chore : bump version to 0.2.2

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/release-artefact.yml

@@ -45,6 +45,7 @@ jobs:
           set -euo pipefail
           mkdir -p release
           tar -czf "release/lesstime-${GITHUB_REF_NAME}.tar.gz" \
+            .env \
             bin \
             config \
             migrations \

CLAUDE.md

@@ -16,7 +16,7 @@ src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatu
 src/ApiResource/     # Ressources API Platform (si découplées des entités)
 src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, ClientTicket*Provider/Processor, NotificationProvider, Gitea*Provider, Gitea*Processor)
 src/Service/         # Services métier (NotificationService)
-src/Controller/      # Controllers custom Symfony (NotificationUnreadCountController, MarkAllReadController)
+src/Controller/      # Controllers custom Symfony (NotificationUnreadCountController, MarkAllReadController, UserAvatarController, TaskDocumentDownloadController)
 src/Mcp/Tool/        # MCP tools organisés par domaine (Project/, Task/, TaskMeta/, TimeEntry/, Reference/)
 src/Security/        # Authenticators custom (ApiTokenAuthenticator pour MCP HTTP)
 src/Command/         # Commandes console (GenerateApiTokenCommand)
@@ -28,10 +28,10 @@ migrations/          # Migrations Doctrine
 docs/plans/          # Plans d'implémentation
 docs/superpowers/    # Plans et specs superpowers
 frontend/            # App Nuxt 4
-frontend/pages/      # Pages (index, login, my-tasks, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin, portal/, portal/projects/[id], portal/projects/[id]/new-ticket)
+frontend/pages/      # Pages (index, login, my-tasks, profile, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin, portal/, portal/projects/[id], portal/projects/[id]/new-ticket)
 frontend/layouts/    # Layouts (default, portal)
 frontend/components/ # Composants Vue organisés en sous-dossiers (ui/, client/, project/, task/, user/, admin/, time-tracking/, client-ticket/, notification/)
-frontend/composables/# Composables (useApi, useAppVersion, useNotifications, useClientTicketHelpers)
+frontend/composables/# Composables (useApi, useAppVersion, useNotifications, useClientTicketHelpers, useAvatarService)
 frontend/stores/     # Stores Pinia (auth, ui, timer)
 frontend/services/   # Services API (auth, clients, gitea, projects, tasks, task-statuses, task-efforts, task-groups, task-priorities, task-tags, users, time-entries, client-tickets, notifications, task-documents)
 frontend/services/dto/ # Types TypeScript
@@ -80,6 +80,8 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 - PostgreSQL : `LIKE` sur colonne JSON ne marche pas → utiliser `roles::text LIKE` via native SQL
 - Controllers custom sous `/api/` : ajouter `priority: 1` sur `#[Route]` pour éviter le conflit avec API Platform `{id}`
 - Serialization : pour embarquer une relation (pas IRI), ajouter le groupe du parent aux propriétés de l'entité cible
+- Upload fichiers : utiliser `$file->getMimeType()` (pas `getClientMimeType()`) pour valider côté serveur — nécessite `symfony/mime`
+- Auth endpoints mixtes (ROLE_USER + ROLE_CLIENT) : utiliser `#[IsGranted('IS_AUTHENTICATED_FULLY')]` au lieu d'un rôle spécifique
 
 ### Frontend
 

README.md

@@ -1,10 +1,173 @@
 # Lesstime
 
-Application de gestion de projet. Symfony 8 + API Platform 4 + Nuxt 4.
+Application de gestion de projet avec suivi du temps et portail client.
 
-## MCP Server
+## Stack
 
-Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistants IA (Claude Code, ChatGPT, Codex) d'interagir avec les projets, tâches et le suivi du temps.
+| Couche | Technologies |
+|--------|-------------|
+| **Backend** | PHP 8.4, Symfony 8, API Platform 4, Doctrine ORM |
+| **Frontend** | Nuxt 4 (SPA), Vue 3, Pinia, Tailwind CSS |
+| **Base de données** | PostgreSQL 16 |
+| **Auth** | JWT HTTP-only cookie (lexik/jwt-authentication-bundle) |
+| **Infrastructure** | Docker (PHP-FPM, Nginx, PostgreSQL) |
+
+## Fonctionnalités
+
+- Gestion de projets et tâches (kanban, groupes, priorités, tags, efforts)
+- Suivi du temps (timer, calendrier, vue liste)
+- Portail client avec tickets (bug, amélioration, autre)
+- Gestion de documents (upload, prévisualisation, téléchargement)
+- Profil utilisateur avec avatar (crop circulaire)
+- Notifications temps réel
+- Intégration Gitea (issues, repos)
+- Serveur MCP pour assistants IA
+- Multi-langue (i18n)
+
+## Prérequis
+
+- Docker & Docker Compose
+- Git
+
+## Installation
+
+```bash
+# 1. Cloner le repo
+git clone <url> && cd lesstime
+
+# 2. Démarrer les containers
+make start
+
+# 3. Installation complète (composer, migrations, fixtures, build Nuxt)
+make install
+```
+
+L'application est accessible sur **http://localhost:8082**.
+
+### Comptes de test (fixtures)
+
+| Utilisateur | Mot de passe | Rôle | Détails |
+|-------------|-------------|------|---------|
+| `admin` | `admin` | ROLE_ADMIN | Administrateur |
+| `alice` | `alice` | ROLE_USER | Utilisateur interne |
+| `bob` | `bob` | ROLE_USER | Utilisateur interne |
+| `charlie` | `charlie` | ROLE_USER | Utilisateur interne |
+| `client-liot` | `client` | ROLE_CLIENT | Client LIOT (projet SIRH) |
+| `client-acme` | `client` | ROLE_CLIENT | Client ACME (projet CRM) |
+
+## Commandes
+
+### Docker
+
+```bash
+make start              # Démarrer les containers
+make stop               # Arrêter les containers
+make restart            # Redémarrer les containers
+make shell              # Shell dans le container PHP
+make shell-root         # Shell root dans le container PHP
+```
+
+### Développement
+
+```bash
+make dev-nuxt           # Dev server Nuxt (hot reload, port 3002)
+make cache-clear        # Vider le cache Symfony
+make logs-dev           # Tail logs Symfony
+```
+
+### Base de données
+
+```bash
+make migration-migrate  # Lancer les migrations
+make fixtures           # Charger les fixtures
+make db-reset           # Reset BDD + migrations + fixtures (⚠️ supprime les données)
+```
+
+### Tests & Qualité
+
+```bash
+make test                       # PHPUnit
+make php-cs-fixer-allow-risky   # Fix code style PHP (Symfony + PSR-12)
+```
+
+### Installation complète
+
+```bash
+make install            # Composer + migrations + fixtures + build Nuxt
+make reset              # Tout supprimer et réinstaller (⚠️ supprime la BDD)
+```
+
+## Architecture
+
+```
+src/
+├── Entity/             # Entités Doctrine
+├── ApiResource/        # Ressources API Platform (découplées)
+├── State/              # Providers et Processors API Platform
+├── Controller/         # Controllers custom Symfony
+├── Service/            # Services métier
+├── EventListener/      # Listeners Doctrine
+├── Exception/          # Exceptions custom
+├── Security/           # Authenticators custom
+├── Repository/         # Repositories Doctrine
+├── Command/            # Commandes console
+├── DataFixtures/       # Fixtures
+└── Mcp/Tool/           # MCP tools par domaine
+    ├── Project/
+    ├── Task/
+    ├── TaskMeta/
+    ├── TimeEntry/
+    └── Reference/
+
+frontend/
+├── pages/              # Pages Nuxt (routing auto)
+│   ├── portal/         # Pages portail client
+│   └── projects/       # Pages projets
+├── layouts/            # Layouts (default, portal)
+├── components/         # Composants Vue
+│   ├── ui/             # Composants génériques
+│   ├── task/           # Tâches
+│   ├── user/           # Utilisateur (avatar, etc.)
+│   ├── project/        # Projets
+│   ├── client/         # Clients
+│   ├── client-ticket/  # Tickets client
+│   ├── admin/          # Administration
+│   ├── notification/   # Notifications
+│   └── time-tracking/  # Suivi du temps
+├── composables/        # Composables (useApi, useNotifications, etc.)
+├── stores/             # Stores Pinia (auth, ui, timer)
+├── services/           # Services API
+│   └── dto/            # Types TypeScript
+├── plugins/            # Plugins Nuxt
+├── utils/              # Utilitaires
+├── i18n/locales/       # Traductions
+└── middleware/          # Middleware auth
+
+config/                 # Config Symfony
+migrations/             # Migrations Doctrine
+docker/                 # Dockerfiles et config Nginx
+```
+
+## Docker
+
+| Container | Port | Description |
+|-----------|------|-------------|
+| `php-lesstime-fpm` | 3002 (dev Nuxt) | PHP-FPM + Node 24 |
+| `nginx-lesstime` | 8082 | Nginx reverse proxy |
+| PostgreSQL | 5435 | Base de données |
+
+Configuration : `docker/.env.docker` (override local : `docker/.env.docker.local`)
+
+## API
+
+Toutes les routes API sont préfixées `/api` (API Platform).
+
+- Documentation auto-générée : **http://localhost:8082/api**
+- Auth : `POST /login_check` avec `{ username, password }` → cookie JWT `BEARER`
+
+## Serveur MCP
+
+Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistants IA d'interagir avec les données.
 
 ### Tools disponibles (22)
 
@@ -16,13 +179,6 @@ Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistant
 | TaskMeta | `list-statuses`, `list-priorities`, `list-efforts`, `list-tags`, `list-groups`, `create-group`, `update-group` |
 | TimeEntry | `list-time-entries`, `create-time-entry`, `update-time-entry`, `delete-time-entry` |
 
-### Transports
-
-| Transport | Usage | Auth |
-|-----------|-------|------|
-| **STDIO** | Claude Code sur la machine locale | Aucune |
-| **HTTP** (`/_mcp`) | Clients MCP sur le réseau local | API token (`Authorization: Bearer <token>`) |
-
 ### Configuration locale (STDIO)
 
 ```json
@@ -55,17 +211,19 @@ Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistant
 ### Gestion des tokens API
 
 ```bash
-# Générer un token pour un utilisateur
 docker exec -u www-data php-lesstime-fpm php bin/console app:generate-api-token <username>
 ```
 
-### Mise en production (réseau local)
+## Déploiement
 
 1. Déployer le code sur le serveur
 2. `composer install --no-dev --optimize-autoloader`
 3. `php bin/console doctrine:migrations:migrate --no-interaction`
 4. `php bin/console cache:clear --env=prod`
-5. `docker restart nginx-lesstime`
-6. `php bin/console app:generate-api-token admin` — noter le token
-7. Ouvrir le port 8082 sur le firewall du serveur (LAN uniquement)
-8. Configurer les clients MCP avec l'URL `http://<ip-serveur>:8082/_mcp` + le token
+5. `cd frontend && npm install && npm run build:dist`
+6. `docker restart nginx-lesstime`
+7. Ouvrir le port 8082 sur le firewall (LAN uniquement)
+
+## Licence
+
+Propriétaire — Tous droits réservés.

composer.json

@@ -25,6 +25,7 @@
         "symfony/framework-bundle": "8.0.*",
         "symfony/http-client": "8.0.*",
         "symfony/mcp-bundle": "^0.6.0",
+        "symfony/mime": "8.0.*",
         "symfony/property-access": "8.0.*",
         "symfony/property-info": "8.0.*",
         "symfony/runtime": "8.0.*",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "75b9dbecf38167d0554dfd64a986a40e",
+    "content-hash": "3e2146f74bbda750c75ab52eb437d2d4",
     "packages": [
         {
             "name": "api-platform/doctrine-common",
@@ -5703,6 +5703,92 @@
             ],
             "time": "2026-03-04T16:39:24+00:00"
         },
+        {
+            "name": "symfony/mime",
+            "version": "v8.0.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/mime.git",
+                "reference": "5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/mime/zipball/5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b",
+                "reference": "5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.4",
+                "symfony/polyfill-intl-idn": "^1.10",
+                "symfony/polyfill-mbstring": "^1.0"
+            },
+            "conflict": {
+                "egulias/email-validator": "~3.0.0",
+                "phpdocumentor/reflection-docblock": "<5.2|>=7",
+                "phpdocumentor/type-resolver": "<1.5.1"
+            },
+            "require-dev": {
+                "egulias/email-validator": "^2.1.10|^3.1|^4",
+                "league/html-to-markdown": "^5.0",
+                "phpdocumentor/reflection-docblock": "^5.2|^6.0",
+                "symfony/dependency-injection": "^7.4|^8.0",
+                "symfony/process": "^7.4|^8.0",
+                "symfony/property-access": "^7.4|^8.0",
+                "symfony/property-info": "^7.4|^8.0",
+                "symfony/serializer": "^7.4|^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\Mime\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Fabien Potencier",
+                    "email": "fabien@symfony.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Allows manipulating MIME messages",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "mime",
+                "mime-type"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/mime/tree/v8.0.7"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-03-06T13:17:40+00:00"
+        },
         {
             "name": "symfony/password-hasher",
             "version": "v8.0.6",
@@ -5858,6 +5944,93 @@
             ],
             "time": "2025-06-27T09:58:17+00:00"
         },
+        {
+            "name": "symfony/polyfill-intl-idn",
+            "version": "v1.33.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-intl-idn.git",
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-idn/zipball/9614ac4d8061dc257ecc64cba1b140873dce8ad3",
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2",
+                "symfony/polyfill-intl-normalizer": "^1.10"
+            },
+            "suggest": {
+                "ext-intl": "For best performance"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Intl\\Idn\\": ""
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Laurent Bassin",
+                    "email": "laurent@bassin.info"
+                },
+                {
+                    "name": "Trevor Rowbotham",
+                    "email": "trevor.rowbotham@pm.me"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill for intl's idn_to_ascii and idn_to_utf8 functions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "idn",
+                "intl",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.33.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2024-09-10T14:38:51+00:00"
+        },
         {
             "name": "symfony/polyfill-intl-normalizer",
             "version": "v1.33.0",

config/services.yaml

@@ -8,6 +8,7 @@
 # https://symfony.com/doc/current/best_practices.html#use-parameters-for-application-configuration
 parameters:
     task_document_upload_dir: '%kernel.project_dir%/var/uploads/documents'
+    avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'
 
 imports:
     - { resource: version.yaml }
@@ -39,3 +40,7 @@ services:
     App\Controller\TaskDocumentDownloadController:
         arguments:
             $uploadDir: '%task_document_upload_dir%'
+
+    App\Controller\UserAvatarController:
+        arguments:
+            $avatarUploadDir: '%avatar_upload_dir%'

config/version.yaml

@@ -1,2 +1,2 @@
 parameters:
-    app.version: '0.1.0'
+    app.version: '0.2.2'

deploy/nginx/lesstime.conf

@@ -0,0 +1,50 @@
+server {
+  listen 80;
+  listen [::]:80;
+  server_name project.malio-dev.fr;
+
+  root /var/www/lesstime/frontend/.output/public;
+  index index.html;
+
+  client_max_body_size 55m;
+
+    location ^~ /api/ {
+        root /var/www/lesstime/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ^~ /bundles/ {
+        root /var/www/lesstime/public;
+        try_files $uri =404;
+    }
+
+    location = /api/login_check {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/lesstime/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/lesstime/public;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param PATH_INFO /login_check;
+        fastcgi_param REQUEST_URI /login_check;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+    }
+
+    location ^~ /_mcp {
+        root /var/www/lesstime/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ~ ^/index\.php(/|$) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/lesstime/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/lesstime/public;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+    }
+
+  location ~ \.php$ {
+      return 404;
+  }
+
+  location / {
+      try_files $uri $uri/ /index.html;
+  }
+}

docs/deploy.md

@@ -0,0 +1,213 @@
+# Deploiement sur serveur Ubuntu (sans Docker)
+
+## Prerequis
+
+- Ubuntu 22.04+ avec PHP 8.4, Node 24, PostgreSQL 16, Nginx
+- Acces root ou sudo sur le serveur
+
+## 1. Preparer la BDD
+
+```bash
+sudo -u postgres createuser lesstime
+sudo -u postgres createdb -O lesstime lesstime
+sudo -u postgres psql -c "ALTER USER lesstime WITH PASSWORD 'ton-mdp';"
+```
+
+## 2. Creer les dossiers
+
+```bash
+sudo mkdir -p /var/www/lesstime/var/log /var/www/lesstime/var/cache /var/www/lesstime/config/jwt
+sudo chown -R www-data:www-data /var/www/lesstime
+```
+
+## 3. Configurer l'environnement
+
+```bash
+sudo nano /var/www/lesstime/.env
+```
+
+Contenu minimal :
+```ini
+APP_ENV=prod
+```
+
+```bash
+sudo nano /var/www/lesstime/.env.local
+```
+
+Contenu :
+```ini
+APP_ENV=prod
+APP_SECRET=<random-hex-32>
+APP_DEBUG=0
+
+DEFAULT_URI=http://project.malio-dev.fr/
+CORS_ALLOW_ORIGIN='^https?://project\.malio-dev\.fr$'
+
+DATABASE_URL="postgresql://lesstime:<mdp>@localhost:5432/lesstime?serverVersion=16&charset=utf8"
+
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+JWT_PASSPHRASE=<passphrase>
+JWT_COOKIE_SECURE=0
+JWT_TOKEN_TTL=86400
+JWT_COOKIE_TTL=86400
+
+ENCRYPTION_KEY=<random-hex-32>
+```
+
+> `JWT_COOKIE_SECURE=0` car HTTP. Passer a `1` si HTTPS.
+
+## 4. Installer le script de deploy
+
+```bash
+sudo cp script/deploy-release.sh /usr/local/bin/deploy-lesstime
+sudo chmod +x /usr/local/bin/deploy-lesstime
+```
+
+Si le repo Gitea est prive, configurer un token :
+```bash
+echo "ton-token-gitea" | sudo tee /etc/lesstime-release-token
+sudo chmod 600 /etc/lesstime-release-token
+```
+
+## 5. Deployer une release
+
+```bash
+sudo /usr/local/bin/deploy-lesstime v0.2.1
+```
+
+Le script telecharge l'artefact, extrait les fichiers, clear le cache et lance les migrations.
+
+## 6. Generer les cles JWT
+
+```bash
+cd /var/www/lesstime
+sudo -u www-data php bin/console lexik:jwt:generate-keypair --skip-if-exists --env=prod
+```
+
+## 7. Configurer Nginx
+
+```bash
+sudo cp deploy/nginx/lesstime.conf /etc/nginx/sites-available/lesstime
+sudo ln -sf /etc/nginx/sites-available/lesstime /etc/nginx/sites-enabled/
+sudo nginx -t && sudo systemctl reload nginx
+```
+
+## 8. Creer le premier user admin
+
+Hasher un mot de passe :
+```bash
+php /var/www/lesstime/bin/console security:hash-password --env=prod
+```
+
+Choisir `App\Entity\User`, taper le mdp, copier le hash. Puis :
+```bash
+sudo -u postgres psql lesstime -c "INSERT INTO \"user\" (username, roles, password, created_at) VALUES ('admin', '[\"ROLE_ADMIN\"]', '<le-hash>', NOW());"
+```
+
+## 9. Tester
+
+```bash
+curl http://project.malio-dev.fr/api/version
+curl http://project.malio-dev.fr/
+```
+
+---
+
+# Connecter le serveur MCP a Claude Code
+
+Le serveur MCP expose 22 tools (projets, taches, time tracking avec liaison tickets client, metadonnees) via le endpoint HTTP `/_mcp`.
+
+## 1. Generer un token API
+
+Sur le serveur (ou en local via Docker) :
+
+```bash
+# Production (serveur)
+php /var/www/lesstime/bin/console app:generate-api-token admin --env=prod
+
+# Dev (Docker)
+docker exec -it php-lesstime-fpm php bin/console app:generate-api-token admin
+```
+
+La commande affiche un token de 64 caracteres. Ce token est lie a l'utilisateur et stocke en base (champ `apiToken` de l'entite `User`).
+
+## 2. Configurer Claude Code
+
+### Transport HTTP (recommande pour la prod)
+
+Creer ou modifier `.mcp.json` a la racine du projet :
+
+```json
+{
+    "mcpServers": {
+        "lesstime": {
+            "type": "http",
+            "url": "http://project.malio-dev.fr/_mcp",
+            "headers": {
+                "Authorization": "Bearer <ton-token>"
+            }
+        }
+    }
+}
+```
+
+### Transport STDIO (dev local via Docker)
+
+```json
+{
+    "mcpServers": {
+        "lesstime-local": {
+            "command": "docker",
+            "args": [
+                "exec",
+                "-i",
+                "php-lesstime-fpm",
+                "php",
+                "bin/console",
+                "mcp:server"
+            ]
+        }
+    }
+}
+```
+
+### Transport STDIO via SSH (prod sans endpoint HTTP)
+
+```json
+{
+    "mcpServers": {
+        "lesstime": {
+            "command": "ssh",
+            "args": [
+                "user@serveur",
+                "php",
+                "/var/www/lesstime/bin/console",
+                "mcp:server",
+                "--env=prod"
+            ]
+        }
+    }
+}
+```
+
+## 3. Redemarrer Claude Code
+
+Apres modification de `.mcp.json`, relancer Claude Code pour qu'il detecte le serveur.
+
+## 4. Verifier
+
+Demander a Claude d'utiliser un outil MCP, par exemple :
+- "Liste les projets sur Lesstime"
+- "Cree une tache dans le projet LT"
+
+## Tools disponibles
+
+| Domaine | Tools |
+|---------|-------|
+| Projets | list-projects, get-project, create-project, update-project |
+| Taches | list-tasks, get-task, create-task, update-task, delete-task |
+| Metadonnees | list-statuses, list-priorities, list-efforts, list-tags, list-groups, create-group, update-group |
+| Time tracking | list-time-entries, create-time-entry, update-time-entry, delete-time-entry (supporte clientTicketId) |
+| Reference | list-users, list-clients |

docs/superpowers/plans/2026-03-15-user-avatar.md

@@ -0,0 +1,802 @@
+# User Avatar Implementation Plan
+
+> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Let users upload a cropped profile avatar that replaces initials everywhere in the app.
+
+**Architecture:** New `avatarFileName` column on User entity, dedicated upload/serve/delete controllers, `UserAvatar.vue` component with `vue-advanced-cropper` for circular crop, and a `/profile` page for management.
+
+**Tech Stack:** PHP 8.4/Symfony 8, Doctrine migration, `vue-advanced-cropper`, Nuxt 4 SPA
+
+---
+
+## File Structure
+
+### Backend (create)
+- `src/Controller/UserAvatarController.php` — upload, serve, delete avatar (3 routes)
+
+### Backend (modify)
+- `src/Entity/User.php` — add `avatarFileName` field + `getAvatarUrl()` virtual getter
+- `config/services.yaml` — add `avatar_upload_dir` parameter + wire controller
+
+### Frontend (create)
+- `frontend/components/user/UserAvatar.vue` — reusable avatar display (image or initials fallback)
+- `frontend/components/user/AvatarCropper.vue` — crop modal using `vue-advanced-cropper`
+- `frontend/services/avatar.ts` — avatar API service (upload, remove, getUrl)
+- `frontend/pages/profile.vue` — profile page with avatar management
+
+### Frontend (modify)
+- `frontend/services/dto/user-data.ts` — add `avatarUrl` to `UserData`
+- `frontend/stores/auth.ts` — add `refreshUser()` action
+- `frontend/components/ui/AppTopNav.vue` — use `UserAvatar` + link "Mon profil" to `/profile`
+- `frontend/components/task/TaskCard.vue:47-59` — replace initials with `UserAvatar`
+- `frontend/pages/projects/[id]/archives.vue:49-55` — replace initials with `UserAvatar`
+- `frontend/components/admin/AdminClientTicketTab.vue:82` — use `UserAvatar` for submitter
+- `frontend/middleware/auth.global.ts` — allow `/profile` for all authenticated users
+
+---
+
+## Task 1: Backend — User entity + migration
+
+**Files:**
+- Modify: `src/Entity/User.php`
+- Create: migration file (generated)
+
+- [ ] **Step 1: Add `avatarFileName` field to User entity**
+
+In `src/Entity/User.php`, add after the `$apiToken` field:
+
+```php
+#[ORM\Column(length: 255, nullable: true)]
+#[Groups(['me:read', 'user:list'])]
+private ?string $avatarFileName = null;
+```
+
+Add getter/setter:
+
+```php
+public function getAvatarFileName(): ?string
+{
+    return $this->avatarFileName;
+}
+
+public function setAvatarFileName(?string $avatarFileName): static
+{
+    $this->avatarFileName = $avatarFileName;
+
+    return $this;
+}
+```
+
+Add virtual `avatarUrl` getter (serialized, read-only):
+
+```php
+#[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+public function getAvatarUrl(): ?string
+{
+    if (null === $this->avatarFileName) {
+        return null;
+    }
+
+    return '/api/users/' . $this->id . '/avatar';
+}
+```
+
+- [ ] **Step 2: Generate and run migration**
+
+```bash
+docker exec -t php-lesstime-fpm php bin/console doctrine:migrations:diff
+docker exec -t php-lesstime-fpm php bin/console doctrine:migrations:migrate --no-interaction
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/Entity/User.php migrations/
+git commit -m "feat(avatar) : add avatarFileName field to User entity"
+```
+
+---
+
+## Task 2: Backend — Avatar controller
+
+**Files:**
+- Create: `src/Controller/UserAvatarController.php`
+- Modify: `config/services.yaml`
+
+- [ ] **Step 1: Add `avatar_upload_dir` parameter in `config/services.yaml`**
+
+Add to `parameters:` section:
+
+```yaml
+avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'
+```
+
+Add service wiring:
+
+```yaml
+App\Controller\UserAvatarController:
+    arguments:
+        $avatarUploadDir: '%avatar_upload_dir%'
+```
+
+- [ ] **Step 2: Create `UserAvatarController.php`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+
+class UserAvatarController extends AbstractController
+{
+    private const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5 MB
+    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly string $avatarUploadDir,
+    ) {}
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_upload', methods: ['POST'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function upload(int $id, Request $request): JsonResponse
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $file = $request->files->get('file');
+
+        if (null === $file || !$file->isValid()) {
+            throw new BadRequestHttpException('No valid file uploaded.');
+        }
+
+        if ($file->getSize() > self::MAX_FILE_SIZE) {
+            throw new BadRequestHttpException('File size exceeds 5 MB limit.');
+        }
+
+        $mimeType = $file->getClientMimeType();
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException('Invalid file type. Allowed: JPEG, PNG, WebP, GIF.');
+        }
+
+        // Delete previous avatar file if exists
+        $this->deleteAvatarFile($user);
+
+        $extension = $file->guessExtension() ?? 'bin';
+        $fileName = Uuid::v4()->toRfc4122() . '.' . $extension;
+
+        if (!is_dir($this->avatarUploadDir)) {
+            mkdir($this->avatarUploadDir, 0o775, true);
+        }
+
+        $file->move($this->avatarUploadDir, $fileName);
+
+        $user->setAvatarFileName($fileName);
+        $this->entityManager->flush();
+
+        return new JsonResponse(['avatarUrl' => $user->getAvatarUrl()]);
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_serve', methods: ['GET'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function serve(int $id): BinaryFileResponse
+    {
+        $user = $this->findUserOrFail($id);
+
+        if (null === $user->getAvatarFileName()) {
+            throw new NotFoundHttpException('No avatar set.');
+        }
+
+        $filePath = $this->avatarUploadDir . '/' . $user->getAvatarFileName();
+
+        if (!file_exists($filePath)) {
+            throw new NotFoundHttpException('Avatar file not found on disk.');
+        }
+
+        $response = new BinaryFileResponse($filePath);
+        $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_INLINE, $user->getAvatarFileName());
+        $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
+        $mimeMap = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
+        $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
+        $response->headers->set('Cache-Control', 'public, max-age=86400');
+
+        return $response;
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_delete', methods: ['DELETE'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function delete(int $id): Response
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $this->deleteAvatarFile($user);
+        $user->setAvatarFileName(null);
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+
+    private function findUserOrFail(int $id): User
+    {
+        $user = $this->entityManager->getRepository(User::class)->find($id);
+
+        if (null === $user) {
+            throw new NotFoundHttpException('User not found.');
+        }
+
+        return $user;
+    }
+
+    private function assertCanManageAvatar(User $user): void
+    {
+        $currentUser = $this->getUser();
+
+        if ($currentUser !== $user && !$this->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedHttpException('You can only manage your own avatar.');
+        }
+    }
+
+    private function deleteAvatarFile(User $user): void
+    {
+        if (null === $user->getAvatarFileName()) {
+            return;
+        }
+
+        $filePath = $this->avatarUploadDir . '/' . $user->getAvatarFileName();
+
+        if (file_exists($filePath)) {
+            unlink($filePath);
+        }
+    }
+}
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/Controller/UserAvatarController.php config/services.yaml
+git commit -m "feat(avatar) : add avatar upload/serve/delete controller"
+```
+
+---
+
+## Task 3: Frontend — Install vue-advanced-cropper + DTO + service
+
+**Files:**
+- Modify: `frontend/services/dto/user-data.ts`
+- Create: `frontend/services/avatar.ts`
+- Modify: `frontend/stores/auth.ts`
+
+- [ ] **Step 1: Install vue-advanced-cropper**
+
+```bash
+cd frontend && npm install vue-advanced-cropper
+```
+
+- [ ] **Step 2: Update `UserData` DTO**
+
+In `frontend/services/dto/user-data.ts`, add `avatarUrl` to `UserData`:
+
+```typescript
+export type UserData = {
+    id: number
+    '@id'?: string
+    username: string
+    roles: string[]
+    client?: { id: number; name: string } | null
+    allowedProjects?: Project[]
+    avatarUrl?: string | null
+}
+```
+
+- [ ] **Step 3: Create `frontend/services/avatar.ts`**
+
+```typescript
+export function useAvatarService() {
+    const api = useApi()
+
+    async function upload(userId: number, file: Blob): Promise<{ avatarUrl: string }> {
+        const formData = new FormData()
+        formData.append('file', file, 'avatar.png')
+
+        return $fetch(`/api/users/${userId}/avatar`, {
+            method: 'POST',
+            body: formData,
+            credentials: 'include',
+        })
+    }
+
+    async function remove(userId: number): Promise<void> {
+        await api.delete(`/users/${userId}/avatar`)
+    }
+
+    function getUrl(userId: number): string {
+        return `/api/users/${userId}/avatar`
+    }
+
+    return { upload, remove, getUrl }
+}
+```
+
+- [ ] **Step 4: Add `refreshUser` to auth store**
+
+In `frontend/stores/auth.ts`, add to actions:
+
+```typescript
+async refreshUser() {
+    try {
+        const me = await getCurrentUser()
+        this.user = me
+    } catch {
+        // Silently fail — user session might have expired
+    }
+}
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add frontend/package.json frontend/package-lock.json frontend/services/dto/user-data.ts frontend/services/avatar.ts frontend/stores/auth.ts
+git commit -m "feat(avatar) : add avatar service, DTO update, and cropper dependency"
+```
+
+---
+
+## Task 4: Frontend — UserAvatar component
+
+**Files:**
+- Create: `frontend/components/user/UserAvatar.vue`
+
+- [ ] **Step 1: Create `UserAvatar.vue`**
+
+```vue
+<template>
+    <span
+        class="inline-flex shrink-0 items-center justify-center rounded-full"
+        :class="sizeClasses"
+        :title="user.username"
+    >
+        <img
+            v-if="user.avatarUrl && !imgError"
+            :src="user.avatarUrl"
+            :alt="user.username"
+            class="h-full w-full rounded-full object-cover"
+            @error="imgError = true"
+        />
+        <span
+            v-else
+            class="flex h-full w-full items-center justify-center rounded-full bg-primary-500 font-bold text-white"
+            :class="textSizeClass"
+        >
+            {{ user.username.substring(0, 2).toUpperCase() }}
+        </span>
+    </span>
+</template>
+
+<script setup lang="ts">
+const props = defineProps<{
+    user: { id?: number; username: string; avatarUrl?: string | null }
+    size?: 'xs' | 'sm' | 'md' | 'lg'
+}>()
+
+const imgError = ref(false)
+
+watch(() => props.user.avatarUrl, () => {
+    imgError.value = false
+})
+
+const sizeClasses = computed(() => {
+    const map = {
+        xs: 'h-5 w-5',
+        sm: 'h-6 w-6',
+        md: 'h-8 w-8',
+        lg: 'h-12 w-12',
+    }
+    return map[props.size ?? 'sm']
+})
+
+const textSizeClass = computed(() => {
+    const map = {
+        xs: 'text-[10px]',
+        sm: 'text-xs',
+        md: 'text-sm',
+        lg: 'text-base',
+    }
+    return map[props.size ?? 'sm']
+})
+</script>
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add frontend/components/user/UserAvatar.vue
+git commit -m "feat(avatar) : add UserAvatar component with image/initials fallback"
+```
+
+---
+
+## Task 5: Frontend — AvatarCropper component
+
+**Files:**
+- Create: `frontend/components/user/AvatarCropper.vue`
+
+- [ ] **Step 1: Create `AvatarCropper.vue`**
+
+```vue
+<template>
+    <Teleport to="body">
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+            <div class="w-full max-w-md rounded-xl bg-white p-6 shadow-2xl">
+                <h3 class="mb-4 text-lg font-bold text-neutral-900">
+                    {{ $t('profile.cropAvatar') }}
+                </h3>
+
+                <div class="mx-auto mb-4 h-72 w-72">
+                    <Cropper
+                        ref="cropperRef"
+                        :src="imageSrc"
+                        :stencil-component="CircleStencil"
+                        :stencil-props="{ aspectRatio: 1 }"
+                        :canvas="{ width: 256, height: 256 }"
+                        class="h-full w-full"
+                    />
+                </div>
+
+                <div class="flex justify-end gap-3">
+                    <button
+                        type="button"
+                        class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-medium text-neutral-700 hover:bg-neutral-50"
+                        @click="emit('cancel')"
+                    >
+                        {{ $t('common.cancel') }}
+                    </button>
+                    <button
+                        type="button"
+                        class="rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white hover:bg-secondary-500"
+                        :disabled="cropping"
+                        @click="onConfirm"
+                    >
+                        {{ $t('common.confirm') }}
+                    </button>
+                </div>
+            </div>
+        </div>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+import { Cropper, CircleStencil } from 'vue-advanced-cropper'
+import 'vue-advanced-cropper/dist/style.css'
+
+const props = defineProps<{
+    imageFile: File
+}>()
+
+const emit = defineEmits<{
+    (e: 'crop', blob: Blob): void
+    (e: 'cancel'): void
+}>()
+
+const cropperRef = ref()
+const cropping = ref(false)
+const imageSrc = ref('')
+
+onMounted(() => {
+    imageSrc.value = URL.createObjectURL(props.imageFile)
+})
+
+onUnmounted(() => {
+    if (imageSrc.value) {
+        URL.revokeObjectURL(imageSrc.value)
+    }
+})
+
+async function onConfirm() {
+    cropping.value = true
+
+    try {
+        const { canvas } = cropperRef.value.getResult()
+
+        if (!canvas) return
+
+        const blob = await new Promise<Blob | null>((resolve) => {
+            canvas.toBlob(resolve, 'image/png')
+        })
+
+        if (blob) {
+            emit('crop', blob)
+        }
+    } finally {
+        cropping.value = false
+    }
+}
+</script>
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add frontend/components/user/AvatarCropper.vue
+git commit -m "feat(avatar) : add AvatarCropper modal with vue-advanced-cropper"
+```
+
+---
+
+## Task 6: Frontend — Profile page
+
+**Files:**
+- Create: `frontend/pages/profile.vue`
+- Modify: `frontend/middleware/auth.global.ts`
+
+- [ ] **Step 1: Create `frontend/pages/profile.vue`**
+
+```vue
+<template>
+    <div class="mx-auto max-w-lg px-4 py-10">
+        <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
+
+        <div class="flex flex-col items-center gap-6 rounded-xl border border-neutral-200 bg-white p-8 shadow-sm">
+            <!-- Current avatar -->
+            <UserAvatar
+                v-if="auth.user"
+                :user="auth.user"
+                size="lg"
+            />
+
+            <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
+
+            <div class="flex gap-3">
+                <label
+                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                >
+                    {{ $t('profile.changeAvatar') }}
+                    <input
+                        type="file"
+                        accept="image/jpeg,image/png,image/webp,image/gif"
+                        class="hidden"
+                        @change="onFileSelect"
+                    />
+                </label>
+
+                <button
+                    v-if="auth.user?.avatarUrl"
+                    type="button"
+                    class="rounded-lg border border-red-300 px-4 py-2 text-sm font-medium text-red-600 hover:bg-red-50"
+                    :disabled="removing"
+                    @click="onRemove"
+                >
+                    {{ $t('profile.removeAvatar') }}
+                </button>
+            </div>
+        </div>
+
+        <!-- Crop modal -->
+        <AvatarCropper
+            v-if="selectedFile"
+            :image-file="selectedFile"
+            @crop="onCrop"
+            @cancel="selectedFile = null"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+const auth = useAuthStore()
+const { upload, remove } = useAvatarService()
+
+const selectedFile = ref<File | null>(null)
+const removing = ref(false)
+
+function onFileSelect(event: Event) {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0]
+    if (file) {
+        selectedFile.value = file
+    }
+    input.value = ''
+}
+
+async function onCrop(blob: Blob) {
+    selectedFile.value = null
+    if (!auth.user) return
+
+    await upload(auth.user.id, blob)
+    await auth.refreshUser()
+}
+
+async function onRemove() {
+    if (!auth.user) return
+    removing.value = true
+
+    try {
+        await remove(auth.user.id)
+        await auth.refreshUser()
+    } finally {
+        removing.value = false
+    }
+}
+</script>
+```
+
+- [ ] **Step 2: Allow `/profile` for ROLE_CLIENT in middleware**
+
+In `frontend/middleware/auth.global.ts`, update the client redirect block to also allow `/profile`:
+
+Change:
+```typescript
+if (!isPortalRoute && !isLoginRoute) {
+```
+To:
+```typescript
+const isProfileRoute = to.path === '/profile'
+if (!isPortalRoute && !isLoginRoute && !isProfileRoute) {
+```
+
+- [ ] **Step 3: Add i18n keys**
+
+In `frontend/i18n/locales/fr.json`, add under a `"profile"` key:
+
+```json
+"profile": {
+    "title": "Mon profil",
+    "changeAvatar": "Changer l'avatar",
+    "removeAvatar": "Supprimer l'avatar",
+    "cropAvatar": "Recadrer l'avatar"
+}
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add frontend/pages/profile.vue frontend/middleware/auth.global.ts frontend/i18n/locales/fr.json
+git commit -m "feat(avatar) : add profile page with avatar upload and crop"
+```
+
+---
+
+## Task 7: Frontend — Replace initials everywhere
+
+**Files:**
+- Modify: `frontend/components/ui/AppTopNav.vue`
+- Modify: `frontend/components/task/TaskCard.vue`
+- Modify: `frontend/pages/projects/[id]/archives.vue`
+- Modify: `frontend/components/admin/AdminClientTicketTab.vue`
+
+- [ ] **Step 1: Update `AppTopNav.vue`**
+
+Replace the icon + username display (lines 12-14):
+
+```vue
+<Icon name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+```
+
+With:
+
+```vue
+<UserAvatar v-if="user" :user="user" size="md" class="cursor-pointer" />
+<Icon v-else name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+```
+
+Make "Mon profil" button navigate to `/profile`:
+
+```vue
+<button
+    type="button"
+    class="block w-full px-3 py-2 text-left hover:bg-neutral-100"
+    @click="navigateTo('/profile')"
+>
+    Mon profil
+</button>
+```
+
+- [ ] **Step 2: Update `TaskCard.vue`**
+
+Replace lines 47-59 (the assignee initials span + empty state):
+
+```vue
+<UserAvatar
+    v-if="task.assignee"
+    :user="task.assignee"
+    size="xs"
+    class="ml-auto"
+/>
+<span
+    v-else
+    class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-neutral-200 text-neutral-400"
+>
+    <Icon name="mdi:account-outline" size="14" />
+</span>
+```
+
+- [ ] **Step 3: Update `archives.vue`**
+
+Replace lines 49-55 (the assignee initials span):
+
+```vue
+<UserAvatar
+    v-if="task.assignee"
+    :user="task.assignee"
+    size="xs"
+/>
+```
+
+- [ ] **Step 4: Update `AdminClientTicketTab.vue`**
+
+Replace the submitter `<td>` at line 82. The `getSubmitterName` function returns a username string. We need to look up the full user to get `avatarUrl`. Modify the function and display:
+
+Change the `<td>`:
+```vue
+<td class="px-3 py-3 text-neutral-600">
+    <div class="flex items-center gap-2">
+        <UserAvatar
+            v-if="getSubmitterUser(ticket.submittedBy)"
+            :user="getSubmitterUser(ticket.submittedBy)!"
+            size="sm"
+        />
+        {{ getSubmitterName(ticket.submittedBy) }}
+    </div>
+</td>
+```
+
+Add helper function:
+```typescript
+function getSubmitterUser(iri: string | null): UserData | undefined {
+    if (!iri) return undefined
+    const match = iri.match(/\/api\/users\/(\d+)/)
+    if (!match) return undefined
+    const id = Number(match[1])
+    return users.value.find(u => u.id === id)
+}
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add frontend/components/ui/AppTopNav.vue frontend/components/task/TaskCard.vue frontend/pages/projects/[id]/archives.vue frontend/components/admin/AdminClientTicketTab.vue
+git commit -m "feat(avatar) : replace initials with UserAvatar component everywhere"
+```
+
+---
+
+## Task 8: Manual testing
+
+- [ ] **Step 1: Rebuild and test**
+
+```bash
+make dev-nuxt
+```
+
+- [ ] **Step 2: Test flow**
+
+1. Login as `admin` / `admin`
+2. Navigate to profile via header dropdown → "Mon profil"
+3. Upload an image → verify crop modal appears with circular stencil
+4. Confirm crop → verify avatar appears on profile page
+5. Check header — avatar should replace the icon
+6. Navigate to a project board — assignee cards should show avatar
+7. Navigate to archives — same check
+8. Go to admin ticket tab — submitter should show avatar + name
+9. Remove avatar → verify initials return everywhere
+10. Login as `client-liot` / `client` → verify profile page accessible from portal
+
+- [ ] **Step 3: Final commit if any fixes needed**

docs/superpowers/specs/2026-03-15-user-avatar-design.md

@@ -0,0 +1,112 @@
+# User Avatar — Design Spec
+
+## Goal
+
+Allow users to upload a profile avatar image (with client-side circular crop) that replaces initials everywhere in the app.
+
+## Backend
+
+### Entity Changes
+
+**User** — add nullable field:
+- `avatarFileName: ?string` (length 255) — UUID-based filename stored on disk
+
+### Storage
+
+- Directory: `var/uploads/avatars/`
+- Parameter in `services.yaml`: `avatar_upload_dir`
+
+### Endpoints
+
+All under `/api/users/{id}/avatar`:
+
+| Method | Description | Auth |
+|--------|-------------|------|
+| `POST` | Upload avatar (multipart file) | Owner or ROLE_ADMIN |
+| `GET` | Serve avatar image (inline) | ROLE_USER or ROLE_CLIENT |
+| `DELETE` | Remove avatar | Owner or ROLE_ADMIN |
+
+**POST** accepts a single `file` field. Validates: image MIME (jpeg, png, webp, gif), max 5 MB. Stores with UUID filename, updates `avatarFileName`. Deletes previous file if exists.
+
+**GET** returns the image with proper `Content-Type`. Returns 404 if no avatar.
+
+**DELETE** removes file from disk, sets `avatarFileName` to null.
+
+These are custom Symfony controllers (not API Platform resources) under `/api/` with `priority: 1`.
+
+### Serialization
+
+Add a virtual `avatarUrl` field to User serialization (group `user:read`):
+- If `avatarFileName` is set: `/api/users/{id}/avatar`
+- If null: `null`
+
+This way the frontend knows if an avatar exists from any user payload.
+
+### Migration
+
+- Add `avatar_file_name` column (VARCHAR 255, nullable) to `user` table.
+
+## Frontend
+
+### New Components
+
+**`UserAvatar.vue`** (`frontend/components/user/UserAvatar.vue`):
+- Props: `user: { id: number, username: string, avatarUrl?: string | null }`, `size: 'xs' | 'sm' | 'md' | 'lg'`
+- Sizes: xs=20px, sm=24px, md=32px, lg=48px
+- If `avatarUrl`: `<img>` rounded-full, object-cover
+- Else: initials badge (current bg-primary-500 style), 2 first chars of username uppercased
+- Handles `@error` on img to fallback to initials (broken image)
+
+**`AvatarCropper.vue`** (`frontend/components/user/AvatarCropper.vue`):
+- Uses `vue-advanced-cropper` with `CircleStencil`
+- Props: `imageFile: File`
+- Emits: `crop(blob: Blob)`, `cancel`
+- Fixed output size: 256x256px
+- Modal overlay with crop area + confirm/cancel buttons
+
+### New Page
+
+**`/profile`** (`frontend/pages/profile.vue`):
+- Shows current avatar (large) with "Change" button
+- File input triggers AvatarCropper modal
+- On confirm: POST blob to `/api/users/{id}/avatar`
+- On success: refresh auth store user data
+- "Remove avatar" button if avatar exists
+- Accessible from "Mon profil" button in AppTopNav dropdown
+
+### New Service
+
+**`frontend/services/avatar.ts`**:
+- `upload(userId: number, file: Blob): Promise<void>` — POST multipart
+- `remove(userId: number): Promise<void>` — DELETE
+- `getUrl(userId: number): string` — returns URL path
+
+### DTO Update
+
+**`UserData`** — add: `avatarUrl?: string | null`
+
+### Replacement Points
+
+Replace initials/icon with `<UserAvatar>` in:
+
+| File | Current display | Size |
+|------|----------------|------|
+| `TaskCard.vue:48-53` | Initials badge (h-5 w-5) | xs |
+| `archives.vue:50-55` | Initials badge (h-5 w-5) | xs |
+| `AppTopNav.vue:13` | `mdi:account-circle-outline` icon | md |
+| `AdminClientTicketTab.vue` | Username text for submitter | sm |
+| `ClientTicketDetailModal.vue` | submittedBy display | sm |
+
+### Auth Store
+
+After avatar upload/delete, re-fetch current user data so `avatarUrl` updates everywhere reactively.
+
+## Dependencies
+
+- `vue-advanced-cropper` — npm install in frontend/
+
+## Out of Scope
+
+- Server-side image processing/resize
+- Multiple image formats conversion
+- Avatar for clients (entities), only users

frontend/components/admin/AdminBookStackTab.vue

@@ -10,15 +10,13 @@
                 input-class="w-full"
             />
 
-            <div>
-                <MalioInputText
-                    v-model="form.tokenId"
-                    :label="$t('bookstack.settings.tokenId')"
-                    :placeholder="$t('bookstack.settings.tokenIdPlaceholder')"
-                    input-class="w-full"
-                    type="password"
-                />
-            </div>
+            <MalioInputText
+                v-model="form.tokenId"
+                :label="$t('bookstack.settings.tokenId')"
+                :placeholder="$t('bookstack.settings.tokenIdPlaceholder')"
+                input-class="w-full"
+                type="password"
+            />
 
             <div>
                 <MalioInputText

frontend/components/admin/AdminClientTicketTab.vue

@@ -79,7 +79,16 @@
                             </span>
                         </td>
                         <td class="px-3 py-3 text-neutral-600">{{ getProjectName(ticket.project) }}</td>
-                        <td class="px-3 py-3 text-neutral-600">{{ getSubmitterName(ticket.submittedBy) }}</td>
+                        <td class="px-3 py-3 text-neutral-600">
+                            <div class="flex items-center gap-2">
+                                <UserAvatar
+                                    v-if="getSubmitterUser(ticket.submittedBy)"
+                                    :user="getSubmitterUser(ticket.submittedBy)!"
+                                    size="sm"
+                                />
+                                {{ getSubmitterName(ticket.submittedBy) }}
+                            </div>
+                        </td>
                         <td class="px-3 py-3 text-neutral-400">{{ formatDate(ticket.createdAt) }}</td>
                         <td class="px-3 py-3">
                             <div class="flex items-center gap-2">
@@ -216,7 +225,7 @@ const { t } = useI18n()
 const clientTicketService = useClientTicketService()
 const projectService = useProjectService()
 const userService = useUserService()
-const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()
+const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()
 
 const tickets = ref<ClientTicket[]>([])
 const projects = ref<Project[]>([])
@@ -261,19 +270,7 @@ const detailTicket = ref<ClientTicket | null>(null)
 
 const availableStatusTransitions = computed(() => {
     if (!statusTarget.value) return []
-    const current = statusTarget.value.status
-    const allStatuses: { label: string; value: ClientTicketStatus }[] = [
-        { label: t('clientTicket.status.new'), value: 'new' },
-        { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
-        { label: t('clientTicket.status.done'), value: 'done' },
-        { label: t('clientTicket.status.rejected'), value: 'rejected' },
-    ]
-    // Filter out forbidden transitions
-    return allStatuses.filter(s => {
-        if (s.value === current) return false
-        if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
-        return true
-    })
+    return getAvailableStatusTransitions(statusTarget.value.status, t)
 })
 
 function getProjectName(iri: string): string {
@@ -291,6 +288,14 @@ function getSubmitterName(iri: string | null): string {
     return users.value.find(u => u.id === id)?.username ?? ''
 }
 
+function getSubmitterUser(iri: string | null): UserData | undefined {
+    if (!iri) return undefined
+    const match = iri.match(/\/api\/users\/(\d+)/)
+    if (!match) return undefined
+    const id = Number(match[1])
+    return users.value.find(u => u.id === id)
+}
+
 function openDetail(ticket: ClientTicket) {
     detailTicket.value = ticket
     detailOpen.value = true

frontend/components/client-ticket/ProjectClientTickets.vue

@@ -211,7 +211,7 @@ const props = defineProps<{
 
 const { t } = useI18n()
 const clientTicketService = useClientTicketService()
-const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()
+const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()
 
 const isOpen = ref(false)
 const isLoading = ref(false)
@@ -238,18 +238,7 @@ const isUpdatingStatus = ref(false)
 
 const availableStatusTransitions = computed(() => {
     if (!statusTarget.value) return []
-    const current = statusTarget.value.status
-    const allStatuses: { label: string; value: ClientTicketStatus }[] = [
-        { label: t('clientTicket.status.new'), value: 'new' },
-        { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
-        { label: t('clientTicket.status.done'), value: 'done' },
-        { label: t('clientTicket.status.rejected'), value: 'rejected' },
-    ]
-    return allStatuses.filter(s => {
-        if (s.value === current) return false
-        if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
-        return true
-    })
+    return getAvailableStatusTransitions(statusTarget.value.status, t)
 })
 
 async function loadTickets() {

frontend/components/project/ProjectGroupTab.vue

@@ -117,7 +117,7 @@ async function loadItems() {
         const [g, t, at] = await Promise.all([
             groupService.getByProject(props.projectId),
             taskService.getByProject(props.projectId),
-            taskService.getByProjectArchived(props.projectId),
+            taskService.getByProject(props.projectId, true),
         ])
         allGroups.value = g
         activeTasks.value = t

frontend/components/task/TaskCard.vue

@@ -44,13 +44,12 @@
             >
                 {{ tag.label }}
             </span>
-            <span
+            <UserAvatar
                 v-if="task.assignee"
-                class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-primary-500 text-[10px] font-bold text-white"
-                :title="task.assignee.username"
-            >
-                {{ task.assignee.username.substring(0, 2).toUpperCase() }}
-            </span>
+                :user="task.assignee"
+                size="xs"
+                class="ml-auto"
+            />
             <span
                 v-else
                 class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-neutral-200 text-neutral-400"

frontend/components/task/TaskDocumentList.vue

@@ -28,12 +28,13 @@
                 <!-- File info -->
                 <div class="min-w-0 flex-1">
                     <p class="truncate text-xs font-medium text-neutral-700">{{ doc.originalName }}</p>
-                    <p class="text-xs text-neutral-400">{{ formatSize(doc.size) }}</p>
+                    <p class="text-xs text-neutral-400">{{ formatFileSize(doc.size) }}</p>
                 </div>
 
                 <!-- Delete button -->
                 <button
                     v-if="isAdmin"
+                    type="button"
                     class="absolute right-1 top-1 hidden rounded p-0.5 text-neutral-400 transition-colors hover:bg-red-50 hover:text-red-500 group-hover:block"
                     @click.stop="$emit('delete', doc)"
                 >
@@ -47,6 +48,7 @@
 <script setup lang="ts">
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { formatFileSize } from '~/utils/format'
 
 defineProps<{
     documents: TaskDocument[]
@@ -72,9 +74,4 @@ function getIconForMime(mimeType: string): string {
     return 'heroicons:paper-clip'
 }
 
-function formatSize(bytes: number): string {
-    if (bytes < 1024) return `${bytes} o`
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
-    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
-}
 </script>

frontend/components/task/TaskDocumentPreview.vue

@@ -56,7 +56,7 @@
                     <div v-else class="flex flex-col items-center gap-4 rounded-xl bg-white p-10">
                         <Icon name="heroicons:document" class="h-16 w-16 text-neutral-400" />
                         <p class="max-w-xs truncate text-lg font-medium text-neutral-700">{{ document.originalName }}</p>
-                        <p class="text-sm text-neutral-400">{{ formatSize(document.size) }}</p>
+                        <p class="text-sm text-neutral-400">{{ formatFileSize(document.size) }}</p>
                         <a
                             :href="downloadUrl"
                             download
@@ -77,6 +77,7 @@
 <script setup lang="ts">
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { formatFileSize } from '~/utils/format'
 
 const props = defineProps<{
     document: TaskDocument | null
@@ -98,12 +99,6 @@ const downloadUrl = computed(() => props.document ? getDownloadUrl(props.documen
 const isImage = computed(() => props.document?.mimeType.startsWith('image/') ?? false)
 const isPdf = computed(() => props.document?.mimeType === 'application/pdf')
 
-function formatSize(bytes: number): string {
-    if (bytes < 1024) return `${bytes} o`
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
-    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
-}
-
 // Focus overlay for keyboard events
 watch(() => props.document, (doc) => {
     if (doc) {

frontend/components/task/TaskModal.vue

@@ -65,6 +65,20 @@
                             @blur="touched.title = true"
                         />
 
+                        <!-- Project select (create mode with project list) -->
+                        <div v-if="showProjectSelect" class="mt-4">
+                            <MalioSelect
+                                v-model="form.projectId"
+                                :options="projectOptions"
+                                label="Projet *"
+                                empty-option-label="Sélectionner un projet"
+                                min-width="w-full"
+                            />
+                            <p v-if="touched.project && !form.projectId" class="mt-1 text-xs text-red-500">
+                                Le projet est requis
+                            </p>
+                        </div>
+
                         <!-- Two-column selects -->
                         <div class="mt-4 grid grid-cols-1 gap-x-6 gap-y-4 sm:grid-cols-2">
                             <MalioSelect
@@ -154,7 +168,7 @@
                         />
                         <TaskDocumentList
                             v-if="isEditing && task"
-                            :documents="documents"
+                            :documents="localDocuments"
                             :is-admin="isAdmin"
                             @preview="openPreview"
                             @delete="handleDeleteDocument"
@@ -164,7 +178,7 @@
                         <TaskDocumentPreview
                             :document="previewDoc"
                             :has-prev="previewIndex > 0"
-                            :has-next="previewIndex < documents.length - 1"
+                            :has-next="previewIndex < localDocuments.length - 1"
                             @close="previewDoc = null"
                             @prev="prevPreview"
                             @next="nextPreview"
@@ -266,6 +280,8 @@ import type { TaskGroup } from '~/services/dto/task-group'
 import type { UserData } from '~/services/dto/user-data'
 import { useTaskService } from '~/services/tasks'
 
+import type { Project } from '~/services/dto/project'
+
 const props = defineProps<{
     modelValue: boolean
     task: Task | null
@@ -276,6 +292,7 @@ const props = defineProps<{
     tags: TaskTag[]
     groups: TaskGroup[]
     users: UserData[]
+    projects?: Project[]
 }>()
 
 const emit = defineEmits<{
@@ -289,6 +306,7 @@ const isOpen = computed({
 })
 
 function close() {
+    if (confirmDeleteDocOpen.value || confirmDeleteOpen.value) return
     isOpen.value = false
 }
 
@@ -317,10 +335,12 @@ const form = reactive({
     groupId: null as number | null,
     tagIds: [] as number[],
     clientTicketId: null as number | null,
+    projectId: null as number | null,
 })
 
 const touched = reactive({
     title: false,
+    project: false,
 })
 
 const statusOptions = computed(() =>
@@ -339,8 +359,22 @@ const userOptions = computed(() =>
     props.users.map(u => ({ label: u.username, value: u.id }))
 )
 
-const groupOptions = computed(() =>
-    props.groups.map(g => ({ label: g.title, value: g.id }))
+const groupOptions = computed(() => {
+    let filtered = props.groups
+    if (showProjectSelect.value && form.projectId) {
+        filtered = filtered.filter(g => g.project?.id === form.projectId)
+    }
+    return filtered.map(g => ({ label: g.title, value: g.id }))
+})
+
+const showProjectSelect = computed(() => !!props.projects?.length && !isEditing.value)
+
+const projectOptions = computed(() =>
+    (props.projects ?? []).map(p => ({ label: p.name, value: p.id }))
+)
+
+const resolvedProjectId = computed(() =>
+    showProjectSelect.value ? form.projectId : props.projectId
 )
 
 const canArchive = computed(() => {
@@ -384,18 +418,35 @@ function populateForm(task: Task | null) {
         form.groupId = null
         form.tagIds = []
         form.clientTicketId = null
+        form.projectId = null
     }
     touched.title = false
+    touched.project = false
 }
 
 watch(() => props.modelValue, async (open) => {
     if (open) {
+        confirmDeleteDocOpen.value = false
+        documentToDelete.value = null
         populateForm(props.task)
-        try {
-            clientTickets.value = await clientTicketService.getAll({ project: props.projectId })
-        } catch {
+        const pid = resolvedProjectId.value
+        if (pid) {
+            try {
+                clientTickets.value = await clientTicketService.getAll({ project: pid })
+            } catch {
+                clientTickets.value = []
+            }
+        } else {
             clientTickets.value = []
         }
+        if (props.task?.project?.giteaOwner && props.task?.project?.giteaRepo && !giteaUrl.value) {
+            try {
+                const settings = await getGiteaSettings()
+                giteaUrl.value = settings.url ?? ''
+            } catch {
+                // Gitea not available
+            }
+        }
     }
 })
 
@@ -405,17 +456,6 @@ watch(() => props.task, (task) => {
     }
 })
 
-watch(() => props.modelValue, async (open) => {
-    if (open && props.task?.project?.giteaOwner && props.task?.project?.giteaRepo && !giteaUrl.value) {
-        try {
-            const settings = await getGiteaSettings()
-            giteaUrl.value = settings.url ?? ''
-        } catch {
-            // Gitea not available
-        }
-    }
-})
-
 const { create, update, remove } = useTaskService()
 const { remove: removeDocument, getByTask: getDocumentsByTask } = useTaskDocumentService()
 const clientTicketService = useClientTicketService()
@@ -426,6 +466,22 @@ const clientTicketOptions = computed(() =>
     clientTickets.value.map(ct => ({ label: `CT-${String(ct.number).padStart(3, '0')} — ${ct.title}`, value: ct.id }))
 )
 
+// Reset group and reload client tickets when project changes in create mode
+watch(() => form.projectId, async (pid) => {
+    if (!showProjectSelect.value) return
+    form.groupId = null
+    form.clientTicketId = null
+    if (pid) {
+        try {
+            clientTickets.value = await clientTicketService.getAll({ project: pid })
+        } catch {
+            clientTickets.value = []
+        }
+    } else {
+        clientTickets.value = []
+    }
+})
+
 const authStore = useAuthStore()
 const isAdmin = computed(() => authStore.user?.roles?.includes('ROLE_ADMIN') ?? false)
 
@@ -440,7 +496,6 @@ function ticketStatusClass(status: string): string {
 }
 
 const localDocuments = ref<TaskDocument[]>([])
-const documents = computed(() => localDocuments.value)
 const previewDoc = ref<TaskDocument | null>(null)
 
 // Sync documents from task prop when modal opens or task changes
@@ -455,7 +510,7 @@ async function refreshDocuments() {
 
 const previewIndex = computed(() => {
     if (!previewDoc.value) return -1
-    return documents.value.findIndex(d => d.id === previewDoc.value!.id)
+    return localDocuments.value.findIndex(d => d.id === previewDoc.value!.id)
 })
 
 function openPreview(doc: TaskDocument) {
@@ -464,13 +519,13 @@ function openPreview(doc: TaskDocument) {
 
 function prevPreview() {
     if (previewIndex.value > 0) {
-        previewDoc.value = documents.value[previewIndex.value - 1]
+        previewDoc.value = localDocuments.value[previewIndex.value - 1]
     }
 }
 
 function nextPreview() {
-    if (previewIndex.value < documents.value.length - 1) {
-        previewDoc.value = documents.value[previewIndex.value + 1]
+    if (previewIndex.value < localDocuments.value.length - 1) {
+        previewDoc.value = localDocuments.value[previewIndex.value + 1]
     }
 }
 
@@ -542,7 +597,9 @@ async function handleUnarchive() {
 
 async function handleSubmit() {
     touched.title = true
+    touched.project = true
     if (!form.title.trim()) return
+    if (showProjectSelect.value && !form.projectId) return
 
     isSubmitting.value = true
     try {
@@ -554,7 +611,7 @@ async function handleSubmit() {
             priority: form.priorityId ? `/api/task_priorities/${form.priorityId}` : null,
             assignee: form.assigneeId ? `/api/users/${form.assigneeId}` : null,
             group: form.groupId ? `/api/task_groups/${form.groupId}` : null,
-            project: `/api/projects/${props.projectId}`,
+            project: `/api/projects/${resolvedProjectId.value}`,
             tags: form.tagIds.map(id => `/api/task_tags/${id}`),
             clientTicket: form.clientTicketId ? `/api/client_tickets/${form.clientTicketId}` : null,
         }

frontend/components/ui/AppTopNav.vue

@@ -10,14 +10,16 @@
       <div class="ml-auto flex items-center gap-4 text-xl text-white sm:gap-8">
         <NotificationBell />
         <div class="group relative flex gap-2 sm:gap-4">
-          <Icon name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+          <UserAvatar v-if="user" :user="user" size="md" class="cursor-pointer" />
+          <Icon v-else name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
           <p class="hidden self-center cursor-pointer sm:block">{{ user?.username }}</p>
           <div class="invisible absolute right-0 top-full z-50 mt-2 w-44 rounded-md border border-neutral-200 bg-white py-1 text-sm text-neutral-800 opacity-0 shadow-lg transition-all group-hover:visible group-hover:opacity-100">
             <button
               type="button"
               class="block w-full px-3 py-2 text-left hover:bg-neutral-100"
+              @click="navigateTo('/profile')"
             >
-              Mon profil
+              {{ $t('profile.title') }}
             </button>
             <button
               type="button"
@@ -43,7 +45,7 @@ defineProps<{
 const auth = useAuthStore()
 const ui = useUiStore()
 
-const handleLogout = async () => {
+async function handleLogout() {
   await auth.logout()
   await navigateTo('/login')
 }

frontend/components/ui/ConfirmDeleteDocumentModal.vue

@@ -2,7 +2,7 @@
     <Teleport v-if="modelValue" to="body">
         <Transition name="modal" appear>
             <div class="fixed inset-0 z-[70] flex items-center justify-center">
-                <div class="absolute inset-0 bg-black/30" @click="cancel" />
+                <div class="absolute inset-0 bg-black/30" @click.stop="cancel" />
                 <div class="relative z-10 w-full max-w-md rounded-lg bg-white p-6 shadow-xl">
                     <h3 class="text-lg font-bold text-neutral-900">{{ $t('taskDocuments.confirmDeleteTitle') }}</h3>
                     <p class="mt-3 text-sm text-neutral-600">

frontend/components/user/AvatarCropper.vue

@@ -0,0 +1,88 @@
+<template>
+    <Teleport to="body">
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+            <div class="w-full max-w-md rounded-xl bg-white p-6 shadow-2xl">
+                <h3 class="mb-4 text-lg font-bold text-neutral-900">
+                    {{ $t('profile.cropAvatar') }}
+                </h3>
+
+                <div class="mx-auto mb-4 h-72 w-72">
+                    <Cropper
+                        ref="cropperRef"
+                        :src="imageSrc"
+                        :stencil-component="CircleStencil"
+                        :stencil-props="{ aspectRatio: 1 }"
+                        :canvas="{ width: 256, height: 256 }"
+                        class="h-full w-full"
+                    />
+                </div>
+
+                <div class="flex justify-end gap-3">
+                    <button
+                        type="button"
+                        class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-medium text-neutral-700 hover:bg-neutral-50"
+                        @click="emit('cancel')"
+                    >
+                        {{ $t('common.cancel') }}
+                    </button>
+                    <button
+                        type="button"
+                        class="rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white hover:bg-secondary-500"
+                        :disabled="cropping"
+                        @click="onConfirm"
+                    >
+                        {{ $t('common.confirm') }}
+                    </button>
+                </div>
+            </div>
+        </div>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+import { Cropper, CircleStencil } from 'vue-advanced-cropper'
+import 'vue-advanced-cropper/dist/style.css'
+
+const props = defineProps<{
+    imageFile: File
+}>()
+
+const emit = defineEmits<{
+    (e: 'crop', blob: Blob): void
+    (e: 'cancel'): void
+}>()
+
+const cropperRef = ref()
+const cropping = ref(false)
+const imageSrc = ref('')
+
+onMounted(() => {
+    imageSrc.value = URL.createObjectURL(props.imageFile)
+})
+
+onUnmounted(() => {
+    if (imageSrc.value) {
+        URL.revokeObjectURL(imageSrc.value)
+    }
+})
+
+async function onConfirm() {
+    cropping.value = true
+
+    try {
+        const { canvas } = cropperRef.value.getResult()
+
+        if (!canvas) return
+
+        const blob = await new Promise<Blob | null>((resolve) => {
+            canvas.toBlob(resolve, 'image/png')
+        })
+
+        if (blob) {
+            emit('crop', blob)
+        }
+    } finally {
+        cropping.value = false
+    }
+}
+</script>

frontend/components/user/UserAvatar.vue

@@ -0,0 +1,55 @@
+<template>
+    <span
+        class="inline-flex shrink-0 items-center justify-center rounded-full"
+        :class="sizeClasses"
+        :title="user.username"
+    >
+        <img
+            v-if="user.avatarUrl && !imgError"
+            :src="user.avatarUrl"
+            :alt="user.username"
+            class="h-full w-full rounded-full object-cover"
+            @error="imgError = true"
+        />
+        <span
+            v-else
+            class="flex h-full w-full items-center justify-center rounded-full bg-primary-500 font-bold text-white"
+            :class="textSizeClass"
+        >
+            {{ user.username.substring(0, 2).toUpperCase() }}
+        </span>
+    </span>
+</template>
+
+<script setup lang="ts">
+const props = defineProps<{
+    user: { id?: number; username: string; avatarUrl?: string | null }
+    size?: 'xs' | 'sm' | 'md' | 'lg'
+}>()
+
+const imgError = ref(false)
+
+watch(() => props.user.avatarUrl, () => {
+    imgError.value = false
+})
+
+const sizeClasses = computed(() => {
+    const map = {
+        xs: 'h-5 w-5',
+        sm: 'h-6 w-6',
+        md: 'h-8 w-8',
+        lg: 'h-12 w-12',
+    }
+    return map[props.size ?? 'sm']
+})
+
+const textSizeClass = computed(() => {
+    const map = {
+        xs: 'text-[10px]',
+        sm: 'text-xs',
+        md: 'text-sm',
+        lg: 'text-base',
+    }
+    return map[props.size ?? 'sm']
+})
+</script>

frontend/composables/useApi.ts

@@ -29,13 +29,14 @@ export type ApiFetchOptions<ResponseType extends 'json' | 'blob'> =
     toastSuccessKey?: string
   }
 
-export const useApi = (): ApiClient => {
+let isHandlingUnauthorized = false
+
+export function useApi(): ApiClient {
   const config = useRuntimeConfig()
   const baseURL = config.public.apiBase || '/api'
   const toast = useToast()
   const auth = useAuthStore()
   const nuxtApp = useNuxtApp()
-  let isHandlingUnauthorized = false
   const i18n = nuxtApp.$i18n as
     | {
         t: (key: string) => string
@@ -45,7 +46,7 @@ export const useApi = (): ApiClient => {
   const t = (key: string) => (i18n?.t ? String(i18n.t(key)) : key)
   const te = (key: string) => (i18n?.te ? i18n.te(key) : false)
 
-  const extractErrorMessage = (error: unknown, responseData?: unknown): string => {
+  function extractErrorMessage(error: unknown, responseData?: unknown): string {
     const data = responseData ?? (error as FetchError)?.data
 
     if (typeof data === 'string') {
@@ -169,11 +170,11 @@ export const useApi = (): ApiClient => {
     }
   })
 
-  const request = <T>(
+  function request<T>(
     method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
     url: string,
     options: ApiFetchOptions<'json'> = {}
-  ) => {
+  ) {
     const needsJsonBody = method === 'POST' || method === 'PUT'
     const needsMergePatch = method === 'PATCH'
 

frontend/composables/useAppVersion.ts

@@ -1,8 +1,8 @@
-export const useAppVersion = () => {
+export function useAppVersion() {
     const api = useApi()
     const version = useState<string | null>('app-version', () => null)
 
-    const load = async () => {
+    async function load(): Promise<string | null> {
         if (version.value) {
             return version.value
         }

frontend/composables/useAvatarService.ts

@@ -0,0 +1,24 @@
+export function useAvatarService() {
+    const api = useApi()
+
+    async function upload(userId: number, file: Blob): Promise<{ avatarUrl: string }> {
+        const formData = new FormData()
+        formData.append('file', file, 'avatar.png')
+
+        return $fetch(`/api/users/${userId}/avatar`, {
+            method: 'POST',
+            body: formData,
+            credentials: 'include',
+        })
+    }
+
+    async function remove(userId: number): Promise<void> {
+        await api.delete(`/users/${userId}/avatar`)
+    }
+
+    function getUrl(userId: number): string {
+        return `/api/users/${userId}/avatar`
+    }
+
+    return { upload, remove, getUrl }
+}

frontend/composables/useClientTicketHelpers.ts

@@ -1,3 +1,5 @@
+import type { ClientTicketStatus } from '~/services/dto/client-ticket'
+
 export function useClientTicketHelpers() {
     function typeBadgeClass(type: string): string {
         switch (type) {
@@ -25,5 +27,22 @@ export function useClientTicketHelpers() {
         })
     }
 
-    return { typeBadgeClass, statusBadgeClass, formatDate }
+    function getAvailableStatusTransitions(
+        current: ClientTicketStatus,
+        t: (key: string) => string,
+    ): { label: string; value: ClientTicketStatus }[] {
+        const allStatuses: { label: string; value: ClientTicketStatus }[] = [
+            { label: t('clientTicket.status.new'), value: 'new' },
+            { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
+            { label: t('clientTicket.status.done'), value: 'done' },
+            { label: t('clientTicket.status.rejected'), value: 'rejected' },
+        ]
+        return allStatuses.filter(s => {
+            if (s.value === current) return false
+            if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
+            return true
+        })
+    }
+
+    return { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions }
 }

frontend/i18n/locales/fr.json

@@ -112,7 +112,8 @@
         "allEfforts": "Tous les efforts",
         "allAssignees": "Tous",
         "noTasks": "Aucune tâche",
-        "backlog": "Backlog"
+        "backlog": "Backlog",
+        "createTask": "Créer une tâche"
     },
     "dashboard": {
         "title": "Tableau de bord",
@@ -237,6 +238,7 @@
         "new": "Nouveau ticket",
         "created": "Ticket créé avec succès.",
         "deleted": "Ticket supprimé avec succès.",
+        "updated": "Ticket mis à jour avec succès.",
         "statusUpdated": "Statut du ticket mis à jour.",
         "type": {
             "bug": "Bug",
@@ -290,6 +292,12 @@
             "days": "Il y a {n}j"
         }
     },
+    "profile": {
+        "title": "Mon profil",
+        "changeAvatar": "Changer l'avatar",
+        "removeAvatar": "Supprimer l'avatar",
+        "cropAvatar": "Recadrer l'avatar"
+    },
     "bookstack": {
         "settings": {
             "title": "Configuration BookStack",

frontend/layouts/auth.vue

@@ -5,7 +5,3 @@
     </main>
   </div>
 </template>
-
-<script setup lang="ts">
-const { version } = useAppVersion()
-</script>

frontend/layouts/default.vue

@@ -123,9 +123,9 @@
                 </div>
             </aside>
 
-            <div class="h-full flex-1 flex flex-col min-h-0">
+            <div class="h-full flex-1 flex flex-col min-h-0 min-w-0">
                 <AppTopNav :user="auth.user" />
-                <main class="flex flex-1 flex-col overflow-y-auto bg-white px-4 pb-24 sm:px-8 lg:px-16">
+                <main class="flex flex-1 flex-col overflow-y-auto overflow-x-hidden bg-white px-4 pb-24 sm:px-8 lg:px-16">
                     <div aria-hidden="true" class="pointer-events-none sticky top-0 z-30 h-8 flex-shrink-0 bg-white sm:h-12" />
                     <slot/>
                 </main>
@@ -242,11 +242,6 @@ function onCompleteSaved() {
         timerStore.clearPendingEntry()
     })
 }
-
-const handleLogout = async () => {
-    await auth.logout()
-    await navigateTo('/login')
-}
 </script>
 
 <style scoped>

frontend/middleware/auth.global.ts

@@ -10,17 +10,16 @@ export default defineNuxtRouteMiddleware(async (to) => {
         return navigateTo('/login')
     }
 
+    const isClientOnly = auth.isAuthenticated
+        && auth.user?.roles?.includes('ROLE_CLIENT')
+        && !auth.user?.roles?.includes('ROLE_ADMIN')
+
     if (isLogin && auth.isAuthenticated) {
-        const isClientOnly = auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')
         return navigateTo(isClientOnly ? '/portal' : '/')
     }
 
-    // ROLE_CLIENT without ROLE_ADMIN: redirect to /portal, block internal pages
-    if (auth.isAuthenticated && auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')) {
-        const isPortalRoute = to.path.startsWith('/portal')
-        const isLoginRoute = to.path === '/login'
-        if (!isPortalRoute && !isLoginRoute) {
-            return navigateTo('/portal')
-        }
+    const isProfileRoute = to.path === '/profile'
+    if (isClientOnly && !to.path.startsWith('/portal') && !isProfileRoute) {
+        return navigateTo('/portal')
     }
 })

frontend/package-lock.json

@@ -18,6 +18,7 @@
                 "nuxt-toast": "^1.4.0",
                 "pinia": "^3.0.4",
                 "vue": "^3.5.29",
+                "vue-advanced-cropper": "^2.8.9",
                 "vue-chartjs": "^5.3.3",
                 "vue-router": "^4.6.4"
             }
@@ -6789,6 +6790,12 @@
                 "consola": "^3.2.3"
             }
         },
+        "node_modules/classnames": {
+            "version": "2.5.1",
+            "resolved": "https://registry.npmjs.org/classnames/-/classnames-2.5.1.tgz",
+            "integrity": "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==",
+            "license": "MIT"
+        },
         "node_modules/clipboardy": {
             "version": "4.0.0",
             "resolved": "https://registry.npmjs.org/clipboardy/-/clipboardy-4.0.0.tgz",
@@ -7301,6 +7308,12 @@
                 }
             }
         },
+        "node_modules/debounce": {
+            "version": "1.2.1",
+            "resolved": "https://registry.npmjs.org/debounce/-/debounce-1.2.1.tgz",
+            "integrity": "sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==",
+            "license": "MIT"
+        },
         "node_modules/debug": {
             "version": "4.4.3",
             "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -7578,6 +7591,12 @@
             "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
             "license": "MIT"
         },
+        "node_modules/easy-bem": {
+            "version": "1.1.1",
+            "resolved": "https://registry.npmjs.org/easy-bem/-/easy-bem-1.1.1.tgz",
+            "integrity": "sha512-GJRqdiy2h+EXy6a8E6R+ubmqUM08BK0FWNq41k24fup6045biQ8NXxoXimiwegMQvFFV3t1emADdGNL1TlS61A==",
+            "license": "MIT"
+        },
         "node_modules/ee-first": {
             "version": "1.1.1",
             "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -13869,6 +13888,24 @@
                 }
             }
         },
+        "node_modules/vue-advanced-cropper": {
+            "version": "2.8.9",
+            "resolved": "https://registry.npmjs.org/vue-advanced-cropper/-/vue-advanced-cropper-2.8.9.tgz",
+            "integrity": "sha512-1jc5gO674kVGpJKekoaol6ZlwaF5VYDLSBwBOUpViW0IOrrRsyLw6XNszjEqgbavvqinlKNS6Kqlom3B5M72Tw==",
+            "license": "MIT",
+            "dependencies": {
+                "classnames": "^2.2.6",
+                "debounce": "^1.2.0",
+                "easy-bem": "^1.0.2"
+            },
+            "engines": {
+                "node": ">=8",
+                "npm": ">=5"
+            },
+            "peerDependencies": {
+                "vue": "^3.0.0"
+            }
+        },
         "node_modules/vue-bundle-renderer": {
             "version": "2.2.0",
             "resolved": "https://registry.npmjs.org/vue-bundle-renderer/-/vue-bundle-renderer-2.2.0.tgz",

frontend/package.json

@@ -22,6 +22,7 @@
         "nuxt-toast": "^1.4.0",
         "pinia": "^3.0.4",
         "vue": "^3.5.29",
+        "vue-advanced-cropper": "^2.8.9",
         "vue-chartjs": "^5.3.3",
         "vue-router": "^4.6.4"
     }

frontend/pages/login.vue

@@ -48,7 +48,6 @@ useHead({
     title: 'Connexion'
 })
 
-const router = useRouter()
 const auth = useAuthStore()
 const {version} = useAppVersion()
 
@@ -56,7 +55,7 @@ const username = ref('')
 const password = ref('')
 const isSubmitting = ref(false)
 
-const handleSubmit = async () => {
+async function handleSubmit() {
     if (isSubmitting.value) return
 
     isSubmitting.value = true
@@ -64,7 +63,7 @@ const handleSubmit = async () => {
         await auth.login(username.value, password.value)
 
         const isClient = auth.user?.roles?.includes('ROLE_CLIENT') ?? false
-        await router.push(isClient ? '/portal' : '/')
+        await navigateTo(isClient ? '/portal' : '/')
     } finally {
         isSubmitting.value = false
     }

frontend/pages/my-tasks.vue

@@ -214,6 +214,11 @@ async function onDropBacklog(event: DragEvent) {
 }
 
 // Modal
+function openTaskCreate() {
+    selectedTask.value = null
+    taskModalOpen.value = true
+}
+
 function openTaskEdit(task: Task) {
     selectedTask.value = task
     taskModalOpen.value = true
@@ -229,28 +234,37 @@ onMounted(() => {
 </script>
 
 <template>
-    <div>
+    <div class="min-w-0">
         <!-- Header + Filters -->
         <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
             <div class="flex items-center justify-between gap-3">
                 <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ $t('myTasks.title') }}</h1>
-                <div class="flex gap-1">
+                <div class="flex items-center gap-2">
                     <button
-                        class="rounded-lg p-2 transition-colors"
-                        :class="viewMode === 'kanban' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
-                        :title="$t('myTasks.viewKanban')"
-                        @click="viewMode = 'kanban'"
+                        class="flex items-center gap-1.5 rounded-lg bg-primary-500 px-3 py-1.5 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                        @click="openTaskCreate"
                     >
-                        <Icon name="mdi:view-column-outline" size="20" />
-                    </button>
-                    <button
-                        class="rounded-lg p-2 transition-colors"
-                        :class="viewMode === 'list' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
-                        :title="$t('myTasks.viewList')"
-                        @click="viewMode = 'list'"
-                    >
-                        <Icon name="mdi:view-list-outline" size="20" />
+                        <Icon name="mdi:plus" size="18" />
+                        {{ $t('myTasks.createTask') }}
                     </button>
+                    <div class="flex gap-1">
+                        <button
+                            class="flex items-center justify-center rounded-md p-1.5 transition-colors"
+                            :class="viewMode === 'kanban' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
+                            :title="$t('myTasks.viewKanban')"
+                            @click="viewMode = 'kanban'"
+                        >
+                            <Icon name="mdi:view-column-outline" size="18" />
+                        </button>
+                        <button
+                            class="flex items-center justify-center rounded-md p-1.5 transition-colors"
+                            :class="viewMode === 'list' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
+                            :title="$t('myTasks.viewList')"
+                            @click="viewMode = 'list'"
+                        >
+                            <Icon name="mdi:view-list-outline" size="18" />
+                        </button>
+                    </div>
                 </div>
             </div>
 
@@ -314,11 +328,11 @@ onMounted(() => {
 
         <!-- Kanban View -->
         <div v-if="viewMode === 'kanban'">
-            <div class="mt-6 flex gap-4 overflow-x-auto pb-4">
+            <div class="mt-6 flex gap-3 overflow-x-auto pb-4">
                 <div
                     v-for="status in sortedStatuses"
                     :key="status.id"
-                    class="flex w-72 shrink-0 flex-col rounded-lg transition-colors"
+                    class="flex min-w-36 flex-1 flex-col rounded-lg transition-colors"
                     :class="dragOverStatusId === status.id ? 'bg-neutral-200' : 'bg-neutral-50'"
                     @dragover.prevent
                     @dragenter.prevent="onDragEnter(status.id)"
@@ -446,6 +460,7 @@ onMounted(() => {
             :tags="tags"
             :groups="selectedTask?.project?.id ? groups.filter(g => g.project?.id === selectedTask?.project?.id) : groups"
             :users="users"
+            :projects="projects"
             @saved="onSaved"
         />
     </div>

frontend/pages/profile.vue

@@ -0,0 +1,91 @@
+<template>
+    <div class="mx-auto max-w-lg px-4 py-10">
+        <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
+
+        <div class="flex flex-col items-center gap-6 rounded-xl border border-neutral-200 bg-white p-8 shadow-sm">
+            <!-- Current avatar -->
+            <UserAvatar
+                v-if="auth.user"
+                :user="auth.user"
+                size="lg"
+            />
+
+            <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
+
+            <div class="flex gap-3">
+                <label
+                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                >
+                    {{ $t('profile.changeAvatar') }}
+                    <input
+                        type="file"
+                        accept="image/jpeg,image/png,image/webp,image/gif"
+                        class="hidden"
+                        @change="onFileSelect"
+                    />
+                </label>
+
+                <button
+                    v-if="auth.user?.avatarUrl"
+                    type="button"
+                    class="rounded-lg border border-red-300 px-4 py-2 text-sm font-medium text-red-600 hover:bg-red-50"
+                    :disabled="removing"
+                    @click="onRemove"
+                >
+                    {{ $t('profile.removeAvatar') }}
+                </button>
+            </div>
+        </div>
+
+        <!-- Crop modal -->
+        <AvatarCropper
+            v-if="selectedFile"
+            :image-file="selectedFile"
+            @crop="onCrop"
+            @cancel="selectedFile = null"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import { useAvatarService } from '~/composables/useAvatarService'
+
+const auth = useAuthStore()
+const { upload, remove } = useAvatarService()
+
+const selectedFile = ref<File | null>(null)
+const removing = ref(false)
+
+function onFileSelect(event: Event) {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0]
+    if (file) {
+        selectedFile.value = file
+    }
+    input.value = ''
+}
+
+async function onCrop(blob: Blob) {
+    selectedFile.value = null
+    if (!auth.user) return
+
+    try {
+        await upload(auth.user.id, blob)
+        await auth.refreshUser()
+    } catch {
+        // Upload error — $fetch will throw on non-2xx
+    }
+}
+
+async function onRemove() {
+    if (!auth.user) return
+    removing.value = true
+
+    try {
+        await remove(auth.user.id)
+        await auth.refreshUser()
+    } finally {
+        removing.value = false
+    }
+}
+</script>

frontend/pages/projects/[id]/archives.vue

@@ -46,13 +46,11 @@
                         >
                             {{ task.group.title }}
                         </span>
-                        <span
+                        <UserAvatar
                             v-if="task.assignee"
-                            class="flex h-5 w-5 items-center justify-center rounded-full bg-primary-500 text-[10px] font-bold text-white"
-                            :title="task.assignee.username"
-                        >
-                            {{ task.assignee.username.substring(0, 2).toUpperCase() }}
-                        </span>
+                            :user="task.assignee"
+                            size="xs"
+                        />
                     </div>
                 </div>
             </div>
@@ -130,7 +128,7 @@ const filteredTasks = computed(() => {
 async function loadData() {
     const [p, t, s, e, pr, ty, g, u] = await Promise.all([
         projectService.getById(projectId.value),
-        taskService.getByProjectArchived(projectId.value),
+        taskService.getByProject(projectId.value, true),
         statusService.getAll(),
         effortService.getAll(),
         priorityService.getAll(),

frontend/pages/projects/[id]/index.vue

@@ -1,5 +1,5 @@
 <template>
-    <div>
+    <div class="min-w-0">
         <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
             <div class="flex items-center justify-between gap-3">
                 <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ project?.name ?? '' }}</h1>
@@ -62,11 +62,11 @@
         </div>
 
         <!-- Kanban -->
-        <div class="mt-6 flex gap-4 overflow-x-auto pb-4">
+        <div class="mt-6 flex gap-3 overflow-x-auto pb-4">
             <div
                 v-for="status in statuses"
                 :key="status.id"
-                class="flex w-72 shrink-0 flex-col rounded-lg transition-colors"
+                class="flex min-w-36 flex-1 flex-col rounded-lg transition-colors"
                 :class="dragOverStatusId === status.id ? 'bg-neutral-200' : 'bg-neutral-50'"
                 @dragover.prevent
                 @dragenter.prevent="onDragEnter(status.id)"

frontend/pages/time-tracking.vue

@@ -284,24 +284,10 @@ async function onPaste() {
     await loadEntries()
 }
 
-onMounted(() => {
-    updatePageHeaderHeight()
-
-    if (!pageHeaderEl.value || typeof ResizeObserver === 'undefined') {
-        return
-    }
-
-    pageHeaderResizeObserver = new ResizeObserver(() => {
-        updatePageHeaderHeight()
-    })
-    pageHeaderResizeObserver.observe(pageHeaderEl.value)
-})
-
 onBeforeUnmount(() => {
     pageHeaderResizeObserver?.disconnect()
 })
 
-
 async function onDelete(entry: TimeEntry) {
     await timeEntryService.remove(entry.id)
     await loadEntries()
@@ -333,6 +319,15 @@ async function loadReferenceData() {
 }
 
 onMounted(async () => {
+    updatePageHeaderHeight()
+
+    if (pageHeaderEl.value && typeof ResizeObserver !== 'undefined') {
+        pageHeaderResizeObserver = new ResizeObserver(() => {
+            updatePageHeaderHeight()
+        })
+        pageHeaderResizeObserver.observe(pageHeaderEl.value)
+    }
+
     await loadReferenceData()
     await loadEntries()
 })

frontend/services/auth.ts

@@ -1,22 +1,22 @@
 import type { UserData } from './dto/user-data'
 
-export const getCurrentUser = () => {
-  const api = useApi()
-  return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
+export function getCurrentUser() {
+    const api = useApi()
+    return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
 }
 
-export const login = (username: string, password: string) => {
-  const api = useApi()
-  return api.post('/login_check', { username, password }, {
-    toastOn401: true,
-    toastErrorKey: 'errors.auth.login'
-  })
+export function login(username: string, password: string) {
+    const api = useApi()
+    return api.post('/login_check', { username, password }, {
+        toastOn401: true,
+        toastErrorKey: 'errors.auth.login'
+    })
 }
 
-export const logout = () => {
-  const api = useApi()
-  return api.post('/logout', {}, {
-    toastErrorKey: 'errors.auth.logout',
-    toastSuccessKey: 'success.auth.logout'
-  })
+export function logout() {
+    const api = useApi()
+    return api.post('/logout', {}, {
+        toastErrorKey: 'errors.auth.logout',
+        toastSuccessKey: 'success.auth.logout'
+    })
 }

frontend/services/client-tickets.ts

@@ -32,7 +32,7 @@ export function useClientTicketService() {
 
     async function update(id: number, data: Partial<ClientTicketWrite>): Promise<ClientTicket> {
         return api.patch<ClientTicket>(`/client_tickets/${id}`, data as Record<string, unknown>, {
-            toastSuccessKey: 'clientTicket.statusUpdated',
+            toastSuccessKey: 'clientTicket.updated',
         })
     }
 

frontend/services/dto/user-data.ts

@@ -7,6 +7,7 @@ export type UserData = {
     roles: string[]
     client?: { id: number; name: string } | null
     allowedProjects?: Project[]
+    avatarUrl?: string | null
 }
 
 export type UserWrite = {

frontend/services/task-documents.ts

@@ -15,30 +15,24 @@ export function useTaskDocumentService() {
         return extractHydraMembers(data)
     }
 
-    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+    async function uploadWithRelation(relationField: string, relationIri: string, file: File): Promise<TaskDocument> {
         const formData = new FormData()
         formData.append('file', file)
-        formData.append('task', `/api/tasks/${taskId}`)
+        formData.append(relationField, relationIri)
 
-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
+        return $fetch<TaskDocument>(`${baseURL}/task_documents`, {
             method: 'POST',
             body: formData,
             credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
         })
     }
 
-    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
-        const formData = new FormData()
-        formData.append('file', file)
-        formData.append('clientTicket', `/api/client_tickets/${clientTicketId}`)
+    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('task', `/api/tasks/${taskId}`, file)
+    }
 
-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
-            method: 'POST',
-            body: formData,
-            credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
-        })
+    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('clientTicket', `/api/client_tickets/${clientTicketId}`, file)
     }
 
     async function getByTicket(clientTicketId: number): Promise<TaskDocument[]> {

frontend/services/tasks.ts

@@ -10,18 +10,10 @@ export function useTaskService() {
         return extractHydraMembers(data)
     }
 
-    async function getByProject(projectId: number): Promise<Task[]> {
+    async function getByProject(projectId: number, archived = false): Promise<Task[]> {
         const data = await api.get<HydraCollection<Task>>('/tasks', {
             project: `/api/projects/${projectId}`,
-            archived: false,
-        })
-        return extractHydraMembers(data)
-    }
-
-    async function getByProjectArchived(projectId: number): Promise<Task[]> {
-        const data = await api.get<HydraCollection<Task>>('/tasks', {
-            project: `/api/projects/${projectId}`,
-            archived: true,
+            archived,
         })
         return extractHydraMembers(data)
     }
@@ -49,5 +41,5 @@ export function useTaskService() {
         })
     }
 
-    return { getAll, getByProject, getByProjectArchived, getFiltered, create, update, remove }
+    return { getAll, getByProject, getFiltered, create, update, remove }
 }

frontend/stores/auth.ts

@@ -58,6 +58,14 @@ export const useAuthStore = defineStore('auth', {
                 this.checked = true
                 this.isLoading = false
             }
+        },
+        async refreshUser() {
+            try {
+                const me = await getCurrentUser()
+                this.user = me
+            } catch {
+                // Silently fail — user session might have expired
+            }
         }
     }
 })

frontend/stores/timer.ts

@@ -66,6 +66,11 @@ export const useTimerStore = defineStore('timer', () => {
         startTicking()
     }
 
+    function toIri<T extends { '@id'?: string; id: number }>(entity: T | string, prefix: string): string {
+        if (typeof entity === 'string') return entity
+        return entity['@id'] ?? `${prefix}/${entity.id}`
+    }
+
     async function startFromTask(task: Task) {
         const authStore = useAuthStore()
         if (!authStore.user) return
@@ -79,11 +84,9 @@ export const useTimerStore = defineStore('timer', () => {
             startedAt: new Date().toISOString(),
             user: `/api/users/${authStore.user.id}`,
             title: task.title,
-            project: task.project
-                ? (typeof task.project === 'string' ? task.project : (task.project['@id'] ?? (task.project.id ? `/api/projects/${task.project.id}` : null)))
-                : null,
-            task: typeof task === 'string' ? task : (task['@id'] ?? `/api/tasks/${task.id}`),
-            tags: task.tags?.map((t) => typeof t === 'string' ? t : (t['@id'] ?? `/api/task_tags/${t.id}`)) ?? [],
+            project: task.project ? toIri(task.project, '/api/projects') : null,
+            task: toIri(task, '/api/tasks'),
+            tags: task.tags?.map(t => toIri(t, '/api/task_tags')) ?? [],
         })
         startTicking()
     }

frontend/utils/format.ts

@@ -0,0 +1,5 @@
+export function formatFileSize(bytes: number): string {
+    if (bytes < 1024) return `${bytes} o`
+    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
+    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
+}

migrations/Version20260315205331.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260315205331 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE "user" ADD avatar_file_name VARCHAR(255) DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE "user" DROP avatar_file_name');
+    }
+}

migrations/Version20260315210619.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260315210619 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE UNIQUE INDEX uniq_task_project_number ON task (project_id, number)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX uniq_task_project_number');
+    }
+}

migrations/Version20260316124157.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260316124157 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE time_entry ADD client_ticket_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE time_entry ADD CONSTRAINT FK_6E537C0C9B2097DD FOREIGN KEY (client_ticket_id) REFERENCES client_ticket (id) ON DELETE SET NULL NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_6E537C0C9B2097DD ON time_entry (client_ticket_id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE time_entry DROP CONSTRAINT FK_6E537C0C9B2097DD');
+        $this->addSql('DROP INDEX IDX_6E537C0C9B2097DD');
+        $this->addSql('ALTER TABLE time_entry DROP client_ticket_id');
+    }
+}

script/deploy-release.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: ./script/deploy-release.sh v0.1.0
+# Requires: curl, tar, (optional) rsync
+#
+# Auth token: set RELEASE_TOKEN env var or create /etc/lesstime-release-token
+umask 002
+
+TAG="${1:-}"
+if [ -z "$TAG" ]; then
+  echo "Usage: $0 v0.1.0" >&2
+  exit 1
+fi
+
+REPO_OWNER="MALIO-DEV"
+REPO_NAME="Lesstime"
+GITEA_API="https://gitea.malio.fr/api/v1"
+DEPLOY_DIR="/var/www/lesstime"
+
+if [ -f /etc/lesstime-release-token ] && [ -z "${RELEASE_TOKEN:-}" ]; then
+  RELEASE_TOKEN="$(cat /etc/lesstime-release-token)"
+fi
+
+tmp_dir="$(mktemp -d)"
+cleanup() {
+  rm -rf "$tmp_dir"
+}
+trap cleanup EXIT
+
+release_json="$tmp_dir/release.json"
+curl_opts=(-sS)
+if [ -n "${RELEASE_TOKEN:-}" ]; then
+  curl_opts+=(-H "Authorization: token ${RELEASE_TOKEN}")
+fi
+curl "${curl_opts[@]}" \
+  "${GITEA_API}/repos/${REPO_OWNER}/${REPO_NAME}/releases/tags/${TAG}" \
+  -o "$release_json"
+
+asset_url="$(python3 - "$release_json" <<'PY'
+import json, sys
+data = json.load(open(sys.argv[1], 'r'))
+assets = data.get("assets", [])
+for a in assets:
+    name = a.get("name", "")
+    if name.startswith("lesstime-") and name.endswith(".tar.gz"):
+        print(a.get("browser_download_url", ""))
+        break
+PY
+)"
+
+if [ -z "$asset_url" ]; then
+  echo "Release asset not found for tag ${TAG}" >&2
+  exit 1
+fi
+
+archive="$tmp_dir/artefact.tar.gz"
+curl "${curl_opts[@]}" -L "$asset_url" -o "$archive"
+
+tar -xzf "$archive" -C "$tmp_dir"
+
+if command -v rsync >/dev/null 2>&1; then
+  rsync -a --delete --no-perms --no-owner --no-group \
+    --exclude ".env" \
+    --exclude ".env.local" \
+    --exclude "config/jwt" \
+    --exclude "var" \
+    "$tmp_dir"/ "$DEPLOY_DIR"/
+else
+  cp -a "$tmp_dir"/. "$DEPLOY_DIR"/
+fi
+
+# Ensure Nginx can traverse the deploy path.
+chmod o+rx "$(dirname "$DEPLOY_DIR")" "$DEPLOY_DIR" 2>/dev/null || true
+
+# Create frontend/dist symlink if needed (nginx serves from frontend/dist)
+if [ -d "${DEPLOY_DIR}/frontend/.output/public" ] && [ ! -L "${DEPLOY_DIR}/frontend/dist" ]; then
+  ln -sfn "${DEPLOY_DIR}/frontend/.output/public" "${DEPLOY_DIR}/frontend/dist"
+fi
+
+echo "Release ${TAG} deployed to ${DEPLOY_DIR}"
+
+if [ -f "${DEPLOY_DIR}/.env.local" ]; then
+  echo "Clearing cache..."
+  php "${DEPLOY_DIR}/bin/console" cache:clear --env=prod --no-debug
+
+  echo "Running migrations (if any)..."
+  php "${DEPLOY_DIR}/bin/console" doctrine:migrations:migrate --no-interaction --env=prod
+else
+  echo "Skip post-deploy: ${DEPLOY_DIR}/.env.local not found" >&2
+fi

src/Controller/TaskDocumentDownloadController.php

@@ -7,8 +7,10 @@ namespace App\Controller;
 use App\Entity\TaskDocument;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
@@ -17,11 +19,12 @@ class TaskDocumentDownloadController extends AbstractController
 {
     public function __construct(
         private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
         private readonly string $uploadDir,
     ) {}
 
-    #[Route('/api/task_documents/{id}/download', name: 'task_document_download', methods: ['GET'])]
-    #[IsGranted('ROLE_USER')]
+    #[Route('/api/task_documents/{id}/download', name: 'task_document_download', methods: ['GET'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function __invoke(int $id): BinaryFileResponse
     {
         $document = $this->entityManager->getRepository(TaskDocument::class)->find($id);
@@ -30,6 +33,14 @@ class TaskDocumentDownloadController extends AbstractController
             throw new NotFoundHttpException('Document not found.');
         }
 
+        // ROLE_CLIENT can only download documents from their own tickets
+        if (!$this->security->isGranted('ROLE_ADMIN') && !$this->security->isGranted('ROLE_USER')) {
+            $ticket = $document->getClientTicket();
+            if (null === $ticket || $ticket->getSubmittedBy() !== $this->security->getUser()) {
+                throw new AccessDeniedHttpException('You do not have access to this document.');
+            }
+        }
+
         $filePath = $this->uploadDir.'/'.$document->getFileName();
 
         if (!file_exists($filePath)) {

src/Controller/UserAvatarController.php

@@ -0,0 +1,145 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+
+class UserAvatarController extends AbstractController
+{
+    private const MAX_FILE_SIZE      = 5 * 1024 * 1024; // 5 MB
+    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly string $avatarUploadDir,
+    ) {}
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_upload', methods: ['POST'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function upload(int $id, Request $request): JsonResponse
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $file = $request->files->get('file');
+
+        if (null === $file || !$file->isValid()) {
+            throw new BadRequestHttpException('No valid file uploaded.');
+        }
+
+        if ($file->getSize() > self::MAX_FILE_SIZE) {
+            throw new BadRequestHttpException('File size exceeds 5 MB limit.');
+        }
+
+        $mimeType = $file->getMimeType();
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException('Invalid file type. Allowed: JPEG, PNG, WebP, GIF.');
+        }
+
+        // Delete previous avatar file if exists
+        $this->deleteAvatarFile($user);
+
+        $extension = $file->guessExtension() ?? 'bin';
+        $fileName  = Uuid::v4()->toRfc4122().'.'.$extension;
+
+        if (!is_dir($this->avatarUploadDir)) {
+            mkdir($this->avatarUploadDir, 0o775, true);
+        }
+
+        $file->move($this->avatarUploadDir, $fileName);
+
+        $user->setAvatarFileName($fileName);
+        $this->entityManager->flush();
+
+        return new JsonResponse(['avatarUrl' => $user->getAvatarUrl()]);
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_serve', methods: ['GET'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function serve(int $id): BinaryFileResponse
+    {
+        $user = $this->findUserOrFail($id);
+
+        if (null === $user->getAvatarFileName()) {
+            throw new NotFoundHttpException('No avatar set.');
+        }
+
+        $filePath = $this->avatarUploadDir.'/'.$user->getAvatarFileName();
+
+        if (!file_exists($filePath)) {
+            throw new NotFoundHttpException('Avatar file not found on disk.');
+        }
+
+        $response = new BinaryFileResponse($filePath);
+        $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_INLINE, $user->getAvatarFileName());
+        $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
+        $mimeMap   = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
+        $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
+        $response->headers->set('Cache-Control', 'no-cache, must-revalidate');
+
+        return $response;
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_delete', methods: ['DELETE'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function delete(int $id): Response
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $this->deleteAvatarFile($user);
+        $user->setAvatarFileName(null);
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+
+    private function findUserOrFail(int $id): User
+    {
+        $user = $this->entityManager->getRepository(User::class)->find($id);
+
+        if (null === $user) {
+            throw new NotFoundHttpException('User not found.');
+        }
+
+        return $user;
+    }
+
+    private function assertCanManageAvatar(User $user): void
+    {
+        $currentUser = $this->getUser();
+
+        if ($currentUser !== $user && !$this->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedHttpException('You can only manage your own avatar.');
+        }
+    }
+
+    private function deleteAvatarFile(User $user): void
+    {
+        if (null === $user->getAvatarFileName()) {
+            return;
+        }
+
+        $filePath = $this->avatarUploadDir.'/'.$user->getAvatarFileName();
+
+        if (file_exists($filePath)) {
+            unlink($filePath);
+        }
+    }
+}

src/Entity/Task.php

@@ -35,6 +35,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(SearchFilter::class, properties: ['project' => 'exact', 'group' => 'exact', 'assignee' => 'exact', 'priority' => 'exact', 'effort' => 'exact', 'tags' => 'exact', 'status' => 'exact'])]
 #[ApiFilter(BooleanFilter::class, properties: ['archived'])]
 #[ORM\Entity(repositoryClass: TaskRepository::class)]
+#[ORM\Table(name: 'task')]
+#[ORM\UniqueConstraint(name: 'uniq_task_project_number', columns: ['project_id', 'number'])]
 class Task
 {
     #[ORM\Id]

src/Entity/TimeEntry.php

@@ -85,6 +85,11 @@ class TimeEntry
     #[Groups(['time_entry:read', 'time_entry:write'])]
     private ?Task $task = null;
 
+    #[ORM\ManyToOne(targetEntity: ClientTicket::class)]
+    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
+    #[Groups(['time_entry:read', 'time_entry:write'])]
+    private ?ClientTicket $clientTicket = null;
+
     /** @var Collection<int, TaskTag> */
     #[ORM\ManyToMany(targetEntity: TaskTag::class)]
     #[ORM\JoinTable(
@@ -189,6 +194,18 @@ class TimeEntry
         return $this;
     }
 
+    public function getClientTicket(): ?ClientTicket
+    {
+        return $this->clientTicket;
+    }
+
+    public function setClientTicket(?ClientTicket $clientTicket): static
+    {
+        $this->clientTicket = $clientTicket;
+
+        return $this;
+    }
+
     /** @return Collection<int, TaskTag> */
     public function getTags(): Collection
     {

src/Entity/User.php

@@ -70,6 +70,9 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     #[ORM\Column(length: 64, unique: true, nullable: true)]
     private ?string $apiToken = null;
 
+    #[ORM\Column(length: 255, nullable: true)]
+    private ?string $avatarFileName = null;
+
     #[ORM\ManyToOne(targetEntity: Client::class)]
     #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
     #[Groups(['me:read', 'user:list', 'user:write'])]
@@ -199,5 +202,27 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         return $this;
     }
 
+    public function getAvatarFileName(): ?string
+    {
+        return $this->avatarFileName;
+    }
+
+    public function setAvatarFileName(?string $avatarFileName): static
+    {
+        $this->avatarFileName = $avatarFileName;
+
+        return $this;
+    }
+
+    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+    public function getAvatarUrl(): ?string
+    {
+        if (null === $this->avatarFileName) {
+            return null;
+        }
+
+        return '/api/users/'.$this->id.'/avatar';
+    }
+
     public function eraseCredentials(): void {}
 }

src/Exception/BookStackApiException.php

@@ -5,12 +5,5 @@ declare(strict_types=1);
 namespace App\Exception;
 
 use RuntimeException;
-use Throwable;
 
-final class BookStackApiException extends RuntimeException
-{
-    public function __construct(string $message, int $code = 0, ?Throwable $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-}
+final class BookStackApiException extends RuntimeException {}

src/Exception/GiteaApiException.php

@@ -5,12 +5,5 @@ declare(strict_types=1);
 namespace App\Exception;
 
 use RuntimeException;
-use Throwable;
 
-final class GiteaApiException extends RuntimeException
-{
-    public function __construct(string $message, int $code = 0, ?Throwable $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-}
+final class GiteaApiException extends RuntimeException {}

src/Mcp/Tool/Project/CreateProjectTool.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\Project;
 
 use App\Entity\Project;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ClientRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -48,17 +49,6 @@ class CreateProjectTool
         $this->entityManager->persist($project);
         $this->entityManager->flush();
 
-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ]);
+        return json_encode(Serializer::project($project));
     }
 }

src/Mcp/Tool/Project/GetProjectTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\Project;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
@@ -45,17 +46,7 @@ class GetProjectTool
             $totalTasks += $count;
         }
 
-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived'    => $project->isArchived(),
+        return json_encode(Serializer::project($project) + [
             'taskSummary' => $statusCounts,
             'totalTasks'  => $totalTasks,
         ]);

src/Mcp/Tool/Project/ListProjectsTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\Project;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use Mcp\Capability\Attribute\McpTool;
 
@@ -18,17 +19,6 @@ class ListProjectsTool
     {
         $projects = $this->projectRepository->findBy(['archived' => $archived], ['name' => 'ASC']);
 
-        return json_encode(array_map(fn ($project) => [
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ], $projects));
+        return json_encode(array_map(Serializer::project(...), $projects));
     }
 }

src/Mcp/Tool/Project/UpdateProjectTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\Project;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\ClientRepository;
 use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
@@ -61,17 +62,6 @@ class UpdateProjectTool
 
         $this->entityManager->flush();
 
-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ]);
+        return json_encode(Serializer::project($project));
     }
 }

src/Mcp/Tool/Serializer.php

@@ -0,0 +1,295 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool;
+
+use App\Entity\ClientTicket;
+use App\Entity\Project;
+use App\Entity\Task;
+use App\Entity\TaskDocument;
+use App\Entity\TaskEffort;
+use App\Entity\TaskGroup;
+use App\Entity\TaskPriority;
+use App\Entity\TaskStatus;
+use App\Entity\TaskTag;
+use App\Entity\TimeEntry;
+use App\Entity\User;
+use Doctrine\Common\Collections\Collection;
+
+/**
+ * Shared serialization helpers for MCP tools.
+ *
+ * Keeps JSON output consistent across all tools.
+ */
+final class Serializer
+{
+    /**
+     * @return array{id: ?int, code: ?string, name: ?string}
+     */
+    public static function projectRef(Project $project): array
+    {
+        return [
+            'id'   => $project->getId(),
+            'code' => $project->getCode(),
+            'name' => $project->getName(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function project(Project $project): array
+    {
+        return [
+            'id'          => $project->getId(),
+            'code'        => $project->getCode(),
+            'name'        => $project->getName(),
+            'description' => $project->getDescription(),
+            'color'       => $project->getColor(),
+            'client'      => $project->getClient() ? [
+                'id'   => $project->getClient()->getId(),
+                'name' => $project->getClient()->getName(),
+            ] : null,
+            'archived' => $project->isArchived(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string}
+     */
+    public static function status(?TaskStatus $status): ?array
+    {
+        if (null === $status) {
+            return null;
+        }
+
+        return [
+            'id'    => $status->getId(),
+            'label' => $status->getLabel(),
+            'color' => $status->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string, isFinal: bool}
+     */
+    public static function statusFull(?TaskStatus $status): ?array
+    {
+        if (null === $status) {
+            return null;
+        }
+
+        return [
+            'id'      => $status->getId(),
+            'label'   => $status->getLabel(),
+            'color'   => $status->getColor(),
+            'isFinal' => $status->getIsFinal(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string}
+     */
+    public static function priority(?TaskPriority $priority): ?array
+    {
+        if (null === $priority) {
+            return null;
+        }
+
+        return [
+            'id'    => $priority->getId(),
+            'label' => $priority->getLabel(),
+            'color' => $priority->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string}
+     */
+    public static function effort(?TaskEffort $effort): ?array
+    {
+        if (null === $effort) {
+            return null;
+        }
+
+        return [
+            'id'    => $effort->getId(),
+            'label' => $effort->getLabel(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, username: ?string}
+     */
+    public static function user(?User $user): ?array
+    {
+        if (null === $user) {
+            return null;
+        }
+
+        return [
+            'id'       => $user->getId(),
+            'username' => $user->getUsername(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, title: ?string, color: ?string}
+     */
+    public static function group(?TaskGroup $group): ?array
+    {
+        if (null === $group) {
+            return null;
+        }
+
+        return [
+            'id'    => $group->getId(),
+            'title' => $group->getTitle(),
+            'color' => $group->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, title: ?string}
+     */
+    public static function groupRef(?TaskGroup $group): ?array
+    {
+        if (null === $group) {
+            return null;
+        }
+
+        return [
+            'id'    => $group->getId(),
+            'title' => $group->getTitle(),
+        ];
+    }
+
+    /**
+     * Full group serialization for MCP group tools (includes description, project, archived).
+     *
+     * @return array<string, mixed>
+     */
+    public static function groupFull(TaskGroup $group): array
+    {
+        return [
+            'id'          => $group->getId(),
+            'title'       => $group->getTitle(),
+            'description' => $group->getDescription(),
+            'color'       => $group->getColor(),
+            'project'     => self::projectRef($group->getProject()),
+            'archived'    => $group->isArchived(),
+        ];
+    }
+
+    /**
+     * @param Collection<int, TaskTag> $tags
+     *
+     * @return list<array{id: ?int, label: ?string}>
+     */
+    public static function tags(Collection $tags): array
+    {
+        return $tags->map(fn (TaskTag $t) => [
+            'id'    => $t->getId(),
+            'label' => $t->getLabel(),
+        ])->toArray();
+    }
+
+    /**
+     * @param Collection<int, TaskTag> $tags
+     *
+     * @return list<array{id: ?int, label: ?string, color: ?string}>
+     */
+    public static function tagsWithColor(Collection $tags): array
+    {
+        return $tags->map(fn (TaskTag $t) => [
+            'id'    => $t->getId(),
+            'label' => $t->getLabel(),
+            'color' => $t->getColor(),
+        ])->toArray();
+    }
+
+    /**
+     * Compute duration in minutes between two timestamps, or null if still active.
+     */
+    public static function durationMinutes(TimeEntry $entry): ?int
+    {
+        $started = $entry->getStartedAt();
+        $stopped = $entry->getStoppedAt();
+
+        if (null === $stopped || null === $started) {
+            return null;
+        }
+
+        return (int) round(($stopped->getTimestamp() - $started->getTimestamp()) / 60);
+    }
+
+    /**
+     * @return null|array{id: ?int, number: ?int, title: ?string}
+     */
+    public static function taskRef(?Task $task): ?array
+    {
+        if (null === $task) {
+            return null;
+        }
+
+        return [
+            'id'     => $task->getId(),
+            'number' => $task->getNumber(),
+            'title'  => $task->getTitle(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, number: ?int, title: ?string}
+     */
+    public static function clientTicketRef(?ClientTicket $ticket): ?array
+    {
+        if (null === $ticket) {
+            return null;
+        }
+
+        return [
+            'id'     => $ticket->getId(),
+            'number' => $ticket->getNumber(),
+            'title'  => $ticket->getTitle(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function timeEntry(TimeEntry $entry): array
+    {
+        return [
+            'id'           => $entry->getId(),
+            'title'        => $entry->getTitle(),
+            'description'  => $entry->getDescription(),
+            'startedAt'    => $entry->getStartedAt()?->format('c'),
+            'stoppedAt'    => $entry->getStoppedAt()?->format('c'),
+            'duration'     => self::durationMinutes($entry),
+            'user'         => self::user($entry->getUser()),
+            'project'      => $entry->getProject() ? self::projectRef($entry->getProject()) : null,
+            'task'         => self::taskRef($entry->getTask()),
+            'clientTicket' => self::clientTicketRef($entry->getClientTicket()),
+            'tags'         => self::tags($entry->getTags()),
+        ];
+    }
+
+    /**
+     * @param Collection<int, TaskDocument> $documents
+     *
+     * @return list<array<string, mixed>>
+     */
+    public static function documents(Collection $documents): array
+    {
+        return $documents->map(fn (TaskDocument $doc) => [
+            'id'           => $doc->getId(),
+            'originalName' => $doc->getOriginalName(),
+            'mimeType'     => $doc->getMimeType(),
+            'size'         => $doc->getSize(),
+            'createdAt'    => $doc->getCreatedAt()?->format('c'),
+            'uploadedBy'   => self::user($doc->getUploadedBy()),
+        ])->toArray();
+    }
+}

src/Mcp/Tool/Task/CreateTaskTool.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\Task;
 
 use App\Entity\Task;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskEffortRepository;
 use App\Repository\TaskGroupRepository;
@@ -53,7 +54,7 @@ class CreateTaskTool
         $task = new Task();
         $task->setProject($project);
         $task->setTitle($title);
-        $task->setNumber($this->taskRepository->findMaxNumberByProject($project) + 1);
+        $task->setNumber($this->taskRepository->findMaxNumberByProjectForUpdate($project) + 1);
 
         if (null !== $description) {
             $task->setDescription($description);
@@ -111,38 +112,14 @@ class CreateTaskTool
             'number'      => $task->getNumber(),
             'title'       => $task->getTitle(),
             'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $project->getId(),
-                'code' => $project->getCode(),
-                'name' => $project->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::status($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::groupRef($task->getGroup()),
+            'project'     => Serializer::projectRef($project),
+            'tags'        => Serializer::tags($task->getTags()),
+            'archived'    => $task->isArchived(),
         ]);
     }
 }

src/Mcp/Tool/Task/GetTaskTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\Task;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
@@ -30,52 +31,15 @@ class GetTaskTool
             'number'      => $task->getNumber(),
             'title'       => $task->getTitle(),
             'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'      => $task->getStatus()->getId(),
-                'label'   => $task->getStatus()->getLabel(),
-                'color'   => $task->getStatus()->getColor(),
-                'isFinal' => $task->getStatus()->getIsFinal(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-                'color' => $task->getGroup()->getColor(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-                'color' => $t->getColor(),
-            ])->toArray(),
-            'documents' => $task->getDocuments()->map(fn ($doc) => [
-                'id'           => $doc->getId(),
-                'originalName' => $doc->getOriginalName(),
-                'mimeType'     => $doc->getMimeType(),
-                'size'         => $doc->getSize(),
-                'createdAt'    => $doc->getCreatedAt()?->format('c'),
-                'uploadedBy'   => $doc->getUploadedBy() ? [
-                    'id'       => $doc->getUploadedBy()->getId(),
-                    'username' => $doc->getUploadedBy()->getUsername(),
-                ] : null,
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::statusFull($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::group($task->getGroup()),
+            'project'     => Serializer::projectRef($task->getProject()),
+            'tags'        => Serializer::tagsWithColor($task->getTags()),
+            'documents'   => Serializer::documents($task->getDocuments()),
+            'archived'    => $task->isArchived(),
         ]);
     }
 }

src/Mcp/Tool/Task/ListTasksTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\Task;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use Mcp\Capability\Attribute\McpTool;
 
@@ -67,40 +68,16 @@ class ListTasksTool
         }
 
         return json_encode(array_map(fn ($task) => [
-            'id'     => $task->getId(),
-            'number' => $task->getNumber(),
-            'title'  => $task->getTitle(),
-            'status' => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
+            'id'       => $task->getId(),
+            'number'   => $task->getNumber(),
+            'title'    => $task->getTitle(),
+            'status'   => Serializer::status($task->getStatus()),
+            'priority' => Serializer::priority($task->getPriority()),
+            'assignee' => Serializer::user($task->getAssignee()),
+            'effort'   => Serializer::effort($task->getEffort()),
+            'group'    => Serializer::groupRef($task->getGroup()),
+            'project'  => Serializer::projectRef($task->getProject()),
+            'tags'     => Serializer::tags($task->getTags()),
             'archived' => $task->isArchived(),
         ], array_values($tasks)));
     }

src/Mcp/Tool/Task/UpdateTaskTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\Task;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskEffortRepository;
 use App\Repository\TaskGroupRepository;
 use App\Repository\TaskPriorityRepository;
@@ -114,38 +115,14 @@ class UpdateTaskTool
             'number'      => $task->getNumber(),
             'title'       => $task->getTitle(),
             'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::status($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::groupRef($task->getGroup()),
+            'project'     => Serializer::projectRef($task->getProject()),
+            'tags'        => Serializer::tags($task->getTags()),
+            'archived'    => $task->isArchived(),
         ]);
     }
 }

src/Mcp/Tool/TaskMeta/CreateGroupTool.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\TaskMeta;
 
 use App\Entity\TaskGroup;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -45,17 +46,6 @@ class CreateGroupTool
         $this->entityManager->persist($group);
         $this->entityManager->flush();
 
-        return json_encode([
-            'id'          => $group->getId(),
-            'title'       => $group->getTitle(),
-            'description' => $group->getDescription(),
-            'color'       => $group->getColor(),
-            'project'     => [
-                'id'   => $project->getId(),
-                'code' => $project->getCode(),
-                'name' => $project->getName(),
-            ],
-            'archived' => $group->isArchived(),
-        ]);
+        return json_encode(Serializer::groupFull($group));
     }
 }

src/Mcp/Tool/TaskMeta/ListGroupsTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\TaskMeta;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskGroupRepository;
 use Mcp\Capability\Attribute\McpTool;
 
@@ -23,17 +24,6 @@ class ListGroupsTool
 
         $groups = $this->taskGroupRepository->findBy($criteria, ['title' => 'ASC']);
 
-        return json_encode(array_map(fn ($g) => [
-            'id'          => $g->getId(),
-            'title'       => $g->getTitle(),
-            'description' => $g->getDescription(),
-            'color'       => $g->getColor(),
-            'project'     => [
-                'id'   => $g->getProject()->getId(),
-                'code' => $g->getProject()->getCode(),
-                'name' => $g->getProject()->getName(),
-            ],
-            'archived' => $g->isArchived(),
-        ], $groups));
+        return json_encode(array_map(Serializer::groupFull(...), $groups));
     }
 }

src/Mcp/Tool/TaskMeta/UpdateGroupTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\TaskMeta;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskGroupRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -47,17 +48,6 @@ class UpdateGroupTool
 
         $this->entityManager->flush();
 
-        return json_encode([
-            'id'          => $group->getId(),
-            'title'       => $group->getTitle(),
-            'description' => $group->getDescription(),
-            'color'       => $group->getColor(),
-            'project'     => [
-                'id'   => $group->getProject()->getId(),
-                'code' => $group->getProject()->getCode(),
-                'name' => $group->getProject()->getName(),
-            ],
-            'archived' => $group->isArchived(),
-        ]);
+        return json_encode(Serializer::groupFull($group));
     }
 }

src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php

@@ -5,6 +5,8 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\TimeEntry;
 
 use App\Entity\TimeEntry;
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -27,6 +29,7 @@ class CreateTimeEntryTool
         private readonly TaskRepository $taskRepository,
         private readonly TaskTagRepository $taskTagRepository,
         private readonly TimeEntryRepository $timeEntryRepository,
+        private readonly ClientTicketRepository $clientTicketRepository,
     ) {}
 
     public function __invoke(
@@ -38,6 +41,7 @@ class CreateTimeEntryTool
         ?int $taskId = null,
         ?array $tagIds = null,
         ?string $description = null,
+        ?int $clientTicketId = null,
     ): string {
         $user = $this->userRepository->find($userId);
         if (null === $user) {
@@ -79,6 +83,13 @@ class CreateTimeEntryTool
             }
             $entry->setTask($task);
         }
+        if (null !== $clientTicketId) {
+            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
+            if (null === $clientTicket) {
+                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
+            }
+            $entry->setClientTicket($clientTicket);
+        }
         if (null !== $tagIds) {
             foreach ($tagIds as $tagId) {
                 $tag = $this->taskTagRepository->find($tagId);
@@ -92,30 +103,6 @@ class CreateTimeEntryTool
         $this->entityManager->persist($entry);
         $this->entityManager->flush();
 
-        return json_encode([
-            'id'          => $entry->getId(),
-            'title'       => $entry->getTitle(),
-            'description' => $entry->getDescription(),
-            'startedAt'   => $entry->getStartedAt()?->format('c'),
-            'stoppedAt'   => $entry->getStoppedAt()?->format('c'),
-            'duration'    => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user'    => ['id' => $user->getId(), 'username' => $user->getUsername()],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ]);
+        return json_encode(Serializer::timeEntry($entry));
     }
 }

src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\TimeEntry;
 
+use App\Mcp\Tool\Serializer;
 use App\Repository\TimeEntryRepository;
 use DateTimeImmutable;
 use Mcp\Capability\Attribute\McpTool;
@@ -19,6 +20,7 @@ class ListTimeEntriesTool
         ?int $userId = null,
         ?int $projectId = null,
         ?int $taskId = null,
+        ?int $clientTicketId = null,
         ?string $startDate = null,
         ?string $endDate = null,
         int $limit = 100,
@@ -30,6 +32,7 @@ class ListTimeEntriesTool
             ->leftJoin('te.project', 'p')->addSelect('p')
             ->leftJoin('te.task', 't')->addSelect('t')
             ->leftJoin('te.tags', 'tg')->addSelect('tg')
+            ->leftJoin('te.clientTicket', 'ct')->addSelect('ct')
             ->orderBy('te.startedAt', 'DESC')
             ->setMaxResults($limit)
         ;
@@ -43,6 +46,9 @@ class ListTimeEntriesTool
         if (null !== $taskId) {
             $qb->andWhere('t.id = :taskId')->setParameter('taskId', $taskId);
         }
+        if (null !== $clientTicketId) {
+            $qb->andWhere('ct.id = :clientTicketId')->setParameter('clientTicketId', $clientTicketId);
+        }
         if (null !== $startDate) {
             $qb->andWhere('te.startedAt >= :startDate')
                 ->setParameter('startDate', new DateTimeImmutable($startDate.' 00:00:00'))
@@ -56,33 +62,6 @@ class ListTimeEntriesTool
 
         $entries = $qb->getQuery()->getResult();
 
-        return json_encode(array_map(fn ($entry) => [
-            'id'          => $entry->getId(),
-            'title'       => $entry->getTitle(),
-            'description' => $entry->getDescription(),
-            'startedAt'   => $entry->getStartedAt()?->format('c'),
-            'stoppedAt'   => $entry->getStoppedAt()?->format('c'),
-            'duration'    => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user' => [
-                'id'       => $entry->getUser()->getId(),
-                'username' => $entry->getUser()->getUsername(),
-            ],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ], $entries));
+        return json_encode(array_map(Serializer::timeEntry(...), $entries));
     }
 }

src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool\TimeEntry;
 
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -23,6 +25,7 @@ class UpdateTimeEntryTool
         private readonly ProjectRepository $projectRepository,
         private readonly TaskRepository $taskRepository,
         private readonly TaskTagRepository $taskTagRepository,
+        private readonly ClientTicketRepository $clientTicketRepository,
         private readonly EntityManagerInterface $entityManager,
     ) {}
 
@@ -35,6 +38,7 @@ class UpdateTimeEntryTool
         ?int $taskId = null,
         ?array $tagIds = null,
         ?string $description = null,
+        ?int $clientTicketId = null,
     ): string {
         $entry = $this->timeEntryRepository->find($id);
 
@@ -68,6 +72,13 @@ class UpdateTimeEntryTool
             }
             $entry->setTask($task);
         }
+        if (null !== $clientTicketId) {
+            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
+            if (null === $clientTicket) {
+                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
+            }
+            $entry->setClientTicket($clientTicket);
+        }
         if (null !== $tagIds) {
             foreach ($entry->getTags()->toArray() as $existingTag) {
                 $entry->removeTag($existingTag);
@@ -83,29 +94,6 @@ class UpdateTimeEntryTool
 
         $this->entityManager->flush();
 
-        return json_encode([
-            'id'        => $entry->getId(),
-            'title'     => $entry->getTitle(),
-            'startedAt' => $entry->getStartedAt()?->format('c'),
-            'stoppedAt' => $entry->getStoppedAt()?->format('c'),
-            'duration'  => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user'    => ['id' => $entry->getUser()->getId(), 'username' => $entry->getUser()->getUsername()],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ]);
+        return json_encode(Serializer::timeEntry($entry));
     }
 }

src/Repository/ClientTicketRepository.php

@@ -19,15 +19,18 @@ class ClientTicketRepository extends ServiceEntityRepository
         parent::__construct($registry, ClientTicket::class);
     }
 
-    public function findNextNumberForProject(Project $project): int
+    /**
+     * Returns the next ticket number for a project, using a row-level lock
+     * to prevent race conditions when creating tickets concurrently.
+     */
+    public function findNextNumberForProjectForUpdate(Project $project): int
     {
-        $result = $this->createQueryBuilder('ct')
-            ->select('MAX(ct.number)')
-            ->where('ct.project = :project')
-            ->setParameter('project', $project)
-            ->getQuery()
-            ->getSingleScalarResult()
-        ;
+        $conn = $this->getEntityManager()->getConnection();
+
+        $result = $conn->fetchOne(
+            'SELECT COALESCE(MAX(number), 0) FROM client_ticket WHERE project_id = :project FOR UPDATE',
+            ['project' => $project->getId()],
+        );
 
         return ((int) $result) + 1;
     }

src/Repository/TaskRepository.php

@@ -9,6 +9,9 @@ use App\Entity\Task;
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\Persistence\ManagerRegistry;
 
+/**
+ * @extends ServiceEntityRepository<Task>
+ */
 class TaskRepository extends ServiceEntityRepository
 {
     public function __construct(ManagerRegistry $registry)
@@ -16,16 +19,19 @@ class TaskRepository extends ServiceEntityRepository
         parent::__construct($registry, Task::class);
     }
 
-    public function findMaxNumberByProject(Project $project): int
+    /**
+     * Returns the max task number for a project, using a row-level lock
+     * to prevent race conditions when creating tasks concurrently.
+     */
+    public function findMaxNumberByProjectForUpdate(Project $project): int
     {
-        $result = $this->createQueryBuilder('t')
-            ->select('MAX(t.number)')
-            ->where('t.project = :project')
-            ->setParameter('project', $project)
-            ->getQuery()
-            ->getSingleScalarResult()
-        ;
+        $conn = $this->getEntityManager()->getConnection();
 
-        return (int) ($result ?? 0);
+        $result = $conn->fetchOne(
+            'SELECT COALESCE(MAX(number), 0) FROM task WHERE project_id = :project',
+            ['project' => $project->getId()],
+        );
+
+        return (int) $result;
     }
 }

src/Service/BookStackApiService.php

@@ -59,7 +59,7 @@ final class BookStackApiService
      * Search for pages and books within a specific shelf.
      *
      * Algorithm:
-     * 1. Fetch the shelf's book IDs
+     * 1. Fetch the shelf data (book IDs + slugs)
      * 2. Run two search queries (one for pages, one for books)
      * 3. Filter results: pages must belong to a book on the shelf, books must be on the shelf
      *
@@ -67,17 +67,27 @@ final class BookStackApiService
      */
     public function searchInShelf(int $shelfId, string $query): array
     {
-        $bookIds = $this->getShelfBookIds($shelfId);
+        $shelfData = $this->request('GET', sprintf('/api/shelves/%d', $shelfId));
+        $books     = $shelfData['books'] ?? [];
 
-        if (empty($bookIds)) {
+        if (empty($books)) {
             return [];
         }
 
+        $bookIds   = array_map(static fn (array $book): int => $book['id'], $books);
+        $bookSlugs = [];
+        foreach ($books as $book) {
+            $bookSlugs[$book['id']] = $book['slug'] ?? '';
+        }
+
+        // Update cache for getShelfBookIds
+        $this->shelfBookCache[$shelfId] = $bookIds;
+
         $config  = $this->getConfiguration();
         $baseUrl = rtrim($config->getUrl() ?? '', '/');
         $trimmed = trim($query);
 
-        // BookStack search API accepts {type:X} for one type at a time — run two queries
+        // BookStack search API accepts {type:X} for one type at a time -- run two queries
         $pageResults = $this->request('GET', '/api/search', [
             'query' => ['query' => $trimmed.' {type:page}', 'count' => 50],
         ]);
@@ -87,13 +97,6 @@ final class BookStackApiService
 
         $allResults = array_merge($pageResults['data'] ?? [], $bookResults['data'] ?? []);
 
-        // Build a map of bookId → bookSlug for URL construction
-        $shelfData = $this->request('GET', sprintf('/api/shelves/%d', $shelfId));
-        $bookSlugs = [];
-        foreach ($shelfData['books'] ?? [] as $book) {
-            $bookSlugs[$book['id']] = $book['slug'] ?? '';
-        }
-
         $filtered = [];
         foreach ($allResults as $item) {
             $type = $item['type'] ?? '';
@@ -101,23 +104,20 @@ final class BookStackApiService
             if ('page' === $type) {
                 $bookId = $item['book_id'] ?? 0;
                 if (in_array($bookId, $bookIds, true)) {
-                    $bookSlug   = $bookSlugs[$bookId] ?? '';
                     $filtered[] = [
                         'id'   => $item['id'],
                         'type' => 'page',
                         'name' => $item['name'] ?? '',
-                        'url'  => $baseUrl.'/books/'.$bookSlug.'/page/'.$item['slug'],
-                    ];
-                }
-            } elseif ('book' === $type) {
-                if (in_array($item['id'], $bookIds, true)) {
-                    $filtered[] = [
-                        'id'   => $item['id'],
-                        'type' => 'book',
-                        'name' => $item['name'] ?? '',
-                        'url'  => $baseUrl.'/books/'.$item['slug'],
+                        'url'  => $baseUrl.'/books/'.($bookSlugs[$bookId] ?? '').'/page/'.$item['slug'],
                     ];
                 }
+            } elseif ('book' === $type && in_array($item['id'], $bookIds, true)) {
+                $filtered[] = [
+                    'id'   => $item['id'],
+                    'type' => 'book',
+                    'name' => $item['name'] ?? '',
+                    'url'  => $baseUrl.'/books/'.$item['slug'],
+                ];
             }
         }
 

src/Service/GiteaApiService.php

@@ -126,9 +126,10 @@ final readonly class GiteaApiService
 
         $regex = sprintf('#^[^/]+/%s($|-.+)#', preg_quote($taskCode, '#'));
 
-        return array_values(array_filter($allBranches, static function (array $branch) use ($regex): bool {
-            return 1 === preg_match($regex, $branch['name']);
-        }));
+        return array_values(array_filter(
+            $allBranches,
+            static fn (array $branch): bool => 1 === preg_match($regex, $branch['name']),
+        ));
     }
 
     /**

src/Service/NotificationService.php

@@ -52,12 +52,12 @@ final readonly class NotificationService
             return;
         }
 
-        $number      = sprintf('CT-%03d', $ticket->getNumber());
-        $statusLabel = $ticket->getStatus();
-        $message     = 'Nouveau statut : '.$statusLabel;
+        $number        = sprintf('CT-%03d', $ticket->getNumber());
+        $statusComment = $ticket->getStatusComment();
+        $message       = 'Nouveau statut : '.$ticket->getStatus();
 
-        if (null !== $ticket->getStatusComment() && '' !== $ticket->getStatusComment()) {
-            $message .= ' — '.$ticket->getStatusComment();
+        if (null !== $statusComment && '' !== $statusComment) {
+            $message .= ' — '.$statusComment;
         }
 
         $notification = new Notification();

src/Service/TokenEncryptor.php

@@ -17,31 +17,10 @@ final class TokenEncryptor
         #[Autowire('%env(ENCRYPTION_KEY)%')]
         string $encryptionKey,
     ) {
-        if ('' === $encryptionKey) {
-            $this->key        = '';
-            $this->configured = false;
+        $key = $this->tryDecodeKey($encryptionKey);
 
-            return;
-        }
-
-        try {
-            $key = sodium_hex2bin($encryptionKey);
-        } catch (SodiumException) {
-            $this->key        = '';
-            $this->configured = false;
-
-            return;
-        }
-
-        if (SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen($key, '8bit')) {
-            $this->key        = '';
-            $this->configured = false;
-
-            return;
-        }
-
-        $this->key        = $key;
-        $this->configured = true;
+        $this->key        = $key ?? '';
+        $this->configured = null !== $key;
     }
 
     public function encrypt(string $plaintext): string
@@ -71,6 +50,25 @@ final class TokenEncryptor
         return $plaintext;
     }
 
+    private function tryDecodeKey(string $encryptionKey): ?string
+    {
+        if ('' === $encryptionKey) {
+            return null;
+        }
+
+        try {
+            $key = sodium_hex2bin($encryptionKey);
+        } catch (SodiumException) {
+            return null;
+        }
+
+        if (SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen($key, '8bit')) {
+            return null;
+        }
+
+        return $key;
+    }
+
     private function assertConfigured(): void
     {
         if (!$this->configured) {

src/State/ClientTicketNumberProcessor.php

@@ -51,12 +51,13 @@ final readonly class ClientTicketNumberProcessor implements ProcessorInterface
             }
         }
 
-        $nextNumber = $this->clientTicketRepository->findNextNumberForProject($project);
-        $data->setNumber($nextNumber);
+        $now = new DateTimeImmutable();
+
+        $data->setNumber($this->clientTicketRepository->findNextNumberForProjectForUpdate($project));
         $data->setSubmittedBy($user);
         $data->setStatus('new');
-        $data->setCreatedAt(new DateTimeImmutable());
-        $data->setUpdatedAt(new DateTimeImmutable());
+        $data->setCreatedAt($now);
+        $data->setUpdatedAt($now);
 
         $this->entityManager->persist($data);
         $this->entityManager->flush();

src/State/ClientTicketProvider.php

@@ -54,17 +54,27 @@ final readonly class ClientTicketProvider implements ProviderInterface
         // Apply filters from query parameters
         $filters = $context['filters'] ?? [];
         if (isset($filters['project'])) {
-            $projectId = is_numeric($filters['project']) ? (int) $filters['project'] : (int) basename($filters['project']);
-            $qb->andWhere('ct.project = :project')->setParameter('project', $projectId);
+            $qb->andWhere('ct.project = :project')
+                ->setParameter('project', self::extractId($filters['project']))
+            ;
         }
         if (isset($filters['status'])) {
             $qb->andWhere('ct.status = :status')->setParameter('status', $filters['status']);
         }
         if (isset($filters['submittedBy']) && $this->security->isGranted('ROLE_ADMIN')) {
-            $submittedById = is_numeric($filters['submittedBy']) ? (int) $filters['submittedBy'] : (int) basename($filters['submittedBy']);
-            $qb->andWhere('ct.submittedBy = :submittedBy')->setParameter('submittedBy', $submittedById);
+            $qb->andWhere('ct.submittedBy = :submittedBy')
+                ->setParameter('submittedBy', self::extractId($filters['submittedBy']))
+            ;
         }
 
         return $qb->getQuery()->getResult();
     }
+
+    /**
+     * Extract an entity ID from a value that may be a numeric ID or an IRI string.
+     */
+    private static function extractId(string $value): int
+    {
+        return is_numeric($value) ? (int) $value : (int) basename($value);
+    }
 }

src/State/ClientTicketStatusProcessor.php

@@ -35,18 +35,21 @@ final readonly class ClientTicketStatusProcessor implements ProcessorInterface
 
         $originalData = $context['previous_data'] ?? null;
 
-        // ROLE_CLIENT: can only edit content fields, not status
-        if (!$this->security->isGranted('ROLE_ADMIN') && $originalData instanceof ClientTicket) {
-            $data->setStatus($originalData->getStatus());
-            $data->setStatusComment($originalData->getStatusComment());
-        }
+        $statusChanged = false;
 
         if ($originalData instanceof ClientTicket) {
+            // ROLE_CLIENT: can only edit content fields, not status
+            if (!$this->security->isGranted('ROLE_ADMIN')) {
+                $data->setStatus($originalData->getStatus());
+                $data->setStatusComment($originalData->getStatusComment());
+            }
+
             $oldStatus = $originalData->getStatus();
             $newStatus = $data->getStatus();
 
             if ($oldStatus !== $newStatus) {
-                $forbidden = self::FORBIDDEN_TRANSITIONS[$oldStatus] ?? [];
+                $statusChanged = true;
+                $forbidden     = self::FORBIDDEN_TRANSITIONS[$oldStatus] ?? [];
                 if (in_array($newStatus, $forbidden, true)) {
                     throw new BadRequestHttpException(sprintf('Transition from "%s" to "%s" is not allowed.', $oldStatus, $newStatus));
                 }
@@ -62,7 +65,9 @@ final readonly class ClientTicketStatusProcessor implements ProcessorInterface
         $this->entityManager->persist($data);
         $this->entityManager->flush();
 
-        $this->notificationService->createForStatusChange($data);
+        if ($statusChanged) {
+            $this->notificationService->createForStatusChange($data);
+        }
 
         return $data;
     }

src/State/GiteaBranchNameProvider.php

@@ -15,6 +15,7 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 final readonly class GiteaBranchNameProvider implements ProviderInterface
 {
+    /** @see GiteaBranchProcessor::ALLOWED_TYPES */
     private const array ALLOWED_TYPES = ['feature', 'fix', 'refactor', 'hotfix', 'chore'];
 
     public function __construct(

src/State/TaskDocumentProcessor.php

@@ -24,6 +24,35 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
 {
     private const MAX_FILE_SIZE = 50 * 1024 * 1024; // 50 MB
 
+    private const ALLOWED_MIME_TYPES = [
+        'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/svg+xml',
+        'application/pdf',
+        'application/msword',
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        'application/vnd.ms-excel',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        'application/vnd.ms-powerpoint',
+        'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        'text/plain', 'text/csv',
+        'application/zip', 'application/x-rar-compressed', 'application/gzip',
+        'application/json', 'application/xml', 'text/xml',
+    ];
+
+    private const MIME_TO_EXTENSION = [
+        'image/jpeg'                                                                => 'jpg', 'image/png' => 'png', 'image/gif' => 'gif',
+        'image/webp'                                                                => 'webp', 'image/svg+xml' => 'svg',
+        'application/pdf'                                                           => 'pdf',
+        'application/msword'                                                        => 'doc',
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document'   => 'docx',
+        'application/vnd.ms-excel'                                                  => 'xls',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'         => 'xlsx',
+        'application/vnd.ms-powerpoint'                                             => 'ppt',
+        'application/vnd.openxmlformats-officedocument.presentationml.presentation' => 'pptx',
+        'text/plain'                                                                => 'txt', 'text/csv' => 'csv',
+        'application/zip'                                                           => 'zip', 'application/x-rar-compressed' => 'rar', 'application/gzip' => 'gz',
+        'application/json'                                                          => 'json', 'application/xml' => 'xml', 'text/xml' => 'xml',
+    ];
+
     public function __construct(
         private EntityManagerInterface $entityManager,
         private Security $security,
@@ -52,50 +81,48 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
             throw new BadRequestHttpException('File size exceeds 50 MB limit.');
         }
 
-        $taskIri         = $request->request->get('task');
-        $clientTicketIri = $request->request->get('clientTicket');
+        $taskIri         = $request->request->get('task', '');
+        $clientTicketIri = $request->request->get('clientTicket', '');
 
-        if ((null === $taskIri || '' === $taskIri) && (null === $clientTicketIri || '' === $clientTicketIri)) {
+        if ('' === $taskIri && '' === $clientTicketIri) {
             throw new BadRequestHttpException('Either task or clientTicket IRI is required.');
         }
 
         $task         = null;
         $clientTicket = null;
 
-        if (null !== $taskIri && '' !== $taskIri) {
-            // Extract task ID from IRI (e.g., "/api/tasks/42" -> 42)
-            $taskId = (int) basename((string) $taskIri);
-            $task   = $this->entityManager->getRepository(Task::class)->find($taskId);
+        if ('' !== $taskIri) {
+            $task = $this->entityManager->getRepository(Task::class)->find((int) basename($taskIri));
 
             if (null === $task) {
                 throw new BadRequestHttpException('Task not found.');
             }
         }
 
-        if (null !== $clientTicketIri && '' !== $clientTicketIri) {
-            $clientTicketId = (int) basename((string) $clientTicketIri);
-            $clientTicket   = $this->entityManager->getRepository(ClientTicket::class)->find($clientTicketId);
+        if ('' !== $clientTicketIri) {
+            $clientTicket = $this->entityManager->getRepository(ClientTicket::class)->find((int) basename($clientTicketIri));
 
             if (null === $clientTicket) {
                 throw new BadRequestHttpException('Client ticket not found.');
             }
 
-            // Ownership validation for ROLE_CLIENT
-            if (!$this->security->isGranted('ROLE_ADMIN')) {
-                $currentUser = $this->security->getUser();
-                if ($clientTicket->getSubmittedBy() !== $currentUser) {
-                    throw new AccessDeniedHttpException('You can only upload documents to your own tickets.');
-                }
+            if (!$this->security->isGranted('ROLE_ADMIN') && $clientTicket->getSubmittedBy() !== $this->security->getUser()) {
+                throw new AccessDeniedHttpException('You can only upload documents to your own tickets.');
             }
         }
 
-        // Capture file metadata BEFORE move() — move invalidates the temp file
+        // Use server-detected MIME type (finfo), not the client-supplied one
         $originalName = $file->getClientOriginalName();
-        $extension    = $file->getClientOriginalExtension() ?: 'bin';
-        $mimeType     = $file->getClientMimeType() ?? 'application/octet-stream';
+        $mimeType     = $file->getMimeType() ?: 'application/octet-stream';
         $fileSize     = $file->getSize();
-        $uuid         = Uuid::v4()->toRfc4122();
-        $fileName     = $uuid.'.'.$extension;
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException(sprintf('File type "%s" is not allowed.', $mimeType));
+        }
+
+        $extension = self::MIME_TO_EXTENSION[$mimeType] ?? 'bin';
+        $uuid      = Uuid::v4()->toRfc4122();
+        $fileName  = $uuid.'.'.$extension;
 
         if (!is_dir($this->uploadDir)) {
             mkdir($this->uploadDir, 0o775, true);

src/State/TaskNumberProcessor.php

@@ -9,6 +9,7 @@ use ApiPlatform\Metadata\Post;
 use ApiPlatform\State\ProcessorInterface;
 use App\Entity\Task;
 use App\Repository\TaskRepository;
+use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Component\DependencyInjection\Attribute\Autowire;
 
 /**
@@ -23,6 +24,7 @@ final readonly class TaskNumberProcessor implements ProcessorInterface
         #[Autowire(service: 'api_platform.doctrine.orm.state.persist_processor')]
         private ProcessorInterface $persistProcessor,
         private TaskRepository $taskRepository,
+        private EntityManagerInterface $entityManager,
     ) {}
 
     /**
@@ -31,8 +33,12 @@ final readonly class TaskNumberProcessor implements ProcessorInterface
     public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
     {
         if ($operation instanceof Post && null !== $data->getProject()) {
-            $maxNumber = $this->taskRepository->findMaxNumberByProject($data->getProject());
-            $data->setNumber($maxNumber + 1);
+            return $this->entityManager->wrapInTransaction(function () use ($data, $operation, $uriVariables, $context) {
+                $maxNumber = $this->taskRepository->findMaxNumberByProjectForUpdate($data->getProject());
+                $data->setNumber($maxNumber + 1);
+
+                return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
+            });
         }
 
         return $this->persistProcessor->process($data, $operation, $uriVariables, $context);

src/State/UserPasswordHasherProcessor.php

@@ -29,10 +29,10 @@ final readonly class UserPasswordHasherProcessor implements ProcessorInterface
      */
     public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
     {
-        if (null !== $data->getPassword() && !str_starts_with($data->getPassword(), '$')) {
-            $data->setPassword(
-                $this->passwordHasher->hashPassword($data, $data->getPassword())
-            );
+        $plainPassword = $data->getPassword();
+
+        if (null !== $plainPassword && !str_starts_with($plainPassword, '$')) {
+            $data->setPassword($this->passwordHasher->hashPassword($data, $plainPassword));
         }
 
         return $this->persistProcessor->process($data, $operation, $uriVariables, $context);