Actualiser README.md

fix(machine) : add addConstructeur/removeConstructeur methods + fix fournisseur display
API Platform silently ignored the constructeurs field on PATCH because Machine was missing the add/remove methods (unlike Composant, Piece, Product). Also fixes the read-only fournisseur display overflow in MachineInfoCard. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-15 07:15:49 +00:00 · 2026-03-10 18:00:09 +01:00 · 2026-03-09 15:52:21 +01:00 · 2026-03-09 15:51:55 +01:00 · 2026-03-09 15:11:55 +01:00 · 2026-03-09 13:04:54 +01:00
91 changed files with 7134 additions and 3579 deletions
--- a/.env
+++ b/.env
@@ -16,7 +16,7 @@

 ###> symfony/framework-bundle ###
 APP_ENV=dev
-APP_SECRET=
+APP_SECRET=change_me_in_env_local
 APP_SHARE_DIR=var/share
 ###< symfony/framework-bundle ###

@@ -40,8 +40,3 @@ DEFAULT_URI=http://localhost
 CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
 ###< nelmio/cors-bundle ###

-###> lexik/jwt-authentication-bundle ###
-JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
-JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
-JWT_PASSPHRASE=281e2cd303ed9ba4a4a4074e19eac9cea505cc9d82ce79a448bb8eb00c636ebe
-###< lexik/jwt-authentication-bundle ###
--- a/.gitignore
+++ b/.gitignore
@@ -39,8 +39,13 @@ FEATURE_IDEAS.md
 ###< temp files ###

 ###> frontend ###
-/frontend/node_modules/
-/frontend/.nuxt/
-/frontend/.output/
-/frontend/dist/
+/frontend/
 ###< frontend ###
+
+###> ide ###
+/.idea/
+###< ide ###
+
+###> wsl ###
+*:Zone.Identifier
+###< wsl ###
--- a/.idea/.gitignore
+++ b/.idea/.gitignore
@@ -1,9 +0,0 @@
-# Default ignored files
-/shelf/
-# Ignored default folder with query files
-/queries/
-# Datasource local storage ignored files
-/dataSources/
-/dataSources.local.xml
-# Editor-based HTTP Client requests
-/httpRequests/
--- a/.idea/Inventory.iml
+++ b/.idea/Inventory.iml
@@ -1,144 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module type="WEB_MODULE" version="4">
-  <component name="NewModuleRootManager">
-    <content url="file://$MODULE_DIR$">
-      <sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" packagePrefix="App\" />
-      <sourceFolder url="file://$MODULE_DIR$/tests" isTestSource="true" packagePrefix="App\Tests\" />
-      <excludeFolder url="file://$MODULE_DIR$/public/bundles" />
-      <excludeFolder url="file://$MODULE_DIR$/var" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/doctrine-common" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/doctrine-orm" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/documentation" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/http-cache" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/hydra" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/json-schema" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/jsonld" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/metadata" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/openapi" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/serializer" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/state" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/symfony" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/api-platform/validator" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/clue/ndjson-react" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/composer" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/collections" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/common" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/dbal" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/deprecations" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/doctrine-bundle" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/doctrine-migrations-bundle" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/event-manager" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/inflector" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/instantiator" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/lexer" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/migrations" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/orm" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/persistence" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/sql-formatter" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/evenement/evenement" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/fidry/cpu-core-counter" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/friendsofphp/php-cs-fixer" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/nelmio/cors-bundle" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpdocumentor/reflection-common" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpdocumentor/reflection-docblock" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpdocumentor/type-resolver" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpstan/phpdoc-parser" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/psr/cache" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/psr/clock" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/psr/container" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/psr/event-dispatcher" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/psr/link" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/psr/log" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/react/cache" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/react/child-process" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/react/dns" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/react/event-loop" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/react/promise" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/react/socket" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/react/stream" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/diff" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/asset" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/cache" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/cache-contracts" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/clock" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/config" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/console" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/dependency-injection" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/deprecation-contracts" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/doctrine-bridge" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/dotenv" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/error-handler" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/event-dispatcher" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/event-dispatcher-contracts" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/expression-language" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/filesystem" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/finder" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/flex" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/framework-bundle" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/http-foundation" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/http-kernel" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/options-resolver" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/password-hasher" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/polyfill-intl-grapheme" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/polyfill-intl-normalizer" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/polyfill-mbstring" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/polyfill-php85" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/polyfill-uuid" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/process" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/property-access" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/property-info" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/routing" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/runtime" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/security-bundle" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/security-core" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/security-csrf" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/security-http" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/serializer" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/service-contracts" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/stopwatch" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/string" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/translation-contracts" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/twig-bridge" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/twig-bundle" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/type-info" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/uid" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/validator" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/var-dumper" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/var-exporter" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/web-link" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/yaml" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/twig/twig" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/webmozart/assert" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/willdurand/negotiation" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/myclabs/deep-copy" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/nikic/php-parser" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phar-io/manifest" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phar-io/version" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpunit/php-code-coverage" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpunit/php-file-iterator" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpunit/php-invoker" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpunit/php-text-template" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpunit/php-timer" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/phpunit/phpunit" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/cli-parser" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/comparator" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/complexity" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/environment" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/exporter" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/global-state" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/lines-of-code" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/object-enumerator" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/object-reflector" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/recursion-context" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/type" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/version" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/staabm/side-effects-detector" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/browser-kit" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/css-selector" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/dom-crawler" />
-      <excludeFolder url="file://$MODULE_DIR$/vendor/theseer/tokenizer" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>
--- a/.idea/codeStyles/codeStyleConfig.xml
+++ b/.idea/codeStyles/codeStyleConfig.xml
@@ -1,5 +0,0 @@
-<component name="ProjectCodeStyleConfiguration">
-  <state>
-    <option name="PREFERRED_PROJECT_CODE_STYLE" value="Default" />
-  </state>
-</component>
--- a/.idea/dataSources.xml
+++ b/.idea/dataSources.xml
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="DataSourceManagerImpl" format="xml" multifile-model="true">
-    <data-source source="LOCAL" name="ferme" uuid="f407a514-c6b4-4b26-9555-445a85892502">
-      <driver-ref>postgresql</driver-ref>
-      <synchronize>true</synchronize>
-      <jdbc-driver>org.postgresql.Driver</jdbc-driver>
-      <jdbc-url>jdbc:postgresql://localhost:5432/ferme</jdbc-url>
-      <working-dir>$ProjectFileDir$</working-dir>
-    </data-source>
-  </component>
-</project>
--- a/.idea/laravel-idea.xml
+++ b/.idea/laravel-idea.xml
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="InertiaPackage">
-    <option name="directoryPaths">
-      <list />
-    </option>
-  </component>
-</project>
--- a/.idea/material_theme_project_new.xml
+++ b/.idea/material_theme_project_new.xml
@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="MaterialThemeProjectNewConfig">
-    <option name="metadata">
-      <MTProjectMetadataState>
-        <option name="migrated" value="true" />
-        <option name="pristineConfig" value="false" />
-        <option name="userId" value="-70fca0d0:19b8da49b68:-7ffe" />
-      </MTProjectMetadataState>
-    </option>
-  </component>
-</project>
--- a/.idea/modules.xml
+++ b/.idea/modules.xml
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ProjectModuleManager">
-    <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/ferme.iml" filepath="$PROJECT_DIR$/.idea/ferme.iml" />
-    </modules>
-  </component>
-</project>
--- a/.idea/php.xml
+++ b/.idea/php.xml
@@ -1,160 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="MessDetectorOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PHPCSFixerOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PHPCodeSnifferOptionsConfiguration">
-    <option name="highlightLevel" value="WARNING" />
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PhpIncludePathManager">
-    <include_path>
-      <path value="$PROJECT_DIR$/vendor/symfony/framework-bundle" />
-      <path value="$PROJECT_DIR$/vendor/symfony/uid" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-normalizer" />
-      <path value="$PROJECT_DIR$/vendor/symfony/cache-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/finder" />
-      <path value="$PROJECT_DIR$/vendor/symfony/asset" />
-      <path value="$PROJECT_DIR$/vendor/symfony/var-exporter" />
-      <path value="$PROJECT_DIR$/vendor/symfony/runtime" />
-      <path value="$PROJECT_DIR$/vendor/symfony/error-handler" />
-      <path value="$PROJECT_DIR$/vendor/symfony/translation-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/clock" />
-      <path value="$PROJECT_DIR$/vendor/symfony/twig-bridge" />
-      <path value="$PROJECT_DIR$/vendor/symfony/event-dispatcher-contracts" />
-      <path value="$PROJECT_DIR$/vendor/theseer/tokenizer" />
-      <path value="$PROJECT_DIR$/vendor/symfony/doctrine-bridge" />
-      <path value="$PROJECT_DIR$/vendor/symfony/type-info" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/doctrine-migrations-bundle" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/deprecations" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/migrations" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/event-manager" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/doctrine-bundle" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/lexer" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/orm" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/inflector" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/sql-formatter" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/common" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/collections" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/instantiator" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/persistence" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/lines-of-code" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/type" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/dbal" />
-      <path value="$PROJECT_DIR$/vendor/evenement/evenement" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/diff" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/cli-parser" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/object-reflector" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/environment" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/complexity" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/comparator" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/recursion-context" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/exporter" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/global-state" />
-      <path value="$PROJECT_DIR$/vendor/webmozart/assert" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/object-enumerator" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/version" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/jsonld" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/hydra" />
-      <path value="$PROJECT_DIR$/vendor/willdurand/negotiation" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/http-cache" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/serializer" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/doctrine-orm" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/validator" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/state" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/metadata" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/symfony" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/openapi" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/documentation" />
-      <path value="$PROJECT_DIR$/vendor/friendsofphp/php-cs-fixer" />
-      <path value="$PROJECT_DIR$/vendor/phpdocumentor/type-resolver" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/json-schema" />
-      <path value="$PROJECT_DIR$/vendor/api-platform/doctrine-common" />
-      <path value="$PROJECT_DIR$/vendor/phpdocumentor/reflection-common" />
-      <path value="$PROJECT_DIR$/vendor/phpdocumentor/reflection-docblock" />
-      <path value="$PROJECT_DIR$/vendor/composer" />
-      <path value="$PROJECT_DIR$/vendor/psr/log" />
-      <path value="$PROJECT_DIR$/vendor/psr/link" />
-      <path value="$PROJECT_DIR$/vendor/psr/cache" />
-      <path value="$PROJECT_DIR$/vendor/psr/clock" />
-      <path value="$PROJECT_DIR$/vendor/clue/ndjson-react" />
-      <path value="$PROJECT_DIR$/vendor/psr/event-dispatcher" />
-      <path value="$PROJECT_DIR$/vendor/psr/container" />
-      <path value="$PROJECT_DIR$/vendor/nikic/php-parser" />
-      <path value="$PROJECT_DIR$/vendor/react/promise" />
-      <path value="$PROJECT_DIR$/vendor/twig/twig" />
-      <path value="$PROJECT_DIR$/vendor/fidry/cpu-core-counter" />
-      <path value="$PROJECT_DIR$/vendor/react/stream" />
-      <path value="$PROJECT_DIR$/vendor/react/child-process" />
-      <path value="$PROJECT_DIR$/vendor/react/cache" />
-      <path value="$PROJECT_DIR$/vendor/react/event-loop" />
-      <path value="$PROJECT_DIR$/vendor/nelmio/cors-bundle" />
-      <path value="$PROJECT_DIR$/vendor/staabm/side-effects-detector" />
-      <path value="$PROJECT_DIR$/vendor/react/socket" />
-      <path value="$PROJECT_DIR$/vendor/react/dns" />
-      <path value="$PROJECT_DIR$/vendor/phar-io/version" />
-      <path value="$PROJECT_DIR$/vendor/phpstan/phpdoc-parser" />
-      <path value="$PROJECT_DIR$/vendor/myclabs/deep-copy" />
-      <path value="$PROJECT_DIR$/vendor/phar-io/manifest" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-code-coverage" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-text-template" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-invoker" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-timer" />
-      <path value="$PROJECT_DIR$/vendor/symfony/flex" />
-      <path value="$PROJECT_DIR$/vendor/symfony/validator" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/phpunit" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-file-iterator" />
-      <path value="$PROJECT_DIR$/vendor/symfony/security-csrf" />
-      <path value="$PROJECT_DIR$/vendor/symfony/dependency-injection" />
-      <path value="$PROJECT_DIR$/vendor/symfony/security-bundle" />
-      <path value="$PROJECT_DIR$/vendor/symfony/deprecation-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/password-hasher" />
-      <path value="$PROJECT_DIR$/vendor/symfony/http-kernel" />
-      <path value="$PROJECT_DIR$/vendor/symfony/console" />
-      <path value="$PROJECT_DIR$/vendor/symfony/filesystem" />
-      <path value="$PROJECT_DIR$/vendor/symfony/cache" />
-      <path value="$PROJECT_DIR$/vendor/symfony/web-link" />
-      <path value="$PROJECT_DIR$/vendor/symfony/serializer" />
-      <path value="$PROJECT_DIR$/vendor/symfony/css-selector" />
-      <path value="$PROJECT_DIR$/vendor/symfony/twig-bundle" />
-      <path value="$PROJECT_DIR$/vendor/symfony/process" />
-      <path value="$PROJECT_DIR$/vendor/symfony/security-http" />
-      <path value="$PROJECT_DIR$/vendor/symfony/config" />
-      <path value="$PROJECT_DIR$/vendor/symfony/event-dispatcher" />
-      <path value="$PROJECT_DIR$/vendor/symfony/browser-kit" />
-      <path value="$PROJECT_DIR$/vendor/symfony/options-resolver" />
-      <path value="$PROJECT_DIR$/vendor/symfony/service-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/yaml" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-mbstring" />
-      <path value="$PROJECT_DIR$/vendor/symfony/string" />
-      <path value="$PROJECT_DIR$/vendor/symfony/property-access" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-uuid" />
-      <path value="$PROJECT_DIR$/vendor/symfony/property-info" />
-      <path value="$PROJECT_DIR$/vendor/symfony/dom-crawler" />
-      <path value="$PROJECT_DIR$/vendor/symfony/var-dumper" />
-      <path value="$PROJECT_DIR$/vendor/symfony/expression-language" />
-      <path value="$PROJECT_DIR$/vendor/symfony/http-foundation" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-php85" />
-      <path value="$PROJECT_DIR$/vendor/symfony/routing" />
-      <path value="$PROJECT_DIR$/vendor/symfony/security-core" />
-      <path value="$PROJECT_DIR$/vendor/symfony/dotenv" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-grapheme" />
-      <path value="$PROJECT_DIR$/vendor/symfony/stopwatch" />
-    </include_path>
-  </component>
-  <component name="PhpProjectSharedConfiguration" php_language_level="8.4" />
-  <component name="PhpStanOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PhpUnit">
-    <phpunit_settings>
-      <PhpUnitSettings custom_loader_path="$PROJECT_DIR$/vendor/autoload.php" />
-    </phpunit_settings>
-  </component>
-  <component name="PsalmOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-</project>
--- a/.idea/symfony2.xml
+++ b/.idea/symfony2.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="Symfony2PluginSettings">
-    <option name="pluginEnabled" value="true" />
-  </component>
-</project>
--- a/.idea/vcs.xml
+++ b/.idea/vcs.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="VcsDirectoryMappings">
-    <mapping directory="$PROJECT_DIR$" vcs="Git" />
-  </component>
-</project>
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ComposerSettings">
-    <execution />
-  </component>
-</project>
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -49,13 +49,14 @@ Inventory/                      # Backend Symfony (repo principal)
 # Docker
 make start                    # Démarrer les containers
 make stop                     # Arrêter
-make shell                    # Shell dans le container PHP
+make shell                    # Shell interactif (nécessite un TTY)
 make install                  # Install complet (composer + npm + build)

 # Backend
-make test                     # PHPUnit
-docker compose exec php vendor/bin/php-cs-fixer fix   # Linter PHP
-docker compose exec php php bin/console doctrine:migrations:migrate
+make test                     # PHPUnit (tous les tests)
+make test FILES=tests/Api/Entity/MachineTest.php   # Un test spécifique
+make php-cs-fixer-allow-risky # Linter PHP (cs-fixer)
+docker exec -u www-data php-inventory-apache php bin/console doctrine:migrations:migrate

 # Frontend (dans Inventory_frontend/)
 npm run dev                   # Dev server (port 3001)
@@ -98,7 +99,7 @@ Le frontend est un submodule git. Lors d'un commit frontend :
 ## Architecture Backend

 ### Entités Principales
-`Machine`, `Piece`, `Composant`, `Product`, `Constructeur`, `Site`, `TypeMachine`, `ModelType`, `CustomField`, `CustomFieldValue`, `Document`, `AuditLog`, `Comment`, `Profile`
+`Machine`, `Piece`, `Composant`, `Product`, `Constructeur`, `Site`, `ModelType`, `CustomField`, `CustomFieldValue`, `Document`, `AuditLog`, `Comment`, `Profile`, `MachineComponentLink`, `MachinePieceLink`, `MachineProductLink`

 ### Patterns
 - **IDs** : CUID-like strings (`'cl' + bin2hex(random_bytes(12))`), pas d'auto-increment
@@ -108,6 +109,16 @@ Le frontend est un submodule git. Lors d'un commit frontend :
 - **Audit** : Subscribers Doctrine `onFlush` capturent diff + snapshot complet
 - **Migrations** : Raw SQL PostgreSQL avec `IF NOT EXISTS`/`IF EXISTS` pour idempotence

+### Custom Controllers (pas API Platform)
+- `MachineStructureController` — `/api/machines/{id}/structure` (GET/PATCH) : hiérarchie complète machine avec normalisation JSON manuelle (pas Symfony Serializer). Source principale de données pour la page détail machine.
+- `MachineCustomFieldsController` — `/api/machines/{id}/add-custom-fields` (POST) : initialise les CustomFieldValue manquants pour une machine.
+- `CustomFieldValueController` — `/api/custom-fields/values/*` : CRUD + upsert pour les valeurs de champs perso.
+
+### Custom Fields — Architecture
+- **Composants/Pièces/Produits** : définitions dans le JSON `structure` du ModelType
+- **Machines** : définitions = entités `CustomField` liées directement via `machineId` FK (pas de ModelType)
+- Les deux partagent la même entité `CustomFieldValue` pour stocker les valeurs
+
 ### Rôles (hiérarchie)
 ```
 ROLE_ADMIN → ROLE_GESTIONNAIRE → ROLE_VIEWER → ROLE_USER
@@ -138,13 +149,18 @@ ROLE_ADMIN → ROLE_GESTIONNAIRE → ROLE_VIEWER → ROLE_USER

 ## Règles Importantes

+### CLAUDE.md — Maintenance obligatoire
+- **Toujours consulter** ce fichier en début de conversation pour respecter les conventions
+- **Mettre à jour** ce fichier quand une nouvelle convention, pattern ou décision architecturale est établie
+- **Utiliser comme source de vérité** pour les commandes, patterns et règles du projet
+
 ### Toujours faire AVANT de modifier du code
 1. **Lire le fichier** avant de l'éditer — ne jamais proposer de changements sur du code non lu
 2. **Comprendre le pattern existant** — reproduire le style du fichier (noms, indentation, structure)
 3. **Vérifier les deux repos** — un changement peut impacter backend ET frontend

 ### Après chaque modification
-1. Backend PHP : `docker compose exec php vendor/bin/php-cs-fixer fix`
+1. Backend PHP : `make php-cs-fixer-allow-risky`
 2. Frontend : `npm run lint:fix` puis `npx nuxi typecheck` si fichiers TS modifiés

 ### Ne jamais faire
@@ -161,6 +177,25 @@ Quand les branches `master` et `develop` divergent sur l'un des deux repos, **to
 - Main repo : `git checkout master && git merge develop && git push`
 - Frontend : `git checkout develop && git merge master && git push` (ou l'inverse selon le cas)

+## Tests
+
+### Stack de test
+- **PHPUnit 12** + **API Platform Test** (`ApiTestCase`)
+- **DAMA DoctrineTestBundle** — wrappe chaque test dans une transaction avec rollback automatique (pas de TRUNCATE)
+- Base de test : même PG, env `test`
+
+### Commandes
+Voir section "Key Commands". Commande additionnelle :
+```bash
+make test-setup               # Créer/mettre à jour le schéma test
+```
+
+### Pattern de test
+- Hériter de `AbstractApiTestCase` (helpers auth + factories)
+- Ne PAS faire de TRUNCATE/cleanup dans tearDown — DAMA s'en occupe par rollback
+- Factories : `createProfile()`, `createMachine()`, `createSite()`, `createComposant()`, `createPiece()`, `createProduct()`, `createCustomField()`, `createCustomFieldValue()`, `createModelType()`, `createMachineComponentLink()`, `createMachinePieceLink()`, `createMachineProductLink()`
+- Auth : `createViewerClient()`, `createGestionnaireClient()`, `createAdminClient()`
+
 ## URLs Locales
 - API Symfony : `http://localhost:8081/api`
 - Nuxt dev : `http://localhost:3001`
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -1,17 +1,29 @@
-# Inventory - Guide de Déploiement & Release
+# Inventory — Guide de Déploiement

-## Architecture
+Guide pour déployer l'application sur un serveur de production.
+
+## Architecture de production

 ```
-inventory.malio-dev.fr/     → Frontend Nuxt (statique)
-inventory.malio-dev.fr/api  → Backend Symfony (PHP-FPM)
+inventory.malio-dev.fr/     → Frontend Nuxt (fichiers statiques servis par Nginx)
+inventory.malio-dev.fr/api  → Backend Symfony (PHP-FPM derrière Nginx)
 ```

 | Composant | Technologie | Emplacement serveur |
 |-----------|-------------|---------------------|
 | Backend | Symfony 8 + API Platform | `/var/www/Inventory/` |
-| Frontend | Nuxt 4 (statique) | `/var/www/Inventory/Inventory_frontend/.output/public/` |
-| Base de données | PostgreSQL 16 | `inventory` |
+| Frontend | Nuxt 4 (site statique) | `/var/www/Inventory/Inventory_frontend/.output/public/` |
+| Base de données | PostgreSQL 16 | Base `inventory` |
+
+### Schéma simplifié
+
+```
+Navigateur
+    ↓ HTTPS
+Nginx (reverse proxy)
+    ├── /api/*  → PHP-FPM (Symfony)  → PostgreSQL
+    └── /*      → Fichiers statiques (Nuxt build)
+```

 ---

@@ -24,7 +36,8 @@ inventory.malio-dev.fr/api  → Backend Symfony (PHP-FPM)
 - **PostgreSQL** : 16
 - **Composer**

-Vérifier :
+### Vérification des prérequis
+
 ```bash
 php -v                    # PHP 8.4+
 php -m | grep -E 'pgsql|intl|zip|gd|mbstring'
@@ -73,10 +86,10 @@ psql -U ferme_user -h 127.0.0.1 -d inventory -f /tmp/backup_v1.0.0_clean.sql
 ```bash
 cd /var/www/Inventory

-# Installer les dépendances
+# Installer les dépendances (sans les outils de dev)
 composer install --no-dev --optimize-autoloader

-# Créer .env.local
+# Créer le fichier de configuration locale
 cat > .env.local << 'EOF'
 APP_ENV=prod
 APP_DEBUG=0
@@ -85,28 +98,20 @@ APP_SECRET=CHANGE_ME
 DATABASE_URL="postgresql://ferme_user:fermerecette@127.0.0.1:5432/inventory?serverVersion=16"

 CORS_ALLOW_ORIGIN='^https?://inventory\.malio-dev\.fr$'
-
-JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
-JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
-JWT_PASSPHRASE=inventoryjwt
 EOF

-# Générer APP_SECRET
+# Générer un secret aléatoire
 sed -i "s/CHANGE_ME/$(openssl rand -hex 32)/" .env.local

-# Générer les clés JWT
-mkdir -p config/jwt
-openssl genrsa -out config/jwt/private.pem -aes256 4096
-# Passphrase : inventoryjwt
-openssl rsa -pubout -in config/jwt/private.pem -out config/jwt/public.pem
-chmod 600 config/jwt/private.pem
-
-# Permissions
+# Permissions pour le dossier var/ (cache, logs)
 sudo chown -R www-data:www-data var/
 sudo chmod -R 775 var/

 # Vider le cache
 php bin/console cache:clear --env=prod
+
+# Appliquer les migrations (si première installation ou mise à jour)
+php bin/console doctrine:migrations:migrate --no-interaction
 ```

 ### 4. Configurer le frontend Nuxt
@@ -120,7 +125,7 @@ sudo chown -R malio:malio .
 # Installer les dépendances
 npm install

-# Créer .env
+# Créer le fichier d'environnement
 cat > .env << 'EOF'
 NUXT_PUBLIC_API_BASE_URL=http://inventory.malio-dev.fr/api
 EOF
@@ -141,7 +146,7 @@ server {
    listen 80;
    server_name inventory.malio-dev.fr;

-    # Gros fichiers (100MB max)
+    # Gros fichiers (100MB max pour les uploads de documents)
    client_max_body_size 100M;
    client_body_timeout 300s;
    send_timeout 300s;
@@ -149,12 +154,13 @@ server {
    access_log /var/log/nginx/inventory-access.log;
    error_log /var/log/nginx/inventory-error.log;

-    # Backend Symfony - /api
+    # Backend Symfony — toutes les requêtes /api
    location /api {
        root /var/www/Inventory/public;
        try_files $uri /index.php$is_args$args;
    }

+    # PHP-FPM (exécute le code PHP)
    location ~ ^/index\.php(/|$) {
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
@@ -165,27 +171,27 @@ server {
        internal;
    }

-    # Frontend statique
+    # Frontend statique — tout le reste
    location / {
        root /var/www/Inventory/Inventory_frontend/.output/public;
        index index.html;
-        try_files $uri $uri/ /index.html;
+        try_files $uri $uri/ /index.html;    # SPA fallback
    }
 }
 ```

-Activer :
+Activer le site :
 ```bash
 sudo ln -s /etc/nginx/sites-available/inventory /etc/nginx/sites-enabled/
-sudo nginx -t
+sudo nginx -t          # Vérifier la syntaxe
 sudo systemctl reload nginx
 ```

 ### 6. Vérifier

 ```bash
-curl http://inventory.malio-dev.fr
-curl http://inventory.malio-dev.fr/api
+curl http://inventory.malio-dev.fr          # Frontend
+curl http://inventory.malio-dev.fr/api      # API (doc Swagger)
 ```

 ---
@@ -197,12 +203,13 @@ curl http://inventory.malio-dev.fr/api
 ```bash
 cd /var/www/Inventory

-# Pull les changements
+# Récupérer les changements
 git pull
 git submodule update --init --recursive

 # Backend
 composer install --no-dev --optimize-autoloader
+php bin/console doctrine:migrations:migrate --no-interaction
 php bin/console cache:clear --env=prod
 sudo chown -R www-data:www-data var/

@@ -214,56 +221,76 @@ npx nuxi generate

 ---

-## Versioning & Releases
+## Backup base de données

-### Source de vérité
-
-Le fichier `VERSION` à la racine contient le numéro de version (ex: `1.0.0`).
-
-Cette version est synchronisée avec :
- Le footer de l'application
- `config/packages/api_platform.yaml`
-
-### Créer une release
+### Export (faire un backup)

 ```bash
-# Depuis le PC de dev
-./scripts/release.sh patch   # 1.0.0 → 1.0.1
-./scripts/release.sh minor   # 1.0.0 → 1.1.0
-./scripts/release.sh major   # 1.0.0 → 2.0.0
-./scripts/release.sh 2.0.0   # Version exacte
+pg_dump -U ferme_user -h 127.0.0.1 -d inventory \
+  --no-owner --no-acl --inserts --column-inserts \
+  --clean --if-exists > backup_inventory_$(date +%Y%m%d).sql
 ```

-Le script :
-1. Vérifie/commit le submodule frontend
-2. Met à jour `VERSION` et `api_platform.yaml`
-3. Commit et tag les deux repos
-4. Affiche les commandes pour push
-
-### Pousser la release
+### Import (restaurer un backup)

 ```bash
-# Frontend (submodule)
-cd Inventory_frontend && git push && git push --tags && cd ..
-
-# Backend
-git push && git push --tags
+psql -U ferme_user -h 127.0.0.1 -d inventory -f backup_inventory_YYYYMMDD.sql
 ```

-### Créer la release sur Gitea
-
-1. Aller sur le dépôt Gitea
-2. **Releases** > **New Release**
-3. Sélectionner le tag `vX.Y.Z`
-4. Ajouter les notes de release
-
 ---

-## Commandes utiles
+## Troubleshooting
+
+### Erreur 502 Bad Gateway
+
+PHP-FPM ne tourne pas ou est crashé :
+```bash
+systemctl status php8.4-fpm
+sudo systemctl restart php8.4-fpm
+```
+
+### Erreur 403 Forbidden
+
+Problème de permissions sur les fichiers :
+```bash
+sudo chown -R www-data:www-data /var/www/Inventory/var/
+sudo chmod -R 775 /var/www/Inventory/var/
+```
+
+### Erreur API "No route found"
+
+Le cache Symfony est probablement périmé :
+```bash
+php /var/www/Inventory/bin/console cache:clear --env=prod
+```
+
+### Frontend ne se met pas à jour
+
+Les fichiers statiques sont en cache. Rebuilder :
+```bash
+cd /var/www/Inventory/Inventory_frontend
+rm -rf .output
+npx nuxi generate
+```
+
+### L'API retourne 401 sur toutes les requêtes
+
+La session PHP ne se crée pas correctement. Vérifier :
+```bash
+# Vérifier que le dossier de sessions existe et est accessible
+ls -la /var/lib/php/sessions/
+# Ou vérifier les logs Symfony
+tail -f /var/www/Inventory/var/log/prod.log
+```
+
+---
+
+## Commandes utiles en production

 ```bash
 # Logs Nginx
 tail -f /var/log/nginx/inventory-error.log
+tail -f /var/log/nginx/inventory-access.log

 # Logs Symfony
 tail -f /var/www/Inventory/var/log/prod.log
@@ -274,55 +301,12 @@ php /var/www/Inventory/bin/console cache:clear --env=prod
 # Rebuild frontend
 cd /var/www/Inventory/Inventory_frontend && npx nuxi generate

-# Status PHP-FPM
+# Status des services
 systemctl status php8.4-fpm
+systemctl status nginx
+systemctl status postgresql

-# Reload Nginx
+# Redémarrer les services
+sudo systemctl restart php8.4-fpm
 sudo systemctl reload nginx
 ```
-
---
-
-## Backup base de données
-
-### Export
-```bash
-pg_dump -U ferme_user -h 127.0.0.1 -d inventory --no-owner --no-acl --inserts --column-inserts --clean --if-exists > backup_inventory_$(date +%Y%m%d).sql
-```
-
-### Import
-```bash
-psql -U ferme_user -h 127.0.0.1 -d inventory -f backup_inventory_YYYYMMDD.sql
-```
-
---
-
-## Troubleshooting
-
-### Erreur 502 Bad Gateway
-```bash
-# Vérifier PHP-FPM
-systemctl status php8.4-fpm
-sudo systemctl restart php8.4-fpm
-```
-
-### Erreur 403 Forbidden
-```bash
-# Vérifier les permissions
-sudo chown -R www-data:www-data /var/www/Inventory/var/
-sudo chmod -R 775 /var/www/Inventory/var/
-```
-
-### Erreur API "No route found"
-```bash
-# Vider le cache
-php /var/www/Inventory/bin/console cache:clear --env=prod
-```
-
-### Frontend ne se met pas à jour
-```bash
-# Rebuild
-cd /var/www/Inventory/Inventory_frontend
-rm -rf .output
-npx nuxi generate
-```
--- a/2
+++ b/2
--- a/README.md
+++ b/README.md
@@ -1,53 +1,88 @@
-# Inventory
+# InventoryTEST

 Application de gestion d'inventaire industriel pour **Malio**. Gestion complète du parc machines, des pièces, composants, produits, fournisseurs et documents associés, avec traçabilité et contrôle d'accès par rôles.

+## C'est quoi ce projet ?
+
+Inventory est une application web qui permet de gérer un parc de machines industrielles. Concrètement, elle permet de :
+
+- **Cataloguer** les machines d'une usine, site par site
+- **Décomposer** chaque machine en composants, pièces et produits (structure arborescente)
+- **Suivre** les fournisseurs/constructeurs de chaque élément
+- **Stocker** les documents techniques (PDF, images, fiches techniques)
+- **Tracer** toutes les modifications (qui a changé quoi, quand) via un journal d'audit
+- **Commenter** les fiches pour collaborer entre équipes
+- **Gérer les accès** avec un système de rôles (admin, gestionnaire, lecteur)
+
+L'application se compose de deux parties :
+- Un **backend** (API REST) qui gère les données, la sécurité et la logique métier
+- Un **frontend** (interface web) qui affiche les données et permet l'interaction utilisateur
+
 ## Stack technique

-| Couche | Technologie | Version |
-|--------|-------------|---------|
-| Backend | Symfony + API Platform | 8.0 / 4.2 |
-| PHP | PHP | >= 8.4 |
-| Base de données | PostgreSQL | 16 |
-| Frontend | Nuxt (SPA, SSR off) | 4 |
-| UI | Vue 3 Composition API + TypeScript | 3.5 / 5.7 |
-| CSS | TailwindCSS + DaisyUI | 4 / 5 |
-| Conteneurs | Docker Compose | |
+| Couche | Technologie | Version | Rôle |
+|--------|-------------|---------|------|
+| Backend | Symfony + API Platform | 8.0 / 4.2 | API REST, logique métier, sécurité |
+| PHP | PHP | >= 8.4 | Langage backend |
+| Base de données | PostgreSQL | 16 | Stockage des données |
+| Frontend | Nuxt (SPA, SSR off) | 4 | Framework web (rendu côté client) |
+| UI | Vue 3 Composition API + TypeScript | 3.5 / 5.7 | Composants d'interface |
+| CSS | TailwindCSS + DaisyUI | 4 / 5 | Mise en page et composants visuels |
+| Conteneurs | Docker Compose | | Environnement de développement |

 ## Prérequis

- **Docker** et **Docker Compose**
- **Node.js** >= 20 (via nvm)
- **make**
+- **Docker** et **Docker Compose** (pour lancer le projet sans rien installer)
+- **Node.js** >= 20 (via [nvm](https://github.com/nvm-sh/nvm))
+- **make** (normalement déjà installé sur Linux/macOS)

-### Installation de l'environnement
+### Guides d'installation de l'environnement

 | OS | Documentation |
 |----|---------------|
 | Windows | [WSL2 + Ubuntu + Docker](https://wiki.malio.fr/bookstack/books/environnement-de-dev/chapter/windows) |
 | Linux | [Docker + nvm](https://wiki.malio.fr/bookstack/books/environnement-de-dev/chapter/linux) |

-## Installation
+## Installation rapide

 ```bash
+# 1. Cloner le projet avec le frontend (submodule)
 git clone --recurse-submodules <url-du-repo>
 cd Inventory
+
+# 2. Démarrer les conteneurs Docker (PHP, PostgreSQL, Adminer)
 make start
+
+# 3. Installer les dépendances et builder le projet
 make install
 ```

 > Si `make start` échoue sur le port de la BDD, modifier `POSTGRES_PORT` dans `docker/.env.docker.local`.

+### Que fait `make install` ?
+
+1. Installe les dépendances PHP (via Composer)
+2. Installe les dépendances Node.js (via npm)
+3. Build le frontend Nuxt
+
+### Premier lancement
+
+Une fois l'installation terminée, tu peux :
+
+1. Charger des données de test : `make fixtures-load`
+2. Lancer le frontend en mode dev : `make dev-nuxt`
+3. Ouvrir l'application : http://localhost:3001
+
 ## URLs locales

-| Service | URL |
-|---------|-----|
-| API Symfony | http://localhost:8081/api |
-| Frontend Nuxt | http://localhost:3001 |
-| Adminer (BDD) | http://localhost:5050 |
-| PostgreSQL | `localhost:5433` (user: root, pass: root, db: inventory) |
+| Service | URL | Description |
+|---------|-----|-------------|
+| API Symfony | http://localhost:8081/api | Documentation interactive de l'API (Swagger) |
+| Frontend Nuxt | http://localhost:3001 | L'application web |
+| Adminer (BDD) | http://localhost:5050 | Interface web pour explorer la base de données |
+| PostgreSQL | `localhost:5433` | Connexion directe (user: root, pass: root, db: inventory) |

-## Commandes
+## Commandes utiles

 ### Docker

@@ -56,26 +91,28 @@ make install
 | `make start` | Démarrer les conteneurs |
 | `make stop` | Arrêter les conteneurs |
 | `make restart` | Redémarrer les conteneurs |
-| `make shell` | Shell bash dans le conteneur PHP |
-| `make reset` | Reset complet (supprime volumes, réinstalle) |
+| `make shell` | Ouvrir un terminal dans le conteneur PHP (pour lancer des commandes Symfony) |
+| `make reset` | Reset complet (supprime les volumes, réinstalle tout) |

 ### Backend

 | Commande | Description |
 |----------|-------------|
 | `make test` | Lancer les tests PHPUnit |
-| `make php-cs-fixer-allow-risky` | Formatter le code PHP |
-| `make cache-clear` | Vider le cache Symfony |
-| `make db-reset` | Reset de la BDD (supprime les données) |
-| `make fixtures-load` | Charger les fixtures SQL |
-| `make fixtures-dump` | Dumper la BDD dans fixtures/data.sql |
+| `make test FILES=tests/Api/Entity/MachineTest.php` | Lancer un test spécifique |
+| `make test-setup` | Créer/mettre à jour la base de test |
+| `make php-cs-fixer-allow-risky` | Formatter le code PHP (indentation, espaces, etc.) |
+| `make cache-clear` | Vider le cache Symfony (à faire si tu as des erreurs bizarres) |
+| `make db-reset` | Reset de la BDD (supprime toutes les données) |
+| `make fixtures-load` | Charger les données de test |
+| `make fixtures-dump` | Sauvegarder la BDD actuelle dans fixtures/data.sql |

 ### Frontend

 | Commande | Description |
 |----------|-------------|
-| `make dev-nuxt` | Serveur de dev Nuxt |
-| `make build-nuxtJS` | Build de production |
+| `make dev-nuxt` | Lancer le serveur de dev Nuxt (avec rechargement automatique) |
+| `make build-nuxtJS` | Builder le frontend pour la production |

 ### Release

@@ -85,79 +122,115 @@ make install

 Synchronise automatiquement la version dans `VERSION`, `api_platform.yaml` et `nuxt.config.ts`, crée le tag git et pousse les deux repos.

-## Architecture
+## Architecture globale
+
+### Comment ça marche ?
+
+```
+┌──────────────────┐     HTTP (JSON)     ┌──────────────────┐     SQL      ┌────────────┐
+│    Frontend      │ ◄─────────────────► │     Backend      │ ◄──────────► │ PostgreSQL │
+│   (Nuxt/Vue)     │   cookies session   │  (Symfony/API)   │              │   (BDD)    │
+│  localhost:3001   │                     │  localhost:8081   │              │  port 5433 │
+└──────────────────┘                     └──────────────────┘              └────────────┘
+       │                                         │
+  Interface web                            API REST + logique
+  pour l'utilisateur                       métier + sécurité
+```
+
+1. L'utilisateur ouvre le navigateur sur `localhost:3001`
+2. Le frontend (Vue/Nuxt) affiche l'interface
+3. Quand l'utilisateur fait une action (créer une machine, etc.), le frontend envoie une requête HTTP à l'API backend
+4. Le backend valide la requête, vérifie les permissions, exécute la logique métier
+5. Le backend lit/écrit dans PostgreSQL et renvoie une réponse JSON
+6. Le frontend met à jour l'interface avec les nouvelles données

 ### Structure du projet

 ```
 Inventory/                          # Backend Symfony (repo principal)
 ├── src/
-│   ├── Entity/                     # 20 entités Doctrine (attributs PHP 8)
-│   ├── Controller/                 # 16 contrôleurs custom
-│   ├── EventSubscriber/            # 9 subscribers (audit onFlush)
-│   ├── EventListener/              # Listeners documents (cleanup, compression)
-│   ├── Command/                    # 3 commandes CLI
-│   ├── Service/                    # 3 services (stockage, conversion, PDF)
-│   ├── State/                      # 3 processeurs API Platform
-│   ├── Repository/                 # 19 repositories Doctrine
-│   ├── Security/                   # Authenticateur session
-│   └── Serializer/                 # Normalizer custom (Document)
-├── config/                         # Configuration Symfony
-├── migrations/                     # 4 migrations Doctrine (SQL PostgreSQL)
+│   ├── Entity/                     # Les "modèles" de données (Machine, Piece, etc.)
+│   ├── Controller/                 # Les endpoints API personnalisés
+│   ├── EventSubscriber/            # Logique déclenchée automatiquement (audit, etc.)
+│   ├── Command/                    # Commandes CLI (lancer via php bin/console)
+│   ├── Service/                    # Services métier (stockage fichiers, PDF, etc.)
+│   ├── State/                      # Processeurs API Platform (hashage mot de passe, upload)
+│   ├── Repository/                 # Requêtes BDD personnalisées
+│   ├── Security/                   # Authentification par session
+│   └── Serializer/                 # Conversion entité ↔ JSON personnalisée
+├── config/                         # Configuration Symfony (routes, sécurité, etc.)
+├── migrations/                     # Scripts de modification de la BDD
 ├── fixtures/                       # Données de test (SQL)
+├── tests/                          # Tests automatisés (PHPUnit)
 ├── scripts/                        # Utilitaires (release, migration, normalisation)
 ├── docker/                         # Dockerfile + config Docker
-├── makefile                        # Commandes de dev
-├── VERSION                         # Version courante (semver)
-└── Inventory_frontend/             # Submodule git (repo séparé)
-    ├── app/pages/                  # 36 pages Nuxt (file-based routing)
-    ├── app/components/             # 57 composants Vue
-    ├── app/composables/            # 45 composables
-    └── app/shared/                 # Types, utils, validation
+├── makefile                        # Commandes de dev raccourcies
+├── VERSION                         # Version courante (ex: 1.8.1)
+└── Inventory_frontend/             # Submodule git (frontend, repo séparé)
+    ├── app/pages/                  # Les pages de l'app (1 fichier = 1 route URL)
+    ├── app/components/             # Composants Vue réutilisables
+    ├── app/composables/            # Logique métier partagée (appels API, états)
+    ├── app/shared/                 # Types TypeScript, utilitaires, validation
+    ├── app/middleware/              # Vérification de session automatique
+    └── app/services/               # Couche service (wrappers API)
 ```

-### Entités principales
+### Entités principales (les "tables" de la BDD)

-| Entité | Description |
-|--------|-------------|
-| `Machine` | Machines du parc industriel |
-| `Composant` | Composants rattachés aux machines |
-| `Piece` | Pièces détachées |
-| `Product` | Produits (consommables, outillage) |
-| `Site` | Sites physiques / usines |
-| `Constructeur` | Fournisseurs / fabricants |
-| `TypeMachine` | Types de machines avec squelettes de structure |
-| `ModelType` | Catégories (pièce, composant, produit) avec champs personnalisés |
-| `CustomField` / `CustomFieldValue` | Champs personnalisés extensibles |
-| `Document` | Documents uploadés (stockage fichier + compression PDF) |
-| `AuditLog` | Journal d'audit (diff + snapshot) |
-| `Comment` | Commentaires / tickets sur les fiches |
-| `Profile` | Utilisateurs avec rôles |
+| Entité | Description | Exemple |
+|--------|-------------|---------|
+| `Machine` | Machines du parc industriel | "CNC Mazak 01" |
+| `Composant` | Composants fonctionnels d'une machine | "Broche principale" |
+| `Piece` | Pièces détachées/de rechange | "Roulement SKF 6205" |
+| `Product` | Produits fournisseur (consommables, outillage) | "Huile de coupe X" |
+| `Site` | Sites physiques / usines | "Usine de Strasbourg" |
+| `Constructeur` | Fournisseurs / fabricants | "SKF", "Mazak" |
+| `ModelType` | Catégories avec squelettes de structure | "Type: Moteur électrique" |
+| `CustomField` / `CustomFieldValue` | Champs personnalisés (dynamiques) | "Tension : 220V" |
+| `Document` | Documents uploadés (PDF, images, etc.) | "Fiche technique CNC.pdf" |
+| `AuditLog` | Journal d'audit (historique des modifications) | "Machine X modifiée par Jean" |
+| `Comment` | Commentaires / tickets sur les fiches | "Vérifier le roulement" |
+| `Profile` | Comptes utilisateurs avec rôles | "admin@malio.fr (ADMIN)" |

-### Commandes Symfony
+### Structure hiérarchique d'une machine

-| Commande | Description |
-|----------|-------------|
-| `app:compress-pdf` | Compresser les PDFs existants (supporte `--dry-run`) |
-| `app:migrate-documents-to-filesystem` | Migrer les documents Base64 vers le système de fichiers |
-| `app:init-profile-passwords` | Initialiser mots de passe et rôles en masse |
+Une machine peut contenir une arborescence de composants, pièces et produits :
+
+```
+Machine "CNC Mazak 01"
+├── Composant "Broche principale"
+│   ├── Pièce "Roulement avant"
+│   │   └── Produit "Graisse SKF LGMT2"
+│   └── Pièce "Joint d'étanchéité"
+├── Composant "Système hydraulique"
+│   ├── Pièce "Pompe HP"
+│   └── Produit "Huile hydraulique ISO 46"
+└── Produit "Filtre à air cabine"
+```

 ### Rôles et permissions

 ```
-ROLE_ADMIN → ROLE_GESTIONNAIRE → ROLE_VIEWER → ROLE_USER
+ROLE_ADMIN           → Tout faire + gérer les utilisateurs
+  ↓ hérite de
+ROLE_GESTIONNAIRE    → Créer, modifier, supprimer les données
+  ↓ hérite de
+ROLE_VIEWER          → Lecture seule sur toutes les données
+  ↓ hérite de
+ROLE_USER            → Accès de base (rôle minimum)
 ```

- **ADMIN** : accès complet, gestion des profils
- **GESTIONNAIRE** : CRUD sur toutes les entités, résolution des commentaires
- **VIEWER** : lecture seule sur toutes les entités
- **USER** : accès de base
-
 ### Authentification

-Authentification par **session (cookies)**, pas de JWT. Le profil actif est stocké en session côté serveur.
+Authentification par **session (cookies)**, pas de JWT. Le profil actif est stocké en session côté serveur. Concrètement :

-### Base de données
+1. L'utilisateur choisit son profil sur la page de login
+2. Il entre son mot de passe
+3. Le backend crée une session et envoie un cookie au navigateur
+4. À chaque requête suivante, le navigateur envoie automatiquement ce cookie
+5. Le backend vérifie le cookie et identifie l'utilisateur
+
+### Base de données — Points importants

 PostgreSQL 16 avec les particularités suivantes :
 - **IDs** : chaînes CUID (`'cl' + bin2hex(random_bytes(12))`), pas d'auto-increment
@@ -171,7 +244,7 @@ PostgreSQL 16 avec les particularités suivantes :
 |---------|-------|------|------|
 | `web` | PHP 8.4 + Apache + Node | 8081, 3001 | API Symfony + Nuxt dev |
 | `db` | PostgreSQL 16 Alpine | 5433 | Base de données |
-| `adminer` | Adminer | 5050 | Interface web BDD |
+| `adminer` | Adminer | 5050 | Interface web pour explorer la BDD |

 ## Xdebug

@@ -191,30 +264,42 @@ Configuration PhpStorm / VSCode :
 - `develop` : branche principale de dev (cible des PR)
 - `feat/xxx`, `fix/xxx`, `refactor/xxx` : branches de travail

-### Convention de commit
+### Convention de commit (enforced par un hook)

 ```
 <type>(<scope>) : <message>
 ```

-**Espace obligatoire autour du `:`**. Types : `feat`, `fix`, `perf`, `refactor`, `chore`, `docs`, `test`, `style`, `build`, `ci`, `revert`, `wip`.
+**Espace obligatoire autour du `:`**. Types autorisés (minuscules) :
+`feat`, `fix`, `perf`, `refactor`, `chore`, `docs`, `test`, `style`, `build`, `ci`, `revert`, `wip`
+
+Exemples :
+```
+feat(machines) : add clone functionality
+fix(documents) : prevent duplicate upload
+refactor(audit) : merge history controllers
+chore(deps) : update composer packages
+```

 ### Pre-commit hook

-1. php-cs-fixer sur les fichiers PHP stagés
-2. PHPUnit — bloque le commit si les tests échouent
+Le hook `pre-commit` s'exécute automatiquement avant chaque commit :
+1. **php-cs-fixer** — Formate automatiquement les fichiers PHP modifiés
+2. **PHPUnit** — Lance les tests. Si un test échoue, le commit est bloqué

 ### Submodule frontend

-Le frontend est un **submodule git** dans `Inventory_frontend/`. Workflow :
+Le frontend est un **submodule git** dans `Inventory_frontend/` (c'est un repo git séparé, inclus dans le repo principal). Workflow de commit :

 1. Commiter dans `Inventory_frontend/` d'abord
-2. Commiter dans le repo principal pour mettre à jour le pointeur
+2. Commiter dans le repo principal pour mettre à jour le pointeur du submodule
 3. Pousser les deux repos

-## Documentation complémentaire
+## Documentation détaillée

- [DEPLOY.md](DEPLOY.md) : guide de déploiement serveur (Nginx, PHP-FPM, PostgreSQL)
- [RELEASE.md](RELEASE.md) : processus de release et versioning
- [CHANGELOG.md](CHANGELOG.md) : historique des versions
- [Frontend README](Inventory_frontend/README.md) : documentation du frontend Nuxt
+- **[docs/BACKEND.md](docs/BACKEND.md)** : guide complet du backend (entités, controllers, API, audit, tests)
+- **[docs/FRONTEND.md](docs/FRONTEND.md)** : guide complet du frontend (pages, composables, composants, patterns)
+- **[DEPLOY.md](DEPLOY.md)** : guide de déploiement serveur (Nginx, PHP-FPM, PostgreSQL)
+- **[RELEASE.md](RELEASE.md)** : processus de release et versioning
+- **[CHANGELOG.md](CHANGELOG.md)** : historique des versions
+- **[Frontend README](Inventory_frontend/README.md)** : documentation du frontend Nuxt
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -1,12 +1,18 @@
 # Guide de Release

-## Versioning
+## C'est quoi une release ?

-Le projet utilise le [Semantic Versioning](https://semver.org/) (SemVer) : `MAJOR.MINOR.PATCH`
+Une release c'est une **version officielle** de l'application. Chaque release a un numéro de version (ex: `1.8.1`) et est marquée par un **tag git**.

- **MAJOR** : Changements incompatibles avec les versions précédentes
- **MINOR** : Nouvelles fonctionnalités rétrocompatibles
- **PATCH** : Corrections de bugs rétrocompatibles
+## Versioning (Semantic Versioning)
+
+Le projet utilise le [Semantic Versioning](https://semver.org/) : `MAJOR.MINOR.PATCH`
+
+| Type | Quand l'utiliser | Exemple |
+|------|------------------|---------|
+| **PATCH** | Correction de bug, pas de nouvelle fonctionnalité | `1.8.0` → `1.8.1` |
+| **MINOR** | Nouvelle fonctionnalité, rétrocompatible | `1.8.1` → `1.9.0` |
+| **MAJOR** | Changement majeur, potentiellement incompatible | `1.9.0` → `2.0.0` |

 La version est centralisée dans le fichier `VERSION` à la racine du projet.

@@ -14,9 +20,9 @@ La version est centralisée dans le fichier `VERSION` à la racine du projet.

 ### Prérequis

- Tous les changements doivent être commités
- Les tests doivent passer
- Être sur la branche à releaser (ex: `main`, `develop`)
+- Tous les changements doivent être commités (pas de fichiers modifiés non commités)
+- Les tests doivent passer (`make test`)
+- Être sur la branche à releaser (généralement `develop` ou `master`)

 ### Utilisation du script

@@ -24,28 +30,38 @@ La version est centralisée dans le fichier `VERSION` à la racine du projet.
 # Afficher l'aide et la version actuelle
 ./scripts/release.sh

-# Bump patch : 1.0.0 → 1.0.1
+# Bump patch : 1.8.1 → 1.8.2
 ./scripts/release.sh patch

-# Bump minor : 1.0.0 → 1.1.0
+# Bump minor : 1.8.1 → 1.9.0
 ./scripts/release.sh minor

-# Bump major : 1.0.0 → 2.0.0
+# Bump major : 1.8.1 → 2.0.0
 ./scripts/release.sh major

 # Version spécifique
 ./scripts/release.sh 2.0.0
 ```

-Le script :
-1. Met à jour le fichier `VERSION`
-2. Met à jour `config/packages/api_platform.yaml`
-3. Crée un commit `chore(release): vX.Y.Z`
-4. Crée le tag `vX.Y.Z`
+### Que fait le script ?
+
+1. Vérifie qu'il n'y a pas de changements non commités
+2. Vérifie/commit le submodule frontend si nécessaire
+3. Met à jour le fichier `VERSION` avec le nouveau numéro
+4. Met à jour `config/packages/api_platform.yaml` (version affichée dans l'API)
+5. Crée un commit `chore(release) : vX.Y.Z`
+6. Crée le tag git `vX.Y.Z`
+7. Affiche les commandes pour pousser

 ### Pousser la release

+Après avoir exécuté le script :
+
 ```bash
+# Pousser le frontend d'abord (si modifié)
+cd Inventory_frontend && git push && git push --tags && cd ..
+
+# Pousser le backend
 git push && git push --tags
 ```

@@ -54,12 +70,21 @@ git push && git push --tags
 1. Aller sur le dépôt Gitea
 2. **Releases** > **New Release**
 3. Sélectionner le tag `vX.Y.Z`
-4. Titre : `v1.0.0` (ou avec un nom descriptif)
-5. Description : résumé des changements (voir section Notes de release)
+4. Titre : `vX.Y.Z` (ou avec un nom descriptif)
+5. Description : résumé des changements (copier depuis CHANGELOG.md)
+
+## Fichiers impactés par le versioning
+
+| Fichier | Rôle |
+|---------|------|
+| `VERSION` | Source unique de vérité |
+| `config/packages/api_platform.yaml` | Version affichée dans la doc API (Swagger) |
+| `Inventory_frontend/nuxt.config.ts` | Lit `VERSION` au build pour l'afficher dans le footer |
+| Footer de l'app | Affiche `v{{ appVersion }}` |

 ## Notes de release

-Template pour les notes de release :
+Template pour les notes de release (à copier dans Gitea) :

 ```markdown
 ## Nouveautés
@@ -73,66 +98,25 @@ Template pour les notes de release :
 ## Changements
 - Refactoring de Z
 - Mise à jour des dépendances
+
+## Migration requise
+\`\`\`bash
+docker compose exec web php bin/console doctrine:migrations:migrate
+\`\`\`
 ```

-## Fichiers impactés par le versioning
+## Déploiement après une release

-| Fichier | Usage |
-|---------|-------|
-| `VERSION` | Source unique de vérité |
-| `config/packages/api_platform.yaml` | Version affichée dans l'API |
-| `Inventory_frontend/nuxt.config.ts` | Lit VERSION au build |
-| Footer de l'app | Affiche `v{{ appVersion }}` |
+Voir [DEPLOY.md](DEPLOY.md) pour les instructions de mise à jour en production.

-## Déploiement en production
-
-### 1. Base de données
-
-Dump de la base locale :
-```bash
-pg_dump -h localhost -p 5433 -U root -d inventory > backup_v1.0.0.sql
-```
-
-Import en production :
-```bash
-psql -h <PROD_HOST> -U <PROD_USER> -d inventory < backup_v1.0.0.sql
-```
-
-### 2. Variables d'environnement production
-
-Créer un fichier `.env.local` en production avec :
-
-```env
-APP_ENV=prod
-APP_SECRET=<générer avec: openssl rand -hex 32>
-DATABASE_URL="postgresql://user:password@host:5432/inventory?serverVersion=16"
-CORS_ALLOW_ORIGIN='^https://votre-domaine\.com$'
-JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
-JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
-JWT_PASSPHRASE=<votre-passphrase>
-```
-
-### 3. Build production
-
-Backend :
+En résumé :
 ```bash
+# Sur le serveur de production
+cd /var/www/Inventory
+git pull
+git submodule update --init --recursive
 composer install --no-dev --optimize-autoloader
-php bin/console cache:clear --env=prod
 php bin/console doctrine:migrations:migrate --no-interaction
+php bin/console cache:clear --env=prod
+cd Inventory_frontend && npm install && npx nuxi generate
 ```
-
-Frontend :
-```bash
-cd Inventory_frontend
-NUXT_PUBLIC_API_BASE_URL=https://api.votre-domaine.com yarn build
-```
-
-### 4. Checklist avant mise en prod
-
- [ ] Tests passent
- [ ] Migrations DB testées
- [ ] Variables d'environnement configurées
- [ ] Clés JWT générées
- [ ] CORS configuré
- [ ] SSL/HTTPS actif
- [ ] Backup de la DB prod existante (si upgrade)
--- a/2
+++ b/2
@@ -1 +1 @@
-1.8.1
+1.9.0
--- a/composer.json
+++ b/composer.json
@@ -86,9 +86,11 @@
        }
    },
    "require-dev": {
+        "dama/doctrine-test-bundle": "^8.6",
        "friendsofphp/php-cs-fixer": "^3.92",
        "phpunit/phpunit": "^12.5",
        "symfony/browser-kit": "8.0.*",
-        "symfony/css-selector": "8.0.*"
+        "symfony/css-selector": "8.0.*",
+        "symfony/http-client": "8.0.*"
    }
 }
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "9e0e35659f9b6ef5c0a60262a36b61f2",
+    "content-hash": "97c89001351c3dcf060e2b9b5f37a8a6",
    "packages": [
        {
            "name": "api-platform/doctrine-common",
@@ -7980,6 +7980,75 @@
            ],
            "time": "2024-05-06T16:37:16+00:00"
        },
+        {
+            "name": "dama/doctrine-test-bundle",
+            "version": "v8.6.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/dmaicher/doctrine-test-bundle.git",
+                "reference": "f7e3487643e685432f7e27c50cac64e9f8c515a4"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/dmaicher/doctrine-test-bundle/zipball/f7e3487643e685432f7e27c50cac64e9f8c515a4",
+                "reference": "f7e3487643e685432f7e27c50cac64e9f8c515a4",
+                "shasum": ""
+            },
+            "require": {
+                "doctrine/dbal": "^3.3 || ^4.0",
+                "doctrine/doctrine-bundle": "^2.11.0 || ^3.0",
+                "php": ">= 8.2",
+                "psr/cache": "^2.0 || ^3.0",
+                "symfony/cache": "^6.4 || ^7.3 || ^8.0",
+                "symfony/framework-bundle": "^6.4 || ^7.3 || ^8.0"
+            },
+            "conflict": {
+                "phpunit/phpunit": "<11.0"
+            },
+            "require-dev": {
+                "behat/behat": "^3.0",
+                "friendsofphp/php-cs-fixer": "^3.27",
+                "phpstan/phpstan": "^2.0",
+                "phpunit/phpunit": "^11.5.41|| ^12.3.14",
+                "symfony/dotenv": "^6.4 || ^7.3 || ^8.0",
+                "symfony/process": "^6.4 || ^7.3 || ^8.0"
+            },
+            "type": "symfony-bundle",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "8.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "DAMA\\DoctrineTestBundle\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "David Maicher",
+                    "email": "mail@dmaicher.de"
+                }
+            ],
+            "description": "Symfony bundle to isolate doctrine database tests and improve test performance",
+            "keywords": [
+                "doctrine",
+                "isolation",
+                "performance",
+                "symfony",
+                "testing",
+                "tests"
+            ],
+            "support": {
+                "issues": "https://github.com/dmaicher/doctrine-test-bundle/issues",
+                "source": "https://github.com/dmaicher/doctrine-test-bundle/tree/v8.6.0"
+            },
+            "time": "2026-01-21T07:39:44+00:00"
+        },
        {
            "name": "evenement/evenement",
            "version": "v3.0.2",
@@ -10344,16 +10413,16 @@
        },
        {
            "name": "symfony/browser-kit",
-            "version": "v8.0.3",
+            "version": "v8.0.4",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/browser-kit.git",
-                "reference": "efc7cc6d442b80c8cb0ad0b29bdb0c9418cee9ee"
+                "reference": "0d998c101e1920fc68572209d1316fec0db728ef"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/browser-kit/zipball/efc7cc6d442b80c8cb0ad0b29bdb0c9418cee9ee",
-                "reference": "efc7cc6d442b80c8cb0ad0b29bdb0c9418cee9ee",
+                "url": "https://api.github.com/repos/symfony/browser-kit/zipball/0d998c101e1920fc68572209d1316fec0db728ef",
+                "reference": "0d998c101e1920fc68572209d1316fec0db728ef",
                "shasum": ""
            },
            "require": {
@@ -10392,7 +10461,7 @@
            "description": "Simulates the behavior of a web browser, allowing you to make requests, click on links and submit forms programmatically",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/browser-kit/tree/v8.0.3"
+                "source": "https://github.com/symfony/browser-kit/tree/v8.0.4"
            },
            "funding": [
                {
@@ -10412,7 +10481,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-12-16T08:10:18+00:00"
+            "time": "2026-01-13T13:06:50+00:00"
        },
        {
            "name": "symfony/css-selector",
@@ -10553,6 +10622,180 @@
            ],
            "time": "2025-12-06T17:00:47+00:00"
        },
+        {
+            "name": "symfony/http-client",
+            "version": "v8.0.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/http-client.git",
+                "reference": "ade9bd433450382f0af154661fc8e72758b4de36"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/http-client/zipball/ade9bd433450382f0af154661fc8e72758b4de36",
+                "reference": "ade9bd433450382f0af154661fc8e72758b4de36",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.4",
+                "psr/log": "^1|^2|^3",
+                "symfony/http-client-contracts": "~3.4.4|^3.5.2",
+                "symfony/service-contracts": "^2.5|^3"
+            },
+            "conflict": {
+                "amphp/amp": "<3",
+                "php-http/discovery": "<1.15"
+            },
+            "provide": {
+                "php-http/async-client-implementation": "*",
+                "php-http/client-implementation": "*",
+                "psr/http-client-implementation": "1.0",
+                "symfony/http-client-implementation": "3.0"
+            },
+            "require-dev": {
+                "amphp/http-client": "^5.3.2",
+                "amphp/http-tunnel": "^2.0",
+                "guzzlehttp/promises": "^1.4|^2.0",
+                "nyholm/psr7": "^1.0",
+                "php-http/httplug": "^1.0|^2.0",
+                "psr/http-client": "^1.0",
+                "symfony/cache": "^7.4|^8.0",
+                "symfony/dependency-injection": "^7.4|^8.0",
+                "symfony/http-kernel": "^7.4|^8.0",
+                "symfony/messenger": "^7.4|^8.0",
+                "symfony/process": "^7.4|^8.0",
+                "symfony/rate-limiter": "^7.4|^8.0",
+                "symfony/stopwatch": "^7.4|^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\HttpClient\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Provides powerful methods to fetch HTTP resources synchronously or asynchronously",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "http"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/http-client/tree/v8.0.7"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-03-06T13:17:40+00:00"
+        },
+        {
+            "name": "symfony/http-client-contracts",
+            "version": "v3.6.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/http-client-contracts.git",
+                "reference": "75d7043853a42837e68111812f4d964b01e5101c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/http-client-contracts/zipball/75d7043853a42837e68111812f4d964b01e5101c",
+                "reference": "75d7043853a42837e68111812f4d964b01e5101c",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/contracts",
+                    "name": "symfony/contracts"
+                },
+                "branch-alias": {
+                    "dev-main": "3.6-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Contracts\\HttpClient\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Test/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Generic abstractions related to HTTP clients",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "abstractions",
+                "contracts",
+                "decoupling",
+                "interfaces",
+                "interoperability",
+                "standards"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/http-client-contracts/tree/v3.6.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-04-29T11:18:49+00:00"
+        },
        {
            "name": "symfony/options-resolver",
            "version": "v8.0.0",
--- a/config/bundles.php
+++ b/config/bundles.php
@@ -3,6 +3,7 @@
 declare(strict_types=1);

 use ApiPlatform\Symfony\Bundle\ApiPlatformBundle;
+use DAMA\DoctrineTestBundle\DAMADoctrineTestBundle;
 use Doctrine\Bundle\DoctrineBundle\DoctrineBundle;
 use Doctrine\Bundle\MigrationsBundle\DoctrineMigrationsBundle;
 use Lexik\Bundle\JWTAuthenticationBundle\LexikJWTAuthenticationBundle;
@@ -20,4 +21,5 @@ return [
    NelmioCorsBundle::class             => ['all' => true],
    ApiPlatformBundle::class            => ['all' => true],
    LexikJWTAuthenticationBundle::class => ['all' => true],
+    DAMADoctrineTestBundle::class       => ['test' => true],
 ];
--- a/config/packages/api_platform.yaml
+++ b/config/packages/api_platform.yaml
@@ -1,5 +1,6 @@
 api_platform:
-    title: Hello API Platform
+    title: Inventory API
+    description: API de gestion d'inventaire industriel — machines, pièces, composants, produits.
    version: 1.8.1
    defaults:
        stateless: false
@@ -7,3 +8,5 @@ api_platform:
            vary: ['Content-Type', 'Authorization', 'Origin']
        pagination_items_per_page: 30
        pagination_maximum_items_per_page: 200
+        pagination_fetch_join_collection: true
+        pagination_partial: false
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -1,4 +1,9 @@
 security:
+    # Login controller already calls $session->migrate(true) on login.
+    # Keeping 'migrate' would regenerate the session ID on every authenticated
+    # API request, which breaks concurrent requests from the SPA (race condition).
+    session_fixation_strategy: none
+
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
@@ -18,24 +23,13 @@ security:
            pattern: ^/(_profiler|_wdt|assets|build)/
            security: false

-        login:
-            pattern: ^/api/login_check
-            stateless: true
-            provider: app_user_provider
-            json_login:
-                check_path: /api/login_check
-                username_path: email
-                password_path: password
-                success_handler: lexik_jwt_authentication.handler.authentication_success
-                failure_handler: lexik_jwt_authentication.handler.authentication_failure
-
        session_public:
            pattern: ^/api/session/profiles?$
            security: false

        api:
            pattern: ^/api
-            stateless: true
+            stateless: false
            custom_authenticators:
                - App\Security\SessionProfileAuthenticator

@@ -54,7 +48,6 @@ security:
        - { path: ^/api/session/profiles, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/admin, roles: ROLE_ADMIN }
        - { path: ^/api/docs, roles: PUBLIC_ACCESS }
-        - { path: ^/api/test, roles: PUBLIC_ACCESS }
        - { path: ^/api/health$, roles: PUBLIC_ACCESS }
        - { path: ^/docs, roles: PUBLIC_ACCESS }
        - { path: ^/contexts, roles: PUBLIC_ACCESS }
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -33,3 +33,8 @@ services:
    App\EventSubscriber\ComposantAuditSubscriber:
        tags:
            - { name: doctrine.event_subscriber }
+
+    App\OpenApi\OpenApiDecorator:
+        decorates: 'api_platform.openapi.factory'
+        arguments:
+            $decorated: '@.inner'
--- a/docs/BACKEND.md
+++ b/docs/BACKEND.md
@@ -0,0 +1,846 @@
+# Guide Backend — Inventory
+
+Guide complet du backend Symfony pour comprendre comment tout fonctionne, même si tu débutes.
+
+## Table des matières
+
+1. [Vue d'ensemble](#vue-densemble)
+2. [Comment fonctionne une API REST](#comment-fonctionne-une-api-rest)
+3. [Symfony + API Platform — les bases](#symfony--api-platform--les-bases)
+4. [Les Entités (les modèles de données)](#les-entités)
+5. [Les Controllers (les endpoints personnalisés)](#les-controllers)
+6. [Le système d'audit](#le-système-daudit)
+7. [L'authentification par session](#lauthentification-par-session)
+8. [Les services](#les-services)
+9. [Les migrations de base de données](#les-migrations)
+10. [Les tests](#les-tests)
+11. [Flux complet d'une requête](#flux-complet-dune-requête)
+12. [Commandes Symfony utiles](#commandes-symfony-utiles)
+
+---
+
+## Vue d'ensemble
+
+Le backend est une **API REST** construite avec :
+
+- **Symfony 8** : le framework PHP (gère le routing, la sécurité, la config, etc.)
+- **API Platform 4.2** : une surcouche qui génère automatiquement les endpoints CRUD à partir des entités
+- **Doctrine ORM** : fait le lien entre les objets PHP et les tables PostgreSQL
+- **PostgreSQL 16** : la base de données relationnelle
+
+### Le principe
+
+Au lieu d'écrire manuellement chaque endpoint (GET /machines, POST /machines, etc.), **API Platform** les génère automatiquement à partir des entités PHP. Tu déclares tes champs, tes relations, tes règles de sécurité directement sur la classe PHP, et API Platform fait le reste.
+
+---
+
+## Comment fonctionne une API REST
+
+### C'est quoi une API REST ?
+
+Une API REST c'est un serveur qui répond à des requêtes HTTP (comme un site web, mais au lieu de renvoyer du HTML, il renvoie du JSON).
+
+### Les verbes HTTP
+
+| Verbe | Action | Exemple |
+|-------|--------|---------|
+| `GET` | Lire des données | `GET /api/machines` → liste toutes les machines |
+| `POST` | Créer une donnée | `POST /api/machines` + body JSON → crée une machine |
+| `PUT` | Remplacer une donnée | `PUT /api/machines/123` + body JSON → remplace la machine 123 |
+| `PATCH` | Modifier partiellement | `PATCH /api/machines/123` + body JSON → modifie certains champs |
+| `DELETE` | Supprimer | `DELETE /api/machines/123` → supprime la machine 123 |
+
+### Les codes de réponse HTTP
+
+| Code | Signification | Quand |
+|------|---------------|-------|
+| `200` | OK | Requête réussie |
+| `201` | Created | Ressource créée avec succès (POST) |
+| `204` | No Content | Suppression réussie (DELETE) |
+| `400` | Bad Request | Données invalides envoyées |
+| `401` | Unauthorized | Pas connecté / session expirée |
+| `403` | Forbidden | Connecté mais pas les permissions |
+| `404` | Not Found | La ressource n'existe pas |
+| `409` | Conflict | Doublon (ex: nom déjà pris) |
+| `500` | Server Error | Bug côté serveur |
+
+### Le format JSON-LD
+
+L'API utilise **JSON-LD** (JSON Linked Data), une extension de JSON qui ajoute des métadonnées :
+
+```json
+{
+  "@context": "/api/contexts/Machine",
+  "@id": "/api/machines/cl1a2b3c4d5e6f7g8h9i0j1k",
+  "@type": "Machine",
+  "id": "cl1a2b3c4d5e6f7g8h9i0j1k",
+  "name": "CNC Mazak 01",
+  "reference": "CNM-001",
+  "prix": "50000.00",
+  "site": "/api/sites/cl9z8y7x6w5v4u3t2s1r0q",
+  "createdAt": "2026-01-15T10:30:00+00:00"
+}
+```
+
+Points importants :
+- `@id` est l'**IRI** (Internationalized Resource Identifier) : c'est l'identifiant unique de la ressource dans l'API
+- Les relations utilisent des IRIs : `"site": "/api/sites/cl9z8..."` au lieu d'un simple ID
+- Les collections retournent un format hydra avec pagination :
+
+```json
+{
+  "@context": "/api/contexts/Machine",
+  "@id": "/api/machines",
+  "@type": "hydra:Collection",
+  "hydra:totalItems": 42,
+  "hydra:member": [
+    { "@id": "/api/machines/cl...", "name": "CNC 01", ... },
+    { "@id": "/api/machines/cl...", "name": "Tour 02", ... }
+  ]
+}
+```
+
+---
+
+## Symfony + API Platform — les bases
+
+### La structure des fichiers
+
+```
+src/
+├── Entity/          # Les classes PHP qui représentent les tables de la BDD
+├── Controller/      # Les endpoints HTTP personnalisés (quand API Platform ne suffit pas)
+├── EventSubscriber/ # Du code qui s'exécute automatiquement quand quelque chose se passe
+├── Repository/      # Les requêtes SQL personnalisées
+├── Service/         # La logique métier réutilisable
+├── State/           # Les processeurs API Platform (interceptent le flux CRUD)
+├── Security/        # L'authentification
+├── Serializer/      # Personnalisation de la conversion entité ↔ JSON
+├── Command/         # Commandes CLI (php bin/console app:xxx)
+├── Enum/            # Les énumérations PHP (ex: catégories)
+└── OpenApi/         # Personnalisation de la doc Swagger
+```
+
+### Comment Symfony traite une requête
+
+```
+Requête HTTP
+    ↓
+Symfony Router (quel code doit répondre ?)
+    ↓
+Sécurité (l'utilisateur a-t-il le droit ?)
+    ↓
+Controller ou API Platform (traitement)
+    ↓
+Doctrine ORM (lecture/écriture en BDD)
+    ↓
+Serializer (conversion entité → JSON)
+    ↓
+Réponse HTTP (JSON envoyé au frontend)
+```
+
+### Les attributs PHP 8
+
+Le projet utilise les **attributs PHP 8** (les `#[...]`) au lieu des annotations (les `@...`). C'est la syntaxe moderne de PHP :
+
+```php
+// Attribut PHP 8 (ce qu'on utilise) ✅
+#[ORM\Column(type: 'string', length: 255)]
+private string $name;
+
+// Annotation (ancien style, on ne l'utilise pas) ❌
+/** @ORM\Column(type="string", length=255) */
+```
+
+---
+
+## Les Entités
+
+Les entités sont les classes PHP qui représentent les tables de la base de données. Chaque propriété de la classe correspond à une colonne.
+
+### Anatomie d'une entité
+
+Prenons un exemple simplifié :
+
+```php
+<?php
+// src/Entity/Machine.php
+
+namespace App\Entity;
+
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Post;
+use ApiPlatform\Metadata\Patch;
+use ApiPlatform\Metadata\Delete;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+#[ORM\Entity(repositoryClass: MachineRepository::class)]    // ← Lié à une table en BDD
+#[ORM\HasLifecycleCallbacks]                                  // ← Active les hooks PrePersist/PreUpdate
+#[ApiResource(                                                // ← Génère les endpoints API
+    operations: [
+        new GetCollection(security: "is_granted('ROLE_VIEWER')"),     // GET /api/machines
+        new Get(security: "is_granted('ROLE_VIEWER')"),               // GET /api/machines/{id}
+        new Post(security: "is_granted('ROLE_GESTIONNAIRE')"),        // POST /api/machines
+        new Patch(security: "is_granted('ROLE_GESTIONNAIRE')"),       // PATCH /api/machines/{id}
+        new Delete(security: "is_granted('ROLE_GESTIONNAIRE')"),      // DELETE /api/machines/{id}
+    ],
+    normalizationContext: ['groups' => ['machine:read']],     // ← Quels champs exposer en lecture
+    denormalizationContext: ['groups' => ['machine:write']],  // ← Quels champs accepter en écriture
+    paginationItemsPerPage: 30,                               // ← 30 résultats par page
+)]
+class Machine
+{
+    #[ORM\Id]
+    #[ORM\Column(type: 'string', length: 36)]
+    #[Groups(['machine:read'])]                               // ← Exposé en lecture uniquement
+    private string $id;
+
+    #[ORM\Column(type: 'string', length: 255, unique: true)]
+    #[Groups(['machine:read', 'machine:write'])]              // ← Exposé en lecture ET écriture
+    private string $name;
+
+    #[ORM\Column(type: 'decimal', precision: 10, scale: 2, nullable: true)]
+    #[Groups(['machine:read', 'machine:write'])]
+    private ?string $prix = null;
+
+    #[ORM\ManyToOne(targetEntity: Site::class)]               // ← Relation : chaque machine appartient à un site
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]   // ← Obligatoire, supprimé en cascade
+    #[Groups(['machine:read', 'machine:write'])]
+    private Site $site;
+
+    #[ORM\Column(type: 'datetime_immutable')]
+    #[Groups(['machine:read'])]                               // ← Lecture seule (pas dans machine:write)
+    private \DateTimeImmutable $createdAt;
+
+    // ... getters et setters
+}
+```
+
+### Décryptage des attributs importants
+
+| Attribut | Signification |
+|----------|--------------|
+| `#[ORM\Entity]` | Cette classe est stockée en BDD |
+| `#[ORM\Column]` | Cette propriété est une colonne |
+| `#[ORM\Id]` | C'est la clé primaire |
+| `#[ORM\ManyToOne]` | Relation N→1 (plusieurs machines → un site) |
+| `#[ORM\OneToMany]` | Relation 1→N (un site → plusieurs machines) |
+| `#[ORM\ManyToMany]` | Relation N→N (machines ↔ constructeurs) |
+| `#[ApiResource]` | API Platform génère les endpoints CRUD |
+| `#[Groups]` | Contrôle quels champs sont visibles/modifiables |
+| `security: "is_granted('ROLE_X')"` | Qui a le droit d'utiliser cet endpoint |
+
+### Le trait CuidEntityTrait
+
+Toutes les entités utilisent un trait partagé qui génère les IDs et gère les timestamps :
+
+```php
+// src/Entity/Trait/CuidEntityTrait.php
+trait CuidEntityTrait
+{
+    #[ORM\PrePersist]    // ← S'exécute automatiquement AVANT l'insertion en BDD
+    public function generateId(): void
+    {
+        if (!isset($this->id)) {
+            $this->id = 'cl' . bin2hex(random_bytes(12));    // ← Génère un ID unique de 26 chars
+        }
+        $this->createdAt = new \DateTimeImmutable();
+        $this->updatedAt = new \DateTimeImmutable();
+    }
+
+    #[ORM\PreUpdate]     // ← S'exécute automatiquement AVANT une mise à jour
+    public function updateTimestamp(): void
+    {
+        $this->updatedAt = new \DateTimeImmutable();
+    }
+}
+```
+
+### Les entités du projet
+
+#### Entités "catalogue" (les éléments qu'on gère)
+
+| Entité | Table | Champs clés | Relations |
+|--------|-------|-------------|-----------|
+| **Machine** | `machine` | name, reference, prix | → Site, ↔ Constructeur, → Documents |
+| **Composant** | `composant` | name, reference, description, prix, structure (JSON) | → ModelType, → Product, ↔ Constructeur |
+| **Piece** | `piece` | name, reference, description, prix, productIds (JSON) | → ModelType, → Product, ↔ Constructeur |
+| **Product** | `product` | name, reference, supplierPrice | → ModelType, ↔ Constructeur |
+
+#### Entités de classification
+
+| Entité | Table | Champs clés | Rôle |
+|--------|-------|-------------|------|
+| **Site** | `site` | name, contactName, contactPhone, contactAddress | Regrouper les machines par lieu |
+| **Constructeur** | `constructeur` | name, email, phone | Fournisseurs/fabricants partagés |
+| **ModelType** | `model_type` | name, code, category (enum), skeletons (JSON) | Catégoriser composants/pièces/produits |
+
+#### Entités de liaison hiérarchique (structure machine)
+
+| Entité | Rôle | Relations |
+|--------|------|-----------|
+| **MachineComponentLink** | Lie un composant à une machine | → Machine, → Composant, → parent (self) |
+| **MachinePieceLink** | Lie une pièce à une machine | → Machine, → Piece, → parent composant |
+| **MachineProductLink** | Lie un produit à une machine | → Machine, → Product, → parent (flexible) |
+
+Ces entités permettent la **structure arborescente** : un composant peut contenir des pièces, qui contiennent des produits.
+
+#### Entités de métadonnées
+
+| Entité | Rôle |
+|--------|------|
+| **CustomField** | Définition d'un champ personnalisé (nom, type, options) |
+| **CustomFieldValue** | Valeur d'un champ personnalisé pour une entité donnée |
+| **Document** | Fichier uploadé (PDF, image) rattaché à une entité |
+| **AuditLog** | Entrée du journal d'audit (diff + snapshot) |
+| **Comment** | Commentaire/ticket sur une fiche |
+| **Profile** | Compte utilisateur (email, rôle, mot de passe hashé) |
+
+### Les relations entre entités (schéma simplifié)
+
+```
+Site ──1:N──► Machine ──1:N──► MachineComponentLink ──► Composant
+                │                      │
+                │                      └──1:N──► MachinePieceLink ──► Piece
+                │                                      │
+                │                                      └──1:N──► MachineProductLink ──► Product
+                │
+                └──N:N──► Constructeur (via table de jointure)
+
+ModelType ──1:N──► Composant / Piece / Product
+                      │
+                      └──► CustomField ──1:N──► CustomFieldValue
+
+Machine / Composant / Piece / Product ──1:N──► Document
+                                        ──1:N──► CustomFieldValue
+```
+
+---
+
+## Les Controllers
+
+API Platform génère automatiquement les endpoints CRUD standard. Les controllers personnalisés gèrent les cas plus complexes.
+
+### Liste des controllers
+
+#### Authentification (3 controllers)
+
+**SessionProfileController** (`/api/session/profile`) — Login/Logout
+
+```
+POST   /api/session/profile      → Se connecter (payload: { profileId, password })
+GET    /api/session/profile      → Récupérer le profil connecté
+DELETE /api/session/profile      → Se déconnecter
+```
+
+**SessionProfilesController** (`/api/session/profiles`) — Liste des profils
+
+```
+GET    /api/session/profiles     → Liste tous les profils actifs (page de login)
+```
+
+**AdminProfileController** (`/api/admin/profiles`) — Administration des utilisateurs
+
+```
+GET    /api/admin/profiles                    → Liste tous les profils (ADMIN only)
+POST   /api/admin/profiles                    → Créer un profil
+PUT    /api/admin/profiles/{id}/role          → Changer le rôle d'un profil
+PUT    /api/admin/profiles/{id}/password      → Réinitialiser un mot de passe
+PUT    /api/admin/profiles/{id}/deactivate    → Désactiver un profil
+```
+
+#### Données et logique métier
+
+**MachineStructureController** — Structure hiérarchique des machines
+
+```
+GET    /api/machines/{id}/structure           → Récupérer l'arborescence complète
+PATCH  /api/machines/{id}/structure           → Modifier l'arborescence
+POST   /api/machines/{id}/clone               → Cloner une machine avec toute sa structure
+```
+
+**MachineCustomFieldsController** — Champs personnalisés machines
+
+```
+POST   /api/machines/{id}/custom-fields/init  → Initialiser les champs personnalisés manquants
+```
+
+**EntityHistoryController** — Historique d'audit par entité
+
+```
+GET    /api/{entityType}/{id}/history         → 200 derniers événements d'audit
+```
+
+**ActivityLogController** — Journal d'activité global
+
+```
+GET    /api/activity-log                      → Liste paginée avec filtres (entityType, action)
+```
+
+**CommentController** — Commentaires/tickets
+
+```
+POST   /api/comments                          → Créer un commentaire
+PATCH  /api/comments/{id}/resolve             → Résoudre un commentaire
+GET    /api/comments/unresolved-count         → Nombre de commentaires non résolus
+```
+
+**CustomFieldValueController** — Valeurs de champs personnalisés
+
+```
+POST   /api/custom-field-values               → Créer/mettre à jour une valeur (upsert)
+DELETE /api/custom-field-values/{id}           → Supprimer une valeur
+```
+
+#### Fichiers
+
+**DocumentQueryController** — Requêter les documents par entité
+
+```
+GET    /api/documents/by-site/{id}            → Documents d'un site
+GET    /api/documents/by-machine/{id}         → Documents d'une machine
+GET    /api/documents/by-composant/{id}       → Documents d'un composant
+GET    /api/documents/by-piece/{id}           → Documents d'une pièce
+GET    /api/documents/by-product/{id}         → Documents d'un produit
+```
+
+**DocumentServeController** — Servir les fichiers
+
+```
+GET    /api/documents/{id}/file               → Afficher le fichier (inline)
+GET    /api/documents/{id}/download           → Télécharger le fichier (attachment)
+```
+
+#### Monitoring
+
+**HealthCheckController** — Vérification de santé
+
+```
+GET    /api/health                            → Version, latence BDD, mémoire, version PHP
+```
+
+### Exemple de controller commenté
+
+```php
+<?php
+// src/Controller/CommentController.php
+
+namespace App\Controller;
+
+use App\Entity\Comment;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Routing\Attribute\Route;
+
+class CommentController extends AbstractController
+{
+    #[Route('/api/comments', methods: ['POST'])]    // ← Définit l'URL et le verbe HTTP
+    public function create(
+        Request $request,                            // ← La requête HTTP entrante
+        EntityManagerInterface $em,                  // ← Pour écrire en BDD (injecté automatiquement)
+    ): JsonResponse {
+        $this->denyAccessUnlessGranted('ROLE_VIEWER');  // ← Vérifie que l'utilisateur est connecté
+
+        $data = json_decode($request->getContent(), true);  // ← Parse le body JSON
+
+        $comment = new Comment();
+        $comment->setContent($data['content']);
+        $comment->setEntityType($data['entityType']);
+        $comment->setEntityId($data['entityId']);
+        // ... autres champs
+
+        $em->persist($comment);   // ← Dit à Doctrine "je veux sauvegarder ça"
+        $em->flush();             // ← Exécute réellement le INSERT SQL
+
+        return $this->json($comment, 201);  // ← Renvoie le commentaire créé avec le code 201
+    }
+}
+```
+
+---
+
+## Le système d'audit
+
+Chaque modification sur les entités principales est automatiquement enregistrée dans un journal d'audit. C'est un des points forts de l'application.
+
+### Comment ça marche ?
+
+Les **Event Subscribers** de Doctrine interceptent les opérations de base de données **avant** qu'elles soient exécutées (événement `onFlush`).
+
+```
+L'utilisateur modifie une machine
+    ↓
+Doctrine détecte le changement
+    ↓
+onFlush se déclenche
+    ↓
+Le subscriber calcule le diff (ancien → nouveau)
+    ↓
+Le subscriber crée un AuditLog avec :
+  - entityType : "machine"
+  - entityId : "cl1a2b3c..."
+  - action : "update"
+  - diff : { "name": { "from": "CNC 01", "to": "CNC 02" } }
+  - snapshot : { état complet de la machine }
+  - actorProfileId : "cl9z8y7x..." (qui a fait la modif)
+    ↓
+Les deux (machine + audit log) sont sauvegardés en même temps
+```
+
+### Le diff
+
+Le diff capture exactement ce qui a changé :
+
+```json
+{
+  "name": { "from": "CNC Mazak 01", "to": "CNC Mazak 02" },
+  "prix": { "from": "45000.00", "to": "50000.00" },
+  "constructeurIds": {
+    "from": ["cl111...", "cl222..."],
+    "to": ["cl111...", "cl333..."]
+  }
+}
+```
+
+### Le snapshot
+
+Le snapshot capture l'état complet de l'entité au moment de la modification :
+
+```json
+{
+  "id": "cl1a2b3c...",
+  "name": "CNC Mazak 02",
+  "reference": "CNM-001",
+  "prix": "50000.00",
+  "siteId": "cl9z8y7x...",
+  "constructeurIds": ["cl111...", "cl333..."]
+}
+```
+
+### Les subscribers d'audit
+
+| Subscriber | Entité | Type |
+|------------|--------|------|
+| MachineAuditSubscriber | Machine | Complex (avec constructeurs + custom fields) |
+| ComposantAuditSubscriber | Composant | Complex |
+| PieceAuditSubscriber | Piece | Complex |
+| ProductAuditSubscriber | Product | Complex |
+| ConstructeurAuditSubscriber | Constructeur | Simple |
+| DocumentAuditSubscriber | Document | Simple |
+| ModelTypeAuditSubscriber | ModelType | Simple |
+
+**Simple** = suit seulement les champs de l'entité
+**Complex** = suit aussi les relations ManyToMany (constructeurs) et les champs personnalisés
+
+### AbstractAuditSubscriber
+
+La classe de base qui contient toute la logique partagée :
+
+```php
+abstract class AbstractAuditSubscriber implements EventSubscriber
+{
+    // Méthode à implémenter par chaque subscriber
+    abstract protected function getEntityClass(): string;       // Ex: Machine::class
+    abstract protected function getEntityType(): string;        // Ex: 'machine'
+    abstract protected function buildSnapshot($entity): array;  // Construit le snapshot
+
+    // Deux chemins d'exécution :
+    // 1. onFlushSimple() : pour les entités sans collections ManyToMany
+    // 2. onFlushComplex() : pour les entités avec constructeurs (détecte les ajouts/suppressions)
+}
+```
+
+### Autres subscribers
+
+| Subscriber | Rôle |
+|------------|------|
+| **PieceProductSyncSubscriber** | Synchronise le champ `productIds` sur Piece quand un Product est lié/délié |
+| **UniqueConstraintSubscriber** | Capture les erreurs de doublon PostgreSQL et renvoie un message clair |
+
+---
+
+## L'authentification par session
+
+### Le flux complet
+
+```
+1. GET /api/session/profiles
+   → Retourne la liste des profils actifs (nom, prénom, email, hasPassword)
+   → Le frontend affiche la page de login avec les profils disponibles
+
+2. POST /api/session/profile
+   Body: { "profileId": "cl...", "password": "secret" }
+   → Le backend vérifie le mot de passe
+   → Si OK : stocke profileId dans la session PHP, retourne le profil
+   → Si KO : retourne 401
+
+3. GET /api/session/profile (à chaque chargement de page)
+   → Le navigateur envoie le cookie de session automatiquement
+   → Le backend retrouve le profil via la session
+   → Retourne le profil connecté ou 401
+
+4. DELETE /api/session/profile
+   → Supprime le profileId de la session
+   → L'utilisateur est déconnecté
+```
+
+### La sécurité sur les endpoints
+
+Chaque endpoint API Platform a une règle de sécurité :
+
+```php
+new GetCollection(security: "is_granted('ROLE_VIEWER')")   // Lecture → minimum ROLE_VIEWER
+new Post(security: "is_granted('ROLE_GESTIONNAIRE')")       // Création → minimum ROLE_GESTIONNAIRE
+```
+
+Les controllers personnalisés utilisent :
+```php
+$this->denyAccessUnlessGranted('ROLE_VIEWER');
+```
+
+### La hiérarchie des rôles
+
+Grâce à la hiérarchie, un ADMIN a automatiquement tous les rôles inférieurs :
+
+```
+ROLE_ADMIN ─── a aussi ──► ROLE_GESTIONNAIRE ──► ROLE_VIEWER ──► ROLE_USER
+```
+
+Donc `is_granted('ROLE_VIEWER')` accepte aussi les GESTIONNAIRES et les ADMINS.
+
+---
+
+## Les services
+
+### DocumentStorageService
+
+Gère le stockage des fichiers sur le système de fichiers :
+
+```php
+// Stocker un fichier uploadé
+$path = $storageService->store($uploadedFile, $entityType, $entityId);
+
+// Supprimer un fichier
+$storageService->delete($path);
+```
+
+Les fichiers sont stockés dans `var/documents/{entityType}/{entityId}/{filename}`.
+
+### PdfCompressorService
+
+Compresse les fichiers PDF via Ghostscript pour réduire leur taille :
+
+```php
+$compressorService->compress($filePath);
+```
+
+### ModelTypeCategoryConversionService
+
+Permet de convertir la catégorie d'un ModelType (ex: transformer un type "composant" en type "pièce").
+
+---
+
+## Les migrations
+
+Les migrations sont des scripts SQL qui modifient la structure de la base de données. Elles sont dans le dossier `migrations/`.
+
+### Principe
+
+Quand tu ajoutes un champ à une entité, il faut créer une migration pour mettre à jour la BDD :
+
+```bash
+# Générer une migration à partir des changements détectés
+make shell
+php bin/console doctrine:migrations:diff
+
+# Appliquer les migrations
+php bin/console doctrine:migrations:migrate
+```
+
+### Particularités PostgreSQL
+
+Les migrations utilisent du **SQL brut** avec des gardes pour l'idempotence :
+
+```sql
+-- On peut relancer la migration sans erreur
+ALTER TABLE machine ADD COLUMN IF NOT EXISTS description TEXT;
+DROP INDEX IF EXISTS idx_machine_name;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_machine_name ON machine (name);
+```
+
+**Attention aux noms de colonnes** : PostgreSQL stocke tout en **minuscules**. Donc `typePieceId` en PHP devient `typepieceid` en SQL. Toujours utiliser des noms lowercase dans le SQL brut.
+
+---
+
+## Les tests
+
+### Stack de test
+
+- **PHPUnit 12** : framework de test PHP
+- **API Platform Test** : utilitaires pour tester des endpoints API
+- **DAMA DoctrineTestBundle** : wrappe chaque test dans une transaction avec rollback automatique (pas besoin de nettoyer la BDD entre les tests)
+
+### Structure
+
+```
+tests/
+├── AbstractApiTestCase.php    # Classe de base avec helpers
+└── Api/
+    └── Entity/
+        ├── MachineTest.php    # Tests des endpoints machine
+        ├── SiteTest.php       # Tests des endpoints site
+        └── ...
+```
+
+### Exemple de test
+
+```php
+class MachineTest extends AbstractApiTestCase
+{
+    public function testCreateMachine(): void
+    {
+        // Créer un client HTTP connecté en tant que gestionnaire
+        $client = $this->createGestionnaireClient();
+
+        // Créer un site (prérequis)
+        $site = $this->createSite();
+
+        // Envoyer une requête POST pour créer une machine
+        $client->request('POST', '/api/machines', [
+            'json' => [
+                'name' => 'Machine Test',
+                'reference' => 'MT-001',
+                'site' => '/api/sites/' . $site->getId(),
+            ],
+        ]);
+
+        // Vérifier que la réponse est 201 Created
+        $this->assertResponseStatusCodeSame(201);
+
+        // Vérifier le contenu de la réponse
+        $this->assertJsonContains([
+            'name' => 'Machine Test',
+            'reference' => 'MT-001',
+        ]);
+    }
+}
+```
+
+### Helpers disponibles dans AbstractApiTestCase
+
+| Méthode | Description |
+|---------|-------------|
+| `createViewerClient()` | Client HTTP connecté avec ROLE_VIEWER |
+| `createGestionnaireClient()` | Client HTTP connecté avec ROLE_GESTIONNAIRE |
+| `createAdminClient()` | Client HTTP connecté avec ROLE_ADMIN |
+| `createProfile()` | Crée un profil utilisateur en BDD |
+| `createSite()` | Crée un site en BDD |
+| `createMachine()` | Crée une machine en BDD |
+
+### Lancer les tests
+
+```bash
+make test                                              # Tous les tests
+make test FILES=tests/Api/Entity/MachineTest.php       # Un fichier
+make test-setup                                        # (Re)créer la BDD de test
+```
+
+---
+
+## Flux complet d'une requête
+
+### Exemple : créer une machine
+
+```
+1. Le frontend envoie :
+   POST /api/machines
+   Content-Type: application/ld+json
+   Cookie: PHPSESSID=abc123
+   {
+     "name": "CNC Mazak 01",
+     "reference": "CNM-001",
+     "prix": "50000.00",
+     "site": "/api/sites/cl9z8y7x..."
+   }
+
+2. Symfony reçoit la requête
+   → Le routeur identifie : c'est un endpoint API Platform (POST sur Machine)
+
+3. Sécurité
+   → Vérifie le cookie de session → retrouve le profil connecté
+   → Vérifie is_granted('ROLE_GESTIONNAIRE') → OK
+
+4. Désérialisation (JSON → objet PHP)
+   → API Platform convertit le JSON en objet Machine
+   → Le champ "site" (IRI) est résolu en objet Site
+   → Seuls les champs du groupe 'machine:write' sont acceptés
+
+5. Validation
+   → Vérifie les contraintes (name non vide, site existe, etc.)
+
+6. Persistence (objet PHP → BDD)
+   → Doctrine déclenche PrePersist (CuidEntityTrait)
+     → Génère l'ID : "cl" + 24 hex chars aléatoires
+     → Set createdAt et updatedAt
+   → Doctrine détecte l'INSERT à faire
+
+7. Audit (onFlush)
+   → MachineAuditSubscriber détecte la nouvelle machine
+   → Crée un AuditLog avec action='create', diff, snapshot
+   → L'AuditLog est aussi ajouté à la transaction
+
+8. Flush
+   → Doctrine exécute les requêtes SQL :
+     INSERT INTO machine (id, name, reference, ...) VALUES (...)
+     INSERT INTO audit_log (id, entity_type, entity_id, action, diff, snapshot, ...) VALUES (...)
+
+9. Sérialisation (objet PHP → JSON)
+   → API Platform convertit la Machine en JSON-LD
+   → Seuls les champs du groupe 'machine:read' sont inclus
+
+10. Réponse
+    HTTP/1.1 201 Created
+    {
+      "@context": "/api/contexts/Machine",
+      "@id": "/api/machines/cl1a2b3c...",
+      "@type": "Machine",
+      "id": "cl1a2b3c...",
+      "name": "CNC Mazak 01",
+      ...
+    }
+```
+
+---
+
+## Commandes Symfony utiles
+
+Lancer ces commandes dans le conteneur Docker (`make shell` pour y entrer) :
+
+| Commande | Description |
+|----------|-------------|
+| `php bin/console debug:router` | Voir toutes les routes disponibles |
+| `php bin/console debug:config api_platform` | Voir la config API Platform |
+| `php bin/console doctrine:schema:validate` | Vérifier que les entités sont synchronisées avec la BDD |
+| `php bin/console doctrine:migrations:diff` | Générer une migration à partir des changements |
+| `php bin/console doctrine:migrations:migrate` | Appliquer les migrations |
+| `php bin/console cache:clear` | Vider le cache (résout beaucoup de problèmes) |
+| `php bin/console app:compress-pdf` | Compresser les PDFs existants |
+| `php bin/console app:create-profile` | Créer un profil utilisateur |
+
+---
+
+## Résumé des points clés pour un débutant
+
+1. **API Platform génère les endpoints CRUD automatiquement** à partir des entités — tu n'as pas besoin d'écrire de controllers pour les opérations standard
+2. **Les attributs PHP 8** (`#[...]`) remplacent les annotations et configurent tout : BDD, API, sérialisation, sécurité
+3. **Les groupes de sérialisation** (`machine:read`, `machine:write`) contrôlent quels champs sont visibles/modifiables
+4. **L'audit est automatique** : chaque modification est tracée sans rien avoir à faire manuellement
+5. **L'authentification est par session (cookies)**, pas par tokens JWT
+6. **Les IDs sont des CUID** (chaînes aléatoires), pas des auto-increment
+7. **PostgreSQL stocke les noms en minuscules** : attention dans le SQL brut
+8. **Les tests utilisent des transactions** : chaque test est isolé et la BDD est nettoyée automatiquement
--- a/docs/FRONTEND.md
+++ b/docs/FRONTEND.md
--- a/6
+++ b/6
@@ -37,7 +37,7 @@ start: env-init
 	@echo "URLs disponibles:"
 	@echo "- Symfony API: http://localhost:8081/api"
 	@echo "- Nuxt (Inventory_frontend): http://localhost:3001"
-	@echo "- pgAdmin: http://localhost:5050"
+	@echo "- adminer: http://localhost:5050"

 # Éteint le container
 stop:
@@ -117,6 +117,10 @@ php-cs-fixer-allow-risky:
 test:
 	$(EXEC_PHP) php -d memory_limit="512M" vendor/bin/phpunit $(FILES)

+test-setup:
+	$(SYMFONY_CONSOLE) doctrine:database:create --if-not-exists --env=test
+	$(SYMFONY_CONSOLE) doctrine:schema:update --force --env=test
+
 wait:
 	sleep 10

--- a/migrations/Version20260309120000.php
+++ b/migrations/Version20260309120000.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260309120000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add color column to sites table';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql("ALTER TABLE sites ADD COLUMN IF NOT EXISTS color VARCHAR(7) NOT NULL DEFAULT ''");
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE sites DROP COLUMN IF EXISTS color');
+    }
+}
--- a/phpunit.dist.xml
+++ b/phpunit.dist.xml
@@ -4,7 +4,7 @@
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
         colors="true"
-         failOnDeprecation="true"
+         failOnDeprecation="false"
         failOnNotice="true"
         failOnWarning="true"
         bootstrap="tests/bootstrap.php"
@@ -40,5 +40,6 @@
    </source>

    <extensions>
+        <bootstrap class="DAMA\DoctrineTestBundle\PHPUnit\PHPUnitExtension" />
    </extensions>
 </phpunit>
--- a/src/Command/CreateProfileCommand.php
+++ b/src/Command/CreateProfileCommand.php
@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Command;
+
+use App\Entity\Profile;
+use App\Repository\ProfileRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+
+use function in_array;
+
+#[AsCommand(
+    name: 'app:create-profile',
+    description: 'Create a new profile with the given credentials',
+)]
+class CreateProfileCommand extends Command
+{
+    public function __construct(
+        private readonly ProfileRepository $profiles,
+        private readonly EntityManagerInterface $em,
+        private readonly UserPasswordHasherInterface $passwordHasher,
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('firstName', InputArgument::REQUIRED, 'First name')
+            ->addArgument('lastName', InputArgument::REQUIRED, 'Last name')
+            ->addOption('email', null, InputOption::VALUE_REQUIRED, 'Email address')
+            ->addOption('role', null, InputOption::VALUE_REQUIRED, 'Role (ROLE_ADMIN, ROLE_GESTIONNAIRE, ROLE_VIEWER)', 'ROLE_VIEWER')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+
+        $firstName = $input->getArgument('firstName');
+        $lastName  = $input->getArgument('lastName');
+        $email     = $input->getOption('email');
+
+        $password = $io->askHidden('Password');
+        if (null === $password || '' === $password) {
+            $io->error('Le mot de passe est requis.');
+
+            return Command::FAILURE;
+        }
+        $role = $input->getOption('role');
+
+        $allowedRoles = ['ROLE_ADMIN', 'ROLE_GESTIONNAIRE', 'ROLE_VIEWER', 'ROLE_USER'];
+        if (!in_array($role, $allowedRoles, true)) {
+            $io->error('Role invalide. Roles autorisés : '.implode(', ', $allowedRoles));
+
+            return Command::FAILURE;
+        }
+
+        if (null !== $email && '' !== $email) {
+            $existing = $this->profiles->findOneBy(['email' => $email]);
+            if (null !== $existing) {
+                $io->error('Un profil avec cet email existe déjà.');
+
+                return Command::FAILURE;
+            }
+        }
+
+        $profile = new Profile();
+        $profile->setFirstName($firstName);
+        $profile->setLastName($lastName);
+        $profile->setRoles([$role]);
+        $profile->setIsActive(true);
+
+        if (null !== $email && '' !== $email) {
+            $profile->setEmail($email);
+        }
+
+        $profile->setPassword(
+            $this->passwordHasher->hashPassword($profile, $password)
+        );
+
+        $this->em->persist($profile);
+        $this->em->flush();
+
+        $io->success(sprintf(
+            'Profil créé : %s %s (ID: %s, Role: %s)',
+            $firstName,
+            $lastName,
+            $profile->getId(),
+            $role,
+        ));
+
+        return Command::SUCCESS;
+    }
+}
--- a/src/Controller/ComposantHistoryController.php
+++ b/src/Controller/ComposantHistoryController.php
@@ -6,35 +6,76 @@ namespace App\Controller;

 use App\Repository\AuditLogRepository;
 use App\Repository\ComposantRepository;
+use App\Repository\MachineRepository;
+use App\Repository\PieceRepository;
+use App\Repository\ProductRepository;
 use App\Repository\ProfileRepository;
 use DateTimeInterface;
+use Doctrine\ORM\EntityRepository;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;

-final class ComposantHistoryController extends AbstractController
+final class EntityHistoryController extends AbstractController
 {
+    /** @var array<string, array{repo: EntityRepository<object>, label: string}> */
+    private readonly array $entityConfig;
+
    public function __construct(
-        private readonly ComposantRepository $components,
+        MachineRepository $machines,
+        PieceRepository $pieces,
+        ComposantRepository $composants,
+        ProductRepository $products,
        private readonly AuditLogRepository $auditLogs,
        private readonly ProfileRepository $profiles,
-    ) {}
+    ) {
+        $this->entityConfig = [
+            'machine'   => ['repo' => $machines, 'label' => 'Machine introuvable.'],
+            'piece'     => ['repo' => $pieces, 'label' => 'Pièce introuvable.'],
+            'composant' => ['repo' => $composants, 'label' => 'Composant introuvable.'],
+            'product'   => ['repo' => $products, 'label' => 'Produit introuvable.'],
+        ];
+    }
+
+    #[Route('/api/machines/{id}/history', name: 'api_machine_history', methods: ['GET'])]
+    public function machineHistory(string $id): JsonResponse
+    {
+        return $this->entityHistory('machine', $id);
+    }
+
+    #[Route('/api/pieces/{id}/history', name: 'api_piece_history', methods: ['GET'])]
+    public function pieceHistory(string $id): JsonResponse
+    {
+        return $this->entityHistory('piece', $id);
+    }

    #[Route('/api/composants/{id}/history', name: 'api_composant_history', methods: ['GET'])]
-    public function __invoke(string $id): JsonResponse
+    public function composantHistory(string $id): JsonResponse
+    {
+        return $this->entityHistory('composant', $id);
+    }
+
+    #[Route('/api/products/{id}/history', name: 'api_product_history', methods: ['GET'])]
+    public function productHistory(string $id): JsonResponse
+    {
+        return $this->entityHistory('product', $id);
+    }
+
+    private function entityHistory(string $type, string $id): JsonResponse
    {
        $this->denyAccessUnlessGranted('ROLE_VIEWER');

-        $component = $this->components->find($id);
-        if (!$component) {
+        $config = $this->entityConfig[$type];
+        $entity = $config['repo']->find($id);
+        if (!$entity) {
            return new JsonResponse(
-                ['message' => 'Composant introuvable.'],
+                ['message' => $config['label']],
                Response::HTTP_NOT_FOUND,
            );
        }

-        $logs = $this->auditLogs->findEntityHistory('composant', $id, 200);
+        $logs = $this->auditLogs->findEntityHistory($type, $id, 200);

        $actorIds = array_values(array_unique(array_filter(array_map(
            static fn ($log) => $log->getActorProfileId(),
--- a/src/Controller/HealthCheckController.php
+++ b/src/Controller/HealthCheckController.php
@@ -17,14 +17,7 @@ class HealthCheckController extends AbstractController
    #[Route('/api/health', name: 'api_health', methods: ['GET'])]
    public function __invoke(Connection $connection): JsonResponse
    {
-        $version     = '0.0.0';
-        $versionFile = $this->getParameter('kernel.project_dir').'/VERSION';
-        if (file_exists($versionFile)) {
-            $version = trim(file_get_contents($versionFile));
-        }
-
-        $dbOk      = false;
-        $dbLatency = null;
+        $dbOk = false;

        try {
            $start = hrtime(true);
@@ -32,22 +25,33 @@ class HealthCheckController extends AbstractController
            $dbLatency = round((hrtime(true) - $start) / 1e6, 1);
            $dbOk      = true;
        } catch (Throwable) {
+            $dbLatency = null;
        }

        $healthy = $dbOk;
+        $data    = ['status' => $healthy ? 'ok' : 'degraded'];

-        return $this->json([
-            'status'    => $healthy ? 'ok' : 'degraded',
-            'version'   => $version,
-            'timestamp' => new DateTimeImmutable()->format(DateTimeInterface::ATOM),
-            'php'       => PHP_VERSION,
-            'checks'    => [
-                'database' => [
-                    'status'     => $dbOk ? 'ok' : 'down',
-                    'latency_ms' => $dbLatency,
+        if ($this->isGranted('ROLE_ADMIN')) {
+            $version     = '0.0.0';
+            $versionFile = $this->getParameter('kernel.project_dir').'/VERSION';
+            if (file_exists($versionFile)) {
+                $version = trim(file_get_contents($versionFile));
+            }
+
+            $data += [
+                'version'   => $version,
+                'timestamp' => new DateTimeImmutable()->format(DateTimeInterface::ATOM),
+                'php'       => PHP_VERSION,
+                'checks'    => [
+                    'database' => [
+                        'status'     => $dbOk ? 'ok' : 'down',
+                        'latency_ms' => $dbLatency,
+                    ],
                ],
-            ],
-            'memory_mb' => round(memory_get_usage(true) / 1024 / 1024, 1),
-        ], $healthy ? 200 : 503);
+                'memory_mb' => round(memory_get_usage(true) / 1024 / 1024, 1),
+            ];
+        }
+
+        return $this->json($data, $healthy ? 200 : 503);
    }
 }
--- a/src/Controller/MachineHistoryController.php
+++ b/src/Controller/MachineHistoryController.php
@@ -1,82 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Controller;
-
-use App\Repository\AuditLogRepository;
-use App\Repository\MachineRepository;
-use App\Repository\ProfileRepository;
-use DateTimeInterface;
-use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
-use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\Routing\Attribute\Route;
-
-final class MachineHistoryController extends AbstractController
-{
-    public function __construct(
-        private readonly MachineRepository $machines,
-        private readonly AuditLogRepository $auditLogs,
-        private readonly ProfileRepository $profiles,
-    ) {}
-
-    #[Route('/api/machines/{id}/history', name: 'api_machine_history', methods: ['GET'])]
-    public function __invoke(string $id): JsonResponse
-    {
-        $this->denyAccessUnlessGranted('ROLE_VIEWER');
-
-        $machine = $this->machines->find($id);
-        if (!$machine) {
-            return new JsonResponse(
-                ['message' => 'Machine introuvable.'],
-                Response::HTTP_NOT_FOUND,
-            );
-        }
-
-        $logs = $this->auditLogs->findEntityHistory('machine', $id, 200);
-
-        $actorIds = array_values(array_unique(array_filter(array_map(
-            static fn ($log) => $log->getActorProfileId(),
-            $logs,
-        ))));
-
-        $actorMap = [];
-        if ([] !== $actorIds) {
-            $profiles = $this->profiles->findBy(['id' => $actorIds]);
-            foreach ($profiles as $profile) {
-                $label = trim(sprintf('%s %s', $profile->getFirstName(), $profile->getLastName()));
-                if ('' === $label) {
-                    $label = $profile->getEmail() ?? $profile->getId();
-                }
-                $actorMap[$profile->getId()] = $label;
-            }
-        }
-
-        $items = array_map(
-            static function ($log) use ($actorMap) {
-                $actorId = $log->getActorProfileId();
-
-                return [
-                    'id'        => $log->getId(),
-                    'action'    => $log->getAction(),
-                    'createdAt' => $log->getCreatedAt()->format(DateTimeInterface::ATOM),
-                    'actor'     => $actorId
-                        ? [
-                            'id'    => $actorId,
-                            'label' => $actorMap[$actorId] ?? $actorId,
-                        ]
-                        : null,
-                    'diff'     => $log->getDiff(),
-                    'snapshot' => $log->getSnapshot(),
-                ];
-            },
-            $logs,
-        );
-
-        return new JsonResponse([
-            'items' => array_values($items),
-            'total' => count($items),
-        ]);
-    }
-}
--- a/src/Controller/MachineStructureController.php
+++ b/src/Controller/MachineStructureController.php
@@ -14,6 +14,7 @@ use App\Entity\MachineProductLink;
 use App\Entity\ModelType;
 use App\Entity\Piece;
 use App\Entity\Product;
+use App\Entity\Site;
 use App\Repository\ComposantRepository;
 use App\Repository\MachineComponentLinkRepository;
 use App\Repository\MachinePieceLinkRepository;
@@ -123,7 +124,7 @@ class MachineStructureController extends AbstractController
            return $this->json(['success' => false, 'error' => 'name et siteId sont requis.'], 400);
        }

-        $site = $this->entityManager->getRepository(\App\Entity\Site::class)->find($payload['siteId']);
+        $site = $this->entityManager->getRepository(Site::class)->find($payload['siteId']);
        if (!$site) {
            return $this->json(['success' => false, 'error' => 'Site introuvable.'], 404);
        }
@@ -572,7 +573,7 @@ class MachineStructureController extends AbstractController
            'constructeurs'     => $this->normalizeConstructeurs($machine->getConstructeurs()),
            'customFields'      => $this->normalizeCustomFields($machine->getCustomFields()),
            'documents'         => null,
-            'customFieldValues' => null,
+            'customFieldValues' => $this->normalizeCustomFieldValues($machine->getCustomFieldValues()),
        ];
    }

@@ -772,7 +773,7 @@ class MachineStructureController extends AbstractController
            if (!$cfv instanceof CustomFieldValue) {
                continue;
            }
-            $cf = $cfv->getCustomField();
+            $cf      = $cfv->getCustomField();
            $items[] = [
                'id'          => $cfv->getId(),
                'value'       => $cfv->getValue(),
--- a/src/Controller/PieceHistoryController.php
+++ b/src/Controller/PieceHistoryController.php
@@ -1,82 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Controller;
-
-use App\Repository\AuditLogRepository;
-use App\Repository\PieceRepository;
-use App\Repository\ProfileRepository;
-use DateTimeInterface;
-use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
-use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\Routing\Attribute\Route;
-
-final class PieceHistoryController extends AbstractController
-{
-    public function __construct(
-        private readonly PieceRepository $pieces,
-        private readonly AuditLogRepository $auditLogs,
-        private readonly ProfileRepository $profiles,
-    ) {}
-
-    #[Route('/api/pieces/{id}/history', name: 'api_piece_history', methods: ['GET'])]
-    public function __invoke(string $id): JsonResponse
-    {
-        $this->denyAccessUnlessGranted('ROLE_VIEWER');
-
-        $piece = $this->pieces->find($id);
-        if (!$piece) {
-            return new JsonResponse(
-                ['message' => 'Pièce introuvable.'],
-                Response::HTTP_NOT_FOUND,
-            );
-        }
-
-        $logs = $this->auditLogs->findEntityHistory('piece', $id, 200);
-
-        $actorIds = array_values(array_unique(array_filter(array_map(
-            static fn ($log) => $log->getActorProfileId(),
-            $logs,
-        ))));
-
-        $actorMap = [];
-        if ([] !== $actorIds) {
-            $profiles = $this->profiles->findBy(['id' => $actorIds]);
-            foreach ($profiles as $profile) {
-                $label = trim(sprintf('%s %s', $profile->getFirstName(), $profile->getLastName()));
-                if ('' === $label) {
-                    $label = $profile->getEmail() ?? $profile->getId();
-                }
-                $actorMap[$profile->getId()] = $label;
-            }
-        }
-
-        $items = array_map(
-            static function ($log) use ($actorMap) {
-                $actorId = $log->getActorProfileId();
-
-                return [
-                    'id'        => $log->getId(),
-                    'action'    => $log->getAction(),
-                    'createdAt' => $log->getCreatedAt()->format(DateTimeInterface::ATOM),
-                    'actor'     => $actorId
-                        ? [
-                            'id'    => $actorId,
-                            'label' => $actorMap[$actorId] ?? $actorId,
-                        ]
-                        : null,
-                    'diff'     => $log->getDiff(),
-                    'snapshot' => $log->getSnapshot(),
-                ];
-            },
-            $logs,
-        );
-
-        return new JsonResponse([
-            'items' => array_values($items),
-            'total' => count($items),
-        ]);
-    }
-}
--- a/src/Controller/ProductHistoryController.php
+++ b/src/Controller/ProductHistoryController.php
@@ -1,82 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Controller;
-
-use App\Repository\AuditLogRepository;
-use App\Repository\ProductRepository;
-use App\Repository\ProfileRepository;
-use DateTimeInterface;
-use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
-use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\Routing\Attribute\Route;
-
-final class ProductHistoryController extends AbstractController
-{
-    public function __construct(
-        private readonly ProductRepository $products,
-        private readonly AuditLogRepository $auditLogs,
-        private readonly ProfileRepository $profiles,
-    ) {}
-
-    #[Route('/api/products/{id}/history', name: 'api_product_history', methods: ['GET'])]
-    public function __invoke(string $id): JsonResponse
-    {
-        $this->denyAccessUnlessGranted('ROLE_VIEWER');
-
-        $product = $this->products->find($id);
-        if (!$product) {
-            return new JsonResponse(
-                ['message' => 'Produit introuvable.'],
-                Response::HTTP_NOT_FOUND,
-            );
-        }
-
-        $logs = $this->auditLogs->findEntityHistory('product', $id, 200);
-
-        $actorIds = array_values(array_unique(array_filter(array_map(
-            static fn ($log) => $log->getActorProfileId(),
-            $logs,
-        ))));
-
-        $actorMap = [];
-        if ([] !== $actorIds) {
-            $profiles = $this->profiles->findBy(['id' => $actorIds]);
-            foreach ($profiles as $profile) {
-                $label = trim(sprintf('%s %s', $profile->getFirstName(), $profile->getLastName()));
-                if ('' === $label) {
-                    $label = $profile->getEmail() ?? $profile->getId();
-                }
-                $actorMap[$profile->getId()] = $label;
-            }
-        }
-
-        $items = array_map(
-            static function ($log) use ($actorMap) {
-                $actorId = $log->getActorProfileId();
-
-                return [
-                    'id'        => $log->getId(),
-                    'action'    => $log->getAction(),
-                    'createdAt' => $log->getCreatedAt()->format(DateTimeInterface::ATOM),
-                    'actor'     => $actorId
-                        ? [
-                            'id'    => $actorId,
-                            'label' => $actorMap[$actorId] ?? $actorId,
-                        ]
-                        : null,
-                    'diff'     => $log->getDiff(),
-                    'snapshot' => $log->getSnapshot(),
-                ];
-            },
-            $logs,
-        );
-
-        return new JsonResponse([
-            'items' => array_values($items),
-            'total' => count($items),
-        ]);
-    }
-}
--- a/src/Controller/SessionProfileController.php
+++ b/src/Controller/SessionProfileController.php
@@ -84,6 +84,7 @@ final class SessionProfileController
            return new JsonResponse(['message' => 'Mot de passe incorrect.'], JsonResponse::HTTP_UNAUTHORIZED);
        }

+        $session->migrate(true);
        $session->set('profileId', $profile->getId());
        $session->set('profileRoles', $profile->getRoles());

--- a/src/Controller/TestController.php
+++ b/src/Controller/TestController.php
@@ -1,18 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Controller;
-
-use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
-use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\Routing\Attribute\Route;
-
-class TestController extends AbstractController
-{
-    #[Route('/api/test', name: 'api_test', methods: ['GET', 'POST'])]
-    public function test(): JsonResponse
-    {
-        return $this->json(['status' => 'ok', 'message' => 'Test endpoint works!']);
-    }
-}
--- a/src/Entity/Comment.php
+++ b/src/Entity/Comment.php
@@ -12,6 +12,7 @@ use ApiPlatform\Metadata\Delete;
 use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
+use App\Entity\Trait\CuidEntityTrait;
 use DateTimeImmutable;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
@@ -23,6 +24,7 @@ use Doctrine\ORM\Mapping as ORM;
 #[ApiFilter(SearchFilter::class, properties: ['entityType' => 'exact', 'entityId' => 'exact', 'status' => 'exact', 'entityName' => 'ipartial'])]
 #[ApiFilter(OrderFilter::class, properties: ['createdAt', 'authorName', 'status'])]
 #[ApiResource(
+    description: 'Commentaires et annotations. Permet aux utilisateurs de commenter les machines, pièces, composants, produits et catégories. Les commentaires peuvent être marqués comme résolus.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -35,6 +37,8 @@ use Doctrine\ORM\Mapping as ORM;
 )]
 class Comment
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    private ?string $id = null;
@@ -75,29 +79,12 @@ class Comment
    #[ORM\Column(type: Types::DATETIME_IMMUTABLE, name: 'updated_at')]
    private DateTimeImmutable $updatedAt;

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
+    public function __construct()
    {
+        $this->createdAt = new DateTimeImmutable();
        $this->updatedAt = new DateTimeImmutable();
    }

-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
    public function getContent(): string
    {
        return $this->content;
@@ -217,19 +204,4 @@ class Comment

        return $this;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/Composant.php
+++ b/src/Entity/Composant.php
@@ -14,6 +14,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\ComposantRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -28,6 +29,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(SearchFilter::class, properties: ['name' => 'ipartial', 'reference' => 'ipartial', 'typeComposant' => 'exact', 'typeComposant.name' => 'ipartial'])]
 #[ApiFilter(OrderFilter::class, properties: ['name', 'createdAt'])]
 #[ApiResource(
+    description: 'Composants du catalogue. Un composant représente un élément fonctionnel rattaché à une machine, avec un type, des fournisseurs et des documents.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -42,6 +44,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class Composant
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['composant:read', 'document:list'])]
@@ -119,42 +123,14 @@ class Composant

    public function __construct()
    {
+        $this->createdAt         = new DateTimeImmutable();
+        $this->updatedAt         = new DateTimeImmutable();
        $this->constructeurs     = new ArrayCollection();
        $this->documents         = new ArrayCollection();
        $this->customFieldValues = new ArrayCollection();
        $this->machineLinks      = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getName(): string
    {
        return $this->name;
@@ -294,19 +270,4 @@ class Composant
    {
        return $this->customFieldValues;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/Constructeur.php
+++ b/src/Entity/Constructeur.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\ConstructeurRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -18,12 +19,14 @@ use Doctrine\Common\Collections\Collection;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
+use Symfony\Component\Validator\Constraints as Assert;

 #[UniqueEntity(fields: ['name'], message: 'Un fournisseur avec ce nom existe déjà.')]
 #[ORM\Entity(repositoryClass: ConstructeurRepository::class)]
 #[ORM\Table(name: 'constructeurs')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Fournisseurs et constructeurs. Référentiel partagé entre les machines, pièces, composants et produits pour identifier les fabricants et distributeurs.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -37,12 +40,15 @@ use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
 )]
 class Constructeur
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    private ?string $id = null;

    #[ORM\Column(type: Types::STRING, length: 255, unique: true)]
-    private string $name;
+    #[Assert\NotBlank(message: 'Le nom est obligatoire.')]
+    private ?string $name = null;

    #[ORM\Column(type: Types::STRING, length: 255, nullable: true)]
    private ?string $email = null;
@@ -82,43 +88,15 @@ class Constructeur

    public function __construct()
    {
+        $this->createdAt  = new DateTimeImmutable();
+        $this->updatedAt  = new DateTimeImmutable();
        $this->machines   = new ArrayCollection();
        $this->composants = new ArrayCollection();
        $this->pieces     = new ArrayCollection();
        $this->products   = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
-    public function getName(): string
+    public function getName(): ?string
    {
        return $this->name;
    }
@@ -153,19 +131,4 @@ class Constructeur

        return $this;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/CustomField.php
+++ b/src/Entity/CustomField.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\CustomFieldRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -23,6 +24,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ORM\Table(name: 'custom_fields')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Définitions de champs personnalisés. Permet de créer des champs dynamiques (texte, nombre, date, etc.) applicables aux machines, pièces, composants et produits.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -34,6 +36,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class CustomField
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['composant:read', 'piece:read', 'product:read', 'machine:read'])]
@@ -92,39 +96,11 @@ class CustomField

    public function __construct()
    {
+        $this->createdAt         = new DateTimeImmutable();
+        $this->updatedAt         = new DateTimeImmutable();
        $this->customFieldValues = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getName(): string
    {
        return $this->name;
@@ -208,19 +184,4 @@ class CustomField

        return $this;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/CustomFieldValue.php
+++ b/src/Entity/CustomFieldValue.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\CustomFieldValueRepository;
 use DateTimeImmutable;
 use Doctrine\DBAL\Types\Types;
@@ -21,6 +22,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ORM\Table(name: 'custom_field_values')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Valeurs des champs personnalisés. Stocke la valeur concrète d\'un champ personnalisé pour une entité donnée (machine, pièce, composant ou produit).',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -32,6 +34,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class CustomFieldValue
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['composant:read', 'piece:read', 'product:read', 'machine:read'])]
@@ -70,36 +74,12 @@ class CustomFieldValue
    #[Groups(['composant:read', 'piece:read', 'product:read', 'machine:read'])]
    private DateTimeImmutable $updatedAt;

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
+    public function __construct()
    {
+        $this->createdAt = new DateTimeImmutable();
        $this->updatedAt = new DateTimeImmutable();
    }

-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getValue(): string
    {
        return $this->value;
@@ -171,19 +151,4 @@ class CustomFieldValue

        return $this;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/Document.php
+++ b/src/Entity/Document.php
@@ -14,6 +14,7 @@ use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\DocumentRepository;
 use App\State\DocumentUploadProcessor;
 use DateTimeImmutable;
@@ -28,6 +29,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(ExistsFilter::class, properties: ['site', 'machine', 'composant', 'piece', 'product'])]
 #[ApiFilter(OrderFilter::class, properties: ['createdAt', 'name', 'size'])]
 #[ApiResource(
+    description: 'Documents et fichiers. Gestion des fichiers joints (PDF, images, etc.) rattachés aux machines, pièces, composants, produits ou sites. Upload via multipart/form-data.',
    operations: [
        new GetCollection(
            security: "is_granted('ROLE_VIEWER')",
@@ -52,6 +54,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class Document
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['document:list', 'document:read', 'composant:read', 'piece:read', 'product:read'])]
@@ -66,7 +70,6 @@ class Document
    private string $filename;

    #[ORM\Column(type: Types::TEXT)]
-    #[Groups(['document:detail', 'document:read', 'composant:read', 'piece:read', 'product:read'])]
    private string $path;

    #[ORM\Column(type: Types::STRING, length: 100, name: 'mimeType')]
@@ -109,36 +112,12 @@ class Document
    #[ORM\Column(type: Types::DATETIME_IMMUTABLE, name: 'updatedAt')]
    private DateTimeImmutable $updatedAt;

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
+    public function __construct()
    {
+        $this->createdAt = new DateTimeImmutable();
        $this->updatedAt = new DateTimeImmutable();
    }

-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getName(): string
    {
        return $this->name;
@@ -258,19 +237,4 @@ class Document

        return $this;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/Machine.php
+++ b/src/Entity/Machine.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\MachineRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -18,11 +19,13 @@ use Doctrine\Common\Collections\Collection;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Serializer\Attribute\Groups;
+use Symfony\Component\Validator\Constraints as Assert;

 #[ORM\Entity(repositoryClass: MachineRepository::class)]
 #[ORM\Table(name: 'machines')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Machines industrielles rattachées à un site. Chaque machine possède une structure hiérarchique de composants, pièces et produits, ainsi que des champs personnalisés et des documents.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -34,6 +37,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class Machine
 {
+    use CuidEntityTrait;
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['document:list'])]
@@ -51,7 +55,8 @@ class Machine

    #[ORM\ManyToOne(targetEntity: Site::class, inversedBy: 'machines')]
    #[ORM\JoinColumn(name: 'siteId', referencedColumnName: 'id', nullable: false, onDelete: 'CASCADE')]
-    private Site $site;
+    #[Assert\NotNull(message: 'Le site est obligatoire.')]
+    private ?Site $site = null;

    /**
     * @var Collection<int, Constructeur>
@@ -108,6 +113,9 @@ class Machine

    public function __construct()
    {
+        $now                     = new DateTimeImmutable();
+        $this->createdAt         = $now;
+        $this->updatedAt         = $now;
        $this->constructeurs     = new ArrayCollection();
        $this->componentLinks    = new ArrayCollection();
        $this->pieceLinks        = new ArrayCollection();
@@ -117,36 +125,6 @@ class Machine
        $this->customFieldValues = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getName(): string
    {
        return $this->name;
@@ -183,12 +161,12 @@ class Machine
        return $this;
    }

-    public function getSite(): Site
+    public function getSite(): ?Site
    {
        return $this->site;
    }

-    public function setSite(Site $site): static
+    public function setSite(?Site $site): static
    {
        $this->site = $site;

@@ -232,6 +210,22 @@ class Machine
        return $this->constructeurs;
    }

+    public function addConstructeur(Constructeur $constructeur): static
+    {
+        if (!$this->constructeurs->contains($constructeur)) {
+            $this->constructeurs->add($constructeur);
+        }
+
+        return $this;
+    }
+
+    public function removeConstructeur(Constructeur $constructeur): static
+    {
+        $this->constructeurs->removeElement($constructeur);
+
+        return $this;
+    }
+
    /**
     * @return Collection<int, MachineComponentLink>
     */
@@ -271,19 +265,4 @@ class Machine
    {
        return $this->customFieldValues;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/MachineComponentLink.php
+++ b/src/Entity/MachineComponentLink.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\MachineComponentLinkRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -22,6 +23,7 @@ use Doctrine\ORM\Mapping as ORM;
 #[ORM\Table(name: 'machine_component_links')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Liaisons machine–composant. Représente le rattachement d\'un composant à une machine, avec quantité, position dans la hiérarchie et surcharges éventuelles (nom, référence).',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -33,6 +35,8 @@ use Doctrine\ORM\Mapping as ORM;
 )]
 class MachineComponentLink
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    private ?string $id = null;
@@ -84,41 +88,13 @@ class MachineComponentLink

    public function __construct()
    {
+        $this->createdAt    = new DateTimeImmutable();
+        $this->updatedAt    = new DateTimeImmutable();
        $this->childLinks   = new ArrayCollection();
        $this->pieceLinks   = new ArrayCollection();
        $this->productLinks = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getMachine(): Machine
    {
        return $this->machine;
@@ -190,9 +166,4 @@ class MachineComponentLink

        return $this;
    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/MachinePieceLink.php
+++ b/src/Entity/MachinePieceLink.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\MachinePieceLinkRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -22,6 +23,7 @@ use Doctrine\ORM\Mapping as ORM;
 #[ORM\Table(name: 'machine_piece_links')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Liaisons machine–pièce. Représente le rattachement d\'une pièce à une machine, avec quantité, position dans la hiérarchie et surcharges éventuelles (nom, référence, prix).',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -33,6 +35,8 @@ use Doctrine\ORM\Mapping as ORM;
 )]
 class MachinePieceLink
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    private ?string $id = null;
@@ -72,39 +76,11 @@ class MachinePieceLink

    public function __construct()
    {
+        $this->createdAt    = new DateTimeImmutable();
+        $this->updatedAt    = new DateTimeImmutable();
        $this->productLinks = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getMachine(): Machine
    {
        return $this->machine;
@@ -176,9 +152,4 @@ class MachinePieceLink

        return $this;
    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/MachineProductLink.php
+++ b/src/Entity/MachineProductLink.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\MachineProductLinkRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -22,6 +23,7 @@ use Doctrine\ORM\Mapping as ORM;
 #[ORM\Table(name: 'machine_product_links')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Liaisons machine–produit. Représente le rattachement d\'un produit à une machine, avec quantité, position dans la hiérarchie et surcharges éventuelles (nom, référence, prix).',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -33,6 +35,8 @@ use Doctrine\ORM\Mapping as ORM;
 )]
 class MachineProductLink
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    private ?string $id = null;
@@ -71,39 +75,11 @@ class MachineProductLink

    public function __construct()
    {
+        $this->createdAt  = new DateTimeImmutable();
+        $this->updatedAt  = new DateTimeImmutable();
        $this->childLinks = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getMachine(): Machine
    {
        return $this->machine;
@@ -163,9 +139,4 @@ class MachineProductLink

        return $this;
    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/ModelType.php
+++ b/src/Entity/ModelType.php
@@ -14,6 +14,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Enum\ModelCategory;
 use App\Repository\ModelTypeRepository;
 use DateTimeImmutable;
@@ -30,6 +31,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(SearchFilter::class, properties: ['category' => 'exact', 'name' => 'ipartial'])]
 #[ApiFilter(OrderFilter::class, properties: ['name', 'createdAt'])]
 #[ApiResource(
+    description: 'Types et catégories. Référentiel de classification pour les machines, pièces, composants et produits. Chaque type appartient à une catégorie (machine, piece, composant, product) et peut être converti.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -43,6 +45,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class ModelType
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['type_machine:read', 'model_type:read', 'product:read', 'composant:read', 'piece:read'])]
@@ -128,6 +132,8 @@ class ModelType

    public function __construct()
    {
+        $this->createdAt           = new DateTimeImmutable();
+        $this->updatedAt           = new DateTimeImmutable();
        $this->composants          = new ArrayCollection();
        $this->pieces              = new ArrayCollection();
        $this->products            = new ArrayCollection();
@@ -136,36 +142,6 @@ class ModelType
        $this->productCustomFields = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getName(): string
    {
        return $this->name;
@@ -315,21 +291,6 @@ class ModelType
        return $this->productCustomFields;
    }

-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
-
    private function applyStructureForCategory(?array $structure, ModelCategory $category): void
    {
        if (ModelCategory::COMPONENT === $category) {
--- a/src/Entity/Piece.php
+++ b/src/Entity/Piece.php
@@ -14,6 +14,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\PieceRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -30,6 +31,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(SearchFilter::class, properties: ['name' => 'ipartial', 'reference' => 'ipartial', 'typePiece' => 'exact', 'typePiece.name' => 'ipartial'])]
 #[ApiFilter(OrderFilter::class, properties: ['name', 'createdAt'])]
 #[ApiResource(
+    description: 'Pièces détachées du catalogue. Une pièce peut être rattachée à plusieurs machines et possède un type, des fournisseurs, des documents et un produit associé.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -44,6 +46,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class Piece
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['piece:read', 'document:list'])]
@@ -121,42 +125,14 @@ class Piece

    public function __construct()
    {
+        $this->createdAt         = new DateTimeImmutable();
+        $this->updatedAt         = new DateTimeImmutable();
        $this->constructeurs     = new ArrayCollection();
        $this->documents         = new ArrayCollection();
        $this->customFieldValues = new ArrayCollection();
        $this->machineLinks      = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getName(): string
    {
        return $this->name;
@@ -322,19 +298,4 @@ class Piece
    {
        return $this->customFieldValues;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/Product.php
+++ b/src/Entity/Product.php
@@ -14,6 +14,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\ProductRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -28,6 +29,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(SearchFilter::class, properties: ['name' => 'ipartial', 'reference' => 'ipartial', 'typeProduct' => 'exact', 'typeProduct.name' => 'ipartial'])]
 #[ApiFilter(OrderFilter::class, properties: ['name', 'createdAt', 'supplierPrice'])]
 #[ApiResource(
+    description: 'Produits du catalogue fournisseur. Un produit possède une référence, un prix indicatif, un type, des fournisseurs et des documents. Il peut être lié à des machines.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -42,6 +44,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class Product
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['product:read', 'document:list'])]
@@ -118,6 +122,8 @@ class Product

    public function __construct()
    {
+        $this->createdAt         = new DateTimeImmutable();
+        $this->updatedAt         = new DateTimeImmutable();
        $this->constructeurs     = new ArrayCollection();
        $this->documents         = new ArrayCollection();
        $this->customFieldValues = new ArrayCollection();
@@ -126,36 +132,6 @@ class Product
        $this->machineLinks      = new ArrayCollection();
    }

-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
-    {
-        $now             = new DateTimeImmutable();
-        $this->createdAt = $now;
-        $this->updatedAt = $now;
-
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
-    }
-
    public function getName(): string
    {
        return $this->name;
@@ -243,19 +219,4 @@ class Product
    {
        return $this->customFieldValues;
    }
-
-    public function getCreatedAt(): DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function getUpdatedAt(): DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    private function generateCuid(): string
-    {
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/Profile.php
+++ b/src/Entity/Profile.php
@@ -25,8 +25,9 @@ use Symfony\Component\Validator\Constraints as Assert;
 #[ORM\UniqueConstraint(name: 'UNIQ_email', columns: ['email'])]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Profils utilisateurs. Chaque profil possède un rôle (Admin, Gestionnaire, Viewer, User), un email unique et un mot de passe. Gère l\'authentification par session.',
    operations: [
-        new Get(security: "is_granted('ROLE_VIEWER')"),
+        new Get(security: "is_granted('ROLE_ADMIN')"),
        new GetCollection(security: "is_granted('ROLE_ADMIN')"),
        new Post(
            security: "is_granted('ROLE_ADMIN')",
@@ -103,7 +104,7 @@ class Profile implements UserInterface, PasswordAuthenticatedUserInterface

    public function __construct()
    {
-        $this->id        = 'cl'.substr(strtolower(base_convert(random_bytes(12), 2, 36)), 0, 24);
+        $this->id        = 'cl'.bin2hex(random_bytes(12));
        $this->createdAt = new DateTimeImmutable();
        $this->updatedAt = new DateTimeImmutable();
    }
--- a/src/Entity/Site.php
+++ b/src/Entity/Site.php
@@ -11,6 +11,7 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use App\Entity\Trait\CuidEntityTrait;
 use App\Repository\SiteRepository;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -24,6 +25,7 @@ use Symfony\Component\Validator\Constraints as Assert;
 #[ORM\Table(name: 'sites')]
 #[ORM\HasLifecycleCallbacks]
 #[ApiResource(
+    description: 'Sites industriels. Chaque site regroupe des machines et peut avoir ses propres documents. Un site possède un nom, une adresse et des coordonnées de contact.',
    operations: [
        new Get(security: "is_granted('ROLE_VIEWER')"),
        new GetCollection(security: "is_granted('ROLE_VIEWER')"),
@@ -37,6 +39,8 @@ use Symfony\Component\Validator\Constraints as Assert;
 )]
 class Site
 {
+    use CuidEntityTrait;
+
    #[ORM\Id]
    #[ORM\Column(type: Types::STRING, length: 36)]
    #[Groups(['document:list'])]
@@ -62,6 +66,9 @@ class Site
    #[ORM\Column(type: Types::STRING, length: 100, options: ['default' => ''], name: 'contactCity')]
    private string $contactCity = '';

+    #[ORM\Column(type: Types::STRING, length: 7, options: ['default' => ''], name: 'color')]
+    private string $color = '';
+
    #[ORM\Column(type: Types::DATETIME_IMMUTABLE, name: 'createdAt')]
    private DateTimeImmutable $createdAt;

@@ -81,41 +88,11 @@ class Site
    private Collection $documents;

    public function __construct()
-    {
-        $this->machines  = new ArrayCollection();
-        $this->documents = new ArrayCollection();
-    }
-
-    #[ORM\PrePersist]
-    public function setCreatedAtValue(): void
    {
        $this->createdAt = new DateTimeImmutable();
        $this->updatedAt = new DateTimeImmutable();
-
-        // Générer un ID CUID-compatible si nécessaire
-        if (null === $this->id) {
-            $this->id = $this->generateCuid();
-        }
-    }
-
-    #[ORM\PreUpdate]
-    public function setUpdatedAtValue(): void
-    {
-        $this->updatedAt = new DateTimeImmutable();
-    }
-
-    // Getters et Setters
-
-    public function getId(): ?string
-    {
-        return $this->id;
-    }
-
-    public function setId(string $id): static
-    {
-        $this->id = $id;
-
-        return $this;
+        $this->machines  = new ArrayCollection();
+        $this->documents = new ArrayCollection();
    }

    public function getName(): string
@@ -190,14 +167,16 @@ class Site
        return $this;
    }

-    public function getCreatedAt(): DateTimeImmutable
+    public function getColor(): string
    {
-        return $this->createdAt;
+        return $this->color;
    }

-    public function getUpdatedAt(): DateTimeImmutable
+    public function setColor(string $color): static
    {
-        return $this->updatedAt;
+        $this->color = $color;
+
+        return $this;
    }

    /**
@@ -259,10 +238,4 @@ class Site

        return $this;
    }
-
-    private function generateCuid(): string
-    {
-        // Génération d'un ID compatible CUID (format: cl + 24 caractères)
-        return 'cl'.bin2hex(random_bytes(12));
-    }
 }
--- a/src/Entity/Trait/CuidEntityTrait.php
+++ b/src/Entity/Trait/CuidEntityTrait.php
@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Entity\Trait;
+
+use DateTimeImmutable;
+use Doctrine\ORM\Mapping as ORM;
+
+trait CuidEntityTrait
+{
+    #[ORM\PrePersist]
+    public function setCreatedAtValue(): void
+    {
+        $now             = new DateTimeImmutable();
+        $this->createdAt = $now;
+        $this->updatedAt = $now;
+
+        if (null === $this->id) {
+            $this->id = $this->generateCuid();
+        }
+    }
+
+    #[ORM\PreUpdate]
+    public function setUpdatedAtValue(): void
+    {
+        $this->updatedAt = new DateTimeImmutable();
+    }
+
+    public function getId(): ?string
+    {
+        return $this->id;
+    }
+
+    public function setId(string $id): static
+    {
+        $this->id = $id;
+
+        return $this;
+    }
+
+    public function getCreatedAt(): DateTimeImmutable
+    {
+        return $this->createdAt;
+    }
+
+    public function getUpdatedAt(): DateTimeImmutable
+    {
+        return $this->updatedAt;
+    }
+
+    private function generateCuid(): string
+    {
+        return 'cl'.bin2hex(random_bytes(12));
+    }
+}
--- a/src/EventSubscriber/AbstractAuditSubscriber.php
+++ b/src/EventSubscriber/AbstractAuditSubscriber.php
@@ -0,0 +1,463 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\EventSubscriber;
+
+use App\Entity\AuditLog;
+use App\Entity\Composant;
+use App\Entity\CustomFieldValue;
+use App\Entity\Machine;
+use App\Entity\ModelType;
+use App\Entity\Piece;
+use App\Entity\Product;
+use App\Entity\Profile;
+use App\Entity\Site;
+use BackedEnum;
+use DateTimeInterface;
+use Doctrine\Common\Collections\Collection;
+use Doctrine\Common\EventSubscriber;
+use Doctrine\ORM\EntityManagerInterface;
+use Doctrine\ORM\Event\OnFlushEventArgs;
+use Doctrine\ORM\Events;
+use Doctrine\ORM\PersistentCollection;
+use Doctrine\ORM\UnitOfWork;
+use Error;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Throwable;
+
+use function is_array;
+use function is_object;
+use function is_scalar;
+use function method_exists;
+
+abstract class AbstractAuditSubscriber implements EventSubscriber
+{
+    public function __construct(
+        private readonly RequestStack $requestStack,
+        private readonly Security $security,
+    ) {}
+
+    public function getSubscribedEvents(): array
+    {
+        return [Events::onFlush];
+    }
+
+    public function onFlush(OnFlushEventArgs $args): void
+    {
+        $em = $args->getObjectManager();
+        if (!$em instanceof EntityManagerInterface) {
+            return;
+        }
+
+        $uow            = $em->getUnitOfWork();
+        $actorProfileId = $this->resolveActorProfileId();
+        $entityType     = $this->entityType();
+
+        if ($this->hasCollectionTracking()) {
+            $this->onFlushComplex($em, $uow, $actorProfileId, $entityType);
+        } else {
+            $this->onFlushSimple($em, $uow, $actorProfileId, $entityType);
+        }
+    }
+
+    abstract protected function supports(object $entity): bool;
+
+    abstract protected function entityType(): string;
+
+    abstract protected function snapshotEntity(object $entity): array;
+
+    /**
+     * Override in subclasses that track custom field value changes.
+     * Return the owner entity if the CFV belongs to the tracked entity type.
+     */
+    protected function getOwnerFromCustomFieldValue(CustomFieldValue $cfv): ?object
+    {
+        return null;
+    }
+
+    /**
+     * Whether this subscriber tracks constructeur collection changes.
+     * Override to return true for entities with a constructeurs ManyToMany.
+     */
+    protected function hasCollectionTracking(): bool
+    {
+        return false;
+    }
+
+    protected function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
+    {
+        $uow = $em->getUnitOfWork();
+        $log->initializeAuditLog();
+        $em->persist($log);
+
+        $meta = $em->getClassMetadata(AuditLog::class);
+        $uow->computeChangeSet($meta, $log);
+    }
+
+    /**
+     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
+     *
+     * @return array<string, array{from:mixed, to:mixed}>
+     */
+    protected function buildDiffFromChangeSet(array $changeSet): array
+    {
+        $diff = [];
+        foreach ($changeSet as $field => [$oldValue, $newValue]) {
+            if ('updatedAt' === $field || 'createdAt' === $field) {
+                continue;
+            }
+
+            $normalizedOld = $this->normalizeValue($oldValue);
+            $normalizedNew = $this->normalizeValue($newValue);
+
+            if ($normalizedOld === $normalizedNew) {
+                continue;
+            }
+
+            $diff[$field] = [
+                'from' => $normalizedOld,
+                'to'   => $normalizedNew,
+            ];
+        }
+
+        return $diff;
+    }
+
+    /**
+     * @param iterable<mixed> $items
+     *
+     * @return list<array{id: string, name: string}|string>
+     */
+    protected function normalizeCollection(iterable $items): array
+    {
+        $entries = [];
+        $seen    = [];
+        foreach ($items as $item) {
+            if (is_object($item) && method_exists($item, 'getId')) {
+                $id = $item->getId();
+                if (null === $id || '' === $id || isset($seen[(string) $id])) {
+                    continue;
+                }
+                $seen[(string) $id] = true;
+                if (method_exists($item, 'getName')) {
+                    $entries[] = ['id' => (string) $id, 'name' => (string) $item->getName()];
+                } else {
+                    $entries[] = (string) $id;
+                }
+            }
+        }
+
+        return $entries;
+    }
+
+    protected function safeGet(object $entity, string $method): mixed
+    {
+        try {
+            return $entity->{$method}();
+        } catch (Error) {
+            return null;
+        }
+    }
+
+    protected function normalizeValue(mixed $value): mixed
+    {
+        if (null === $value || is_scalar($value)) {
+            return $value;
+        }
+
+        if ($value instanceof DateTimeInterface) {
+            return $value->format(DateTimeInterface::ATOM);
+        }
+
+        if ($value instanceof BackedEnum) {
+            return $value->value;
+        }
+
+        if ($value instanceof ModelType) {
+            return [
+                'id'   => $value->getId(),
+                'name' => $value->getName(),
+                'code' => $value->getCode(),
+            ];
+        }
+
+        if ($value instanceof Product) {
+            return [
+                'id'        => $value->getId(),
+                'name'      => $value->getName(),
+                'reference' => $value->getReference(),
+            ];
+        }
+
+        if ($value instanceof Site || $value instanceof Machine || $value instanceof Composant || $value instanceof Piece) {
+            return [
+                'id'   => $value->getId(),
+                'name' => $value->getName(),
+            ];
+        }
+
+        if ($value instanceof Collection) {
+            return $this->normalizeCollection($value);
+        }
+
+        if (is_object($value) && method_exists($value, 'getId')) {
+            return (string) $value->getId();
+        }
+
+        if (is_array($value)) {
+            return $value;
+        }
+
+        return (string) $value;
+    }
+
+    /**
+     * @param array<string, array{from:mixed, to:mixed}> $base
+     * @param array<string, array{from:mixed, to:mixed}> $extra
+     *
+     * @return array<string, array{from:mixed, to:mixed}>
+     */
+    protected function mergeDiffs(array $base, array $extra): array
+    {
+        foreach ($extra as $field => $change) {
+            $base[$field] = $change;
+        }
+
+        return $base;
+    }
+
+    protected function resolveActorProfileId(): ?string
+    {
+        try {
+            $session = $this->requestStack->getSession();
+            if ($session instanceof SessionInterface) {
+                $profileId = $session->get('profileId');
+                if ($profileId) {
+                    return (string) $profileId;
+                }
+            }
+        } catch (Throwable) {
+            // No session available (CLI context, etc.)
+        }
+
+        $user = $this->security->getUser();
+        if ($user instanceof Profile) {
+            return $user->getId();
+        }
+
+        return null;
+    }
+
+    private function onFlushSimple(EntityManagerInterface $em, UnitOfWork $uow, ?string $actorProfileId, string $entityType): void
+    {
+        foreach ($uow->getScheduledEntityInsertions() as $entity) {
+            if (!$this->supports($entity)) {
+                continue;
+            }
+
+            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
+            $snapshot = $this->snapshotEntity($entity);
+            $this->persistAuditLog($em, new AuditLog($entityType, (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
+        }
+
+        foreach ($uow->getScheduledEntityUpdates() as $entity) {
+            if (!$this->supports($entity)) {
+                continue;
+            }
+
+            $id = (string) $entity->getId();
+            if ('' === $id) {
+                continue;
+            }
+
+            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
+            if ([] !== $diff) {
+                $snapshot = $this->snapshotEntity($entity);
+                $this->persistAuditLog($em, new AuditLog($entityType, $id, 'update', $diff, $snapshot, $actorProfileId));
+            }
+        }
+
+        foreach ($uow->getScheduledEntityDeletions() as $entity) {
+            if (!$this->supports($entity)) {
+                continue;
+            }
+
+            $snapshot = $this->snapshotEntity($entity);
+            $this->persistAuditLog($em, new AuditLog($entityType, (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
+        }
+    }
+
+    private function onFlushComplex(EntityManagerInterface $em, UnitOfWork $uow, ?string $actorProfileId, string $entityType): void
+    {
+        $pendingUpdates   = [];
+        $pendingSnapshots = [];
+        $pendingEntities  = [];
+
+        foreach ($uow->getScheduledEntityInsertions() as $entity) {
+            if (!$this->supports($entity)) {
+                continue;
+            }
+
+            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
+            $snapshot = $this->snapshotEntity($entity);
+            $this->persistAuditLog($em, new AuditLog($entityType, (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
+        }
+
+        foreach ($uow->getScheduledEntityUpdates() as $entity) {
+            if (!$this->supports($entity)) {
+                continue;
+            }
+
+            $entityId = (string) $entity->getId();
+            if ('' === $entityId) {
+                continue;
+            }
+
+            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
+            if ([] !== $diff) {
+                $pendingUpdates[$entityId]   = $this->mergeDiffs($pendingUpdates[$entityId] ?? [], $diff);
+                $pendingSnapshots[$entityId] = $this->snapshotEntity($entity);
+                $pendingEntities[$entityId]  = $entity;
+            }
+        }
+
+        foreach ($uow->getScheduledEntityDeletions() as $entity) {
+            if (!$this->supports($entity)) {
+                continue;
+            }
+
+            $snapshot = $this->snapshotEntity($entity);
+            $this->persistAuditLog($em, new AuditLog($entityType, (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
+        }
+
+        foreach ($uow->getScheduledCollectionUpdates() as $collection) {
+            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingEntities);
+        }
+        foreach ($uow->getScheduledCollectionDeletions() as $collection) {
+            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingEntities);
+        }
+
+        $this->collectCustomFieldValueChanges($uow, $pendingUpdates, $pendingSnapshots, $pendingEntities);
+
+        foreach ($pendingUpdates as $entityId => $diff) {
+            if ([] === $diff) {
+                continue;
+            }
+
+            $entity = $pendingEntities[$entityId] ?? null;
+            if (null === $entity || !$this->supports($entity)) {
+                continue;
+            }
+
+            $snapshot = $pendingSnapshots[$entityId] ?? $this->snapshotEntity($entity);
+            $this->persistAuditLog($em, new AuditLog($entityType, $entityId, 'update', $diff, $snapshot, $actorProfileId));
+        }
+    }
+
+    private function collectCollectionUpdate(
+        object $collection,
+        array &$pendingUpdates,
+        array &$pendingSnapshots,
+        array &$pendingEntities,
+    ): void {
+        if (!$collection instanceof PersistentCollection) {
+            return;
+        }
+
+        $owner = $collection->getOwner();
+        if (null === $owner || !$this->supports($owner)) {
+            return;
+        }
+
+        $ownerId = (string) $owner->getId();
+        if ('' === $ownerId) {
+            return;
+        }
+
+        $mapping   = $collection->getMapping();
+        $fieldName = $mapping['fieldName'] ?? null;
+        if ('constructeurs' !== $fieldName) {
+            return;
+        }
+
+        $before = $this->normalizeCollection($collection->getSnapshot());
+        $after  = $this->normalizeCollection($collection->toArray());
+
+        if ($before === $after) {
+            return;
+        }
+
+        $diff = [
+            'constructeurIds' => [
+                'from' => $before,
+                'to'   => $after,
+            ],
+        ];
+
+        $pendingUpdates[$ownerId]   = $this->mergeDiffs($pendingUpdates[$ownerId] ?? [], $diff);
+        $pendingSnapshots[$ownerId] = $this->snapshotEntity($owner);
+        $pendingEntities[$ownerId]  = $owner;
+    }
+
+    private function collectCustomFieldValueChanges(
+        UnitOfWork $uow,
+        array &$pendingUpdates,
+        array &$pendingSnapshots,
+        array &$pendingEntities,
+    ): void {
+        foreach ($uow->getScheduledEntityInsertions() as $entity) {
+            if ($entity instanceof CustomFieldValue) {
+                $this->trackCustomFieldValueChange($entity, null, $entity->getValue(), $pendingUpdates, $pendingSnapshots, $pendingEntities);
+            }
+        }
+
+        foreach ($uow->getScheduledEntityUpdates() as $entity) {
+            if (!$entity instanceof CustomFieldValue) {
+                continue;
+            }
+            $changeSet = $uow->getEntityChangeSet($entity);
+            if (!isset($changeSet['value'])) {
+                continue;
+            }
+            [$oldVal, $newVal] = $changeSet['value'];
+            if ($oldVal !== $newVal) {
+                $this->trackCustomFieldValueChange($entity, $oldVal, $newVal, $pendingUpdates, $pendingSnapshots, $pendingEntities);
+            }
+        }
+
+        foreach ($uow->getScheduledEntityDeletions() as $entity) {
+            if ($entity instanceof CustomFieldValue) {
+                $this->trackCustomFieldValueChange($entity, $entity->getValue(), null, $pendingUpdates, $pendingSnapshots, $pendingEntities);
+            }
+        }
+    }
+
+    private function trackCustomFieldValueChange(
+        CustomFieldValue $cfv,
+        mixed $from,
+        mixed $to,
+        array &$pendingUpdates,
+        array &$pendingSnapshots,
+        array &$pendingEntities,
+    ): void {
+        $owner = $this->getOwnerFromCustomFieldValue($cfv);
+        if (null === $owner) {
+            return;
+        }
+
+        $ownerId = (string) $owner->getId();
+        if ('' === $ownerId) {
+            return;
+        }
+
+        $fieldName = 'customField:'.$cfv->getCustomField()->getName();
+        $diff      = [$fieldName => ['from' => $from, 'to' => $to]];
+
+        $pendingUpdates[$ownerId]   = $this->mergeDiffs($pendingUpdates[$ownerId] ?? [], $diff);
+        $pendingSnapshots[$ownerId] = $this->snapshotEntity($owner);
+        $pendingEntities[$ownerId]  = $owner;
+    }
+}
--- a/src/EventSubscriber/ComposantAuditSubscriber.php
+++ b/src/EventSubscriber/ComposantAuditSubscriber.php
@@ -4,394 +4,45 @@ declare(strict_types=1);

 namespace App\EventSubscriber;

-use App\Entity\AuditLog;
 use App\Entity\Composant;
 use App\Entity\CustomFieldValue;
-use App\Entity\ModelType;
-use App\Entity\Product;
-use App\Entity\Profile;
-use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Attribute\AsDoctrineListener;
-use Doctrine\Common\Collections\Collection;
-use Doctrine\Common\EventSubscriber;
-use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\Event\OnFlushEventArgs;
 use Doctrine\ORM\Events;
-use Doctrine\ORM\PersistentCollection;
-use Doctrine\ORM\UnitOfWork;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\SessionInterface;
-use Throwable;
-
-use function is_array;
-use function is_object;
-use function is_scalar;
-use function method_exists;

 #[AsDoctrineListener(event: Events::onFlush)]
-final class ComposantAuditSubscriber implements EventSubscriber
+final class ComposantAuditSubscriber extends AbstractAuditSubscriber
 {
-    public function __construct(
-        private readonly RequestStack $requestStack,
-        private readonly Security $security,
-    ) {}
+    protected function supports(object $entity): bool
+    {
+        return $entity instanceof Composant;
+    }

-    public function getSubscribedEvents(): array
+    protected function entityType(): string
+    {
+        return 'composant';
+    }
+
+    protected function hasCollectionTracking(): bool
+    {
+        return true;
+    }
+
+    protected function getOwnerFromCustomFieldValue(CustomFieldValue $cfv): ?object
+    {
+        return $cfv->getComposant();
+    }
+
+    protected function snapshotEntity(object $entity): array
    {
        return [
-            Events::onFlush,
+            'id'              => $entity->getId(),
+            'name'            => $this->safeGet($entity, 'getName'),
+            'reference'       => $this->safeGet($entity, 'getReference'),
+            'prix'            => $this->safeGet($entity, 'getPrix'),
+            'structure'       => $this->safeGet($entity, 'getStructure'),
+            'typeComposant'   => $this->normalizeValue($this->safeGet($entity, 'getTypeComposant')),
+            'product'         => $this->normalizeValue($this->safeGet($entity, 'getProduct')),
+            'constructeurIds' => $this->normalizeCollection($entity->getConstructeurs()),
        ];
    }
-
-    public function onFlush(OnFlushEventArgs $args): void
-    {
-        $em = $args->getObjectManager();
-        if (!$em instanceof EntityManagerInterface) {
-            return;
-        }
-
-        $uow               = $em->getUnitOfWork();
-        $actorProfileId    = $this->resolveActorProfileId();
-        $pendingUpdates    = [];
-        $pendingSnapshots  = [];
-        $pendingComponents = [];
-
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if (!$entity instanceof Composant) {
-                continue;
-            }
-
-            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            $snapshot = $this->snapshotComposant($entity);
-            $this->persistAuditLog($em, new AuditLog('composant', (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof Composant) {
-                continue;
-            }
-
-            $componentId = (string) $entity->getId();
-            if ('' === $componentId) {
-                continue;
-            }
-
-            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            if ([] !== $diff) {
-                $pendingUpdates[$componentId]    = $this->mergeDiffs($pendingUpdates[$componentId] ?? [], $diff);
-                $pendingSnapshots[$componentId]  = $this->snapshotComposant($entity);
-                $pendingComponents[$componentId] = $entity;
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if (!$entity instanceof Composant) {
-                continue;
-            }
-
-            $snapshot = $this->snapshotComposant($entity);
-            $this->persistAuditLog($em, new AuditLog('composant', (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledCollectionUpdates() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingComponents);
-        }
-        foreach ($uow->getScheduledCollectionDeletions() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingComponents);
-        }
-
-        $this->collectCustomFieldValueChanges($uow, $pendingUpdates, $pendingSnapshots, $pendingComponents);
-
-        foreach ($pendingUpdates as $componentId => $diff) {
-            if ([] === $diff) {
-                continue;
-            }
-
-            $component = $pendingComponents[$componentId] ?? null;
-            if (!$component instanceof Composant) {
-                continue;
-            }
-
-            $snapshot = $pendingSnapshots[$componentId] ?? $this->snapshotComposant($component);
-            $this->persistAuditLog($em, new AuditLog('composant', $componentId, 'update', $diff, $snapshot, $actorProfileId));
-        }
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Composant>                                  $pendingComponents
-     */
-    private function collectCollectionUpdate(
-        object $collection,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingComponents,
-    ): void {
-        if (!$collection instanceof PersistentCollection) {
-            return;
-        }
-
-        $owner = $collection->getOwner();
-        if (!$owner instanceof Composant) {
-            return;
-        }
-
-        $componentId = (string) $owner->getId();
-        if ('' === $componentId) {
-            return;
-        }
-
-        $mapping   = $collection->getMapping();
-        $fieldName = $mapping['fieldName'] ?? null;
-        if ('constructeurs' !== $fieldName) {
-            return;
-        }
-
-        $before = $this->normalizeCollection($collection->getSnapshot());
-        $after  = $this->normalizeCollection($collection->toArray());
-
-        if ($before === $after) {
-            return;
-        }
-
-        $diff = [
-            'constructeurIds' => [
-                'from' => $before,
-                'to'   => $after,
-            ],
-        ];
-
-        $pendingUpdates[$componentId]    = $this->mergeDiffs($pendingUpdates[$componentId] ?? [], $diff);
-        $pendingSnapshots[$componentId]  = $this->snapshotComposant($owner);
-        $pendingComponents[$componentId] = $owner;
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Composant>                                  $pendingComponents
-     */
-    private function collectCustomFieldValueChanges(
-        UnitOfWork $uow,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingComponents,
-    ): void {
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, null, $entity->getValue(), $pendingUpdates, $pendingSnapshots, $pendingComponents);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof CustomFieldValue) {
-                continue;
-            }
-            $changeSet = $uow->getEntityChangeSet($entity);
-            if (!isset($changeSet['value'])) {
-                continue;
-            }
-            [$oldVal, $newVal] = $changeSet['value'];
-            if ($oldVal !== $newVal) {
-                $this->trackCustomFieldValueChange($entity, $oldVal, $newVal, $pendingUpdates, $pendingSnapshots, $pendingComponents);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, $entity->getValue(), null, $pendingUpdates, $pendingSnapshots, $pendingComponents);
-            }
-        }
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Composant>                                  $pendingComponents
-     */
-    private function trackCustomFieldValueChange(
-        CustomFieldValue $cfv,
-        mixed $from,
-        mixed $to,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingComponents,
-    ): void {
-        $owner = $cfv->getComposant();
-        if (!$owner instanceof Composant) {
-            return;
-        }
-
-        $ownerId = (string) $owner->getId();
-        if ('' === $ownerId) {
-            return;
-        }
-
-        $fieldName = 'customField:'.$cfv->getCustomField()->getName();
-        $diff      = [$fieldName => ['from' => $from, 'to' => $to]];
-
-        $pendingUpdates[$ownerId]    = $this->mergeDiffs($pendingUpdates[$ownerId] ?? [], $diff);
-        $pendingSnapshots[$ownerId]  = $this->snapshotComposant($owner);
-        $pendingComponents[$ownerId] = $owner;
-    }
-
-    private function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
-    {
-        $uow = $em->getUnitOfWork();
-        $log->initializeAuditLog();
-        $em->persist($log);
-
-        $meta = $em->getClassMetadata(AuditLog::class);
-        $uow->computeChangeSet($meta, $log);
-    }
-
-    /**
-     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function buildDiffFromChangeSet(array $changeSet): array
-    {
-        $diff = [];
-        foreach ($changeSet as $field => [$oldValue, $newValue]) {
-            if ('updatedAt' === $field || 'createdAt' === $field) {
-                continue;
-            }
-
-            $normalizedOld = $this->normalizeValue($oldValue);
-            $normalizedNew = $this->normalizeValue($newValue);
-
-            if ($normalizedOld === $normalizedNew) {
-                continue;
-            }
-
-            $diff[$field] = [
-                'from' => $normalizedOld,
-                'to'   => $normalizedNew,
-            ];
-        }
-
-        return $diff;
-    }
-
-    private function snapshotComposant(Composant $component): array
-    {
-        return [
-            'id'              => $component->getId(),
-            'name'            => $component->getName(),
-            'reference'       => $component->getReference(),
-            'prix'            => $component->getPrix(),
-            'structure'       => $component->getStructure(),
-            'typeComposant'   => $this->normalizeValue($component->getTypeComposant()),
-            'product'         => $this->normalizeValue($component->getProduct()),
-            'constructeurIds' => $this->normalizeCollection($component->getConstructeurs()),
-        ];
-    }
-
-    /**
-     * @param iterable<mixed> $items
-     *
-     * @return list<array{id: string, name: string}|string>
-     */
-    private function normalizeCollection(iterable $items): array
-    {
-        $entries = [];
-        $seen    = [];
-        foreach ($items as $item) {
-            if (is_object($item) && method_exists($item, 'getId')) {
-                $id = $item->getId();
-                if (null === $id || '' === $id || isset($seen[(string) $id])) {
-                    continue;
-                }
-                $seen[(string) $id] = true;
-                if (method_exists($item, 'getName')) {
-                    $entries[] = ['id' => (string) $id, 'name' => (string) $item->getName()];
-                } else {
-                    $entries[] = (string) $id;
-                }
-            }
-        }
-
-        return $entries;
-    }
-
-    private function normalizeValue(mixed $value): mixed
-    {
-        if (null === $value || is_scalar($value)) {
-            return $value;
-        }
-
-        if ($value instanceof DateTimeInterface) {
-            return $value->format(DateTimeInterface::ATOM);
-        }
-
-        if ($value instanceof ModelType) {
-            return [
-                'id'   => $value->getId(),
-                'name' => $value->getName(),
-                'code' => $value->getCode(),
-            ];
-        }
-
-        if ($value instanceof Product) {
-            return [
-                'id'        => $value->getId(),
-                'name'      => $value->getName(),
-                'reference' => $value->getReference(),
-            ];
-        }
-
-        if ($value instanceof Collection) {
-            return $this->normalizeCollection($value);
-        }
-
-        if (is_object($value) && method_exists($value, 'getId')) {
-            return (string) $value->getId();
-        }
-
-        if (is_array($value)) {
-            return $value;
-        }
-
-        return (string) $value;
-    }
-
-    /**
-     * @param array<string, array{from:mixed, to:mixed}> $base
-     * @param array<string, array{from:mixed, to:mixed}> $extra
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function mergeDiffs(array $base, array $extra): array
-    {
-        foreach ($extra as $field => $change) {
-            $base[$field] = $change;
-        }
-
-        return $base;
-    }
-
-    private function resolveActorProfileId(): ?string
-    {
-        try {
-            $session = $this->requestStack->getSession();
-            if ($session instanceof SessionInterface) {
-                $profileId = $session->get('profileId');
-                if ($profileId) {
-                    return (string) $profileId;
-                }
-            }
-        } catch (Throwable) {
-            // No session available (CLI context, etc.)
-        }
-
-        $user = $this->security->getUser();
-        if ($user instanceof Profile) {
-            return $user->getId();
-        }
-
-        return null;
-    }
 }
--- a/src/EventSubscriber/ConstructeurAuditSubscriber.php
+++ b/src/EventSubscriber/ConstructeurAuditSubscriber.php
@@ -4,165 +4,30 @@ declare(strict_types=1);

 namespace App\EventSubscriber;

-use App\Entity\AuditLog;
 use App\Entity\Constructeur;
-use App\Entity\Profile;
-use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Attribute\AsDoctrineListener;
-use Doctrine\Common\EventSubscriber;
-use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\Event\OnFlushEventArgs;
 use Doctrine\ORM\Events;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\SessionInterface;
-use Throwable;
-
-use function is_scalar;

 #[AsDoctrineListener(event: Events::onFlush)]
-final class ConstructeurAuditSubscriber implements EventSubscriber
+final class ConstructeurAuditSubscriber extends AbstractAuditSubscriber
 {
-    public function __construct(
-        private readonly RequestStack $requestStack,
-        private readonly Security $security,
-    ) {}
+    protected function supports(object $entity): bool
+    {
+        return $entity instanceof Constructeur;
+    }

-    public function getSubscribedEvents(): array
+    protected function entityType(): string
+    {
+        return 'constructeur';
+    }
+
+    protected function snapshotEntity(object $entity): array
    {
        return [
-            Events::onFlush,
+            'id'    => $entity->getId(),
+            'name'  => $this->safeGet($entity, 'getName'),
+            'email' => $this->safeGet($entity, 'getEmail'),
+            'phone' => $this->safeGet($entity, 'getPhone'),
        ];
    }
-
-    public function onFlush(OnFlushEventArgs $args): void
-    {
-        $em = $args->getObjectManager();
-        if (!$em instanceof EntityManagerInterface) {
-            return;
-        }
-
-        $uow            = $em->getUnitOfWork();
-        $actorProfileId = $this->resolveActorProfileId();
-
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if (!$entity instanceof Constructeur) {
-                continue;
-            }
-
-            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            $snapshot = $this->snapshotConstructeur($entity);
-            $this->persistAuditLog($em, new AuditLog('constructeur', (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof Constructeur) {
-                continue;
-            }
-
-            $id = (string) $entity->getId();
-            if ('' === $id) {
-                continue;
-            }
-
-            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            if ([] !== $diff) {
-                $snapshot = $this->snapshotConstructeur($entity);
-                $this->persistAuditLog($em, new AuditLog('constructeur', $id, 'update', $diff, $snapshot, $actorProfileId));
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if (!$entity instanceof Constructeur) {
-                continue;
-            }
-
-            $snapshot = $this->snapshotConstructeur($entity);
-            $this->persistAuditLog($em, new AuditLog('constructeur', (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
-        }
-    }
-
-    private function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
-    {
-        $uow = $em->getUnitOfWork();
-        $log->initializeAuditLog();
-        $em->persist($log);
-
-        $meta = $em->getClassMetadata(AuditLog::class);
-        $uow->computeChangeSet($meta, $log);
-    }
-
-    /**
-     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function buildDiffFromChangeSet(array $changeSet): array
-    {
-        $diff = [];
-        foreach ($changeSet as $field => [$oldValue, $newValue]) {
-            if ('updatedAt' === $field || 'createdAt' === $field) {
-                continue;
-            }
-
-            $normalizedOld = $this->normalizeValue($oldValue);
-            $normalizedNew = $this->normalizeValue($newValue);
-
-            if ($normalizedOld === $normalizedNew) {
-                continue;
-            }
-
-            $diff[$field] = [
-                'from' => $normalizedOld,
-                'to'   => $normalizedNew,
-            ];
-        }
-
-        return $diff;
-    }
-
-    private function snapshotConstructeur(Constructeur $constructeur): array
-    {
-        return [
-            'id'    => $constructeur->getId(),
-            'name'  => $constructeur->getName(),
-            'email' => $constructeur->getEmail(),
-            'phone' => $constructeur->getPhone(),
-        ];
-    }
-
-    private function normalizeValue(mixed $value): mixed
-    {
-        if (null === $value || is_scalar($value)) {
-            return $value;
-        }
-
-        if ($value instanceof DateTimeInterface) {
-            return $value->format(DateTimeInterface::ATOM);
-        }
-
-        return (string) $value;
-    }
-
-    private function resolveActorProfileId(): ?string
-    {
-        try {
-            $session = $this->requestStack->getSession();
-            if ($session instanceof SessionInterface) {
-                $profileId = $session->get('profileId');
-                if ($profileId) {
-                    return (string) $profileId;
-                }
-            }
-        } catch (Throwable) {
-            // No session available (CLI context, etc.)
-        }
-
-        $user = $this->security->getUser();
-        if ($user instanceof Profile) {
-            return $user->getId();
-        }
-
-        return null;
-    }
 }
--- a/src/EventSubscriber/DocumentAuditSubscriber.php
+++ b/src/EventSubscriber/DocumentAuditSubscriber.php
@@ -4,189 +4,36 @@ declare(strict_types=1);

 namespace App\EventSubscriber;

-use App\Entity\AuditLog;
-use App\Entity\Composant;
 use App\Entity\Document;
-use App\Entity\Machine;
-use App\Entity\Piece;
-use App\Entity\Product;
-use App\Entity\Profile;
-use App\Entity\Site;
-use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Attribute\AsDoctrineListener;
-use Doctrine\Common\EventSubscriber;
-use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\Event\OnFlushEventArgs;
 use Doctrine\ORM\Events;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\SessionInterface;
-use Throwable;
-
-use function is_object;
-use function is_scalar;
-use function method_exists;

 #[AsDoctrineListener(event: Events::onFlush)]
-final class DocumentAuditSubscriber implements EventSubscriber
+final class DocumentAuditSubscriber extends AbstractAuditSubscriber
 {
-    public function __construct(
-        private readonly RequestStack $requestStack,
-        private readonly Security $security,
-    ) {}
+    protected function supports(object $entity): bool
+    {
+        return $entity instanceof Document;
+    }

-    public function getSubscribedEvents(): array
+    protected function entityType(): string
+    {
+        return 'document';
+    }
+
+    protected function snapshotEntity(object $entity): array
    {
        return [
-            Events::onFlush,
+            'id'        => $entity->getId(),
+            'name'      => $this->safeGet($entity, 'getName'),
+            'filename'  => $this->safeGet($entity, 'getFilename'),
+            'mimeType'  => $this->safeGet($entity, 'getMimeType'),
+            'size'      => $this->safeGet($entity, 'getSize'),
+            'machine'   => $this->normalizeValue($this->safeGet($entity, 'getMachine')),
+            'composant' => $this->normalizeValue($this->safeGet($entity, 'getComposant')),
+            'piece'     => $this->normalizeValue($this->safeGet($entity, 'getPiece')),
+            'product'   => $this->normalizeValue($this->safeGet($entity, 'getProduct')),
+            'site'      => $this->normalizeValue($this->safeGet($entity, 'getSite')),
        ];
    }
-
-    public function onFlush(OnFlushEventArgs $args): void
-    {
-        $em = $args->getObjectManager();
-        if (!$em instanceof EntityManagerInterface) {
-            return;
-        }
-
-        $uow            = $em->getUnitOfWork();
-        $actorProfileId = $this->resolveActorProfileId();
-
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if (!$entity instanceof Document) {
-                continue;
-            }
-
-            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            $snapshot = $this->snapshotDocument($entity);
-            $this->persistAuditLog($em, new AuditLog('document', (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof Document) {
-                continue;
-            }
-
-            $id = (string) $entity->getId();
-            if ('' === $id) {
-                continue;
-            }
-
-            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            if ([] !== $diff) {
-                $snapshot = $this->snapshotDocument($entity);
-                $this->persistAuditLog($em, new AuditLog('document', $id, 'update', $diff, $snapshot, $actorProfileId));
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if (!$entity instanceof Document) {
-                continue;
-            }
-
-            $snapshot = $this->snapshotDocument($entity);
-            $this->persistAuditLog($em, new AuditLog('document', (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
-        }
-    }
-
-    private function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
-    {
-        $uow = $em->getUnitOfWork();
-        $log->initializeAuditLog();
-        $em->persist($log);
-
-        $meta = $em->getClassMetadata(AuditLog::class);
-        $uow->computeChangeSet($meta, $log);
-    }
-
-    /**
-     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function buildDiffFromChangeSet(array $changeSet): array
-    {
-        $diff = [];
-        foreach ($changeSet as $field => [$oldValue, $newValue]) {
-            if ('updatedAt' === $field || 'createdAt' === $field) {
-                continue;
-            }
-
-            $normalizedOld = $this->normalizeValue($oldValue);
-            $normalizedNew = $this->normalizeValue($newValue);
-
-            if ($normalizedOld === $normalizedNew) {
-                continue;
-            }
-
-            $diff[$field] = [
-                'from' => $normalizedOld,
-                'to'   => $normalizedNew,
-            ];
-        }
-
-        return $diff;
-    }
-
-    private function snapshotDocument(Document $document): array
-    {
-        return [
-            'id'        => $document->getId(),
-            'name'      => $document->getName(),
-            'filename'  => $document->getFilename(),
-            'mimeType'  => $document->getMimeType(),
-            'size'      => $document->getSize(),
-            'machine'   => $this->normalizeValue($document->getMachine()),
-            'composant' => $this->normalizeValue($document->getComposant()),
-            'piece'     => $this->normalizeValue($document->getPiece()),
-            'product'   => $this->normalizeValue($document->getProduct()),
-            'site'      => $this->normalizeValue($document->getSite()),
-        ];
-    }
-
-    private function normalizeValue(mixed $value): mixed
-    {
-        if (null === $value || is_scalar($value)) {
-            return $value;
-        }
-
-        if ($value instanceof DateTimeInterface) {
-            return $value->format(DateTimeInterface::ATOM);
-        }
-
-        if ($value instanceof Machine || $value instanceof Composant || $value instanceof Piece || $value instanceof Product || $value instanceof Site) {
-            return [
-                'id'   => $value->getId(),
-                'name' => $value->getName(),
-            ];
-        }
-
-        if (is_object($value) && method_exists($value, 'getId')) {
-            return (string) $value->getId();
-        }
-
-        return (string) $value;
-    }
-
-    private function resolveActorProfileId(): ?string
-    {
-        try {
-            $session = $this->requestStack->getSession();
-            if ($session instanceof SessionInterface) {
-                $profileId = $session->get('profileId');
-                if ($profileId) {
-                    return (string) $profileId;
-                }
-            }
-        } catch (Throwable) {
-            // No session available (CLI context, etc.)
-        }
-
-        $user = $this->security->getUser();
-        if ($user instanceof Profile) {
-            return $user->getId();
-        }
-
-        return null;
-    }
 }
--- a/src/EventSubscriber/MachineAuditSubscriber.php
+++ b/src/EventSubscriber/MachineAuditSubscriber.php
@@ -4,400 +4,45 @@ declare(strict_types=1);

 namespace App\EventSubscriber;

-use App\Entity\AuditLog;
 use App\Entity\CustomFieldValue;
 use App\Entity\Machine;
-use App\Entity\ModelType;
-use App\Entity\Product;
-use App\Entity\Profile;
-use App\Entity\Site;
-use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Attribute\AsDoctrineListener;
-use Doctrine\Common\Collections\Collection;
-use Doctrine\Common\EventSubscriber;
-use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\Event\OnFlushEventArgs;
 use Doctrine\ORM\Events;
-use Doctrine\ORM\PersistentCollection;
-use Doctrine\ORM\UnitOfWork;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\SessionInterface;
-use Throwable;
-
-use function is_array;
-use function is_object;
-use function is_scalar;
-use function method_exists;

 #[AsDoctrineListener(event: Events::onFlush)]
-final class MachineAuditSubscriber implements EventSubscriber
+final class MachineAuditSubscriber extends AbstractAuditSubscriber
 {
-    public function __construct(
-        private readonly RequestStack $requestStack,
-        private readonly Security $security,
-    ) {}
-
-    public function getSubscribedEvents(): array
+    protected function supports(object $entity): bool
    {
-        return [
-            Events::onFlush,
-        ];
+        return $entity instanceof Machine;
    }

-    public function onFlush(OnFlushEventArgs $args): void
+    protected function entityType(): string
    {
-        $em = $args->getObjectManager();
-        if (!$em instanceof EntityManagerInterface) {
-            return;
-        }
-
-        $uow              = $em->getUnitOfWork();
-        $actorProfileId   = $this->resolveActorProfileId();
-        $pendingUpdates   = [];
-        $pendingSnapshots = [];
-        $pendingMachines  = [];
-
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if (!$entity instanceof Machine) {
-                continue;
-            }
-
-            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            $snapshot = $this->snapshotMachine($entity);
-            $this->persistAuditLog($em, new AuditLog('machine', (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof Machine) {
-                continue;
-            }
-
-            $machineId = (string) $entity->getId();
-            if ('' === $machineId) {
-                continue;
-            }
-
-            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            if ([] !== $diff) {
-                $pendingUpdates[$machineId]   = $this->mergeDiffs($pendingUpdates[$machineId] ?? [], $diff);
-                $pendingSnapshots[$machineId] = $this->snapshotMachine($entity);
-                $pendingMachines[$machineId]  = $entity;
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if (!$entity instanceof Machine) {
-                continue;
-            }
-
-            $snapshot = $this->snapshotMachine($entity);
-            $this->persistAuditLog($em, new AuditLog('machine', (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledCollectionUpdates() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingMachines);
-        }
-        foreach ($uow->getScheduledCollectionDeletions() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingMachines);
-        }
-
-        $this->collectCustomFieldValueChanges($uow, $pendingUpdates, $pendingSnapshots, $pendingMachines);
-
-        foreach ($pendingUpdates as $machineId => $diff) {
-            if ([] === $diff) {
-                continue;
-            }
-
-            $machine = $pendingMachines[$machineId] ?? null;
-            if (!$machine instanceof Machine) {
-                continue;
-            }
-
-            $snapshot = $pendingSnapshots[$machineId] ?? $this->snapshotMachine($machine);
-            $this->persistAuditLog($em, new AuditLog('machine', $machineId, 'update', $diff, $snapshot, $actorProfileId));
-        }
+        return 'machine';
    }

-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Machine>                                    $pendingMachines
-     */
-    private function collectCollectionUpdate(
-        object $collection,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingMachines,
-    ): void {
-        if (!$collection instanceof PersistentCollection) {
-            return;
-        }
-
-        $owner = $collection->getOwner();
-        if (!$owner instanceof Machine) {
-            return;
-        }
-
-        $machineId = (string) $owner->getId();
-        if ('' === $machineId) {
-            return;
-        }
-
-        $mapping   = $collection->getMapping();
-        $fieldName = $mapping['fieldName'] ?? null;
-        if ('constructeurs' !== $fieldName) {
-            return;
-        }
-
-        $before = $this->normalizeCollection($collection->getSnapshot());
-        $after  = $this->normalizeCollection($collection->toArray());
-
-        if ($before === $after) {
-            return;
-        }
-
-        $diff = [
-            'constructeurIds' => [
-                'from' => $before,
-                'to'   => $after,
-            ],
-        ];
-
-        $pendingUpdates[$machineId]   = $this->mergeDiffs($pendingUpdates[$machineId] ?? [], $diff);
-        $pendingSnapshots[$machineId] = $this->snapshotMachine($owner);
-        $pendingMachines[$machineId]  = $owner;
+    protected function hasCollectionTracking(): bool
+    {
+        return true;
    }

-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Machine>                                    $pendingMachines
-     */
-    private function collectCustomFieldValueChanges(
-        UnitOfWork $uow,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingMachines,
-    ): void {
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, null, $entity->getValue(), $pendingUpdates, $pendingSnapshots, $pendingMachines);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof CustomFieldValue) {
-                continue;
-            }
-            $changeSet = $uow->getEntityChangeSet($entity);
-            if (!isset($changeSet['value'])) {
-                continue;
-            }
-            [$oldVal, $newVal] = $changeSet['value'];
-            if ($oldVal !== $newVal) {
-                $this->trackCustomFieldValueChange($entity, $oldVal, $newVal, $pendingUpdates, $pendingSnapshots, $pendingMachines);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, $entity->getValue(), null, $pendingUpdates, $pendingSnapshots, $pendingMachines);
-            }
-        }
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Machine>                                    $pendingMachines
-     */
-    private function trackCustomFieldValueChange(
-        CustomFieldValue $cfv,
-        mixed $from,
-        mixed $to,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingMachines,
-    ): void {
+    protected function getOwnerFromCustomFieldValue(CustomFieldValue $cfv): ?object
+    {
        $owner = $cfv->getMachine();
-        if (!$owner instanceof Machine) {
-            return;
-        }

-        $ownerId = (string) $owner->getId();
-        if ('' === $ownerId) {
-            return;
-        }
-
-        $fieldName = 'customField:'.$cfv->getCustomField()->getName();
-        $diff      = [$fieldName => ['from' => $from, 'to' => $to]];
-
-        $pendingUpdates[$ownerId]   = $this->mergeDiffs($pendingUpdates[$ownerId] ?? [], $diff);
-        $pendingSnapshots[$ownerId] = $this->snapshotMachine($owner);
-        $pendingMachines[$ownerId]  = $owner;
+        return $owner instanceof Machine ? $owner : null;
    }

-    private function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
-    {
-        $uow = $em->getUnitOfWork();
-        $log->initializeAuditLog();
-        $em->persist($log);
-
-        $meta = $em->getClassMetadata(AuditLog::class);
-        $uow->computeChangeSet($meta, $log);
-    }
-
-    /**
-     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function buildDiffFromChangeSet(array $changeSet): array
-    {
-        $diff = [];
-        foreach ($changeSet as $field => [$oldValue, $newValue]) {
-            if ('updatedAt' === $field || 'createdAt' === $field) {
-                continue;
-            }
-
-            $normalizedOld = $this->normalizeValue($oldValue);
-            $normalizedNew = $this->normalizeValue($newValue);
-
-            if ($normalizedOld === $normalizedNew) {
-                continue;
-            }
-
-            $diff[$field] = [
-                'from' => $normalizedOld,
-                'to'   => $normalizedNew,
-            ];
-        }
-
-        return $diff;
-    }
-
-    private function snapshotMachine(Machine $machine): array
+    protected function snapshotEntity(object $entity): array
    {
        return [
-            'id'              => $machine->getId(),
-            'name'            => $machine->getName(),
-            'reference'       => $machine->getReference(),
-            'prix'            => $machine->getPrix(),
-            'site'            => $this->normalizeValue($machine->getSite()),
-            'constructeurIds' => $this->normalizeCollection($machine->getConstructeurs()),
+            'id'              => $entity->getId(),
+            'name'            => $this->safeGet($entity, 'getName'),
+            'reference'       => $this->safeGet($entity, 'getReference'),
+            'prix'            => $this->safeGet($entity, 'getPrix'),
+            'site'            => $this->normalizeValue($this->safeGet($entity, 'getSite')),
+            'constructeurIds' => $this->normalizeCollection($entity->getConstructeurs()),
        ];
    }
-
-    /**
-     * @param iterable<mixed> $items
-     *
-     * @return list<array{id: string, name: string}|string>
-     */
-    private function normalizeCollection(iterable $items): array
-    {
-        $entries = [];
-        $seen    = [];
-        foreach ($items as $item) {
-            if (is_object($item) && method_exists($item, 'getId')) {
-                $id = $item->getId();
-                if (null === $id || '' === $id || isset($seen[(string) $id])) {
-                    continue;
-                }
-                $seen[(string) $id] = true;
-                if (method_exists($item, 'getName')) {
-                    $entries[] = ['id' => (string) $id, 'name' => (string) $item->getName()];
-                } else {
-                    $entries[] = (string) $id;
-                }
-            }
-        }
-
-        return $entries;
-    }
-
-    private function normalizeValue(mixed $value): mixed
-    {
-        if (null === $value || is_scalar($value)) {
-            return $value;
-        }
-
-        if ($value instanceof DateTimeInterface) {
-            return $value->format(DateTimeInterface::ATOM);
-        }
-
-        if ($value instanceof Site) {
-            return [
-                'id'   => $value->getId(),
-                'name' => $value->getName(),
-            ];
-        }
-
-        if ($value instanceof ModelType) {
-            return [
-                'id'   => $value->getId(),
-                'name' => $value->getName(),
-                'code' => $value->getCode(),
-            ];
-        }
-
-        if ($value instanceof Product) {
-            return [
-                'id'        => $value->getId(),
-                'name'      => $value->getName(),
-                'reference' => $value->getReference(),
-            ];
-        }
-
-        if ($value instanceof Collection) {
-            return $this->normalizeCollection($value);
-        }
-
-        if (is_object($value) && method_exists($value, 'getId')) {
-            return (string) $value->getId();
-        }
-
-        if (is_array($value)) {
-            return $value;
-        }
-
-        return (string) $value;
-    }
-
-    /**
-     * @param array<string, array{from:mixed, to:mixed}> $base
-     * @param array<string, array{from:mixed, to:mixed}> $extra
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function mergeDiffs(array $base, array $extra): array
-    {
-        foreach ($extra as $field => $change) {
-            $base[$field] = $change;
-        }
-
-        return $base;
-    }
-
-    private function resolveActorProfileId(): ?string
-    {
-        try {
-            $session = $this->requestStack->getSession();
-            if ($session instanceof SessionInterface) {
-                $profileId = $session->get('profileId');
-                if ($profileId) {
-                    return (string) $profileId;
-                }
-            }
-        } catch (Throwable) {
-            // No session available (CLI context, etc.)
-        }
-
-        $user = $this->security->getUser();
-        if ($user instanceof Profile) {
-            return $user->getId();
-        }
-
-        return null;
-    }
 }
--- a/src/EventSubscriber/ModelTypeAuditSubscriber.php
+++ b/src/EventSubscriber/ModelTypeAuditSubscriber.php
@@ -4,177 +4,32 @@ declare(strict_types=1);

 namespace App\EventSubscriber;

-use App\Entity\AuditLog;
 use App\Entity\ModelType;
-use App\Entity\Profile;
-use App\Enum\ModelCategory;
-use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Attribute\AsDoctrineListener;
-use Doctrine\Common\EventSubscriber;
-use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\Event\OnFlushEventArgs;
 use Doctrine\ORM\Events;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\SessionInterface;
-use Throwable;
-
-use function is_array;
-use function is_scalar;

 #[AsDoctrineListener(event: Events::onFlush)]
-final class ModelTypeAuditSubscriber implements EventSubscriber
+final class ModelTypeAuditSubscriber extends AbstractAuditSubscriber
 {
-    public function __construct(
-        private readonly RequestStack $requestStack,
-        private readonly Security $security,
-    ) {}
+    protected function supports(object $entity): bool
+    {
+        return $entity instanceof ModelType;
+    }

-    public function getSubscribedEvents(): array
+    protected function entityType(): string
+    {
+        return 'model_type';
+    }
+
+    protected function snapshotEntity(object $entity): array
    {
        return [
-            Events::onFlush,
+            'id'          => $entity->getId(),
+            'name'        => $this->safeGet($entity, 'getName'),
+            'code'        => $this->safeGet($entity, 'getCode'),
+            'category'    => $this->safeGet($entity, 'getCategory')?->value,
+            'notes'       => $this->safeGet($entity, 'getNotes'),
+            'description' => $this->safeGet($entity, 'getDescription'),
        ];
    }
-
-    public function onFlush(OnFlushEventArgs $args): void
-    {
-        $em = $args->getObjectManager();
-        if (!$em instanceof EntityManagerInterface) {
-            return;
-        }
-
-        $uow            = $em->getUnitOfWork();
-        $actorProfileId = $this->resolveActorProfileId();
-
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if (!$entity instanceof ModelType) {
-                continue;
-            }
-
-            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            $snapshot = $this->snapshotModelType($entity);
-            $this->persistAuditLog($em, new AuditLog('model_type', (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof ModelType) {
-                continue;
-            }
-
-            $id = (string) $entity->getId();
-            if ('' === $id) {
-                continue;
-            }
-
-            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            if ([] !== $diff) {
-                $snapshot = $this->snapshotModelType($entity);
-                $this->persistAuditLog($em, new AuditLog('model_type', $id, 'update', $diff, $snapshot, $actorProfileId));
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if (!$entity instanceof ModelType) {
-                continue;
-            }
-
-            $snapshot = $this->snapshotModelType($entity);
-            $this->persistAuditLog($em, new AuditLog('model_type', (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
-        }
-    }
-
-    private function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
-    {
-        $uow = $em->getUnitOfWork();
-        $log->initializeAuditLog();
-        $em->persist($log);
-
-        $meta = $em->getClassMetadata(AuditLog::class);
-        $uow->computeChangeSet($meta, $log);
-    }
-
-    /**
-     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function buildDiffFromChangeSet(array $changeSet): array
-    {
-        $diff = [];
-        foreach ($changeSet as $field => [$oldValue, $newValue]) {
-            if ('updatedAt' === $field || 'createdAt' === $field) {
-                continue;
-            }
-
-            $normalizedOld = $this->normalizeValue($oldValue);
-            $normalizedNew = $this->normalizeValue($newValue);
-
-            if ($normalizedOld === $normalizedNew) {
-                continue;
-            }
-
-            $diff[$field] = [
-                'from' => $normalizedOld,
-                'to'   => $normalizedNew,
-            ];
-        }
-
-        return $diff;
-    }
-
-    private function snapshotModelType(ModelType $modelType): array
-    {
-        return [
-            'id'          => $modelType->getId(),
-            'name'        => $modelType->getName(),
-            'code'        => $modelType->getCode(),
-            'category'    => $modelType->getCategory()->value,
-            'notes'       => $modelType->getNotes(),
-            'description' => $modelType->getDescription(),
-        ];
-    }
-
-    private function normalizeValue(mixed $value): mixed
-    {
-        if (null === $value || is_scalar($value)) {
-            return $value;
-        }
-
-        if ($value instanceof DateTimeInterface) {
-            return $value->format(DateTimeInterface::ATOM);
-        }
-
-        if ($value instanceof ModelCategory) {
-            return $value->value;
-        }
-
-        if (is_array($value)) {
-            return $value;
-        }
-
-        return (string) $value;
-    }
-
-    private function resolveActorProfileId(): ?string
-    {
-        try {
-            $session = $this->requestStack->getSession();
-            if ($session instanceof SessionInterface) {
-                $profileId = $session->get('profileId');
-                if ($profileId) {
-                    return (string) $profileId;
-                }
-            }
-        } catch (Throwable) {
-            // No session available (CLI context, etc.)
-        }
-
-        $user = $this->security->getUser();
-        if ($user instanceof Profile) {
-            return $user->getId();
-        }
-
-        return null;
-    }
 }
--- a/src/EventSubscriber/PieceAuditSubscriber.php
+++ b/src/EventSubscriber/PieceAuditSubscriber.php
@@ -4,394 +4,45 @@ declare(strict_types=1);

 namespace App\EventSubscriber;

-use App\Entity\AuditLog;
 use App\Entity\CustomFieldValue;
-use App\Entity\ModelType;
 use App\Entity\Piece;
-use App\Entity\Product;
-use App\Entity\Profile;
-use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Attribute\AsDoctrineListener;
-use Doctrine\Common\Collections\Collection;
-use Doctrine\Common\EventSubscriber;
-use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\Event\OnFlushEventArgs;
 use Doctrine\ORM\Events;
-use Doctrine\ORM\PersistentCollection;
-use Doctrine\ORM\UnitOfWork;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\SessionInterface;
-use Throwable;
-
-use function is_array;
-use function is_object;
-use function is_scalar;
-use function method_exists;

 #[AsDoctrineListener(event: Events::onFlush)]
-final class PieceAuditSubscriber implements EventSubscriber
+final class PieceAuditSubscriber extends AbstractAuditSubscriber
 {
-    public function __construct(
-        private readonly RequestStack $requestStack,
-        private readonly Security $security,
-    ) {}
+    protected function supports(object $entity): bool
+    {
+        return $entity instanceof Piece;
+    }

-    public function getSubscribedEvents(): array
+    protected function entityType(): string
+    {
+        return 'piece';
+    }
+
+    protected function hasCollectionTracking(): bool
+    {
+        return true;
+    }
+
+    protected function getOwnerFromCustomFieldValue(CustomFieldValue $cfv): ?object
+    {
+        return $cfv->getPiece();
+    }
+
+    protected function snapshotEntity(object $entity): array
    {
        return [
-            Events::onFlush,
+            'id'              => $entity->getId(),
+            'name'            => $this->safeGet($entity, 'getName'),
+            'reference'       => $this->safeGet($entity, 'getReference'),
+            'prix'            => $this->safeGet($entity, 'getPrix'),
+            'typePiece'       => $this->normalizeValue($this->safeGet($entity, 'getTypePiece')),
+            'product'         => $this->normalizeValue($this->safeGet($entity, 'getProduct')),
+            'productIds'      => $this->safeGet($entity, 'getProductIds') ?? [],
+            'constructeurIds' => $this->normalizeCollection($entity->getConstructeurs()),
        ];
    }
-
-    public function onFlush(OnFlushEventArgs $args): void
-    {
-        $em = $args->getObjectManager();
-        if (!$em instanceof EntityManagerInterface) {
-            return;
-        }
-
-        $uow              = $em->getUnitOfWork();
-        $actorProfileId   = $this->resolveActorProfileId();
-        $pendingUpdates   = [];
-        $pendingSnapshots = [];
-        $pendingPieces    = [];
-
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if (!$entity instanceof Piece) {
-                continue;
-            }
-
-            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            $snapshot = $this->snapshotPiece($entity);
-            $this->persistAuditLog($em, new AuditLog('piece', (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof Piece) {
-                continue;
-            }
-
-            $pieceId = (string) $entity->getId();
-            if ('' === $pieceId) {
-                continue;
-            }
-
-            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            if ([] !== $diff) {
-                $pendingUpdates[$pieceId]   = $this->mergeDiffs($pendingUpdates[$pieceId] ?? [], $diff);
-                $pendingSnapshots[$pieceId] = $this->snapshotPiece($entity);
-                $pendingPieces[$pieceId]    = $entity;
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if (!$entity instanceof Piece) {
-                continue;
-            }
-
-            $snapshot = $this->snapshotPiece($entity);
-            $this->persistAuditLog($em, new AuditLog('piece', (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledCollectionUpdates() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingPieces);
-        }
-        foreach ($uow->getScheduledCollectionDeletions() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingPieces);
-        }
-
-        $this->collectCustomFieldValueChanges($uow, $pendingUpdates, $pendingSnapshots, $pendingPieces);
-
-        foreach ($pendingUpdates as $pieceId => $diff) {
-            if ([] === $diff) {
-                continue;
-            }
-
-            $piece = $pendingPieces[$pieceId] ?? null;
-            if (!$piece instanceof Piece) {
-                continue;
-            }
-
-            $snapshot = $pendingSnapshots[$pieceId] ?? $this->snapshotPiece($piece);
-            $this->persistAuditLog($em, new AuditLog('piece', $pieceId, 'update', $diff, $snapshot, $actorProfileId));
-        }
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Piece>                                      $pendingPieces
-     */
-    private function collectCollectionUpdate(
-        object $collection,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingPieces,
-    ): void {
-        if (!$collection instanceof PersistentCollection) {
-            return;
-        }
-
-        $owner = $collection->getOwner();
-        if (!$owner instanceof Piece) {
-            return;
-        }
-
-        $pieceId = (string) $owner->getId();
-        if ('' === $pieceId) {
-            return;
-        }
-
-        $mapping   = $collection->getMapping();
-        $fieldName = $mapping['fieldName'] ?? null;
-        if ('constructeurs' !== $fieldName) {
-            return;
-        }
-
-        $before = $this->normalizeCollection($collection->getSnapshot());
-        $after  = $this->normalizeCollection($collection->toArray());
-
-        if ($before === $after) {
-            return;
-        }
-
-        $diff = [
-            'constructeurIds' => [
-                'from' => $before,
-                'to'   => $after,
-            ],
-        ];
-
-        $pendingUpdates[$pieceId]   = $this->mergeDiffs($pendingUpdates[$pieceId] ?? [], $diff);
-        $pendingSnapshots[$pieceId] = $this->snapshotPiece($owner);
-        $pendingPieces[$pieceId]    = $owner;
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Piece>                                      $pendingPieces
-     */
-    private function collectCustomFieldValueChanges(
-        UnitOfWork $uow,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingPieces,
-    ): void {
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, null, $entity->getValue(), $pendingUpdates, $pendingSnapshots, $pendingPieces);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof CustomFieldValue) {
-                continue;
-            }
-            $changeSet = $uow->getEntityChangeSet($entity);
-            if (!isset($changeSet['value'])) {
-                continue;
-            }
-            [$oldVal, $newVal] = $changeSet['value'];
-            if ($oldVal !== $newVal) {
-                $this->trackCustomFieldValueChange($entity, $oldVal, $newVal, $pendingUpdates, $pendingSnapshots, $pendingPieces);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, $entity->getValue(), null, $pendingUpdates, $pendingSnapshots, $pendingPieces);
-            }
-        }
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Piece>                                      $pendingPieces
-     */
-    private function trackCustomFieldValueChange(
-        CustomFieldValue $cfv,
-        mixed $from,
-        mixed $to,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingPieces,
-    ): void {
-        $owner = $cfv->getPiece();
-        if (!$owner instanceof Piece) {
-            return;
-        }
-
-        $ownerId = (string) $owner->getId();
-        if ('' === $ownerId) {
-            return;
-        }
-
-        $fieldName = 'customField:'.$cfv->getCustomField()->getName();
-        $diff      = [$fieldName => ['from' => $from, 'to' => $to]];
-
-        $pendingUpdates[$ownerId]   = $this->mergeDiffs($pendingUpdates[$ownerId] ?? [], $diff);
-        $pendingSnapshots[$ownerId] = $this->snapshotPiece($owner);
-        $pendingPieces[$ownerId]    = $owner;
-    }
-
-    private function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
-    {
-        $uow = $em->getUnitOfWork();
-        $log->initializeAuditLog();
-        $em->persist($log);
-
-        $meta = $em->getClassMetadata(AuditLog::class);
-        $uow->computeChangeSet($meta, $log);
-    }
-
-    /**
-     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function buildDiffFromChangeSet(array $changeSet): array
-    {
-        $diff = [];
-        foreach ($changeSet as $field => [$oldValue, $newValue]) {
-            if ('updatedAt' === $field || 'createdAt' === $field) {
-                continue;
-            }
-
-            $normalizedOld = $this->normalizeValue($oldValue);
-            $normalizedNew = $this->normalizeValue($newValue);
-
-            if ($normalizedOld === $normalizedNew) {
-                continue;
-            }
-
-            $diff[$field] = [
-                'from' => $normalizedOld,
-                'to'   => $normalizedNew,
-            ];
-        }
-
-        return $diff;
-    }
-
-    private function snapshotPiece(Piece $piece): array
-    {
-        return [
-            'id'              => $piece->getId(),
-            'name'            => $piece->getName(),
-            'reference'       => $piece->getReference(),
-            'prix'            => $piece->getPrix(),
-            'typePiece'       => $this->normalizeValue($piece->getTypePiece()),
-            'product'         => $this->normalizeValue($piece->getProduct()),
-            'productIds'      => $piece->getProductIds(),
-            'constructeurIds' => $this->normalizeCollection($piece->getConstructeurs()),
-        ];
-    }
-
-    /**
-     * @param iterable<mixed> $items
-     *
-     * @return list<array{id: string, name: string}|string>
-     */
-    private function normalizeCollection(iterable $items): array
-    {
-        $entries = [];
-        $seen    = [];
-        foreach ($items as $item) {
-            if (is_object($item) && method_exists($item, 'getId')) {
-                $id = $item->getId();
-                if (null === $id || '' === $id || isset($seen[(string) $id])) {
-                    continue;
-                }
-                $seen[(string) $id] = true;
-                if (method_exists($item, 'getName')) {
-                    $entries[] = ['id' => (string) $id, 'name' => (string) $item->getName()];
-                } else {
-                    $entries[] = (string) $id;
-                }
-            }
-        }
-
-        return $entries;
-    }
-
-    private function normalizeValue(mixed $value): mixed
-    {
-        if (null === $value || is_scalar($value)) {
-            return $value;
-        }
-
-        if ($value instanceof DateTimeInterface) {
-            return $value->format(DateTimeInterface::ATOM);
-        }
-
-        if ($value instanceof ModelType) {
-            return [
-                'id'   => $value->getId(),
-                'name' => $value->getName(),
-                'code' => $value->getCode(),
-            ];
-        }
-
-        if ($value instanceof Product) {
-            return [
-                'id'        => $value->getId(),
-                'name'      => $value->getName(),
-                'reference' => $value->getReference(),
-            ];
-        }
-
-        if ($value instanceof Collection) {
-            return $this->normalizeCollection($value);
-        }
-
-        if (is_object($value) && method_exists($value, 'getId')) {
-            return (string) $value->getId();
-        }
-
-        if (is_array($value)) {
-            return $value;
-        }
-
-        return (string) $value;
-    }
-
-    /**
-     * @param array<string, array{from:mixed, to:mixed}> $base
-     * @param array<string, array{from:mixed, to:mixed}> $extra
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function mergeDiffs(array $base, array $extra): array
-    {
-        foreach ($extra as $field => $change) {
-            $base[$field] = $change;
-        }
-
-        return $base;
-    }
-
-    private function resolveActorProfileId(): ?string
-    {
-        try {
-            $session = $this->requestStack->getSession();
-            if ($session instanceof SessionInterface) {
-                $profileId = $session->get('profileId');
-                if ($profileId) {
-                    return (string) $profileId;
-                }
-            }
-        } catch (Throwable) {
-            // No session available (CLI context, etc.)
-        }
-
-        $user = $this->security->getUser();
-        if ($user instanceof Profile) {
-            return $user->getId();
-        }
-
-        return null;
-    }
 }
--- a/src/EventSubscriber/ProductAuditSubscriber.php
+++ b/src/EventSubscriber/ProductAuditSubscriber.php
@@ -4,393 +4,43 @@ declare(strict_types=1);

 namespace App\EventSubscriber;

-use App\Entity\AuditLog;
 use App\Entity\CustomFieldValue;
-use App\Entity\ModelType;
 use App\Entity\Product;
-use App\Entity\Profile;
-use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Attribute\AsDoctrineListener;
-use Doctrine\Common\Collections\Collection;
-use Doctrine\Common\EventSubscriber;
-use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\Event\OnFlushEventArgs;
 use Doctrine\ORM\Events;
-use Doctrine\ORM\PersistentCollection;
-use Doctrine\ORM\UnitOfWork;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpFoundation\Session\SessionInterface;
-use Throwable;

-use function is_array;
-use function is_object;
-use function is_scalar;
-use function method_exists;
-
-/**
- * Record a lightweight, per-product audit trail.
- *
- * This MVP focuses on Product updates and captures:
- * - scalar field changes (from Doctrine change sets)
- * - constructeur collection changes (from collection updates)
- */
 #[AsDoctrineListener(event: Events::onFlush)]
-final class ProductAuditSubscriber implements EventSubscriber
+final class ProductAuditSubscriber extends AbstractAuditSubscriber
 {
-    public function __construct(
-        private readonly RequestStack $requestStack,
-        private readonly Security $security,
-    ) {}
+    protected function supports(object $entity): bool
+    {
+        return $entity instanceof Product;
+    }

-    public function getSubscribedEvents(): array
+    protected function entityType(): string
+    {
+        return 'product';
+    }
+
+    protected function hasCollectionTracking(): bool
+    {
+        return true;
+    }
+
+    protected function getOwnerFromCustomFieldValue(CustomFieldValue $cfv): ?object
+    {
+        return $cfv->getProduct();
+    }
+
+    protected function snapshotEntity(object $entity): array
    {
        return [
-            Events::onFlush,
+            'id'              => $entity->getId(),
+            'name'            => $this->safeGet($entity, 'getName'),
+            'reference'       => $this->safeGet($entity, 'getReference'),
+            'supplierPrice'   => $this->safeGet($entity, 'getSupplierPrice'),
+            'typeProduct'     => $this->normalizeValue($this->safeGet($entity, 'getTypeProduct')),
+            'constructeurIds' => $this->normalizeCollection($entity->getConstructeurs()),
        ];
    }
-
-    public function onFlush(OnFlushEventArgs $args): void
-    {
-        $em = $args->getObjectManager();
-        if (!$em instanceof EntityManagerInterface) {
-            return;
-        }
-
-        $uow              = $em->getUnitOfWork();
-        $actorProfileId   = $this->resolveActorProfileId();
-        $pendingUpdates   = [];
-        $pendingSnapshots = [];
-        $pendingProducts  = [];
-
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if (!$entity instanceof Product) {
-                continue;
-            }
-
-            $diff     = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            $snapshot = $this->snapshotProduct($entity);
-            $this->persistAuditLog($em, new AuditLog('product', (string) $entity->getId(), 'create', $diff, $snapshot, $actorProfileId));
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof Product) {
-                continue;
-            }
-
-            $productId = (string) $entity->getId();
-            if ('' === $productId) {
-                continue;
-            }
-
-            $diff = $this->buildDiffFromChangeSet($uow->getEntityChangeSet($entity));
-            if ([] !== $diff) {
-                $pendingUpdates[$productId]   = $this->mergeDiffs($pendingUpdates[$productId] ?? [], $diff);
-                $pendingSnapshots[$productId] = $this->snapshotProduct($entity);
-                $pendingProducts[$productId]  = $entity;
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if (!$entity instanceof Product) {
-                continue;
-            }
-
-            $snapshot = $this->snapshotProduct($entity);
-            $this->persistAuditLog($em, new AuditLog('product', (string) $entity->getId(), 'delete', null, $snapshot, $actorProfileId));
-        }
-
-        // Capture constructeur collection updates, which are not included in the change set.
-        foreach ($uow->getScheduledCollectionUpdates() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingProducts);
-        }
-        foreach ($uow->getScheduledCollectionDeletions() as $collection) {
-            $this->collectCollectionUpdate($collection, $pendingUpdates, $pendingSnapshots, $pendingProducts);
-        }
-
-        $this->collectCustomFieldValueChanges($uow, $pendingUpdates, $pendingSnapshots, $pendingProducts);
-
-        foreach ($pendingUpdates as $productId => $diff) {
-            if ([] === $diff) {
-                continue;
-            }
-
-            $product = $pendingProducts[$productId] ?? null;
-            if (!$product instanceof Product) {
-                continue;
-            }
-
-            $snapshot = $pendingSnapshots[$productId] ?? $this->snapshotProduct($product);
-            $this->persistAuditLog($em, new AuditLog('product', $productId, 'update', $diff, $snapshot, $actorProfileId));
-        }
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Product>                                    $pendingProducts
-     */
-    private function collectCollectionUpdate(
-        object $collection,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingProducts,
-    ): void {
-        if (!$collection instanceof PersistentCollection) {
-            return;
-        }
-
-        $owner = $collection->getOwner();
-        if (!$owner instanceof Product) {
-            return;
-        }
-
-        $productId = (string) $owner->getId();
-        if ('' === $productId) {
-            return;
-        }
-
-        $mapping   = $collection->getMapping();
-        $fieldName = $mapping['fieldName'] ?? null;
-        if ('constructeurs' !== $fieldName) {
-            return;
-        }
-
-        $before = $this->normalizeCollection($collection->getSnapshot());
-        $after  = $this->normalizeCollection($collection->toArray());
-
-        if ($before === $after) {
-            return;
-        }
-
-        $diff = [
-            'constructeurIds' => [
-                'from' => $before,
-                'to'   => $after,
-            ],
-        ];
-
-        $pendingUpdates[$productId]   = $this->mergeDiffs($pendingUpdates[$productId] ?? [], $diff);
-        $pendingSnapshots[$productId] = $this->snapshotProduct($owner);
-        $pendingProducts[$productId]  = $owner;
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Product>                                    $pendingProducts
-     */
-    private function collectCustomFieldValueChanges(
-        UnitOfWork $uow,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingProducts,
-    ): void {
-        foreach ($uow->getScheduledEntityInsertions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, null, $entity->getValue(), $pendingUpdates, $pendingSnapshots, $pendingProducts);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityUpdates() as $entity) {
-            if (!$entity instanceof CustomFieldValue) {
-                continue;
-            }
-            $changeSet = $uow->getEntityChangeSet($entity);
-            if (!isset($changeSet['value'])) {
-                continue;
-            }
-            [$oldVal, $newVal] = $changeSet['value'];
-            if ($oldVal !== $newVal) {
-                $this->trackCustomFieldValueChange($entity, $oldVal, $newVal, $pendingUpdates, $pendingSnapshots, $pendingProducts);
-            }
-        }
-
-        foreach ($uow->getScheduledEntityDeletions() as $entity) {
-            if ($entity instanceof CustomFieldValue) {
-                $this->trackCustomFieldValueChange($entity, $entity->getValue(), null, $pendingUpdates, $pendingSnapshots, $pendingProducts);
-            }
-        }
-    }
-
-    /**
-     * @param array<string, array<string, array{from:mixed, to:mixed}>> $pendingUpdates
-     * @param array<string, array<string, mixed>>                       $pendingSnapshots
-     * @param array<string, Product>                                    $pendingProducts
-     */
-    private function trackCustomFieldValueChange(
-        CustomFieldValue $cfv,
-        mixed $from,
-        mixed $to,
-        array &$pendingUpdates,
-        array &$pendingSnapshots,
-        array &$pendingProducts,
-    ): void {
-        $owner = $cfv->getProduct();
-        if (!$owner instanceof Product) {
-            return;
-        }
-
-        $ownerId = (string) $owner->getId();
-        if ('' === $ownerId) {
-            return;
-        }
-
-        $fieldName = 'customField:'.$cfv->getCustomField()->getName();
-        $diff      = [$fieldName => ['from' => $from, 'to' => $to]];
-
-        $pendingUpdates[$ownerId]   = $this->mergeDiffs($pendingUpdates[$ownerId] ?? [], $diff);
-        $pendingSnapshots[$ownerId] = $this->snapshotProduct($owner);
-        $pendingProducts[$ownerId]  = $owner;
-    }
-
-    private function persistAuditLog(EntityManagerInterface $em, AuditLog $log): void
-    {
-        $uow = $em->getUnitOfWork();
-        // Ensure identifiers and timestamps are set even when persisting during onFlush.
-        $log->initializeAuditLog();
-        $em->persist($log);
-
-        $meta = $em->getClassMetadata(AuditLog::class);
-        $uow->computeChangeSet($meta, $log);
-    }
-
-    /**
-     * @param array<string, array{0:mixed, 1:mixed}> $changeSet
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function buildDiffFromChangeSet(array $changeSet): array
-    {
-        $diff = [];
-        foreach ($changeSet as $field => [$oldValue, $newValue]) {
-            // Skip noisy timestamps managed automatically.
-            if ('updatedAt' === $field || 'createdAt' === $field) {
-                continue;
-            }
-
-            $normalizedOld = $this->normalizeValue($oldValue);
-            $normalizedNew = $this->normalizeValue($newValue);
-
-            if ($normalizedOld === $normalizedNew) {
-                continue;
-            }
-
-            $diff[$field] = [
-                'from' => $normalizedOld,
-                'to'   => $normalizedNew,
-            ];
-        }
-
-        return $diff;
-    }
-
-    private function snapshotProduct(Product $product): array
-    {
-        return [
-            'id'              => $product->getId(),
-            'name'            => $product->getName(),
-            'reference'       => $product->getReference(),
-            'supplierPrice'   => $product->getSupplierPrice(),
-            'typeProduct'     => $this->normalizeValue($product->getTypeProduct()),
-            'constructeurIds' => $this->normalizeCollection($product->getConstructeurs()),
-        ];
-    }
-
-    /**
-     * @param array<string, array{from:mixed, to:mixed}> $base
-     * @param array<string, array{from:mixed, to:mixed}> $extra
-     *
-     * @return array<string, array{from:mixed, to:mixed}>
-     */
-    private function mergeDiffs(array $base, array $extra): array
-    {
-        foreach ($extra as $field => $change) {
-            $base[$field] = $change;
-        }
-
-        return $base;
-    }
-
-    /**
-     * @param iterable<mixed> $items
-     *
-     * @return list<array{id: string, name: string}|string>
-     */
-    private function normalizeCollection(iterable $items): array
-    {
-        $entries = [];
-        $seen    = [];
-        foreach ($items as $item) {
-            if (is_object($item) && method_exists($item, 'getId')) {
-                $id = $item->getId();
-                if (null === $id || '' === $id || isset($seen[(string) $id])) {
-                    continue;
-                }
-                $seen[(string) $id] = true;
-                if (method_exists($item, 'getName')) {
-                    $entries[] = ['id' => (string) $id, 'name' => (string) $item->getName()];
-                } else {
-                    $entries[] = (string) $id;
-                }
-            }
-        }
-
-        return $entries;
-    }
-
-    private function normalizeValue(mixed $value): mixed
-    {
-        if (null === $value || is_scalar($value)) {
-            return $value;
-        }
-
-        if ($value instanceof DateTimeInterface) {
-            return $value->format(DateTimeInterface::ATOM);
-        }
-
-        if ($value instanceof ModelType) {
-            return [
-                'id'   => $value->getId(),
-                'name' => $value->getName(),
-                'code' => $value->getCode(),
-            ];
-        }
-
-        if ($value instanceof Collection) {
-            return $this->normalizeCollection($value);
-        }
-
-        if (is_object($value) && method_exists($value, 'getId')) {
-            return (string) $value->getId();
-        }
-
-        if (is_array($value)) {
-            return $value;
-        }
-
-        return (string) $value;
-    }
-
-    private function resolveActorProfileId(): ?string
-    {
-        try {
-            $session = $this->requestStack->getSession();
-            if ($session instanceof SessionInterface) {
-                $profileId = $session->get('profileId');
-                if ($profileId) {
-                    return (string) $profileId;
-                }
-            }
-        } catch (Throwable) {
-            // No session available (CLI context, etc.)
-        }
-
-        $user = $this->security->getUser();
-        if ($user instanceof Profile) {
-            return $user->getId();
-        }
-
-        return null;
-    }
 }
--- a/src/OpenApi/OpenApiDecorator.php
+++ b/src/OpenApi/OpenApiDecorator.php
@@ -0,0 +1,520 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\OpenApi;
+
+use ApiPlatform\OpenApi\Factory\OpenApiFactoryInterface;
+use ApiPlatform\OpenApi\Model;
+use ApiPlatform\OpenApi\OpenApi;
+use ArrayObject;
+
+final class OpenApiDecorator implements OpenApiFactoryInterface
+{
+    public function __construct(
+        private readonly OpenApiFactoryInterface $decorated,
+    ) {}
+
+    public function __invoke(array $context = []): OpenApi
+    {
+        $openApi = ($this->decorated)($context);
+
+        $this->addHealthCheck($openApi);
+        $this->addSessionRoutes($openApi);
+        $this->addAdminProfileRoutes($openApi);
+        $this->addActivityLogs($openApi);
+        $this->addCommentRoutes($openApi);
+        $this->addCustomFieldValueRoutes($openApi);
+        $this->addDocumentQueryRoutes($openApi);
+        $this->addDocumentServeRoutes($openApi);
+        $this->addEntityHistoryRoutes($openApi);
+        $this->addMachineStructureRoutes($openApi);
+        $this->addMachineCustomFieldsRoutes($openApi);
+        $this->addModelTypeConversionRoutes($openApi);
+
+        return $this->addTagDescriptions($openApi);
+    }
+
+    private function addHealthCheck(OpenApi $openApi): void
+    {
+        $openApi->getPaths()->addPath('/api/health', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'getHealthCheck',
+                tags: ['Monitoring'],
+                summary: 'Vérification de santé du système',
+                description: 'Retourne le statut du système, la version, la latence BDD et la mémoire utilisée.',
+                responses: [
+                    '200' => $this->jsonResponse('Système opérationnel.'),
+                    '503' => $this->jsonResponse('Système dégradé.'),
+                ],
+            ),
+        ));
+    }
+
+    private function addSessionRoutes(OpenApi $openApi): void
+    {
+        $openApi->getPaths()->addPath('/api/session/profiles', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'getSessionProfiles',
+                tags: ['Session'],
+                summary: 'Lister les profils disponibles',
+                description: 'Retourne les profils actifs (id, prénom, nom, hasPassword). Aucune authentification requise.',
+                responses: ['200' => $this->jsonResponse('Liste des profils.')],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/session/profile', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'getSessionProfile',
+                tags: ['Session'],
+                summary: 'Profil actif de la session',
+                description: 'Retourne le profil actuellement connecté via la session.',
+                responses: [
+                    '200' => $this->jsonResponse('Profil actif.'),
+                    '401' => $this->jsonResponse('Aucun profil actif.'),
+                ],
+            ),
+            post: new Model\Operation(
+                operationId: 'loginSessionProfile',
+                tags: ['Session'],
+                summary: 'Connexion — activer un profil',
+                description: 'Active un profil dans la session. Requiert profileId et password.',
+                requestBody: $this->jsonRequestBody('Identifiants de connexion.'),
+                responses: [
+                    '200' => $this->jsonResponse('Connexion réussie.'),
+                    '401' => $this->jsonResponse('Mot de passe incorrect.'),
+                    '404' => $this->jsonResponse('Profil introuvable.'),
+                ],
+            ),
+            delete: new Model\Operation(
+                operationId: 'logoutSessionProfile',
+                tags: ['Session'],
+                summary: 'Déconnexion — invalider la session',
+                responses: ['200' => $this->jsonResponse('Session invalidée.')],
+            ),
+        ));
+    }
+
+    private function addAdminProfileRoutes(OpenApi $openApi): void
+    {
+        $openApi->getPaths()->addPath('/api/admin/profiles', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'adminListProfiles',
+                tags: ['Admin — Profils'],
+                summary: 'Lister tous les profils',
+                description: 'Liste complète des profils triés par prénom. Requiert ROLE_ADMIN.',
+                responses: ['200' => $this->jsonResponse('Liste des profils.')],
+            ),
+            post: new Model\Operation(
+                operationId: 'adminCreateProfile',
+                tags: ['Admin — Profils'],
+                summary: 'Créer un profil',
+                description: 'Crée un nouveau profil avec rôle. Requiert ROLE_ADMIN.',
+                requestBody: $this->jsonRequestBody('Données du profil (firstName, lastName, email, password, role).'),
+                responses: [
+                    '201' => $this->jsonResponse('Profil créé.'),
+                    '400' => $this->jsonResponse('Données invalides.'),
+                    '409' => $this->jsonResponse('Email déjà utilisé.'),
+                ],
+            ),
+        ));
+
+        $idParam = $this->pathParam('id', 'Identifiant du profil');
+
+        $openApi->getPaths()->addPath('/api/admin/profiles/{id}/role', new Model\PathItem(
+            put: new Model\Operation(
+                operationId: 'adminUpdateProfileRole',
+                tags: ['Admin — Profils'],
+                summary: 'Modifier le rôle d\'un profil',
+                description: 'Change le rôle d\'un profil. Empêche la suppression du dernier admin. Requiert ROLE_ADMIN.',
+                parameters: [$idParam],
+                requestBody: $this->jsonRequestBody('Nouveau rôle.'),
+                responses: [
+                    '200' => $this->jsonResponse('Rôle mis à jour.'),
+                    '400' => $this->jsonResponse('Rôle invalide ou dernier admin.'),
+                ],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/admin/profiles/{id}/password', new Model\PathItem(
+            put: new Model\Operation(
+                operationId: 'adminUpdateProfilePassword',
+                tags: ['Admin — Profils'],
+                summary: 'Modifier le mot de passe d\'un profil',
+                description: 'Requiert ROLE_ADMIN.',
+                parameters: [$idParam],
+                requestBody: $this->jsonRequestBody('Nouveau mot de passe.'),
+                responses: ['200' => $this->jsonResponse('Mot de passe mis à jour.')],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/admin/profiles/{id}/deactivate', new Model\PathItem(
+            put: new Model\Operation(
+                operationId: 'adminDeactivateProfile',
+                tags: ['Admin — Profils'],
+                summary: 'Désactiver un profil',
+                description: 'Désactive un profil. Empêche la désactivation du dernier admin. Requiert ROLE_ADMIN.',
+                parameters: [$idParam],
+                responses: [
+                    '200' => $this->jsonResponse('Profil désactivé.'),
+                    '400' => $this->jsonResponse('Dernier admin, impossible de désactiver.'),
+                ],
+            ),
+        ));
+    }
+
+    private function addActivityLogs(OpenApi $openApi): void
+    {
+        $openApi->getPaths()->addPath('/api/activity-logs', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'getActivityLogs',
+                tags: ['Audit'],
+                summary: 'Journal d\'activité paginé',
+                description: 'Retourne les logs d\'audit avec filtrage optionnel par type d\'entité et action. Requiert ROLE_VIEWER.',
+                parameters: [
+                    $this->queryParam('page', 'Numéro de page'),
+                    $this->queryParam('itemsPerPage', 'Éléments par page'),
+                    $this->queryParam('entityType', 'Filtrer par type d\'entité'),
+                    $this->queryParam('action', 'Filtrer par action'),
+                ],
+                responses: ['200' => $this->jsonResponse('Logs paginés.')],
+            ),
+        ));
+    }
+
+    private function addCommentRoutes(OpenApi $openApi): void
+    {
+        $openApi->getPaths()->addPath('/api/comments', new Model\PathItem(
+            post: new Model\Operation(
+                operationId: 'createComment',
+                tags: ['Commentaires'],
+                summary: 'Créer un commentaire',
+                description: 'Ajoute un commentaire à une entité (machine, pièce, composant, produit, catégorie, squelette). Requiert ROLE_VIEWER.',
+                requestBody: $this->jsonRequestBody('Données du commentaire (content, entityType, entityId, entityName).'),
+                responses: [
+                    '201' => $this->jsonResponse('Commentaire créé.'),
+                    '400' => $this->jsonResponse('Données invalides.'),
+                ],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/comments/{id}/resolve', new Model\PathItem(
+            patch: new Model\Operation(
+                operationId: 'resolveComment',
+                tags: ['Commentaires'],
+                summary: 'Résoudre un commentaire',
+                description: 'Marque un commentaire comme résolu. Requiert ROLE_GESTIONNAIRE.',
+                parameters: [$this->pathParam('id', 'Identifiant du commentaire')],
+                responses: [
+                    '200' => $this->jsonResponse('Commentaire résolu.'),
+                    '404' => $this->jsonResponse('Commentaire introuvable.'),
+                ],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/comments/stats/unresolved-count', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'getUnresolvedCommentCount',
+                tags: ['Commentaires'],
+                summary: 'Nombre de commentaires non résolus',
+                description: 'Requiert ROLE_VIEWER.',
+                responses: ['200' => $this->jsonResponse('Compteur.')],
+            ),
+        ));
+    }
+
+    private function addCustomFieldValueRoutes(OpenApi $openApi): void
+    {
+        $openApi->getPaths()->addPath('/api/custom-fields/values', new Model\PathItem(
+            post: new Model\Operation(
+                operationId: 'createCustomFieldValue',
+                tags: ['Champs personnalisés'],
+                summary: 'Créer une valeur de champ personnalisé',
+                description: 'Crée une valeur pour un champ personnalisé sur une entité. Auto-crée le champ si nécessaire. Requiert ROLE_GESTIONNAIRE.',
+                requestBody: $this->jsonRequestBody('Données (customFieldId/customFieldName, value, entité cible).'),
+                responses: [
+                    '201' => $this->jsonResponse('Valeur créée.'),
+                    '400' => $this->jsonResponse('Données invalides.'),
+                ],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/custom-fields/values/upsert', new Model\PathItem(
+            post: new Model\Operation(
+                operationId: 'upsertCustomFieldValue',
+                tags: ['Champs personnalisés'],
+                summary: 'Créer ou mettre à jour une valeur de champ personnalisé',
+                description: 'Requiert ROLE_GESTIONNAIRE.',
+                requestBody: $this->jsonRequestBody('Données du champ.'),
+                responses: ['200' => $this->jsonResponse('Valeur créée ou mise à jour.')],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/custom-fields/values/{entityType}/{entityId}', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'listCustomFieldValues',
+                tags: ['Champs personnalisés'],
+                summary: 'Lister les valeurs de champs personnalisés d\'une entité',
+                description: 'Requiert ROLE_VIEWER.',
+                parameters: [
+                    $this->pathParam('entityType', 'Type d\'entité (machine, composant, piece, product)'),
+                    $this->pathParam('entityId', 'Identifiant de l\'entité'),
+                ],
+                responses: ['200' => $this->jsonResponse('Liste des valeurs.')],
+            ),
+        ));
+
+        $idParam = $this->pathParam('id', 'Identifiant de la valeur');
+
+        $openApi->getPaths()->addPath('/api/custom-fields/values/{id}', new Model\PathItem(
+            patch: new Model\Operation(
+                operationId: 'updateCustomFieldValue',
+                tags: ['Champs personnalisés'],
+                summary: 'Modifier une valeur de champ personnalisé',
+                description: 'Requiert ROLE_GESTIONNAIRE.',
+                parameters: [$idParam],
+                requestBody: $this->jsonRequestBody('Nouvelle valeur.'),
+                responses: ['200' => $this->jsonResponse('Valeur mise à jour.')],
+            ),
+            delete: new Model\Operation(
+                operationId: 'deleteCustomFieldValue',
+                tags: ['Champs personnalisés'],
+                summary: 'Supprimer une valeur de champ personnalisé',
+                description: 'Requiert ROLE_GESTIONNAIRE.',
+                parameters: [$idParam],
+                responses: ['204' => new Model\Response(description: 'Valeur supprimée.')],
+            ),
+        ));
+    }
+
+    private function addDocumentQueryRoutes(OpenApi $openApi): void
+    {
+        $entities = [
+            'site'      => 'un site',
+            'machine'   => 'une machine',
+            'composant' => 'un composant',
+            'piece'     => 'une pièce',
+            'product'   => 'un produit',
+        ];
+
+        foreach ($entities as $entity => $label) {
+            $openApi->getPaths()->addPath("/api/documents/{$entity}/{id}", new Model\PathItem(
+                get: new Model\Operation(
+                    operationId: 'getDocumentsBy'.ucfirst($entity),
+                    tags: ['Documents'],
+                    summary: "Documents rattachés à {$label}",
+                    description: 'Requiert ROLE_VIEWER.',
+                    parameters: [$this->pathParam('id', "Identifiant de l'entité")],
+                    responses: ['200' => $this->jsonResponse('Liste des documents.')],
+                ),
+            ));
+        }
+    }
+
+    private function addDocumentServeRoutes(OpenApi $openApi): void
+    {
+        $idParam = $this->pathParam('id', 'Identifiant du document');
+
+        $openApi->getPaths()->addPath('/api/documents/{id}/file', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'serveDocumentFile',
+                tags: ['Documents'],
+                summary: 'Afficher un fichier document (inline)',
+                description: 'Sert le fichier pour affichage dans le navigateur. Requiert ROLE_VIEWER.',
+                parameters: [$idParam],
+                responses: ['200' => new Model\Response(description: 'Contenu du fichier.')],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/documents/{id}/download', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'downloadDocumentFile',
+                tags: ['Documents'],
+                summary: 'Télécharger un fichier document',
+                description: 'Sert le fichier en téléchargement (attachment). Requiert ROLE_VIEWER.',
+                parameters: [$idParam],
+                responses: ['200' => new Model\Response(description: 'Fichier en téléchargement.')],
+            ),
+        ));
+    }
+
+    private function addEntityHistoryRoutes(OpenApi $openApi): void
+    {
+        $entities = [
+            'machines'   => 'une machine',
+            'pieces'     => 'une pièce',
+            'composants' => 'un composant',
+            'products'   => 'un produit',
+        ];
+
+        foreach ($entities as $plural => $label) {
+            $openApi->getPaths()->addPath("/api/{$plural}/{id}/history", new Model\PathItem(
+                get: new Model\Operation(
+                    operationId: 'get'.ucfirst(rtrim($plural, 's')).'History',
+                    tags: ['Audit'],
+                    summary: "Historique d'audit de {$label}",
+                    description: "Retourne les 200 derniers événements d'audit. Requiert ROLE_VIEWER.",
+                    parameters: [$this->pathParam('id', "Identifiant de l'entité")],
+                    responses: ['200' => $this->jsonResponse('Historique paginé.')],
+                ),
+            ));
+        }
+    }
+
+    private function addMachineStructureRoutes(OpenApi $openApi): void
+    {
+        $idParam = $this->pathParam('id', 'Identifiant de la machine');
+
+        $openApi->getPaths()->addPath('/api/machines/{id}/structure', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'getMachineStructure',
+                tags: ['Machines — Structure'],
+                summary: 'Structure complète d\'une machine',
+                description: 'Retourne les composants, pièces et produits avec hiérarchie. Requiert ROLE_VIEWER.',
+                parameters: [$idParam],
+                responses: ['200' => $this->jsonResponse('Structure de la machine.')],
+            ),
+            patch: new Model\Operation(
+                operationId: 'updateMachineStructure',
+                tags: ['Machines — Structure'],
+                summary: 'Modifier la structure d\'une machine',
+                description: 'Crée, met à jour ou supprime les liens composants/pièces/produits. Requiert ROLE_GESTIONNAIRE.',
+                parameters: [$idParam],
+                requestBody: $this->jsonRequestBody('Liens à créer/modifier/supprimer.'),
+                responses: ['200' => $this->jsonResponse('Structure mise à jour.')],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/machines/{id}/clone', new Model\PathItem(
+            post: new Model\Operation(
+                operationId: 'cloneMachine',
+                tags: ['Machines — Structure'],
+                summary: 'Cloner une machine',
+                description: 'Clone une machine avec tous ses composants, pièces, produits, champs personnalisés et constructeurs. Requiert ROLE_GESTIONNAIRE.',
+                parameters: [$idParam],
+                requestBody: $this->jsonRequestBody('Données de la copie (name, siteId, reference).'),
+                responses: [
+                    '201' => $this->jsonResponse('Machine clonée.'),
+                    '404' => $this->jsonResponse('Machine source introuvable.'),
+                ],
+            ),
+        ));
+    }
+
+    private function addMachineCustomFieldsRoutes(OpenApi $openApi): void
+    {
+        $openApi->getPaths()->addPath('/api/machines/{id}/add-custom-fields', new Model\PathItem(
+            post: new Model\Operation(
+                operationId: 'addMachineCustomFields',
+                tags: ['Machines — Structure'],
+                summary: 'Initialiser les champs personnalisés manquants',
+                description: 'Crée les entrées de valeur manquantes pour les champs personnalisés définis. Requiert ROLE_GESTIONNAIRE.',
+                parameters: [$this->pathParam('id', 'Identifiant de la machine')],
+                responses: ['200' => $this->jsonResponse('Champs ajoutés.')],
+            ),
+        ));
+    }
+
+    private function addModelTypeConversionRoutes(OpenApi $openApi): void
+    {
+        $idParam = $this->pathParam('id', 'Identifiant du ModelType');
+
+        $openApi->getPaths()->addPath('/api/model_types/{id}/conversion-check', new Model\PathItem(
+            get: new Model\Operation(
+                operationId: 'checkModelTypeConversion',
+                tags: ['ModelType'],
+                summary: 'Vérifier la convertibilité d\'un ModelType',
+                description: 'Vérifie si la catégorie du ModelType peut être convertie. Requiert ROLE_VIEWER.',
+                parameters: [$idParam],
+                responses: ['200' => $this->jsonResponse('Résultat de la vérification.')],
+            ),
+        ));
+
+        $openApi->getPaths()->addPath('/api/model_types/{id}/convert', new Model\PathItem(
+            post: new Model\Operation(
+                operationId: 'convertModelType',
+                tags: ['ModelType'],
+                summary: 'Convertir la catégorie d\'un ModelType',
+                description: 'Convertit la catégorie. Retourne 409 en cas de conflit. Requiert ROLE_GESTIONNAIRE.',
+                parameters: [$idParam],
+                responses: [
+                    '200' => $this->jsonResponse('Conversion effectuée.'),
+                    '409' => $this->jsonResponse('Conflit — conversion impossible.'),
+                ],
+            ),
+        ));
+    }
+
+    private function addTagDescriptions(OpenApi $openApi): OpenApi
+    {
+        $customTags = [
+            'Monitoring'           => 'Supervision et vérification de l\'état de santé du système (statut, version, latence BDD, mémoire).',
+            'Session'              => 'Authentification par session. Permet de lister les profils disponibles, se connecter (activer un profil) et se déconnecter.',
+            'Admin — Profils'      => 'Administration des profils utilisateurs. Création, modification des rôles et mots de passe, désactivation. Réservé aux administrateurs.',
+            'Audit'                => 'Journal d\'activité et historique d\'audit. Consultation des modifications apportées aux entités avec détail des changements (diff et snapshot).',
+            'Commentaires'         => 'Système de commentaires et annotations sur les entités. Permet de créer des commentaires, les résoudre et suivre le nombre de commentaires ouverts.',
+            'Champs personnalisés' => 'Gestion des valeurs de champs personnalisés. Permet d\'ajouter, modifier et supprimer des données dynamiques sur les machines, pièces, composants et produits.',
+            'Documents'            => 'Gestion des fichiers joints. Consultation des documents par entité, affichage inline et téléchargement.',
+            'Machines — Structure' => 'Structure hiérarchique des machines. Consultation et modification des liaisons composants/pièces/produits, clonage de machines et initialisation des champs personnalisés.',
+            'ModelType'            => 'Conversion de catégories de types. Vérification de compatibilité et conversion effective des catégories de ModelType.',
+        ];
+
+        $existingTags  = $openApi->getTags();
+        $existingNames = array_map(static fn (Model\Tag $tag) => $tag->getName(), $existingTags);
+
+        foreach ($customTags as $name => $description) {
+            if (!in_array($name, $existingNames, true)) {
+                $existingTags[] = new Model\Tag(name: $name, description: $description);
+            }
+        }
+
+        return $openApi->withTags($existingTags);
+    }
+
+    private function jsonResponse(string $description): Model\Response
+    {
+        return new Model\Response(
+            description: $description,
+            content: new ArrayObject([
+                'application/json' => new Model\MediaType(
+                    schema: new ArrayObject(['type' => 'object']),
+                ),
+            ]),
+        );
+    }
+
+    private function jsonRequestBody(string $description): Model\RequestBody
+    {
+        return new Model\RequestBody(
+            description: $description,
+            content: new ArrayObject([
+                'application/json' => new Model\MediaType(
+                    schema: new ArrayObject(['type' => 'object']),
+                ),
+            ]),
+            required: true,
+        );
+    }
+
+    private function pathParam(string $name, string $description): Model\Parameter
+    {
+        return new Model\Parameter(
+            name: $name,
+            in: 'path',
+            description: $description,
+            required: true,
+            schema: ['type' => 'string'],
+        );
+    }
+
+    private function queryParam(string $name, string $description): Model\Parameter
+    {
+        return new Model\Parameter(
+            name: $name,
+            in: 'query',
+            description: $description,
+            required: false,
+            schema: ['type' => 'string'],
+        );
+    }
+}
--- a/src/Service/DocumentStorageService.php
+++ b/src/Service/DocumentStorageService.php
@@ -27,7 +27,14 @@ class DocumentStorageService

    public function getAbsolutePath(string $relativePath): string
    {
-        return $this->storageDir.'/'.$relativePath;
+        $absolutePath = $this->storageDir.'/'.$relativePath;
+        $realPath     = realpath($absolutePath);
+
+        if (false !== $realPath && !str_starts_with($realPath, realpath($this->storageDir))) {
+            throw new RuntimeException(sprintf('Path traversal detected: "%s"', $relativePath));
+        }
+
+        return $absolutePath;
    }

    /**
--- a/src/Service/PdfCompressorService.php
+++ b/src/Service/PdfCompressorService.php
@@ -6,6 +6,8 @@ namespace App\Service;

 class PdfCompressorService
 {
+    private ?bool $qpdfAvailable = null;
+
    /**
     * Compress an actual PDF file on disk. Returns metadata or null if no gain.
     *
@@ -13,8 +15,7 @@ class PdfCompressorService
     */
    public function compressFile(string $absolutePath): ?array
    {
-        exec('which qpdf', $qpdfPath, $returnCode);
-        if (0 !== $returnCode) {
+        if (!$this->isQpdfAvailable()) {
            return null;
        }

@@ -65,9 +66,7 @@ class PdfCompressorService

    public function compressBase64Pdf(string $base64Data): ?array
    {
-        // Check if qpdf is available
-        exec('which qpdf', $qpdfPath, $returnCode);
-        if (0 !== $returnCode) {
+        if (!$this->isQpdfAvailable()) {
            return null;
        }

@@ -127,4 +126,14 @@ class PdfCompressorService
            'saved'        => $originalSize - $compressedSize,
        ];
    }
+
+    private function isQpdfAvailable(): bool
+    {
+        if (null === $this->qpdfAvailable) {
+            exec('which qpdf', $qpdfPath, $returnCode);
+            $this->qpdfAvailable = 0 === $returnCode;
+        }
+
+        return $this->qpdfAvailable;
+    }
 }
--- a/symfony.lock
+++ b/symfony.lock
@@ -13,6 +13,15 @@
            "src/ApiResource/.gitignore"
        ]
    },
+    "dama/doctrine-test-bundle": {
+        "version": "8.6",
+        "recipe": {
+            "repo": "github.com/symfony/recipes-contrib",
+            "branch": "main",
+            "version": "8.3",
+            "ref": "dfc51177476fb39d014ed89944cde53dc3326d23"
+        }
+    },
    "doctrine/deprecations": {
        "version": "1.1",
        "recipe": {
--- a/tests/AbstractApiTestCase.php
+++ b/tests/AbstractApiTestCase.php
@@ -0,0 +1,327 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests;
+
+use ApiPlatform\Symfony\Bundle\Test\ApiTestCase;
+use ApiPlatform\Symfony\Bundle\Test\Client;
+use App\Entity\Composant;
+use App\Entity\Constructeur;
+use App\Entity\CustomField;
+use App\Entity\CustomFieldValue;
+use App\Entity\Machine;
+use App\Entity\MachineComponentLink;
+use App\Entity\MachinePieceLink;
+use App\Entity\MachineProductLink;
+use App\Entity\ModelType;
+use App\Entity\Piece;
+use App\Entity\Product;
+use App\Entity\Profile;
+use App\Entity\Site;
+use App\Enum\ModelCategory;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+
+abstract class AbstractApiTestCase extends ApiTestCase
+{
+    private const DEFAULT_PASSWORD = 'test1234';
+
+    protected function tearDown(): void
+    {
+        $this->getEntityManager()->clear();
+
+        parent::tearDown();
+    }
+
+    protected function getEntityManager(): EntityManagerInterface
+    {
+        return static::getContainer()->get('doctrine')->getManager();
+    }
+
+    protected function getPasswordHasher(): UserPasswordHasherInterface
+    {
+        return static::getContainer()->get(UserPasswordHasherInterface::class);
+    }
+
+    // ── Auth helpers ────────────────────────────────────────────────
+
+    protected function createAuthenticatedClient(string $role): Client
+    {
+        $profile = $this->createProfile(roles: [$role], password: self::DEFAULT_PASSWORD);
+
+        $client = static::createClient();
+        $client->request('POST', '/api/session/profile', [
+            'json' => [
+                'profileId' => $profile->getId(),
+                'password'  => self::DEFAULT_PASSWORD,
+            ],
+        ]);
+
+        return $client;
+    }
+
+    protected function createViewerClient(): Client
+    {
+        return $this->createAuthenticatedClient('ROLE_VIEWER');
+    }
+
+    protected function createGestionnaireClient(): Client
+    {
+        return $this->createAuthenticatedClient('ROLE_GESTIONNAIRE');
+    }
+
+    protected function createAdminClient(): Client
+    {
+        return $this->createAuthenticatedClient('ROLE_ADMIN');
+    }
+
+    protected function createUnauthenticatedClient(): Client
+    {
+        return static::createClient();
+    }
+
+    // ── Factory helpers ─────────────────────────────────────────────
+
+    protected function createProfile(
+        string $firstName = 'Test',
+        string $lastName = 'User',
+        ?string $email = null,
+        array $roles = ['ROLE_USER'],
+        ?string $password = null,
+        bool $isActive = true,
+    ): Profile {
+        $profile = new Profile();
+        $profile->setFirstName($firstName);
+        $profile->setLastName($lastName);
+        $profile->setEmail($email ?? uniqid('test-', true).'@test.local');
+        $profile->setRoles($roles);
+        $profile->setIsActive($isActive);
+
+        if (null !== $password) {
+            $hashed = $this->getPasswordHasher()->hashPassword($profile, $password);
+            $profile->setPassword($hashed);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($profile);
+        $em->flush();
+
+        return $profile;
+    }
+
+    protected function createSite(string $name = 'Site Test', array $extra = []): Site
+    {
+        $site = new Site();
+        $site->setName($name);
+
+        if (isset($extra['contactName'])) {
+            $site->setContactName($extra['contactName']);
+        }
+        if (isset($extra['contactCity'])) {
+            $site->setContactCity($extra['contactCity']);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($site);
+        $em->flush();
+
+        return $site;
+    }
+
+    protected function createConstructeur(string $name = 'Constructeur Test', ?string $email = null, ?string $phone = null): Constructeur
+    {
+        $c = new Constructeur();
+        $c->setName($name);
+        $c->setEmail($email);
+        $c->setPhone($phone);
+
+        $em = $this->getEntityManager();
+        $em->persist($c);
+        $em->flush();
+
+        return $c;
+    }
+
+    protected function createModelType(
+        string $name = 'ModelType Test',
+        string $code = 'MT-001',
+        ModelCategory $category = ModelCategory::COMPONENT,
+    ): ModelType {
+        $mt = new ModelType();
+        $mt->setName($name);
+        $mt->setCode($code);
+        $mt->setCategory($category);
+
+        $em = $this->getEntityManager();
+        $em->persist($mt);
+        $em->flush();
+
+        return $mt;
+    }
+
+    protected function createMachine(string $name = 'Machine Test', ?Site $site = null, ?string $reference = null): Machine
+    {
+        $site ??= $this->createSite();
+
+        $machine = new Machine();
+        $machine->setName($name);
+        $machine->setSite($site);
+        if (null !== $reference) {
+            $machine->setReference($reference);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($machine);
+        $em->flush();
+
+        return $machine;
+    }
+
+    protected function createComposant(string $name = 'Composant Test', ?ModelType $type = null): Composant
+    {
+        $c = new Composant();
+        $c->setName($name);
+        if (null !== $type) {
+            $c->setTypeComposant($type);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($c);
+        $em->flush();
+
+        return $c;
+    }
+
+    protected function createPiece(string $name = 'Piece Test', ?string $reference = null, ?ModelType $type = null): Piece
+    {
+        $p = new Piece();
+        $p->setName($name);
+        if (null !== $reference) {
+            $p->setReference($reference);
+        }
+        if (null !== $type) {
+            $p->setTypePiece($type);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($p);
+        $em->flush();
+
+        return $p;
+    }
+
+    protected function createProduct(string $name = 'Product Test', ?string $reference = null, ?ModelType $type = null): Product
+    {
+        $p = new Product();
+        $p->setName($name);
+        if (null !== $reference) {
+            $p->setReference($reference);
+        }
+        if (null !== $type) {
+            $p->setTypeProduct($type);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($p);
+        $em->flush();
+
+        return $p;
+    }
+
+    protected function createCustomField(
+        string $name = 'Custom Field',
+        string $type = 'text',
+        ?Machine $machine = null,
+    ): CustomField {
+        $cf = new CustomField();
+        $cf->setName($name);
+        $cf->setType($type);
+        if (null !== $machine) {
+            $cf->setMachine($machine);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($cf);
+        $em->flush();
+
+        return $cf;
+    }
+
+    protected function createCustomFieldValue(
+        CustomField $customField,
+        string $value = 'test value',
+        ?Machine $machine = null,
+        ?Composant $composant = null,
+    ): CustomFieldValue {
+        $cfv = new CustomFieldValue();
+        $cfv->setValue($value);
+        $cfv->setCustomField($customField);
+        if (null !== $machine) {
+            $cfv->setMachine($machine);
+        }
+        if (null !== $composant) {
+            $cfv->setComposant($composant);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($cfv);
+        $em->flush();
+
+        return $cfv;
+    }
+
+    protected function createMachineComponentLink(Machine $machine, Composant $composant): MachineComponentLink
+    {
+        $link = new MachineComponentLink();
+        $link->setMachine($machine);
+        $link->setComposant($composant);
+
+        $em = $this->getEntityManager();
+        $em->persist($link);
+        $em->flush();
+
+        return $link;
+    }
+
+    protected function createMachinePieceLink(Machine $machine, Piece $piece, ?MachineComponentLink $parentLink = null): MachinePieceLink
+    {
+        $link = new MachinePieceLink();
+        $link->setMachine($machine);
+        $link->setPiece($piece);
+        if (null !== $parentLink) {
+            $link->setParentLink($parentLink);
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($link);
+        $em->flush();
+
+        return $link;
+    }
+
+    protected function createMachineProductLink(Machine $machine, Product $product): MachineProductLink
+    {
+        $link = new MachineProductLink();
+        $link->setMachine($machine);
+        $link->setProduct($product);
+
+        $em = $this->getEntityManager();
+        $em->persist($link);
+        $em->flush();
+
+        return $link;
+    }
+
+    // ── Assertion helpers ───────────────────────────────────────────
+
+    protected function assertJsonContainsHydraCollection(): void
+    {
+        $this->assertJsonContains(['@type' => 'Collection']);
+    }
+
+    protected static function iri(string $resource, string $id): string
+    {
+        return sprintf('/api/%s/%s', $resource, $id);
+    }
+}
--- a/tests/Api/Controller/CommentControllerTest.php
+++ b/tests/Api/Controller/CommentControllerTest.php
@@ -0,0 +1,150 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Controller;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class CommentControllerTest extends AbstractApiTestCase
+{
+    public function testCreateComment(): void
+    {
+        $machine = $this->createMachine('Machine A');
+
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => 'Test comment',
+                'entityType' => 'machine',
+                'entityId'   => $machine->getId(),
+                'entityName' => 'Machine A',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains([
+            'content'    => 'Test comment',
+            'entityType' => 'machine',
+            'status'     => 'open',
+        ]);
+    }
+
+    public function testCreateCommentUnauthenticated(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => 'No auth',
+                'entityType' => 'machine',
+                'entityId'   => 'fake-id',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testCreateCommentEmptyContent(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => '',
+                'entityType' => 'machine',
+                'entityId'   => 'some-id',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(400);
+        $this->assertJsonContains(['message' => 'Le contenu est requis.']);
+    }
+
+    public function testCreateCommentInvalidEntityType(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => 'Invalid type',
+                'entityType' => 'invalid',
+                'entityId'   => 'some-id',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(400);
+        $this->assertJsonContains(['message' => "Type d'entité invalide."]);
+    }
+
+    public function testCreateCommentMissingEntityId(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => 'Missing ID',
+                'entityType' => 'machine',
+                'entityId'   => '',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(400);
+    }
+
+    public function testResolveComment(): void
+    {
+        $machine = $this->createMachine('Machine A');
+
+        $viewerClient = $this->createViewerClient();
+        $response     = $viewerClient->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => 'To resolve',
+                'entityType' => 'machine',
+                'entityId'   => $machine->getId(),
+            ],
+        ]);
+
+        $data      = $response->toArray();
+        $commentId = $data['id'];
+
+        $gestionnaireClient = $this->createGestionnaireClient();
+        $gestionnaireClient->request('PATCH', sprintf('/api/comments/%s/resolve', $commentId));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['status' => 'resolved']);
+    }
+
+    public function testResolveCommentNotFound(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', '/api/comments/nonexistent-id/resolve');
+
+        $this->assertResponseStatusCodeSame(404);
+    }
+
+    public function testUnresolvedCount(): void
+    {
+        $machine = $this->createMachine('Machine A');
+
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => 'Open 1',
+                'entityType' => 'machine',
+                'entityId'   => $machine->getId(),
+            ],
+        ]);
+        $client->request('POST', '/api/comments', [
+            'json' => [
+                'content'    => 'Open 2',
+                'entityType' => 'machine',
+                'entityId'   => $machine->getId(),
+            ],
+        ]);
+
+        $client->request('GET', '/api/comments/stats/unresolved-count');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['count' => 2]);
+    }
+}
--- a/tests/Api/Controller/EntityHistoryTest.php
+++ b/tests/Api/Controller/EntityHistoryTest.php
@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Controller;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class EntityHistoryTest extends AbstractApiTestCase
+{
+    public function testMachineHistoryAfterCreate(): void
+    {
+        $machine = $this->createMachine('Machine A');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', sprintf('/api/machines/%s/history', $machine->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $data = $client->getResponse()->toArray();
+        $this->assertArrayHasKey('items', $data);
+        $this->assertArrayHasKey('total', $data);
+    }
+
+    public function testMachineHistoryAfterUpdate(): void
+    {
+        $machine = $this->createMachine('Machine A');
+
+        $gClient = $this->createGestionnaireClient();
+        $gClient->request('PATCH', self::iri('machines', $machine->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['name' => 'Machine A Updated'],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        $vClient = $this->createViewerClient();
+        $vClient->request('GET', sprintf('/api/machines/%s/history', $machine->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $data = $vClient->getResponse()->toArray();
+        $this->assertGreaterThanOrEqual(1, $data['total']);
+    }
+
+    public function testMachineHistoryNotFound(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/machines/nonexistent-id/history');
+
+        $this->assertResponseStatusCodeSame(404);
+        $this->assertJsonContains(['message' => 'Machine introuvable.']);
+    }
+
+    public function testPieceHistory(): void
+    {
+        $piece = $this->createPiece('Joint A');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', sprintf('/api/pieces/%s/history', $piece->getId()));
+
+        $this->assertResponseIsSuccessful();
+    }
+
+    public function testComposantHistory(): void
+    {
+        $composant = $this->createComposant('Pompe A');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', sprintf('/api/composants/%s/history', $composant->getId()));
+
+        $this->assertResponseIsSuccessful();
+    }
+
+    public function testProductHistory(): void
+    {
+        $product = $this->createProduct('Produit A');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', sprintf('/api/products/%s/history', $product->getId()));
+
+        $this->assertResponseIsSuccessful();
+    }
+
+    public function testHistoryUnauthenticated(): void
+    {
+        $machine = $this->createMachine('Machine A');
+
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', sprintf('/api/machines/%s/history', $machine->getId()));
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+}
--- a/tests/Api/Controller/MachineCustomFieldDefinitionTest.php
+++ b/tests/Api/Controller/MachineCustomFieldDefinitionTest.php
@@ -0,0 +1,122 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Controller;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class MachineCustomFieldDefinitionTest extends AbstractApiTestCase
+{
+    public function testCreateCustomFieldForMachine(): void
+    {
+        $machine = $this->createMachine('Machine CF Create');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/custom_fields', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'    => 'Tension',
+                'type'    => 'number',
+                'machine' => self::iri('machines', $machine->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Tension', 'type' => 'number']);
+
+        // Verify via structure endpoint
+        $client->request('GET', sprintf('/api/machines/%s/structure', $machine->getId()));
+        $this->assertResponseIsSuccessful();
+
+        $data = $client->getResponse()->toArray();
+        $this->assertArrayHasKey('customFields', $data['machine']);
+        $this->assertNotEmpty($data['machine']['customFields'], 'customFields should contain the new field');
+
+        $found = false;
+        foreach ($data['machine']['customFields'] as $cf) {
+            if ('Tension' === $cf['name'] && 'number' === $cf['type']) {
+                $found = true;
+
+                break;
+            }
+        }
+        $this->assertTrue($found, 'Structure should contain the created custom field "Tension"');
+    }
+
+    public function testUpdateCustomFieldForMachine(): void
+    {
+        $machine = $this->createMachine('Machine CF Update');
+        $cf      = $this->createCustomField('OldName', 'text', $machine);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('custom_fields', $cf->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['name' => 'NewName'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'NewName']);
+
+        // Verify via structure endpoint
+        $client->request('GET', sprintf('/api/machines/%s/structure', $machine->getId()));
+        $this->assertResponseIsSuccessful();
+
+        $data = $client->getResponse()->toArray();
+        $this->assertNotEmpty($data['machine']['customFields']);
+
+        $names = array_column($data['machine']['customFields'], 'name');
+        $this->assertContains('NewName', $names, 'Structure should reflect the updated custom field name');
+        $this->assertNotContains('OldName', $names, 'Old name should no longer appear');
+    }
+
+    public function testDeleteCustomFieldForMachine(): void
+    {
+        $machine = $this->createMachine('Machine CF Delete');
+        $cf      = $this->createCustomField('ToDelete', 'text', $machine);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('custom_fields', $cf->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+
+        // Verify via structure endpoint
+        $client->request('GET', sprintf('/api/machines/%s/structure', $machine->getId()));
+        $this->assertResponseIsSuccessful();
+
+        $data = $client->getResponse()->toArray();
+        $this->assertSame([], $data['machine']['customFields'], 'customFields should be empty after deletion');
+    }
+
+    public function testAddCustomFieldsEndpointInitializesValues(): void
+    {
+        $machine = $this->createMachine('Machine CF Values');
+        $cf      = $this->createCustomField('Voltage', 'number', $machine);
+        $cf->setDefaultValue('220');
+        $em = $this->getEntityManager();
+        $em->persist($cf);
+        $em->flush();
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', sprintf('/api/machines/%s/add-custom-fields', $machine->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $response = $client->getResponse()->toArray();
+        $this->assertTrue($response['success']);
+        $this->assertNotEmpty($response['customFieldValues'], 'customFieldValues should not be empty after add-custom-fields');
+
+        // Verify via structure endpoint
+        $client->request('GET', sprintf('/api/machines/%s/structure', $machine->getId()));
+        $this->assertResponseIsSuccessful();
+
+        $data = $client->getResponse()->toArray();
+        $this->assertNotEmpty($data['machine']['customFieldValues'], 'Structure should contain initialized custom field values');
+
+        $cfv = $data['machine']['customFieldValues'][0];
+        $this->assertSame('220', $cfv['value'], 'Value should match the default value');
+        $this->assertSame('Voltage', $cfv['customField']['name']);
+    }
+}
--- a/tests/Api/Controller/MachineStructureCustomFieldValuesTest.php
+++ b/tests/Api/Controller/MachineStructureCustomFieldValuesTest.php
@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Controller;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class MachineStructureCustomFieldValuesTest extends AbstractApiTestCase
+{
+    public function testStructureIncludesCustomFieldValues(): void
+    {
+        $machine = $this->createMachine('Machine CFV');
+        $cf      = $this->createCustomField('Tension', 'number', $machine);
+        $this->createCustomFieldValue($cf, '220', $machine);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', sprintf('/api/machines/%s/structure', $machine->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $data = $client->getResponse()->toArray();
+
+        $this->assertArrayHasKey('machine', $data);
+        $this->assertArrayHasKey('customFieldValues', $data['machine']);
+        $this->assertIsArray($data['machine']['customFieldValues']);
+        $this->assertNotEmpty($data['machine']['customFieldValues'], 'customFieldValues should not be empty');
+
+        $cfv = $data['machine']['customFieldValues'][0];
+        $this->assertSame('220', $cfv['value']);
+        $this->assertArrayHasKey('customField', $cfv);
+        $this->assertSame('Tension', $cfv['customField']['name']);
+        $this->assertSame('number', $cfv['customField']['type']);
+    }
+
+    public function testStructureReturnsEmptyArrayWhenNoCustomFieldValues(): void
+    {
+        $machine = $this->createMachine('Machine sans CFV');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', sprintf('/api/machines/%s/structure', $machine->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $data = $client->getResponse()->toArray();
+
+        $this->assertArrayHasKey('customFieldValues', $data['machine']);
+        $this->assertSame([], $data['machine']['customFieldValues']);
+    }
+}
--- a/tests/Api/Entity/ComposantTest.php
+++ b/tests/Api/Entity/ComposantTest.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Enum\ModelCategory;
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class ComposantTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $this->createComposant('Pompe A');
+        $this->createComposant('Pompe B');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/composants');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $c = $this->createComposant('Pompe A');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('composants', $c->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Pompe A']);
+    }
+
+    public function testPost(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/composants', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'      => 'Nouveau composant',
+                'reference' => 'REF-COMP-001',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Nouveau composant']);
+    }
+
+    public function testPostWithType(): void
+    {
+        $mt = $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/composants', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'          => 'Composant typé',
+                'typeComposant' => self::iri('model_types', $mt->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPut(): void
+    {
+        $c = $this->createComposant('Pompe A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('composants', $c->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Pompe A Renommée'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Pompe A Renommée']);
+    }
+
+    public function testPatch(): void
+    {
+        $c = $this->createComposant('Pompe A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('composants', $c->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['prix' => '250.00'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['prix' => '250.00']);
+    }
+
+    public function testDelete(): void
+    {
+        $c = $this->createComposant('ToDelete');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('composants', $c->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/composants');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/composants', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Blocked'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testSearchFilter(): void
+    {
+        $this->createComposant('Pompe hydraulique');
+        $this->createComposant('Vanne de contrôle');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/composants?name=pompe');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+}
--- a/tests/Api/Entity/ConstructeurTest.php
+++ b/tests/Api/Entity/ConstructeurTest.php
@@ -0,0 +1,129 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class ConstructeurTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $this->createConstructeur('Siemens');
+        $this->createConstructeur('ABB');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/constructeurs');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $c = $this->createConstructeur('Siemens', 'contact@siemens.com', '+33123456789');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('constructeurs', $c->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name'  => 'Siemens',
+            'email' => 'contact@siemens.com',
+            'phone' => '+33123456789',
+        ]);
+    }
+
+    public function testPost(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/constructeurs', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'  => 'Schneider',
+                'email' => 'info@schneider.com',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Schneider']);
+    }
+
+    public function testPut(): void
+    {
+        $c = $this->createConstructeur('Siemens');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('constructeurs', $c->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'  => 'Siemens AG',
+                'email' => 'updated@siemens.com',
+            ],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Siemens AG']);
+    }
+
+    public function testPatch(): void
+    {
+        $c = $this->createConstructeur('Siemens');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('constructeurs', $c->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['phone' => '+33987654321'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['phone' => '+33987654321']);
+    }
+
+    public function testDelete(): void
+    {
+        $c = $this->createConstructeur('ToDelete');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('constructeurs', $c->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/constructeurs');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/constructeurs', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Blocked'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testUniqueNameConstraint(): void
+    {
+        $this->createConstructeur('Siemens');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/constructeurs', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Siemens'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+}
--- a/tests/Api/Entity/CustomFieldTest.php
+++ b/tests/Api/Entity/CustomFieldTest.php
@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class CustomFieldTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $this->createCustomField('Tension', 'number', $machine);
+        $this->createCustomField('Couleur', 'text', $machine);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/custom_fields');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('Tension', 'number', $machine);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('custom_fields', $cf->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name' => 'Tension',
+            'type' => 'number',
+        ]);
+    }
+
+    public function testPost(): void
+    {
+        $machine = $this->createMachine('Machine A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/custom_fields', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'    => 'Pression',
+                'type'    => 'number',
+                'machine' => self::iri('machines', $machine->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Pression']);
+    }
+
+    public function testPatch(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('Tension', 'number', $machine);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('custom_fields', $cf->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['required' => true],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['required' => true]);
+    }
+
+    public function testDelete(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('ToDelete', 'text', $machine);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('custom_fields', $cf->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/custom_fields');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/custom_fields', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name' => 'Blocked',
+                'type' => 'text',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+}
--- a/tests/Api/Entity/CustomFieldValueTest.php
+++ b/tests/Api/Entity/CustomFieldValueTest.php
@@ -0,0 +1,112 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class CustomFieldValueTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('Tension', 'number', $machine);
+        $this->createCustomFieldValue($cf, '220', $machine);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/custom_field_values');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testGetItem(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('Tension', 'number', $machine);
+        $cfv     = $this->createCustomFieldValue($cf, '220', $machine);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('custom_field_values', $cfv->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['value' => '220']);
+    }
+
+    public function testPost(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('Tension', 'number', $machine);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/custom_field_values', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'value'       => '380',
+                'customField' => self::iri('custom_fields', $cf->getId()),
+                'machine'     => self::iri('machines', $machine->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['value' => '380']);
+    }
+
+    public function testPatch(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('Tension', 'number', $machine);
+        $cfv     = $this->createCustomFieldValue($cf, '220', $machine);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('custom_field_values', $cfv->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['value' => '400'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['value' => '400']);
+    }
+
+    public function testDelete(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('ToDelete', 'text', $machine);
+        $cfv     = $this->createCustomFieldValue($cf, 'val', $machine);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('custom_field_values', $cfv->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/custom_field_values');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $cf      = $this->createCustomField('Blocked', 'text', $machine);
+
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/custom_field_values', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'value'       => 'nope',
+                'customField' => self::iri('custom_fields', $cf->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+}
--- a/tests/Api/Entity/DocumentTest.php
+++ b/tests/Api/Entity/DocumentTest.php
@@ -0,0 +1,146 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Entity\Document;
+use App\Entity\Machine;
+use App\Entity\Site;
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class DocumentTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $this->createDocumentInDb();
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/documents');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testGetItem(): void
+    {
+        $doc = $this->createDocumentInDb();
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('documents', $doc->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name'     => 'test-doc',
+            'filename' => 'test.pdf',
+            'mimeType' => 'application/pdf',
+            'size'     => 1024,
+        ]);
+    }
+
+    public function testPut(): void
+    {
+        $doc = $this->createDocumentInDb();
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('documents', $doc->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'     => 'renamed-doc',
+                'filename' => 'test.pdf',
+                'path'     => '/uploads/test.pdf',
+                'mimeType' => 'application/pdf',
+                'size'     => 1024,
+            ],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'renamed-doc']);
+    }
+
+    public function testDelete(): void
+    {
+        $doc = $this->createDocumentInDb();
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('documents', $doc->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/documents');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotDelete(): void
+    {
+        $doc = $this->createDocumentInDb();
+
+        $client = $this->createViewerClient();
+        $client->request('DELETE', self::iri('documents', $doc->getId()));
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testDocumentLinkedToMachine(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $doc     = $this->createDocumentInDb($machine->getId());
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/documents?machine[exists]=true');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testDocumentLinkedToSite(): void
+    {
+        $site = $this->createSite('Site A');
+        $doc  = $this->createDocumentInDb(siteId: $site->getId());
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/documents?site[exists]=true');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    private function createDocumentInDb(?string $machineId = null, ?string $siteId = null): Document
+    {
+        $doc = new Document();
+        $doc->setName('test-doc');
+        $doc->setFilename('test.pdf');
+        $doc->setPath('/uploads/test.pdf');
+        $doc->setMimeType('application/pdf');
+        $doc->setSize(1024);
+
+        if ($machineId) {
+            $machine = $this->getEntityManager()->getRepository(Machine::class)->find($machineId);
+            if ($machine) {
+                $doc->setMachine($machine);
+            }
+        }
+
+        if ($siteId) {
+            $site = $this->getEntityManager()->getRepository(Site::class)->find($siteId);
+            if ($site) {
+                $doc->setSite($site);
+            }
+        }
+
+        $em = $this->getEntityManager();
+        $em->persist($doc);
+        $em->flush();
+
+        return $doc;
+    }
+}
--- a/tests/Api/Entity/MachineComponentLinkTest.php
+++ b/tests/Api/Entity/MachineComponentLinkTest.php
@@ -0,0 +1,134 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class MachineComponentLinkTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+        $this->createMachineComponentLink($machine, $composant);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/machine_component_links');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testGetItem(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+        $link      = $this->createMachineComponentLink($machine, $composant);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('machine_component_links', $link->getId()));
+
+        $this->assertResponseIsSuccessful();
+    }
+
+    public function testPost(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_component_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine'   => self::iri('machines', $machine->getId()),
+                'composant' => self::iri('composants', $composant->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPostWithOverrides(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_component_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine'           => self::iri('machines', $machine->getId()),
+                'composant'         => self::iri('composants', $composant->getId()),
+                'nameOverride'      => 'Pompe spéciale',
+                'referenceOverride' => 'REF-OVERRIDE',
+                'prixOverride'      => '500.00',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains([
+            'nameOverride'      => 'Pompe spéciale',
+            'referenceOverride' => 'REF-OVERRIDE',
+            'prixOverride'      => '500.00',
+        ]);
+    }
+
+    public function testPatch(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+        $link      = $this->createMachineComponentLink($machine, $composant);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('machine_component_links', $link->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['nameOverride' => 'Overridden'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['nameOverride' => 'Overridden']);
+    }
+
+    public function testDelete(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+        $link      = $this->createMachineComponentLink($machine, $composant);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('machine_component_links', $link->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/machine_component_links');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/machine_component_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine'   => self::iri('machines', $machine->getId()),
+                'composant' => self::iri('composants', $composant->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+}
--- a/tests/Api/Entity/MachinePieceLinkTest.php
+++ b/tests/Api/Entity/MachinePieceLinkTest.php
@@ -0,0 +1,124 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class MachinePieceLinkTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $piece   = $this->createPiece('Joint A');
+        $this->createMachinePieceLink($machine, $piece);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/machine_piece_links');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testPost(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $piece   = $this->createPiece('Joint A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_piece_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine' => self::iri('machines', $machine->getId()),
+                'piece'   => self::iri('pieces', $piece->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPostWithParentComponentLink(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe A');
+        $piece     = $this->createPiece('Joint A');
+        $compLink  = $this->createMachineComponentLink($machine, $composant);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_piece_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine'    => self::iri('machines', $machine->getId()),
+                'piece'      => self::iri('pieces', $piece->getId()),
+                'parentLink' => self::iri('machine_component_links', $compLink->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPostWithOverrides(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $piece   = $this->createPiece('Joint A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_piece_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine'      => self::iri('machines', $machine->getId()),
+                'piece'        => self::iri('pieces', $piece->getId()),
+                'nameOverride' => 'Joint spécial',
+                'prixOverride' => '25.00',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains([
+            'nameOverride' => 'Joint spécial',
+            'prixOverride' => '25.00',
+        ]);
+    }
+
+    public function testDelete(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $piece   = $this->createPiece('Joint A');
+        $link    = $this->createMachinePieceLink($machine, $piece);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('machine_piece_links', $link->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/machine_piece_links');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $piece   = $this->createPiece('Joint A');
+
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/machine_piece_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine' => self::iri('machines', $machine->getId()),
+                'piece'   => self::iri('pieces', $piece->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+}
--- a/tests/Api/Entity/MachineProductLinkTest.php
+++ b/tests/Api/Entity/MachineProductLinkTest.php
@@ -0,0 +1,121 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class MachineProductLinkTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $product = $this->createProduct('Produit A');
+        $this->createMachineProductLink($machine, $product);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/machine_product_links');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testPost(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $product = $this->createProduct('Produit A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_product_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine' => self::iri('machines', $machine->getId()),
+                'product' => self::iri('products', $product->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPostWithParentComponentLink(): void
+    {
+        $machine   = $this->createMachine('Machine A');
+        $composant = $this->createComposant('Pompe');
+        $product   = $this->createProduct('Produit A');
+        $compLink  = $this->createMachineComponentLink($machine, $composant);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_product_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine'             => self::iri('machines', $machine->getId()),
+                'product'             => self::iri('products', $product->getId()),
+                'parentComponentLink' => self::iri('machine_component_links', $compLink->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPostWithParentPieceLink(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $piece   = $this->createPiece('Joint');
+        $product = $this->createProduct('Produit A');
+        $plLink  = $this->createMachinePieceLink($machine, $piece);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machine_product_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine'         => self::iri('machines', $machine->getId()),
+                'product'         => self::iri('products', $product->getId()),
+                'parentPieceLink' => self::iri('machine_piece_links', $plLink->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testDelete(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $product = $this->createProduct('Produit A');
+        $link    = $this->createMachineProductLink($machine, $product);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('machine_product_links', $link->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/machine_product_links');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $product = $this->createProduct('Produit A');
+
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/machine_product_links', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'machine' => self::iri('machines', $machine->getId()),
+                'product' => self::iri('products', $product->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+}
--- a/tests/Api/Entity/MachineTest.php
+++ b/tests/Api/Entity/MachineTest.php
@@ -0,0 +1,135 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class MachineTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $site = $this->createSite();
+        $this->createMachine('Machine A', $site);
+        $this->createMachine('Machine B', $site);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/machines');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $m = $this->createMachine('Machine A', reference: 'REF-001');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('machines', $m->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name'      => 'Machine A',
+            'reference' => 'REF-001',
+        ]);
+    }
+
+    public function testPost(): void
+    {
+        $site = $this->createSite('Usine');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machines', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'      => 'Nouvelle Machine',
+                'reference' => 'REF-NEW',
+                'site'      => self::iri('sites', $site->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Nouvelle Machine']);
+    }
+
+    public function testPut(): void
+    {
+        $m = $this->createMachine('Machine A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('machines', $m->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name' => 'Machine A Renommée',
+                'site' => self::iri('sites', $m->getSite()->getId()),
+            ],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Machine A Renommée']);
+    }
+
+    public function testPatch(): void
+    {
+        $m = $this->createMachine('Machine A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('machines', $m->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['prix' => '1500.00'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['prix' => '1500.00']);
+    }
+
+    public function testDelete(): void
+    {
+        $m = $this->createMachine('ToDelete');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('machines', $m->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/machines');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $site = $this->createSite();
+
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/machines', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name' => 'Blocked',
+                'site' => self::iri('sites', $site->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testPostWithoutSiteFails(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machines', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'No site'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+}
--- a/tests/Api/Entity/ModelTypeTest.php
+++ b/tests/Api/Entity/ModelTypeTest.php
@@ -0,0 +1,155 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Enum\ModelCategory;
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class ModelTypeTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+        $this->createModelType('Joint', 'JOINT-001', ModelCategory::PIECE);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/model_types');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $mt = $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('model_types', $mt->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name'     => 'Pompe',
+            'code'     => 'POMPE-001',
+            'category' => 'COMPONENT',
+        ]);
+    }
+
+    public function testPost(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/model_types', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'     => 'Roulement',
+                'code'     => 'ROUL-001',
+                'category' => 'PIECE',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains([
+            'name'     => 'Roulement',
+            'category' => 'PIECE',
+        ]);
+    }
+
+    public function testPut(): void
+    {
+        $mt = $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('model_types', $mt->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'     => 'Pompe hydraulique',
+                'code'     => 'POMPE-001',
+                'category' => 'COMPONENT',
+            ],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Pompe hydraulique']);
+    }
+
+    public function testPatch(): void
+    {
+        $mt = $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('model_types', $mt->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['notes' => 'Updated notes'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['notes' => 'Updated notes']);
+    }
+
+    public function testDelete(): void
+    {
+        $mt = $this->createModelType('ToDelete', 'DEL-001', ModelCategory::PRODUCT);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('model_types', $mt->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/model_types');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/model_types', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'     => 'Blocked',
+                'code'     => 'BLK-001',
+                'category' => 'COMPONENT',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testFilterByCategory(): void
+    {
+        $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+        $this->createModelType('Joint', 'JOINT-001', ModelCategory::PIECE);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/model_types?category=COMPONENT');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testUniqueCodeConstraint(): void
+    {
+        $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/model_types', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'     => 'Autre',
+                'code'     => 'POMPE-001',
+                'category' => 'PIECE',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(409);
+    }
+}
--- a/tests/Api/Entity/PieceTest.php
+++ b/tests/Api/Entity/PieceTest.php
@@ -0,0 +1,145 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Enum\ModelCategory;
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class PieceTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $this->createPiece('Joint A');
+        $this->createPiece('Joint B');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/pieces');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $p = $this->createPiece('Joint A', 'REF-J001');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('pieces', $p->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name'      => 'Joint A',
+            'reference' => 'REF-J001',
+        ]);
+    }
+
+    public function testPost(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/pieces', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'      => 'Nouvelle pièce',
+                'reference' => 'REF-NEW',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Nouvelle pièce']);
+    }
+
+    public function testPostWithType(): void
+    {
+        $mt = $this->createModelType('Joint', 'JOINT-001', ModelCategory::PIECE);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/pieces', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'      => 'Pièce typée',
+                'typePiece' => self::iri('model_types', $mt->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPut(): void
+    {
+        $p = $this->createPiece('Joint A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('pieces', $p->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Joint A Renommé'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Joint A Renommé']);
+    }
+
+    public function testPatch(): void
+    {
+        $p = $this->createPiece('Joint A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('pieces', $p->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['prix' => '15.50'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['prix' => '15.50']);
+    }
+
+    public function testDelete(): void
+    {
+        $p = $this->createPiece('ToDelete');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('pieces', $p->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/pieces');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/pieces', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Blocked'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testUniqueReferenceConstraint(): void
+    {
+        $this->createPiece('Joint A', 'REF-UNIQUE');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/pieces', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'      => 'Joint B',
+                'reference' => 'REF-UNIQUE',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+}
--- a/tests/Api/Entity/ProductTest.php
+++ b/tests/Api/Entity/ProductTest.php
@@ -0,0 +1,142 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Enum\ModelCategory;
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class ProductTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $this->createProduct('Produit A');
+        $this->createProduct('Produit B');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/products');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $p = $this->createProduct('Produit A', 'REF-P001');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('products', $p->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name'      => 'Produit A',
+            'reference' => 'REF-P001',
+        ]);
+    }
+
+    public function testPost(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/products', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'          => 'Nouveau produit',
+                'reference'     => 'REF-NEW',
+                'supplierPrice' => '99.99',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Nouveau produit']);
+    }
+
+    public function testPostWithType(): void
+    {
+        $mt = $this->createModelType('Huile', 'HUILE-001', ModelCategory::PRODUCT);
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/products', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'        => 'Produit typé',
+                'typeProduct' => self::iri('model_types', $mt->getId()),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+    }
+
+    public function testPut(): void
+    {
+        $p = $this->createProduct('Produit A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('products', $p->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Produit A Renommé'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Produit A Renommé']);
+    }
+
+    public function testPatch(): void
+    {
+        $p = $this->createProduct('Produit A');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('products', $p->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['supplierPrice' => '150.00'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['supplierPrice' => '150.00']);
+    }
+
+    public function testDelete(): void
+    {
+        $p = $this->createProduct('ToDelete');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('products', $p->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/products');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/products', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Blocked'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testSearchFilter(): void
+    {
+        $this->createProduct('Huile moteur');
+        $this->createProduct('Filtre à air');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/products?name=huile');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+}
--- a/tests/Api/Entity/ProfileTest.php
+++ b/tests/Api/Entity/ProfileTest.php
@@ -0,0 +1,125 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class ProfileTest extends AbstractApiTestCase
+{
+    public function testGetCollectionAsAdmin(): void
+    {
+        $this->createProfile(firstName: 'Alice', lastName: 'Dupont');
+
+        $client = $this->createAdminClient();
+        $client->request('GET', '/api/profiles');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+    }
+
+    public function testGetCollectionForbiddenForViewer(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/profiles');
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testGetItemForbiddenForViewer(): void
+    {
+        $profile = $this->createProfile(firstName: 'Alice', lastName: 'Dupont');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('profiles', $profile->getId()));
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testGetItemAsAdmin(): void
+    {
+        $profile = $this->createProfile(firstName: 'Alice', lastName: 'Dupont');
+
+        $client = $this->createAdminClient();
+        $client->request('GET', self::iri('profiles', $profile->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'firstName' => 'Alice',
+            'lastName'  => 'Dupont',
+        ]);
+    }
+
+    public function testPostAsAdmin(): void
+    {
+        $client = $this->createAdminClient();
+        $client->request('POST', '/api/profiles', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'firstName'     => 'Nouveau',
+                'lastName'      => 'Profil',
+                'email'         => 'new@test.local',
+                'plainPassword' => 'secret123',
+                'roles'         => ['ROLE_VIEWER'],
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains([
+            'firstName' => 'Nouveau',
+            'lastName'  => 'Profil',
+        ]);
+    }
+
+    public function testPostForbiddenForGestionnaire(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/profiles', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'firstName' => 'Blocked',
+                'lastName'  => 'User',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testPatchAsAdmin(): void
+    {
+        $profile = $this->createProfile(firstName: 'Alice', lastName: 'Dupont');
+
+        $client = $this->createAdminClient();
+        $client->request('PATCH', self::iri('profiles', $profile->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['firstName' => 'Alice modifiée'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['firstName' => 'Alice modifiée']);
+    }
+
+    public function testDeleteAsAdmin(): void
+    {
+        $profile = $this->createProfile(firstName: 'ToDelete', lastName: 'User');
+
+        $client = $this->createAdminClient();
+        $client->request('DELETE', self::iri('profiles', $profile->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $profile = $this->createProfile();
+
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', self::iri('profiles', $profile->getId()));
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+}
--- a/tests/Api/Entity/SiteTest.php
+++ b/tests/Api/Entity/SiteTest.php
@@ -0,0 +1,124 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Entity;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class SiteTest extends AbstractApiTestCase
+{
+    public function testGetCollection(): void
+    {
+        $this->createSite('Usine Nord');
+        $this->createSite('Usine Sud');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/sites');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContainsHydraCollection();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testGetItem(): void
+    {
+        $site = $this->createSite('Usine Nord', ['contactCity' => 'Lyon']);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', self::iri('sites', $site->getId()));
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'name'        => 'Usine Nord',
+            'contactCity' => 'Lyon',
+        ]);
+    }
+
+    public function testPost(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/sites', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => [
+                'name'        => 'Usine Est',
+                'contactName' => 'Jean Dupont',
+                'contactCity' => 'Strasbourg',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains(['name' => 'Usine Est']);
+    }
+
+    public function testPut(): void
+    {
+        $site = $this->createSite('Usine Nord');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PUT', self::iri('sites', $site->getId()), [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Usine Nord Renommée'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['name' => 'Usine Nord Renommée']);
+    }
+
+    public function testPatch(): void
+    {
+        $site = $this->createSite('Usine Nord');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('PATCH', self::iri('sites', $site->getId()), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['contactPhone' => '0612345678'],
+        ]);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['contactPhone' => '0612345678']);
+    }
+
+    public function testDelete(): void
+    {
+        $site = $this->createSite('ToDelete');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('DELETE', self::iri('sites', $site->getId()));
+
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testUnauthenticatedAccess(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/sites');
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testViewerCannotWrite(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('POST', '/api/sites', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Blocked'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testValidationNameRequired(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/sites', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['contactCity' => 'Paris'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+}
--- a/tests/Api/FilterTest.php
+++ b/tests/Api/FilterTest.php
@@ -0,0 +1,112 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api;
+
+use App\Entity\Document;
+use App\Enum\ModelCategory;
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class FilterTest extends AbstractApiTestCase
+{
+    public function testSearchFilterOnName(): void
+    {
+        $this->createComposant('Pompe hydraulique');
+        $this->createComposant('Vanne de contrôle');
+        $this->createComposant('Pompe centrifuge');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/composants?name=pompe');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 2]);
+    }
+
+    public function testSearchFilterOnReference(): void
+    {
+        $this->createPiece('Joint A', 'REF-ALPHA');
+        $this->createPiece('Joint B', 'REF-BETA');
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/pieces?reference=alpha');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testOrderFilterAscending(): void
+    {
+        $this->createProduct('Zebra');
+        $this->createProduct('Alpha');
+
+        $client   = $this->createViewerClient();
+        $response = $client->request('GET', '/api/products?order[name]=asc');
+
+        $this->assertResponseIsSuccessful();
+        $data = $response->toArray();
+        $this->assertSame('Alpha', $data['member'][0]['name']);
+    }
+
+    public function testOrderFilterDescending(): void
+    {
+        $this->createProduct('Alpha');
+        $this->createProduct('Zebra');
+
+        $client   = $this->createViewerClient();
+        $response = $client->request('GET', '/api/products?order[name]=desc');
+
+        $this->assertResponseIsSuccessful();
+        $data = $response->toArray();
+        $this->assertSame('Zebra', $data['member'][0]['name']);
+    }
+
+    public function testExactFilterOnCategory(): void
+    {
+        $this->createModelType('Pompe', 'POMPE-001', ModelCategory::COMPONENT);
+        $this->createModelType('Joint', 'JOINT-001', ModelCategory::PIECE);
+        $this->createModelType('Huile', 'HUILE-001', ModelCategory::PRODUCT);
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/model_types?category=PIECE');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+
+    public function testExistsFilterOnDocuments(): void
+    {
+        $machine = $this->createMachine('Machine A');
+        $site    = $this->createSite('Site B');
+
+        $doc1 = new Document();
+        $doc1->setName('doc1');
+        $doc1->setFilename('f1.pdf');
+        $doc1->setPath('/uploads/f1.pdf');
+        $doc1->setMimeType('application/pdf');
+        $doc1->setSize(100);
+        $doc1->setMachine($machine);
+
+        $doc2 = new Document();
+        $doc2->setName('doc2');
+        $doc2->setFilename('f2.pdf');
+        $doc2->setPath('/uploads/f2.pdf');
+        $doc2->setMimeType('application/pdf');
+        $doc2->setSize(200);
+        $doc2->setSite($site);
+
+        $em = $this->getEntityManager();
+        $em->persist($doc1);
+        $em->persist($doc2);
+        $em->flush();
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/documents?exists[machine]=true');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['totalItems' => 1]);
+    }
+}
--- a/tests/Api/HealthCheckTest.php
+++ b/tests/Api/HealthCheckTest.php
@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class HealthCheckTest extends AbstractApiTestCase
+{
+    public function testHealthEndpointPublicReturnsMinimalInfo(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/health');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['status' => 'ok']);
+
+        $data = $client->getResponse()->toArray();
+        $this->assertArrayNotHasKey('php', $data);
+        $this->assertArrayNotHasKey('checks', $data);
+        $this->assertArrayNotHasKey('memory_mb', $data);
+    }
+
+    public function testHealthEndpointAdminReturnsFullInfo(): void
+    {
+        $client = $this->createAdminClient();
+        $client->request('GET', '/api/health');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains([
+            'status' => 'ok',
+            'checks' => [
+                'database' => [
+                    'status' => 'ok',
+                ],
+            ],
+        ]);
+    }
+}
--- a/tests/Api/PaginationTest.php
+++ b/tests/Api/PaginationTest.php
@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class PaginationTest extends AbstractApiTestCase
+{
+    public function testDefaultPagination(): void
+    {
+        for ($i = 1; $i <= 35; ++$i) {
+            $this->createConstructeur("Constructeur {$i}");
+        }
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/constructeurs');
+
+        $this->assertResponseIsSuccessful();
+        $data = $client->getResponse()->toArray();
+        $this->assertSame(35, $data['totalItems']);
+        $this->assertCount(30, $data['member']);
+    }
+
+    public function testCustomItemsPerPage(): void
+    {
+        for ($i = 1; $i <= 15; ++$i) {
+            $this->createConstructeur("Constructeur {$i}");
+        }
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/constructeurs?itemsPerPage=5');
+
+        $this->assertResponseIsSuccessful();
+        $data = $client->getResponse()->toArray();
+        $this->assertCount(5, $data['member']);
+        $this->assertSame(15, $data['totalItems']);
+    }
+
+    public function testPageNavigation(): void
+    {
+        for ($i = 1; $i <= 15; ++$i) {
+            $this->createConstructeur("Constructeur {$i}");
+        }
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/constructeurs?itemsPerPage=5&page=2');
+
+        $this->assertResponseIsSuccessful();
+        $data = $client->getResponse()->toArray();
+        $this->assertCount(5, $data['member']);
+    }
+
+    public function testMaxItemsPerPageIsCapped(): void
+    {
+        for ($i = 1; $i <= 5; ++$i) {
+            $this->createConstructeur("Constructeur {$i}");
+        }
+
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/constructeurs?itemsPerPage=999');
+
+        $this->assertResponseIsSuccessful();
+        $data = $client->getResponse()->toArray();
+        $this->assertCount(5, $data['member']);
+    }
+}
--- a/tests/Api/Session/SessionProfileTest.php
+++ b/tests/Api/Session/SessionProfileTest.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api\Session;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class SessionProfileTest extends AbstractApiTestCase
+{
+    private const PASSWORD = 'secret123';
+
+    public function testLoginSuccess(): void
+    {
+        $profile = $this->createProfile(password: self::PASSWORD);
+        $client  = static::createClient();
+
+        $client->request('POST', '/api/session/profile', [
+            'json' => [
+                'profileId' => $profile->getId(),
+                'password'  => self::PASSWORD,
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(200);
+        $this->assertJsonContains([
+            'id'        => $profile->getId(),
+            'firstName' => 'Test',
+            'lastName'  => 'User',
+            'isActive'  => true,
+        ]);
+    }
+
+    public function testLoginWrongPassword(): void
+    {
+        $profile = $this->createProfile(password: self::PASSWORD);
+        $client  = static::createClient();
+
+        $client->request('POST', '/api/session/profile', [
+            'json' => [
+                'profileId' => $profile->getId(),
+                'password'  => 'wrong',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(401);
+        $this->assertJsonContains(['message' => 'Mot de passe incorrect.']);
+    }
+
+    public function testLoginMissingPassword(): void
+    {
+        $profile = $this->createProfile(password: self::PASSWORD);
+        $client  = static::createClient();
+
+        $client->request('POST', '/api/session/profile', [
+            'json' => [
+                'profileId' => $profile->getId(),
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(400);
+        $this->assertJsonContains(['message' => 'Mot de passe requis.']);
+    }
+
+    public function testLoginMissingProfileId(): void
+    {
+        $client = static::createClient();
+        $client->request('POST', '/api/session/profile', [
+            'json' => [],
+        ]);
+
+        $this->assertResponseStatusCodeSame(400);
+        $this->assertJsonContains(['message' => 'profileId est requis.']);
+    }
+
+    public function testLoginInactiveProfile(): void
+    {
+        $profile = $this->createProfile(password: self::PASSWORD, isActive: false);
+        $client  = static::createClient();
+
+        $client->request('POST', '/api/session/profile', [
+            'json' => [
+                'profileId' => $profile->getId(),
+                'password'  => self::PASSWORD,
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testLoginNoPasswordSet(): void
+    {
+        $profile = $this->createProfile();
+        $client  = static::createClient();
+
+        $client->request('POST', '/api/session/profile', [
+            'json' => [
+                'profileId' => $profile->getId(),
+                'password'  => 'anything',
+            ],
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testGetActiveProfileAuthenticated(): void
+    {
+        $client = $this->createViewerClient();
+        $client->request('GET', '/api/session/profile');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['isActive' => true]);
+    }
+
+    public function testGetActiveProfileUnauthenticated(): void
+    {
+        $client = $this->createUnauthenticatedClient();
+        $client->request('GET', '/api/session/profile');
+
+        $this->assertResponseStatusCodeSame(401);
+        $this->assertJsonContains(['message' => 'Aucun profil actif.']);
+    }
+
+    public function testLogout(): void
+    {
+        $client = $this->createViewerClient();
+
+        $client->request('DELETE', '/api/session/profile');
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['success' => true]);
+
+        $client->request('GET', '/api/session/profile');
+        $this->assertResponseStatusCodeSame(401);
+    }
+}
--- a/tests/Api/ValidationTest.php
+++ b/tests/Api/ValidationTest.php
@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Api;
+
+use App\Tests\AbstractApiTestCase;
+
+/**
+ * @internal
+ */
+class ValidationTest extends AbstractApiTestCase
+{
+    public function testConstructeurRequiresName(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/constructeurs', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['email' => 'no-name@test.com'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+
+    public function testSiteRequiresName(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/sites', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['contactCity' => 'Paris'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+
+    public function testMachineRequiresSite(): void
+    {
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/machines', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Machine sans site'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+
+    public function testProfileRequiresFirstAndLastName(): void
+    {
+        $client = $this->createAdminClient();
+        $client->request('POST', '/api/profiles', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['email' => 'missing@names.com'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+
+    public function testDuplicateConstructeurName(): void
+    {
+        $this->createConstructeur('Siemens');
+
+        $client = $this->createGestionnaireClient();
+        $client->request('POST', '/api/constructeurs', [
+            'headers' => ['Content-Type' => 'application/ld+json'],
+            'json'    => ['name' => 'Siemens'],
+        ]);
+
+        $this->assertResponseStatusCodeSame(422);
+    }
+}
Author	SHA1	Message	Date
THOLOT DECHENE Matthieu	b5d5ce0d8e	Actualiser README.md	2026-03-15 07:15:49 +00:00
Matthieu	03e6c2432b	fix(machine) : add addConstructeur/removeConstructeur methods + fix fournisseur display API Platform silently ignored the constructeurs field on PATCH because Machine was missing the add/remove methods (unlike Composant, Piece, Product). Also fixes the read-only fournisseur display overflow in MachineInfoCard. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-10 18:00:09 +01:00
Matthieu	31408ded7f	chore : bump version to 1.9.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 15:52:21 +01:00
Matthieu	4054fb24e6	feat(site) : add color field to sites + frontend submodule update - Add color VARCHAR(7) column to sites entity - Migration with IF NOT EXISTS for idempotence - Update reference config - Frontend: site color picker, dark mode, card styling improvements Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 15:51:55 +01:00
Matthieu	32ba4928df	chore(frontend) : update submodule — site edit + card buttons alignment Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 15:11:55 +01:00
r-dev	edf7d0fa9e	chore(frontend) : update submodule — changelog v1.9.0	2026-03-09 13:04:54 +01:00
r-dev	233927df19	chore : sync frontend submodule and update reference config Update frontend submodule pointer to latest UI refactor. Update config/reference.php with Symfony auto-generated changes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 00:14:49 +01:00
r-dev	dcb5f15769	docs : update CLAUDE.md with custom controllers, fields architecture and factories Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 18:43:19 +01:00
r-dev	d3cd3fc3ce	feat(machine) : add custom field management on machine detail page - Fix: return customFieldValues in structure endpoint (was hardcoded null) - Frontend: add editor to create/edit/delete custom field definitions - Tests: add integration tests for structure values + definition CRUD Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 18:36:14 +01:00
r-dev	33fc80cbc2	fix(security) : disable session migration on API firewall Symfony's default session_fixation_strategy (migrate) regenerated the session ID on every authenticated request, breaking concurrent API calls from the SPA — only the first request succeeded, all others got 401. The login controller already calls $session->migrate(true) explicitly, so disabling automatic migration is safe. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 14:30:38 +01:00
r-dev	33e3f25850	docs : update project documentation and frontend submodule pointer Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 13:47:46 +01:00
r-dev	efc6ec5691	test(api) : add comprehensive API test suite (161 tests) - Add AbstractApiTestCase with auth helpers and entity factories - Add tests for all entities: Machine, Piece, Composant, Product, Site, ModelType, Constructeur, CustomField, CustomFieldValue, Document, MachineComponentLink, MachinePieceLink, MachineProductLink, Profile - Add controller tests: CommentController, EntityHistory - Add HealthCheck, Filter, Pagination, Validation, Session tests - Test auth (401), authorization (403), CRUD, and edge cases Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 13:42:56 +01:00
r-dev	b342d0e50a	fix(security) : harden auth, session, document access and health endpoint - Remove orphaned PUBLIC_ACCESS rule for deleted /api/test route - Remove JWT login firewall (app is session-based only) - Set APP_SECRET placeholder (real value must be in .env.local) - Remove JWT env vars from .env - Add session regeneration on login (prevent session fixation) - Remove Document.path from API serialization groups (prevent path leak) - Restrict health check details to ROLE_ADMIN (anonymes get status only) - Add path traversal guard in DocumentStorageService - Convert CreateProfileCommand password to interactive hidden prompt - Restrict Profile Get endpoint to ROLE_ADMIN - Change api firewall to stateless: false (matches session-based auth) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 13:42:09 +01:00
r-dev	0709d01240	chore(config) : add DAMA test bundle, update API Platform config, improve makefile - Register DAMADoctrineTestBundle for test env (transaction rollback) - Update API Platform title/description, add pagination defaults - Configure services for new controllers and commands - Update makefile targets Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 13:39:44 +01:00
r-dev	74f77a3ba8	refactor(backend) : extract CuidEntityTrait, abstract audit subscriber, merge history controllers - Extract shared ID generation + timestamps into CuidEntityTrait used by all entities - Create AbstractAuditSubscriber to deduplicate audit logic across 7 subscribers - Merge per-entity history controllers into single EntityHistoryController - Delete redundant ComposantHistory/MachineHistory/PieceHistory/ProductHistoryController - Add OpenApiDecorator for API documentation customization - Disable failOnDeprecation in PHPUnit (vendor API Platform deprecation) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 13:39:03 +01:00
r-dev	bab13e5c57	chore : clean project config — untrack .idea/, gitignore Zone.Identifier and frontend/, blank JWT secret Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 02:01:54 +01:00
Matthieu	378026ebce	chore(frontend) : update submodule — add buttons repositioned Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-06 11:32:56 +01:00
@@ -1 +1 @@
 .8.1
 .9.0