
--- a/11
+++ b/11
@@ -7,7 +7,7 @@ ENV_FILE    := $(if $(wildcard $(ENV_LOCAL)),$(ENV_LOCAL),$(ENV_DEFAULT))
 include $(ENV_DEFAULT)
 -include $(ENV_LOCAL)

-PHP_CONTAINER				= php-$(DOCKER_APP_NAME)-apache
+PHP_CONTAINER				= php-$(DOCKER_APP_NAME)-fpm
 SYMFONY_CONSOLE				= $(EXEC_PHP) php bin/console

 DOCKER_COMPOSE = docker compose --env-file $(ENV_FILE)
@@ -40,13 +40,14 @@ restart: env-init
 	$(DOCKER_COMPOSE) down
 	CURRENT_UID=$(shell id -u) CURRENT_GID=$(shell id -g) $(DOCKER_COMPOSE) up -d

-install: copy-git-hook composer-install cache-clear node-use build-nuxtJS
+install: copy-git-hook composer-install cache-clear node-use build-nuxtJS migration-migrate

 # Supprime tout est réinstalle tout (Attention ça supprime la bdd aussi)
 reset: delete_built_dir remove_orphans build-without-cache start wait install

 composer-install:
 	$(EXEC_PHP) composer install
+	$(SYMFONY_CONSOLE) lexik:jwt:generate-keypair --skip-if-exists

 build-nuxtJS:
 #	$(EXEC_PHP) cp -n frontend/.env.dist frontend/.env.local
@@ -72,10 +73,16 @@ build-without-cache:
 		--build-arg="CURRENT_GID=$(shell id -g)" 	\
 		--no-cache

+migration-migrate:
+	$(SYMFONY_CONSOLE) bin/console doctrine:migrations:migrate --no-interaction
+
 # Attention, supprime votre bdd local
 db-reset:
 	$(DOCKER_COMPOSE) down -v
 	$(DOCKER_COMPOSE) up -d
+	$(MAKE) wait
+	$(SYMFONY_CONSOLE) doctrine:database:create --if-not-exists
+	$(MAKE) migration-migrate

 # Restart la bdd
 db-restart:
--- a/migrations/Version20260112000700.php
+++ b/migrations/Version20260112000700.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260112000700 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Create user table for authentication';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('CREATE TABLE "user" (id INT GENERATED BY DEFAULT AS IDENTITY NOT NULL, username VARCHAR(180) NOT NULL, roles JSON NOT NULL, password VARCHAR(255) NOT NULL, PRIMARY KEY(id))');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_USER_USERNAME ON "user" (username)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('DROP TABLE "user"');
+    }
+}
--- a/migrations/Version20260112000800.php
+++ b/migrations/Version20260112000800.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260112000800 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Ensure user table exists and align weight type default';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('CREATE TABLE IF NOT EXISTS "user" (id INT GENERATED BY DEFAULT AS IDENTITY NOT NULL, username VARCHAR(180) NOT NULL, roles JSON NOT NULL, password VARCHAR(255) NOT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE UNIQUE INDEX IF NOT EXISTS UNIQ_8D93D649F85E0677 ON "user" (username)');
+        $this->addSql('ALTER TABLE weight ALTER type DROP DEFAULT');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE weight ALTER type SET DEFAULT \'gross\'');
+        $this->addSql('DROP INDEX IF EXISTS UNIQ_8D93D649F85E0677');
+        $this->addSql('DROP TABLE IF EXISTS "user"');
+    }
+}
--- a/scripts/deploy-native.sh
+++ b/scripts/deploy-native.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+BRANCH="develop"
+
+for cmd in git php composer npm; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "Missing required command: $cmd" >&2
+    exit 1
+  fi
+done
+
+echo "==> Pulling latest code ($BRANCH)"
+git fetch origin "$BRANCH"
+git checkout "$BRANCH"
+git pull --ff-only origin "$BRANCH"
+
+echo "==> Installing backend deps (prod)"
+composer install --no-dev --optimize-autoloader
+
+echo "==> Running DB migrations"
+php bin/console doctrine:migrations:migrate --no-interaction --env=prod
+
+echo "==> Warming Symfony cache (prod)"
+php bin/console cache:clear --env=prod
+php bin/console cache:warmup --env=prod
+
+echo "==> Building frontend (static)"
+cd "$ROOT_DIR/frontend"
+npm ci
+npm run generate
+
+echo "==> Done."
--- a/src/Entity/Reception.php
+++ b/src/Entity/Reception.php
@@ -63,6 +63,7 @@ use Symfony\Component\Serializer\Normalizer\DateTimeNormalizer;
            provider: ReceptionReceiptProvider::class,
        ),
    ],
+    security: "is_granted('ROLE_USER')",
 )]
 class Reception
 {
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Entity;
+
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use App\State\MeProvider;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+#[ORM\Entity]
+#[ORM\Table(name: 'user', schema: 'public')]
+#[ApiResource(
+    operations: [
+        new Get(
+            uriTemplate: '/me',
+            normalizationContext: ['groups' => ['user:read']],
+            security: "is_granted('ROLE_USER')",
+            provider: MeProvider::class
+        ),
+        new GetCollection(
+            normalizationContext: ['groups' => ['user:read']],
+            security: "is_granted('PUBLIC_ACCESS')"
+        ),
+    ],
+    normalizationContext: ['groups' => ['user:read']],
+    paginationEnabled: false
+)]
+class User implements UserInterface, PasswordAuthenticatedUserInterface
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column(type: 'integer')]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 180, unique: true)]
+    #[Groups(['user:read'])]
+    private string $username = '';
+
+    #[ORM\Column(type: 'json')]
+    private array $roles = [];
+
+    #[ORM\Column]
+    private string $password = '';
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getUsername(): string
+    {
+        return $this->username;
+    }
+
+    public function setUsername(string $username): self
+    {
+        $this->username = $username;
+
+        return $this;
+    }
+
+    public function getUserIdentifier(): string
+    {
+        return $this->username;
+    }
+
+    public function getRoles(): array
+    {
+        $roles   = $this->roles;
+        $roles[] = 'ROLE_USER';
+
+        return array_unique($roles);
+    }
+
+    public function setRoles(array $roles): self
+    {
+        $this->roles = $roles;
+
+        return $this;
+    }
+
+    public function getPassword(): string
+    {
+        return $this->password;
+    }
+
+    public function setPassword(string $password): self
+    {
+        $this->password = $password;
+
+        return $this;
+    }
+
+    public function eraseCredentials(): void
+    {
+        // No-op: we don't store temporary sensitive data on the entity.
+    }
+}
--- a/src/Entity/Weight.php
+++ b/src/Entity/Weight.php
@@ -32,6 +32,7 @@ use Symfony\Component\Validator\Constraints as Assert;
            denormalizationContext: ['groups' => ['weight:write']],
        ),
    ],
+    security: "is_granted('ROLE_USER')",
 )]
 #[UniqueEntity(fields: ['reception', 'type'], message: 'A weighing already exists for this type.')]
 class Weight
--- a/src/State/MeProvider.php
+++ b/src/State/MeProvider.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\State;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProviderInterface;
+use App\Entity\User;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\File\Exception\AccessDeniedException;
+
+final readonly class MeProvider implements ProviderInterface
+{
+    public function __construct(private Security $security) {}
+
+    public function provide(Operation $operation, array $uriVariables = [], array $context = []): ?object
+    {
+        $user = $this->security->getUser();
+
+        if (!$user instanceof User) {
+            throw new AccessDeniedException('User not authenticated.');
+        }
+
+        return $user;
+    }
+}
--- a/symfony.lock
+++ b/symfony.lock
@@ -61,6 +61,18 @@
            ".php-cs-fixer.dist.php"
        ]
    },
+    "lexik/jwt-authentication-bundle": {
+        "version": "3.2",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "2.5",
+            "ref": "e9481b233a11ef7e15fe055a2b21fd3ac1aa2bb7"
+        },
+        "files": [
+            "config/packages/lexik_jwt_authentication.yaml"
+        ]
+    },
    "nelmio/cors-bundle": {
        "version": "2.6",
        "recipe": {
Author	SHA1	Message	Date
tristan	66274e239b	ci : fix release artefact All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m7s Details	2026-01-21 20:43:35 +01:00
tristan	f93a867dd4	ci : fix release artefact All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m15s Details	2026-01-21 20:01:22 +01:00
tristan	744d8a4088	ci : auto tag + release artefact Some checks failed Auto Tag Develop / tag (push) Successful in 6s Details Build Release Artefact / build (push) Failing after 58s Details	2026-01-21 19:57:09 +01:00
tristan	cf693c0304	fix : dernière modification pour le déploiement en recette et le changement de conf vers nginx	2026-01-21 19:56:06 +01:00
tristan	44bff2a4e5	fix : migration apache vers nginx pour un déploiement plus simple	2026-01-21 19:14:54 +01:00
tristan	6c1f14ae4d	fix : fix de la conf pour le déploiement en recette	2026-01-21 17:56:53 +01:00
tristan	6f2218d2c9	fix : fix de la conf pour le déploiement en recette	2026-01-21 16:18:29 +01:00
tristan	9596d94617	feat : ajout de la conf pour le déploiement en recette	2026-01-21 15:20:28 +01:00
tristan	f99e5cd386	fix : correction de l'accès au swagger en mode dev qui n'était plus accessible	2026-01-20 21:15:07 +01:00
tristan	8f5730c3f6	[#202 ] Authentification — Connexion utilisateur (JWT) (!5 ) \| Numéro du ticket \| Titre du ticket \| \|------------------\|-----------------\| \| #202 \| Authentification — Connexion utilisateur (JWT) \| ## Description de la PR [#202] Authentification — Connexion utilisateur (JWT) ## Modification du .env ## Check list - [x] Pas de régression - [ ] TU/TI/TF rédigée - [x] TU/TI/TF OK - [x] CHANGELOG modifié Reviewed-on: #5 Reviewed-by: THOLOT DECHENE Matthieu <matthieu@yuno.malio.fr> Co-authored-by: tristan <tristan@yuno.malio.fr> Co-committed-by: tristan <tristan@yuno.malio.fr>	2026-01-20 20:06:29 +00:00