Migration modular monolith DDD (0.1 → 3.3) (#17)

## Migration modular monolith DDD — Lesstime (0.1 → 3.3)

Cette MR regroupe l'intégralité de la refonte en monolithe modulaire (strangler progressif, additif). Elle remplace les MR stackées de Phase 1 (#12–#16), désormais incluses ici.

**Ne pas merger avant validation fonctionnelle** : branche destinée à être testée telle quelle.

### Périmètre — 9 modules sous `src/Module/`
| Phase | Module | Contenu |
|------|--------|---------|
| 0.1 | (socle) | infrastructure modulaire, `ModuleInterface`, mapping Doctrine par module |
| 0.2 | (socle front) | auto-détection des layers Nuxt sous `frontend/modules/*` |
| 1.1 | **Core** | Identité (User/Auth), Notifications, Notifier |
| 1.2 | Core | RBAC fin (permissions `module.resource.action`, sidebar gated) |
| 1.3 | Core | Audit log (`#[Auditable]`, listener, provider DBAL) |
| 2.1 | **TimeTracking** | TimeEntry + MCP + export |
| 2.2 | **ProjectManagement** | cœur métier Projets/Tâches + 38 MCP tools |
| 2.3 | **Absence** | demandes, soldes, policies, justificatifs |
| 2.4 | **Directory** | Clients (migrés) + **Prospects** (nouveau, conversion → Client) |
| 2.5 | **Mail** | intégration IMAP OVH + liens tâches |
| 2.6 | **Integration** | Gitea / BookStack / Zimbra / Share |
| 3.1 | **Reporting** | rapports transverses (DBAL read-only, 0 import inter-module) |
| 3.2 | **ClientPortal** | portail client (ROLE_CLIENT cloisonné, tickets, notifications) |
| 3.3 | (finition) | nettoyage legacy — `src/Entity` vide, app 100% modulaire |

### Architecture
- Découplage inter-modules par **contrats** (`UserInterface`, `ProjectInterface`, `TaskInterface`, `TaskTagInterface`, `ClientInterface`, `ClientTicketInterface`, `LeaveProfileInterface`) + `resolve_target_entities` 100% modulaire (aucune cible legacy).
- Repositories : interface `Domain/Repository` + implémentation `Infrastructure/Doctrine`, bindées.
- Reporting en DBAL read-only pur (aucun import d'entité d'un autre module).
- Chaque migration de module : déplacement à comportement préservé (API publique et noms d'outils MCP inchangés), migrations **additives** uniquement (zéro destructif).

### Sécurité
- ROLE_CLIENT cloisonné : un utilisateur client n'accède qu'à `/portal` et à ses propres tickets (filtrés par `allowedProjects`), interdit sur toute l'API interne.
- Correctif : interdiction pour un client de créer un lien vers le partage SMB (upload uniquement).

### QA non-régression (branche reconstruite from scratch)
- Migrations from scratch + fixtures : OK.
- Compilation dev + prod : OK.
- **180 tests PHPUnit verts**, php-cs-fixer clean, ~96 routes, **66 outils MCP** tous sous `App\Module\*`.
- Smoke test runtime multi-rôles (admin / ROLE_USER / ROLE_CLIENT) : 44 vérifications HTTP, **0 écart**, cloisonnement client étanche.
- Build Nuxt OK, 9 layers, 0 import legacy résiduel.

### Points à arbitrer (hors périmètre de cette migration)
- Durcissement MCP/IDOR pré-existant (`userId` explicite sans scoping sur certains tools TimeTracking/Absence/TaskDocument) — ticket dédié recommandé.
- Validation fonctionnelle de **Prospect** et **ClientPortal** (conçus depuis les specs disque).
- **Harmonisation visuelle Malio finale** (3.3) — finition esthétique inter-modules laissée au PO.

---

## ⚠️ Déploiement / migration des données — à ne pas oublier

### 1. Resynchroniser les séquences PostgreSQL après tout import/restore de dump
Si la prod (ou tout environnement) est **montée depuis un dump** (`pg_restore` / `COPY`), les lignes sont chargées avec leurs `id` explicites **sans avancer les séquences** → au premier `INSERT` : `duplicate key value violates unique constraint "..._pkey"` (constaté en local sur `notification`, `task`, `time_entry`…).

À lancer **juste après chaque restore/import** :

```sql
DO $$
DECLARE r RECORD; maxid BIGINT; seq TEXT;
BEGIN
  FOR r IN SELECT table_name, column_name FROM information_schema.columns WHERE table_schema='public'
  LOOP
    seq := pg_get_serial_sequence(quote_ident(r.table_name), r.column_name);
    IF seq IS NOT NULL THEN
      EXECUTE format('SELECT COALESCE(MAX(%I),0) FROM %I', r.column_name, r.table_name) INTO maxid;
      PERFORM setval(seq, GREATEST(maxid,1), maxid > 0);
    END IF;
  END LOOP;
END $$;
```

> Ne concerne **pas** une prod qui tourne déjà (séquences avancées organiquement) — uniquement le cas restore/import. Idempotent, sans risque.

### 2. Fix dénormalisation des collections typées-contrat (code, inclus dans la branche)
Les relations **to-many** typées par une interface `Shared\Domain\Contract\*` (`TimeEntry::tags` → `TaskTagInterface`, `Task::collaborators` → `UserInterface`) étaient **indénormalisables par API Platform** (mono-valué OK via IRI, collection KO) → **tout POST/PATCH portant une telle collection renvoyait 400/500**. Corrigé par un dénormaliseur générique `ContractRelationDenormalizer` (réutilise `resolve_target_entities`, zéro couplage par-entité) + test fonctionnel de non-régression.

---------

Co-authored-by: Matthieu <contact@malio.fr>
Reviewed-on: #17

tests/Unit/Mail/ImapMailProviderTest.php

@@ -4,11 +4,11 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Mail;
 
-use App\Entity\MailConfiguration;
-use App\Mail\Exception\MailProviderException;
-use App\Mail\ImapMailProvider;
-use App\Repository\MailConfigurationRepository;
-use App\Service\TokenEncryptor;
+use App\Module\Mail\Domain\Entity\MailConfiguration;
+use App\Module\Mail\Domain\Exception\MailProviderException;
+use App\Module\Mail\Domain\Repository\MailConfigurationRepositoryInterface;
+use App\Module\Mail\Infrastructure\Imap\ImapMailProvider;
+use App\Shared\Infrastructure\Service\TokenEncryptor;
 use PHPUnit\Framework\TestCase;
 use Psr\Log\NullLogger;
 
@@ -22,7 +22,7 @@ class ImapMailProviderTest extends TestCase
         $config = new MailConfiguration();
         $config->setEnabled(false);
 
-        $repo = $this->createMock(MailConfigurationRepository::class);
+        $repo = $this->createMock(MailConfigurationRepositoryInterface::class);
         $repo->method('findSingleton')->willReturn($config);
 
         $provider = new ImapMailProvider($repo, $this->makeEncryptor(), new NullLogger());
@@ -33,7 +33,7 @@ class ImapMailProviderTest extends TestCase
 
     public function testThrowsWhenConfigMissing(): void
     {
-        $repo = $this->createMock(MailConfigurationRepository::class);
+        $repo = $this->createMock(MailConfigurationRepositoryInterface::class);
         $repo->method('findSingleton')->willReturn(null);
 
         $provider = new ImapMailProvider($repo, $this->makeEncryptor(), new NullLogger());

tests/Unit/Mail/MailSyncReportTest.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Mail;
 
-use App\Mail\Dto\MailSyncReport;
+use App\Module\Mail\Application\Dto\MailSyncReport;
 use DateTimeImmutable;
 use PHPUnit\Framework\TestCase;
 

tests/Unit/Mail/MimeHeaderDecoderTest.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Mail;
 
-use App\Mail\MimeHeaderDecoder;
+use App\Module\Mail\Infrastructure\Imap\MimeHeaderDecoder;
 use PHPUnit\Framework\TestCase;
 
 /**

tests/Unit/Mcp/CoercingSchemaGeneratorTest.php

@@ -5,8 +5,8 @@ declare(strict_types=1);
 namespace App\Tests\Unit\Mcp;
 
 use App\Mcp\Schema\CoercingSchemaGenerator;
-use App\Mcp\Tool\Task\CreateTaskTool;
-use App\Mcp\Tool\Task\ListTasksTool;
+use App\Module\ProjectManagement\Infrastructure\Mcp\Tool\Task\CreateTaskTool;
+use App\Module\ProjectManagement\Infrastructure\Mcp\Tool\Task\ListTasksTool;
 use PHPUnit\Framework\TestCase;
 use ReflectionMethod;
 

tests/Unit/Module/Core/CoreModuleTest.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Module\Core;
+
+use App\Module\Core\CoreModule;
+use App\Shared\Domain\Module\ModuleInterface;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+final class CoreModuleTest extends TestCase
+{
+    public function testItIsAModule(): void
+    {
+        self::assertInstanceOf(ModuleInterface::class, new CoreModule());
+    }
+
+    public function testIdentity(): void
+    {
+        self::assertSame('core', CoreModule::id());
+        self::assertTrue(CoreModule::isRequired());
+        self::assertNotSame('', CoreModule::label());
+    }
+
+    public function testPermissionsAreWellFormed(): void
+    {
+        foreach (CoreModule::permissions() as $permission) {
+            self::assertArrayHasKey('code', $permission);
+            self::assertArrayHasKey('label', $permission);
+        }
+    }
+
+    public function testPermissionsExposeAuditLogView(): void
+    {
+        $codes = array_column(CoreModule::permissions(), 'code');
+
+        self::assertCount(6, $codes);
+        self::assertContains('core.audit_log.view', $codes);
+    }
+}

tests/Unit/Module/Core/Domain/Entity/PermissionTest.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Module\Core\Domain\Entity;
+
+use App\Module\Core\Domain\Entity\Permission;
+use InvalidArgumentException;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+final class PermissionTest extends TestCase
+{
+    public function testValidConstruction(): void
+    {
+        $p = new Permission('core.users.view', 'Voir les utilisateurs', 'core');
+        self::assertSame('core.users.view', $p->getCode());
+        self::assertSame('Voir les utilisateurs', $p->getLabel());
+        self::assertSame('core', $p->getModule());
+        self::assertFalse($p->isOrphan());
+    }
+
+    public function testCodeMustContainADot(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        new Permission('coreusersview', 'x', 'core');
+    }
+
+    public function testCodeCannotBeEmpty(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        new Permission('', 'x', 'core');
+    }
+
+    public function testLabelCannotBeEmpty(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        new Permission('core.users.view', '', 'core');
+    }
+
+    public function testModuleCannotBeEmpty(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        new Permission('core.users.view', 'x', '');
+    }
+
+    public function testMarkOrphanAndRevive(): void
+    {
+        $p = new Permission('core.users.view', 'Voir', 'core');
+        $p->markOrphan();
+        self::assertTrue($p->isOrphan());
+        $p->revive('Voir maj', 'core');
+        self::assertFalse($p->isOrphan());
+        self::assertSame('Voir maj', $p->getLabel());
+    }
+}

tests/Unit/Module/Core/Domain/Entity/RoleTest.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Module\Core\Domain\Entity;
+
+use App\Module\Core\Domain\Entity\Permission;
+use App\Module\Core\Domain\Entity\Role;
+use App\Module\Core\Domain\Exception\SystemRoleDeletionException;
+use InvalidArgumentException;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+final class RoleTest extends TestCase
+{
+    public function testValidConstruction(): void
+    {
+        $r = new Role('bureau', 'Bureau');
+        self::assertSame('bureau', $r->getCode());
+        self::assertSame('Bureau', $r->getLabel());
+        self::assertFalse($r->isSystem());
+        self::assertCount(0, $r->getPermissions());
+    }
+
+    public function testCodeMustBeSnakeCase(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        new Role('Bureau Commercial', 'x');
+    }
+
+    public function testAddRemovePermission(): void
+    {
+        $r = new Role('bureau', 'Bureau');
+        $p = new Permission('core.users.view', 'Voir', 'core');
+        $r->addPermission($p);
+        self::assertCount(1, $r->getPermissions());
+        $r->addPermission($p); // idempotent
+        self::assertCount(1, $r->getPermissions());
+        $r->removePermission($p);
+        self::assertCount(0, $r->getPermissions());
+    }
+
+    public function testSystemRoleCannotBeDeleted(): void
+    {
+        $r = new Role('admin', 'Administrateur', null, true);
+        $this->expectException(SystemRoleDeletionException::class);
+        $r->ensureDeletable();
+    }
+
+    public function testNonSystemRoleIsDeletable(): void
+    {
+        $r = new Role('bureau', 'Bureau');
+        $r->ensureDeletable();
+        self::assertFalse($r->isSystem());
+    }
+}

tests/Unit/Module/Core/Infrastructure/Security/PermissionVoterTest.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Module\Core\Infrastructure\Security;
+
+use App\Module\Core\Domain\Entity\Permission;
+use App\Module\Core\Domain\Entity\Role;
+use App\Module\Core\Domain\Entity\User;
+use App\Module\Core\Infrastructure\Security\PermissionVoter;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * @internal
+ */
+final class PermissionVoterTest extends TestCase
+{
+    public function testAbstainsOnNonRbacAttributes(): void
+    {
+        $voter = new PermissionVoter();
+        $user  = new User();
+        self::assertSame(VoterInterface::ACCESS_ABSTAIN, $voter->vote($this->token($user), null, ['ROLE_ADMIN']));
+        self::assertSame(VoterInterface::ACCESS_ABSTAIN, $voter->vote($this->token($user), null, ['IS_AUTHENTICATED_FULLY']));
+    }
+
+    public function testGrantsWhenUserHasPermissionViaRole(): void
+    {
+        $voter = new PermissionVoter();
+        $role  = new Role('bureau', 'Bureau');
+        $role->addPermission(new Permission('core.users.view', 'Voir', 'core'));
+        $user = new User();
+        $user->addRbacRole($role);
+
+        self::assertSame(VoterInterface::ACCESS_GRANTED, $voter->vote($this->token($user), null, ['core.users.view']));
+        self::assertSame(VoterInterface::ACCESS_DENIED, $voter->vote($this->token($user), null, ['core.users.manage']));
+    }
+
+    public function testAdminBypassesViaRole(): void
+    {
+        $voter = new PermissionVoter();
+        $user  = new User();
+        $user->setRoles(['ROLE_ADMIN']);
+
+        self::assertSame(VoterInterface::ACCESS_GRANTED, $voter->vote($this->token($user), null, ['core.users.manage']));
+    }
+
+    private function token(User $user): UsernamePasswordToken
+    {
+        return new UsernamePasswordToken($user, 'main', $user->getRoles());
+    }
+}

tests/Unit/Repository/MailConfigurationRepositoryTest.php

@@ -4,8 +4,8 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Repository;
 
-use App\Entity\MailConfiguration;
-use App\Repository\MailConfigurationRepository;
+use App\Module\Mail\Domain\Entity\MailConfiguration;
+use App\Module\Mail\Infrastructure\Doctrine\DoctrineMailConfigurationRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
 
@@ -14,14 +14,14 @@ use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
  */
 class MailConfigurationRepositoryTest extends KernelTestCase
 {
-    private MailConfigurationRepository $repository;
+    private DoctrineMailConfigurationRepository $repository;
     private EntityManagerInterface $em;
 
     protected function setUp(): void
     {
         self::bootKernel();
         $container        = static::getContainer();
-        $this->repository = $container->get(MailConfigurationRepository::class);
+        $this->repository = $container->get(DoctrineMailConfigurationRepository::class);
         $this->em         = $container->get('doctrine.orm.entity_manager');
         $this->em->getConnection()->executeStatement('TRUNCATE TABLE mail_configuration RESTART IDENTITY CASCADE');
     }

tests/Unit/Service/AbsenceDayCalculatorTest.php

@@ -4,9 +4,9 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Service;
 
-use App\Enum\HalfDay;
-use App\Service\AbsenceDayCalculator;
-use App\Service\PublicHolidayProvider;
+use App\Module\Absence\Domain\Enum\HalfDay;
+use App\Module\Absence\Domain\Service\AbsenceDayCalculator;
+use App\Module\Absence\Domain\Service\PublicHolidayProvider;
 use DateTimeImmutable;
 use PHPUnit\Framework\TestCase;
 

tests/Unit/Service/MailSyncServiceTest.php

@@ -4,14 +4,14 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Service;
 
-use App\Entity\MailConfiguration;
-use App\Entity\MailFolder;
-use App\Mail\Dto\MailFolderDto;
-use App\Mail\MailProviderInterface;
-use App\Repository\MailConfigurationRepository;
-use App\Repository\MailFolderRepository;
-use App\Repository\MailMessageRepository;
-use App\Service\MailSyncService;
+use App\Module\Mail\Application\Dto\MailFolderDto;
+use App\Module\Mail\Application\Service\MailSyncService;
+use App\Module\Mail\Domain\Entity\MailConfiguration;
+use App\Module\Mail\Domain\Entity\MailFolder;
+use App\Module\Mail\Domain\Provider\MailProviderInterface;
+use App\Module\Mail\Domain\Repository\MailConfigurationRepositoryInterface;
+use App\Module\Mail\Domain\Repository\MailFolderRepositoryInterface;
+use App\Module\Mail\Domain\Repository\MailMessageRepositoryInterface;
 use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\Persistence\ManagerRegistry;
 use PHPUnit\Framework\TestCase;
@@ -29,12 +29,12 @@ class MailSyncServiceTest extends TestCase
         $config = new MailConfiguration();
         $config->setEnabled(false);
 
-        $configRepo = $this->createMock(MailConfigurationRepository::class);
+        $configRepo = $this->createMock(MailConfigurationRepositoryInterface::class);
         $configRepo->method('findSingleton')->willReturn($config);
 
         $provider    = $this->createMock(MailProviderInterface::class);
-        $folderRepo  = $this->createMock(MailFolderRepository::class);
-        $messageRepo = $this->createMock(MailMessageRepository::class);
+        $folderRepo  = $this->createMock(MailFolderRepositoryInterface::class);
+        $messageRepo = $this->createMock(MailMessageRepositoryInterface::class);
         $em          = $this->createMock(EntityManagerInterface::class);
         $lockFactory = $this->makeLockFactory();
 
@@ -62,12 +62,12 @@ class MailSyncServiceTest extends TestCase
         $config = new MailConfiguration();
         $config->setEnabled(true);
 
-        $configRepo = $this->createMock(MailConfigurationRepository::class);
+        $configRepo = $this->createMock(MailConfigurationRepositoryInterface::class);
         $configRepo->method('findSingleton')->willReturn($config);
 
         $provider    = $this->createMock(MailProviderInterface::class);
-        $folderRepo  = $this->createMock(MailFolderRepository::class);
-        $messageRepo = $this->createMock(MailMessageRepository::class);
+        $folderRepo  = $this->createMock(MailFolderRepositoryInterface::class);
+        $messageRepo = $this->createMock(MailMessageRepositoryInterface::class);
         $em          = $this->createMock(EntityManagerInterface::class);
         $lockFactory = $this->makeLockFactory(false);
 
@@ -93,7 +93,7 @@ class MailSyncServiceTest extends TestCase
         $config = new MailConfiguration();
         $config->setEnabled(true);
 
-        $configRepo = $this->createMock(MailConfigurationRepository::class);
+        $configRepo = $this->createMock(MailConfigurationRepositoryInterface::class);
         $configRepo->method('findSingleton')->willReturn($config);
 
         $folderDto = new MailFolderDto(
@@ -107,11 +107,11 @@ class MailSyncServiceTest extends TestCase
         $provider = $this->createMock(MailProviderInterface::class);
         $provider->method('listFolders')->willReturn([$folderDto]);
 
-        $folderRepo = $this->createMock(MailFolderRepository::class);
+        $folderRepo = $this->createMock(MailFolderRepositoryInterface::class);
         $folderRepo->method('findByPath')->willReturn(null);
         $folderRepo->method('findAllOrderedByPath')->willReturn([]);
 
-        $messageRepo = $this->createMock(MailMessageRepository::class);
+        $messageRepo = $this->createMock(MailMessageRepositoryInterface::class);
         $em          = $this->createMock(EntityManagerInterface::class);
         $em->expects(self::once())->method('persist');
         $em->expects(self::once())->method('flush');
@@ -137,13 +137,13 @@ class MailSyncServiceTest extends TestCase
         $config = new MailConfiguration();
         $config->setEnabled(true);
 
-        $configRepo = $this->createMock(MailConfigurationRepository::class);
+        $configRepo = $this->createMock(MailConfigurationRepositoryInterface::class);
         $configRepo->method('findSingleton')->willReturn($config);
 
         $folder = new MailFolder();
         $folder->setPath('INBOX');
 
-        $messageRepo = $this->createMock(MailMessageRepository::class);
+        $messageRepo = $this->createMock(MailMessageRepositoryInterface::class);
         $messageRepo->method('findMaxUidInFolder')->willReturn(10);
         $messageRepo->method('findAllUidsByFolder')->willReturn([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
         $messageRepo->method('findLastNByFolder')->willReturn([]);
@@ -151,7 +151,7 @@ class MailSyncServiceTest extends TestCase
         $provider = $this->createMock(MailProviderInterface::class);
         $provider->method('listMessages')->willReturn([]);
 
-        $folderRepo = $this->createMock(MailFolderRepository::class);
+        $folderRepo = $this->createMock(MailFolderRepositoryInterface::class);
         $em         = $this->createMock(EntityManagerInterface::class);
         $em->expects(self::never())->method('remove');
 

tests/Unit/Service/PublicHolidayProviderTest.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Service;
 
-use App\Service\PublicHolidayProvider;
+use App\Module\Absence\Domain\Service\PublicHolidayProvider;
 use DateTimeImmutable;
 use PHPUnit\Framework\TestCase;
 

tests/Unit/Service/SharePathResolverTest.php

@@ -4,8 +4,8 @@ declare(strict_types=1);
 
 namespace App\Tests\Unit\Service;
 
-use App\Service\Share\Exception\InvalidPathException;
-use App\Service\Share\SharePathResolver;
+use App\Module\Integration\Domain\Exception\InvalidPathException;
+use App\Module\Integration\Domain\Service\SharePathResolver;
 use PHPUnit\Framework\TestCase;
 
 /**

tests/Unit/Shared/Database/ColumnCommentsCatalogTest.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Shared\Database;
+
+use App\Shared\Infrastructure\Database\ColumnCommentsCatalog;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+final class ColumnCommentsCatalogTest extends TestCase
+{
+    public function testTimestampableBlamableCommentsCoverFourColumns(): void
+    {
+        $sql = ColumnCommentsCatalog::timestampableBlamableComments('task');
+
+        self::assertCount(4, $sql);
+        self::assertSame(
+            "COMMENT ON COLUMN task.created_at IS 'Date de creation (UTC). Rempli automatiquement (Timestampable).'",
+            $sql[0],
+        );
+        self::assertStringContainsString('COMMENT ON COLUMN task.created_by IS', $sql[2]);
+    }
+
+    public function testTableNameIsInterpolatedForEveryColumn(): void
+    {
+        foreach (ColumnCommentsCatalog::timestampableBlamableComments('time_entry') as $statement) {
+            self::assertStringContainsString('COMMENT ON COLUMN time_entry.', $statement);
+        }
+    }
+}

tests/Unit/Shared/Doctrine/TimestampableBlamableSubscriberTest.php

@@ -0,0 +1,132 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Shared\Doctrine;
+
+use App\Shared\Application\CurrentUserProviderInterface;
+use App\Shared\Domain\Contract\BlamableInterface;
+use App\Shared\Domain\Contract\TimestampableInterface;
+use App\Shared\Domain\Contract\UserInterface;
+use App\Shared\Domain\Trait\TimestampableBlamableTrait;
+use App\Shared\Infrastructure\Doctrine\TimestampableBlamableSubscriber;
+use DateTimeImmutable;
+use PHPUnit\Framework\TestCase;
+use stdClass;
+
+/**
+ * @internal
+ */
+final class TimestampableBlamableSubscriberTest extends TestCase
+{
+    public function testApplyOnCreateSetsTimestampsAndAuthor(): void
+    {
+        $user       = $this->makeUser(7);
+        $subscriber = new TimestampableBlamableSubscriber($this->providerReturning($user));
+        $entity     = $this->makeEntity();
+
+        $subscriber->applyOnCreate($entity);
+
+        self::assertInstanceOf(DateTimeImmutable::class, $entity->getCreatedAt());
+        self::assertInstanceOf(DateTimeImmutable::class, $entity->getUpdatedAt());
+        self::assertSame($user, $entity->getCreatedBy());
+        self::assertSame($user, $entity->getUpdatedBy());
+    }
+
+    public function testApplyOnUpdateLeavesCreatedUntouched(): void
+    {
+        $creator = $this->makeUser(1);
+        $editor  = $this->makeUser(2);
+        $entity  = $this->makeEntity();
+
+        new TimestampableBlamableSubscriber($this->providerReturning($creator))->applyOnCreate($entity);
+        $createdAt = $entity->getCreatedAt();
+
+        new TimestampableBlamableSubscriber($this->providerReturning($editor))->applyOnUpdate($entity);
+
+        self::assertSame($createdAt, $entity->getCreatedAt());
+        self::assertSame($creator, $entity->getCreatedBy());
+        self::assertSame($editor, $entity->getUpdatedBy());
+    }
+
+    public function testApplyOnCreateIgnoresNonTimestampableEntities(): void
+    {
+        $subscriber = new TimestampableBlamableSubscriber($this->providerReturning(null));
+
+        // Must not throw.
+        $subscriber->applyOnCreate(new stdClass());
+        $this->addToAssertionCount(1);
+    }
+
+    private function providerReturning(?UserInterface $user): CurrentUserProviderInterface
+    {
+        return new class($user) implements CurrentUserProviderInterface {
+            public function __construct(private ?UserInterface $user) {}
+
+            public function getCurrentUser(): ?UserInterface
+            {
+                return $this->user;
+            }
+        };
+    }
+
+    private function makeUser(int $id): UserInterface
+    {
+        return new class($id) implements UserInterface {
+            public function __construct(private int $id) {}
+
+            public function getId(): ?int
+            {
+                return $this->id;
+            }
+
+            public function getUserIdentifier(): string
+            {
+                return 'user-'.$this->id;
+            }
+
+            public function getUsername(): ?string
+            {
+                return 'user-'.$this->id;
+            }
+
+            /** @return list<string> */
+            public function getRoles(): array
+            {
+                return ['ROLE_USER'];
+            }
+
+            public function getFirstName(): ?string
+            {
+                return null;
+            }
+
+            public function getLastName(): ?string
+            {
+                return null;
+            }
+
+            public function getAvatarUrl(): ?string
+            {
+                return null;
+            }
+
+            public function getIsEmployee(): bool
+            {
+                return false;
+            }
+
+            public function getEffectivePermissions(): array
+            {
+                return [];
+            }
+        };
+    }
+
+    private function makeEntity(): object
+    {
+        return new class implements TimestampableInterface, BlamableInterface {
+            use TimestampableBlamableTrait;
+        };
+    }
+}

tests/Unit/Shared/Module/ModuleRegistryPermissionsTest.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Shared\Module;
+
+use App\Module\Core\CoreModule;
+use App\Shared\Domain\Module\ModuleRegistry;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+final class ModuleRegistryPermissionsTest extends TestCase
+{
+    public function testAggregatesPermissionsWithModuleId(): void
+    {
+        $perms = ModuleRegistry::permissions([CoreModule::class]);
+
+        self::assertNotEmpty($perms);
+        foreach ($perms as $perm) {
+            self::assertArrayHasKey('code', $perm);
+            self::assertArrayHasKey('label', $perm);
+            self::assertArrayHasKey('module', $perm);
+            self::assertSame('core', $perm['module']);
+            self::assertStringStartsWith('core.', $perm['code']);
+        }
+    }
+}

tests/Unit/Shared/Module/ModuleRegistryTest.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Shared\Module;
+
+use App\Shared\Domain\Module\ModuleInterface;
+use App\Shared\Domain\Module\ModuleRegistry;
+use PHPUnit\Framework\TestCase;
+use stdClass;
+
+/**
+ * @internal
+ */
+final class ModuleRegistryTest extends TestCase
+{
+    public function testIdsExtractsDeclaredModuleIds(): void
+    {
+        $classes = [FakeAlphaModule::class, FakeBetaModule::class];
+
+        self::assertSame(['alpha', 'beta'], ModuleRegistry::ids($classes));
+    }
+
+    public function testIdsIgnoresClassesNotImplementingModuleInterface(): void
+    {
+        $classes = [FakeAlphaModule::class, stdClass::class];
+
+        self::assertSame(['alpha'], ModuleRegistry::ids($classes));
+    }
+
+    public function testIdsReturnsEmptyArrayForNoModules(): void
+    {
+        self::assertSame([], ModuleRegistry::ids([]));
+    }
+}
+
+final class FakeAlphaModule implements ModuleInterface
+{
+    public static function id(): string
+    {
+        return 'alpha';
+    }
+
+    public static function label(): string
+    {
+        return 'Alpha';
+    }
+
+    public static function isRequired(): bool
+    {
+        return false;
+    }
+
+    public static function permissions(): array
+    {
+        return [];
+    }
+}
+
+final class FakeBetaModule implements ModuleInterface
+{
+    public static function id(): string
+    {
+        return 'beta';
+    }
+
+    public static function label(): string
+    {
+        return 'Beta';
+    }
+
+    public static function isRequired(): bool
+    {
+        return true;
+    }
+
+    public static function permissions(): array
+    {
+        return [];
+    }
+}

tests/Unit/Shared/Sidebar/SidebarFilterTest.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Shared\Sidebar;
+
+use App\Shared\Domain\Sidebar\SidebarFilter;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+final class SidebarFilterTest extends TestCase
+{
+    public function testItemWithoutModuleIsAlwaysVisible(): void
+    {
+        $sections = [
+            ['label' => 'sidebar.core.section', 'icon' => 'mdi:home', 'items' => [
+                ['label' => 'sidebar.core.dashboard', 'to' => '/', 'icon' => 'mdi:view-dashboard'],
+            ]],
+        ];
+
+        $result = SidebarFilter::filter($sections, [], ['ROLE_USER']);
+
+        self::assertCount(1, $result['sections']);
+        self::assertSame('/', $result['sections'][0]['items'][0]['to']);
+        self::assertSame([], $result['disabledRoutes']);
+        self::assertArrayNotHasKey('module', $result['sections'][0]['items'][0]);
+    }
+
+    public function testItemWithInactiveModuleIsHiddenAndRouteDisabled(): void
+    {
+        $sections = [
+            ['label' => 'sidebar.tt.section', 'icon' => 'mdi:clock', 'items' => [
+                ['label' => 'sidebar.tt.timesheet', 'to' => '/time-tracking', 'icon' => 'mdi:clock', 'module' => 'time_tracking'],
+            ]],
+        ];
+
+        $result = SidebarFilter::filter($sections, [], ['ROLE_USER']);
+
+        self::assertSame([], $result['sections']);
+        self::assertSame(['/time-tracking'], $result['disabledRoutes']);
+    }
+
+    public function testItemWithActiveModuleIsVisible(): void
+    {
+        $sections = [
+            ['label' => 'sidebar.tt.section', 'icon' => 'mdi:clock', 'items' => [
+                ['label' => 'sidebar.tt.timesheet', 'to' => '/time-tracking', 'icon' => 'mdi:clock', 'module' => 'time_tracking'],
+            ]],
+        ];
+
+        $result = SidebarFilter::filter($sections, ['time_tracking'], ['ROLE_USER']);
+
+        self::assertCount(1, $result['sections']);
+        self::assertSame('/time-tracking', $result['sections'][0]['items'][0]['to']);
+        self::assertSame([], $result['disabledRoutes']);
+    }
+
+    public function testSectionWithRolesIsHiddenWhenRoleMissing(): void
+    {
+        $sections = [
+            ['label' => 'sidebar.admin.section', 'icon' => 'mdi:cog', 'roles' => ['ROLE_ADMIN'], 'items' => [
+                ['label' => 'sidebar.admin.admin', 'to' => '/admin', 'icon' => 'mdi:cog'],
+            ]],
+        ];
+
+        $result = SidebarFilter::filter($sections, [], ['ROLE_USER']);
+
+        self::assertSame([], $result['sections']);
+        // Filtrage par rôle => PAS de disabledRoutes (réservé au filtrage par module).
+        self::assertSame([], $result['disabledRoutes']);
+    }
+
+    public function testSectionWithRolesIsVisibleWhenRolePresent(): void
+    {
+        $sections = [
+            ['label' => 'sidebar.admin.section', 'icon' => 'mdi:cog', 'roles' => ['ROLE_ADMIN'], 'items' => [
+                ['label' => 'sidebar.admin.admin', 'to' => '/admin', 'icon' => 'mdi:cog'],
+            ]],
+        ];
+
+        $result = SidebarFilter::filter($sections, [], ['ROLE_USER', 'ROLE_ADMIN']);
+
+        self::assertCount(1, $result['sections']);
+        self::assertSame('/admin', $result['sections'][0]['items'][0]['to']);
+        self::assertArrayNotHasKey('roles', $result['sections'][0]);
+    }
+
+    public function testItemWithRolesIsHiddenWhenRoleMissing(): void
+    {
+        $sections = [
+            ['label' => 'sidebar.hr.section', 'icon' => 'mdi:calendar', 'items' => [
+                ['label' => 'sidebar.hr.teamAbsences', 'to' => '/team-absences', 'icon' => 'mdi:account-group', 'roles' => ['ROLE_ADMIN']],
+                ['label' => 'sidebar.hr.x', 'to' => '/x', 'icon' => 'mdi:x'],
+            ]],
+        ];
+
+        $result = SidebarFilter::filter($sections, [], ['ROLE_USER']);
+
+        self::assertCount(1, $result['sections']);
+        self::assertCount(1, $result['sections'][0]['items']);
+        self::assertSame('/x', $result['sections'][0]['items'][0]['to']);
+        self::assertArrayNotHasKey('roles', $result['sections'][0]['items'][0]);
+    }
+
+    public function testItemHiddenWhenPermissionMissing(): void
+    {
+        $sections = [[
+            'label' => 's', 'icon' => 'i',
+            'items' => [
+                ['label' => 'a', 'to' => '/a', 'icon' => 'i', 'permission' => 'core.users.view'],
+                ['label' => 'b', 'to' => '/b', 'icon' => 'i'],
+            ],
+        ]];
+        $out = SidebarFilter::filter($sections, [], [], []);
+        self::assertCount(1, $out['sections'][0]['items']);
+        self::assertSame('/b', $out['sections'][0]['items'][0]['to']);
+    }
+
+    public function testItemVisibleWhenPermissionGranted(): void
+    {
+        $sections = [[
+            'label' => 's', 'icon' => 'i',
+            'items' => [['label' => 'a', 'to' => '/a', 'icon' => 'i', 'permission' => 'core.users.view']],
+        ]];
+        $out = SidebarFilter::filter($sections, [], [], ['core.users.view']);
+        self::assertCount(1, $out['sections'][0]['items']);
+    }
+}