chore: bump version to v0.4.36

Reviewed-on: #22

config/sidebar.php

@@ -23,9 +23,9 @@ return [
         'icon'  => 'mdi:view-dashboard-outline',
         'items' => [
             ['label' => 'sidebar.general.dashboard', 'to' => '/', 'icon' => 'mdi:view-dashboard-outline'],
-            ['label' => 'sidebar.general.myTasks', 'to' => '/my-tasks', 'icon' => 'mdi:clipboard-check-outline', 'module' => 'project-management'],
-            ['label' => 'sidebar.general.projects', 'to' => '/projects', 'icon' => 'mdi:folder-outline', 'module' => 'project-management'],
-            ['label' => 'sidebar.general.timeTracking', 'to' => '/time-tracking', 'icon' => 'mdi:calendar-edit-outline', 'module' => 'time-tracking'],
+            ['label' => 'sidebar.general.myTasks', 'to' => '/my-tasks', 'icon' => 'mdi:clipboard-check-outline', 'module' => 'project-management', 'permission' => 'project-management.tasks.view'],
+            ['label' => 'sidebar.general.projects', 'to' => '/projects', 'icon' => 'mdi:folder-outline', 'module' => 'project-management', 'permission' => 'project-management.projects.view'],
+            ['label' => 'sidebar.general.timeTracking', 'to' => '/time-tracking', 'icon' => 'mdi:calendar-edit-outline', 'module' => 'time-tracking', 'permission' => 'time-tracking.entries.view'],
             // Gating module uniquement (cf. en-tête) : rendu visuel + badge gérés côté layout.
             ['label' => 'sidebar.general.mail', 'to' => '/mail', 'icon' => 'mdi:email-outline', 'module' => 'mail'],
         ],

config/version.yaml

@@ -1,2 +1,2 @@
 parameters:
-    app.version: '0.4.31'
+    app.version: '0.4.36'

frontend/components/ui/ConfirmDeleteReportModal.vue

@@ -0,0 +1,61 @@
+<template>
+    <Teleport v-if="modelValue" to="body">
+        <Transition name="modal" appear>
+            <div class="fixed inset-0 z-[70] flex items-center justify-center">
+                <div class="absolute inset-0 bg-black/30" @click.stop="cancel" />
+                <div class="relative z-10 w-full max-w-md rounded-lg bg-white p-6 shadow-xl">
+                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('directory.reports.confirmDeleteTitle') }}</h3>
+                    <p class="mt-3 text-sm text-neutral-600">
+                        {{ $t('directory.reports.confirmDeleteMessage') }}
+                    </p>
+                    <div class="mt-6 flex justify-end gap-3">
+                        <MalioButton
+                            variant="tertiary"
+                            :label="$t('common.cancel')"
+                            button-class="w-auto px-4"
+                            :disabled="busy"
+                            @click="cancel"
+                        />
+                        <MalioButton
+                            variant="danger"
+                            :label="$t('common.delete')"
+                            button-class="w-auto px-4"
+                            :disabled="busy"
+                            @click="$emit('confirm')"
+                        />
+                    </div>
+                </div>
+            </div>
+        </Transition>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+const props = defineProps<{
+    modelValue: boolean
+    // Suppression en cours : on désactive les actions pour éviter un double envoi.
+    busy?: boolean
+}>()
+
+const emit = defineEmits<{
+    (e: 'update:modelValue', value: boolean): void
+    (e: 'confirm'): void
+}>()
+
+function cancel() {
+    if (props.busy) return
+    emit('update:modelValue', false)
+}
+</script>
+
+<style scoped>
+.modal-enter-active,
+.modal-leave-active {
+    transition: opacity 0.2s ease;
+}
+
+.modal-enter-from,
+.modal-leave-to {
+    opacity: 0;
+}
+</style>

frontend/i18n/locales/fr.json

@@ -24,7 +24,9 @@
     "updated": "Client mis à jour avec succès.",
     "deleted": "Client supprimé avec succès.",
     "addClient": "Ajouter un client",
-    "editClient": "Modifier un client"
+    "editClient": "Modifier un client",
+    "deleteConfirmTitle": "Supprimer le client",
+    "deleteConfirmMessage": "Êtes-vous sûr de vouloir supprimer le client « {name} » ? Cette action est irréversible."
   },
   "projects": {
     "title": "Projets",
@@ -908,6 +910,8 @@
     "editProspect": "Modifier un prospect",
     "convert": "Convertir en client",
     "alreadyConverted": "Déjà converti en client",
+    "deleteConfirmTitle": "Supprimer le prospect",
+    "deleteConfirmMessage": "Êtes-vous sûr de vouloir supprimer le prospect « {name} » ? Cette action est irréversible.",
     "fields": {
       "name": "Nom",
       "company": "Société",
@@ -934,12 +938,24 @@
   "directory": {
     "title": "Répertoire",
     "tabs": {
+      "info": "Informations",
       "clients": "Clients",
       "prospects": "Prospects",
       "contact": "Contact",
       "address": "Adresse",
       "report": "Rapport"
     },
+    "info": {
+      "fields": {
+        "name": "Nom",
+        "email": "Email",
+        "phone": "Téléphone"
+      }
+    },
+    "validation": {
+      "nameRequired": "Le nom est requis.",
+      "subjectRequired": "L'objet est requis."
+    },
     "clients": {
       "add": "Ajouter un client",
       "empty": "Aucun client trouvé."
@@ -978,9 +994,16 @@
     },
     "reports": {
       "add": "Ajouter un compte-rendu",
-      "empty": "Aucun compte-rendu.",
+      "addTitle": "Nouveau compte-rendu",
+      "editTitle": "Modifier le compte-rendu",
+      "empty": "Aucun compte-rendu",
+      "emptyHint": "Consignez vos échanges (appels, rendez-vous, emails) pour garder l'historique de la relation.",
+      "count": "{n} compte-rendu | {n} comptes-rendus",
+      "documentsLabel": "Documents",
       "saved": "Compte-rendu enregistré.",
       "deleted": "Compte-rendu supprimé.",
+      "confirmDeleteTitle": "Supprimer ce compte-rendu ?",
+      "confirmDeleteMessage": "Cette action est irréversible. Les documents joints seront également supprimés.",
       "fields": {
         "subject": "Objet",
         "type": "Type d'échange",

frontend/modules/directory/components/ClientDrawer.vue

@@ -6,21 +6,11 @@
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="form.name"
-                label="Nom"
+                label="Nom société"
                 input-class="w-full"
                 :error="touched.name && !form.name.trim() ? 'Le nom est requis' : ''"
                 @blur="touched.name = true"
             />
-            <MalioInputText
-                v-model="form.email"
-                label="Email"
-                input-class="w-full"
-            />
-            <MalioInputText
-                v-model="form.phone"
-                label="Téléphone"
-                input-class="w-full"
-            />
 
             <div class="mt-6 flex justify-end">
                 <MalioButton
@@ -58,28 +48,16 @@ const isSubmitting = ref(false)
 
 const form = reactive({
     name: '',
-    email: '',
-    phone: '',
 })
 
 const touched = reactive({
     name: false,
-    email: false,
 })
 
 watch(() => props.modelValue, (open) => {
     if (open) {
-        if (props.client) {
-            form.name = props.client.name ?? ''
-            form.email = props.client.email ?? ''
-            form.phone = props.client.phone ?? ''
-        } else {
-            form.name = ''
-            form.email = ''
-            form.phone = ''
-        }
+        form.name = props.client?.name ?? ''
         touched.name = false
-        touched.email = false
     }
 })
 
@@ -93,8 +71,6 @@ async function handleSubmit() {
     try {
         const payload: ClientWrite = {
             name: form.name.trim(),
-            email: form.email.trim() || null,
-            phone: form.phone.trim() || null,
         }
 
         if (isEditing.value && props.client) {

frontend/modules/directory/components/CommercialReportDrawer.vue

@@ -0,0 +1,144 @@
+<template>
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">
+                {{ isEditing ? $t('directory.reports.editTitle') : $t('directory.reports.addTitle') }}
+            </h2>
+        </template>
+        <form @submit.prevent="handleSubmit" class="flex flex-col gap-4">
+            <MalioInputText
+                v-model="form.subject"
+                :label="$t('directory.reports.fields.subject')"
+                input-class="w-full"
+                :error="touched.subject && !form.subject.trim() ? $t('directory.validation.subjectRequired') : ''"
+                @blur="touched.subject = true"
+            />
+            <MalioSelect
+                v-model="form.type"
+                :label="$t('directory.reports.fields.type')"
+                :options="typeOptions"
+                group-class="w-full"
+            />
+            <MalioDate
+                v-model="form.occurredAt"
+                :label="$t('directory.reports.fields.occurredAt')"
+            />
+            <MalioInputRichText
+                v-model="form.body"
+                :label="$t('directory.reports.fields.body')"
+                min-height="180px"
+            />
+
+            <div class="mt-4 flex justify-end gap-3">
+                <MalioButton
+                    variant="tertiary"
+                    button-class="w-auto px-4"
+                    :label="$t('common.cancel')"
+                    @click="isOpen = false"
+                />
+                <MalioButton
+                    button-class="w-auto px-6"
+                    :label="$t('common.save')"
+                    :disabled="isSubmitting"
+                    @click="handleSubmit"
+                />
+            </div>
+        </form>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { CommercialReport, CommercialReportWrite, ReportType } from '~/modules/directory/services/dto/commercial-report'
+import { useCommercialReportService } from '~/modules/directory/services/commercial-reports'
+
+const props = defineProps<{
+    modelValue: boolean
+    report: CommercialReport | null
+    owner: { client?: string, prospect?: string }
+}>()
+
+const emit = defineEmits<{
+    (e: 'update:modelValue', value: boolean): void
+    (e: 'saved'): void
+}>()
+
+const { t } = useI18n()
+const { create, update } = useCommercialReportService()
+
+const isOpen = computed({
+    get: () => props.modelValue,
+    set: (v) => emit('update:modelValue', v),
+})
+
+const isEditing = computed(() => !!props.report)
+const isSubmitting = ref(false)
+
+const typeOptions: { label: string, value: ReportType }[] = [
+    { label: t('directory.reports.types.call'), value: 'call' },
+    { label: t('directory.reports.types.meeting'), value: 'meeting' },
+    { label: t('directory.reports.types.email'), value: 'email' },
+    { label: t('directory.reports.types.note'), value: 'note' },
+]
+
+function today(): string {
+    return new Date().toISOString().slice(0, 10)
+}
+
+// L'éditeur riche émet du HTML : un contenu « vide » vaut `<p></p>`. On le
+// normalise en null pour ne pas persister une coquille vide.
+function normalizeBody(html: string): string | null {
+    const stripped = html.replace(/<[^>]*>/g, '').replace(/&nbsp;/g, ' ').trim()
+    return stripped ? html : null
+}
+
+const form = reactive<{ subject: string, type: ReportType, occurredAt: string, body: string }>({
+    subject: '',
+    type: 'note',
+    occurredAt: today(),
+    body: '',
+})
+const touched = reactive({ subject: false })
+
+watch(() => props.modelValue, (open) => {
+    if (!open) return
+    if (props.report) {
+        form.subject = props.report.subject
+        form.type = props.report.type
+        form.occurredAt = props.report.occurredAt.slice(0, 10)
+        form.body = props.report.body ?? ''
+    } else {
+        form.subject = ''
+        form.type = 'note'
+        form.occurredAt = today()
+        form.body = ''
+    }
+    touched.subject = false
+})
+
+async function handleSubmit(): Promise<void> {
+    touched.subject = true
+    if (!form.subject.trim() || isSubmitting.value) return
+
+    isSubmitting.value = true
+    try {
+        const payload: CommercialReportWrite = {
+            subject: form.subject.trim(),
+            type: form.type,
+            occurredAt: form.occurredAt,
+            body: normalizeBody(form.body),
+            ...props.owner,
+        }
+
+        if (isEditing.value && props.report) {
+            await update(props.report.id, payload)
+        } else {
+            await create(payload)
+        }
+
+        emit('saved')
+        isOpen.value = false
+    } finally {
+        isSubmitting.value = false
+    }
+}
+</script>

frontend/modules/directory/components/CommercialReportTab.vue

@@ -1,158 +1,235 @@
 <template>
-    <div class="flex flex-col gap-6 pt-6">
-        <!-- Formulaire d'ajout / édition -->
-        <div v-if="isAdmin" class="grid grid-cols-2 gap-x-[44px] gap-y-4 rounded-lg bg-white px-7 py-5 shadow-[0_4px_4px_0_rgba(0,0,0,0.10)]">
-            <MalioInputText
-                class="col-span-2"
-                :label="$t('directory.reports.fields.subject')"
-                v-model="draft.subject"
+    <div class="flex flex-col gap-5 pt-6">
+        <!-- Barre d'action -->
+        <div class="flex items-center justify-between gap-3">
+            <p class="text-sm text-neutral-500">
+                <span v-if="reports.length">{{ $t('directory.reports.count', { n: reports.length }, reports.length) }}</span>
+            </p>
+            <MalioButton
+                v-if="canManage"
+                icon-name="mdi:plus"
+                icon-position="left"
+                button-class="w-auto px-4"
+                :label="$t('directory.reports.add')"
+                @click="openCreate"
             />
-            <MalioSelect
-                :label="$t('directory.reports.fields.type')"
-                v-model="draft.type"
-                :options="typeOptions"
-                group-class="w-full"
-            />
-            <MalioDate
-                :label="$t('directory.reports.fields.occurredAt')"
-                v-model="draft.occurredAt"
-            />
-            <MalioInputTextArea
-                class="col-span-2"
-                :label="$t('directory.reports.fields.body')"
-                v-model="draft.body"
-            />
-            <div class="col-span-2 flex justify-end gap-3">
-                <MalioButton
-                    v-if="editingId"
-                    variant="secondary"
-                    button-class="w-auto px-4"
-                    :label="$t('common.cancel')"
-                    @click="resetDraft"
-                />
-                <MalioButton
-                    button-class="w-auto px-4"
-                    :label="editingId ? $t('common.save') : $t('directory.reports.add')"
-                    :disabled="!draft.subject"
-                    @click="save"
-                />
-            </div>
         </div>
 
-        <!-- Liste des comptes-rendus -->
-        <div v-for="report in reports" :key="report.id" class="rounded border border-neutral-200 p-4">
-            <div class="flex items-start justify-between">
-                <div>
-                    <p class="font-semibold text-neutral-800">{{ report.subject }}</p>
-                    <p class="text-xs text-neutral-500">
-                        {{ formatDate(report.occurredAt) }} · {{ $t(`directory.reports.types.${report.type}`) }}
-                        <span v-if="report.author"> · {{ report.author.username }}</span>
-                    </p>
-                </div>
-                <div v-if="isAdmin" class="flex gap-2">
-                    <MalioButtonIcon icon="mdi:pencil-outline" variant="ghost" :aria-label="$t('common.edit')" @click="edit(report)" />
-                    <MalioButtonIcon icon="mdi:delete-outline" variant="ghost" :aria-label="$t('common.delete')" @click="remove(report.id)" />
-                </div>
-            </div>
-            <p v-if="report.body" class="mt-2 whitespace-pre-wrap text-sm text-neutral-700">{{ report.body }}</p>
-
-            <div class="mt-3 flex flex-col gap-2">
-                <ReportDocumentList
-                    :documents="report.documents ?? []"
-                    :is-admin="isAdmin"
-                    @delete="(id) => removeDocument(report, id)"
-                />
-                <ReportDocumentUpload
-                    v-if="isAdmin"
-                    :report-id="report.id"
-                    @uploaded="reload"
-                />
-            </div>
+        <!-- État vide -->
+        <div
+            v-if="!loading && !reports.length"
+            class="flex flex-col items-center gap-2 rounded-lg border border-dashed border-neutral-200 bg-neutral-50 px-6 py-12 text-center"
+        >
+            <Icon name="mdi:message-text-outline" class="text-4xl text-neutral-300" />
+            <p class="font-medium text-neutral-600">{{ $t('directory.reports.empty') }}</p>
+            <p class="max-w-sm text-sm text-neutral-400">{{ $t('directory.reports.emptyHint') }}</p>
+            <MalioButton
+                v-if="canManage"
+                variant="tertiary"
+                icon-name="mdi:plus"
+                icon-position="left"
+                button-class="mt-2 w-auto px-4"
+                :label="$t('directory.reports.add')"
+                @click="openCreate"
+            />
         </div>
 
-        <p v-if="!reports.length" class="text-sm text-neutral-400">
-            {{ $t('directory.reports.empty') }}
-        </p>
+        <!-- Timeline antéchronologique -->
+        <ol v-else class="flex flex-col">
+            <li
+                v-for="report in sortedReports"
+                :key="report.id"
+                class="relative flex gap-4 pb-6 last:pb-0"
+            >
+                <!-- Rail + pastille de type -->
+                <div class="flex flex-col items-center">
+                    <span
+                        class="flex h-9 w-9 shrink-0 items-center justify-center rounded-full"
+                        :class="typeStyle(report.type).badge"
+                    >
+                        <Icon :name="typeStyle(report.type).icon" class="text-lg" />
+                    </span>
+                    <span class="mt-1 w-px grow bg-neutral-200" aria-hidden="true" />
+                </div>
+
+                <!-- Carte -->
+                <div class="flex-1 rounded-lg border border-neutral-200 bg-white p-4 shadow-[0_1px_2px_0_rgba(0,0,0,0.05)]">
+                    <div class="flex items-start justify-between gap-3">
+                        <div class="min-w-0">
+                            <div class="flex flex-wrap items-center gap-2">
+                                <span
+                                    class="rounded-full px-2 py-0.5 text-xs font-medium"
+                                    :class="typeStyle(report.type).chip"
+                                >
+                                    {{ $t(`directory.reports.types.${report.type}`) }}
+                                </span>
+                                <p class="truncate font-semibold text-neutral-800">{{ report.subject }}</p>
+                            </div>
+                            <p class="mt-1 text-xs text-neutral-500">
+                                <span :title="absoluteDate(report.occurredAt)">{{ relativeDate(report.occurredAt) }}</span>
+                                <span v-if="report.author"> · {{ report.author.username }}</span>
+                            </p>
+                        </div>
+                        <div v-if="canManage" class="flex shrink-0 gap-1">
+                            <MalioButtonIcon
+                                icon="mdi:pencil-outline"
+                                variant="ghost"
+                                :aria-label="$t('common.edit')"
+                                @click="openEdit(report)"
+                            />
+                            <MalioButtonIcon
+                                icon="mdi:delete-outline"
+                                variant="ghost"
+                                :aria-label="$t('common.delete')"
+                                @click="askDelete(report)"
+                            />
+                        </div>
+                    </div>
+
+                    <MalioInputRichText
+                        v-if="report.body"
+                        :model-value="report.body"
+                        :editable="false"
+                        :reserve-message-space="false"
+                        editor-class="!border-0 !rounded-none !bg-transparent !p-0 text-sm text-neutral-700"
+                        class="mt-2"
+                    />
+
+                    <!-- Documents joints -->
+                    <div
+                        v-if="(report.documents?.length ?? 0) || canManage"
+                        class="mt-3 border-t border-neutral-100 pt-3"
+                    >
+                        <p class="mb-2 text-xs font-medium uppercase tracking-wide text-neutral-400">
+                            {{ $t('directory.reports.documentsLabel') }}
+                        </p>
+                        <div class="flex flex-col gap-2">
+                            <ReportDocumentList
+                                v-if="report.documents?.length"
+                                :documents="report.documents"
+                                :can-manage="canManage"
+                                @delete="(docId) => removeDocument(docId)"
+                            />
+                            <ReportDocumentUpload
+                                v-if="canManage"
+                                :report-id="report.id"
+                                @uploaded="reload"
+                            />
+                        </div>
+                    </div>
+                </div>
+            </li>
+        </ol>
+
+        <CommercialReportDrawer
+            v-model="drawerOpen"
+            :report="editing"
+            :owner="owner"
+            @saved="reload"
+        />
+        <ConfirmDeleteReportModal
+            v-model="confirmOpen"
+            :busy="deleting"
+            @confirm="confirmDelete"
+        />
     </div>
 </template>
 
 <script setup lang="ts">
-import type { CommercialReport, CommercialReportWrite, ReportType } from '~/modules/directory/services/dto/commercial-report'
+import type { CommercialReport, ReportType } from '~/modules/directory/services/dto/commercial-report'
 import { useCommercialReportService } from '~/modules/directory/services/commercial-reports'
 import { useReportDocumentService } from '~/modules/directory/services/report-documents'
 
 const props = defineProps<{
     owner: { client?: string, prospect?: string }
-    isAdmin: boolean
+    canManage: boolean
 }>()
 
-const { t } = useI18n()
 const reportService = useCommercialReportService()
 const documentService = useReportDocumentService()
 
 const reports = ref<CommercialReport[]>([])
-const editingId = ref<number | null>(null)
+const loading = ref(true)
 
-function emptyDraft(): CommercialReportWrite {
-    return {
-        subject: '',
-        body: null,
-        occurredAt: new Date().toISOString().slice(0, 10),
-        type: 'note',
-        ...props.owner,
+const drawerOpen = ref(false)
+const editing = ref<CommercialReport | null>(null)
+
+const confirmOpen = ref(false)
+const pendingDelete = ref<CommercialReport | null>(null)
+const deleting = ref(false)
+
+// Le plus récent en haut (l'API ne garantit pas l'ordre).
+const sortedReports = computed(() =>
+    [...reports.value].sort((a, b) => b.occurredAt.localeCompare(a.occurredAt)),
+)
+
+const typeStyles: Record<ReportType, { icon: string, badge: string, chip: string }> = {
+    call: { icon: 'mdi:phone-outline', badge: 'bg-emerald-100 text-emerald-700', chip: 'bg-emerald-50 text-emerald-700' },
+    meeting: { icon: 'mdi:account-group-outline', badge: 'bg-violet-100 text-violet-700', chip: 'bg-violet-50 text-violet-700' },
+    email: { icon: 'mdi:email-outline', badge: 'bg-sky-100 text-sky-700', chip: 'bg-sky-50 text-sky-700' },
+    note: { icon: 'mdi:note-text-outline', badge: 'bg-amber-100 text-amber-700', chip: 'bg-amber-50 text-amber-700' },
+}
+function typeStyle(type: ReportType) {
+    return typeStyles[type]
+}
+
+function startOfDay(d: Date): number {
+    return new Date(d.getFullYear(), d.getMonth(), d.getDate()).getTime()
+}
+
+function absoluteDate(iso: string): string {
+    return new Date(iso).toLocaleDateString('fr-FR')
+}
+
+// Date relative lisible (« aujourd'hui », « il y a 3 jours »…) avec repli sur la
+// date absolue au-delà d'un an. La date exacte reste disponible en infobulle.
+function relativeDate(iso: string): string {
+    const diffDays = Math.round((startOfDay(new Date(iso)) - startOfDay(new Date())) / 86400000)
+    const rtf = new Intl.RelativeTimeFormat('fr-FR', { numeric: 'auto' })
+    const abs = Math.abs(diffDays)
+    if (abs < 1) return rtf.format(0, 'day')
+    if (abs < 7) return rtf.format(diffDays, 'day')
+    if (abs < 31) return rtf.format(Math.round(diffDays / 7), 'week')
+    if (abs < 365) return rtf.format(Math.round(diffDays / 30), 'month')
+    return absoluteDate(iso)
+}
+
+function openCreate(): void {
+    editing.value = null
+    drawerOpen.value = true
+}
+
+function openEdit(report: CommercialReport): void {
+    editing.value = report
+    drawerOpen.value = true
+}
+
+function askDelete(report: CommercialReport): void {
+    pendingDelete.value = report
+    confirmOpen.value = true
+}
+
+async function confirmDelete(): Promise<void> {
+    if (!pendingDelete.value || deleting.value) return
+    deleting.value = true
+    try {
+        await reportService.remove(pendingDelete.value.id)
+        confirmOpen.value = false
+        pendingDelete.value = null
+        await reload()
+    } finally {
+        deleting.value = false
     }
 }
-const draft = ref<CommercialReportWrite>(emptyDraft())
 
-const typeOptions: { label: string, value: ReportType }[] = [
-    { label: t('directory.reports.types.call'), value: 'call' },
-    { label: t('directory.reports.types.meeting'), value: 'meeting' },
-    { label: t('directory.reports.types.email'), value: 'email' },
-    { label: t('directory.reports.types.note'), value: 'note' },
-]
-
-function formatDate(iso: string): string {
-    return new Date(iso).toLocaleDateString('fr-FR')
+async function removeDocument(id: number): Promise<void> {
+    await documentService.remove(id)
+    await reload()
 }
 
 async function reload(): Promise<void> {
     reports.value = await reportService.getByOwner(props.owner)
-}
-
-function resetDraft(): void {
-    editingId.value = null
-    draft.value = emptyDraft()
-}
-
-function edit(report: CommercialReport): void {
-    editingId.value = report.id
-    draft.value = {
-        subject: report.subject,
-        body: report.body,
-        occurredAt: report.occurredAt.slice(0, 10),
-        type: report.type,
-        ...props.owner,
-    }
-}
-
-async function save(): Promise<void> {
-    if (editingId.value) {
-        await reportService.update(editingId.value, draft.value)
-    } else {
-        await reportService.create(draft.value)
-    }
-    resetDraft()
-    await reload()
-}
-
-async function remove(id: number): Promise<void> {
-    await reportService.remove(id)
-    await reload()
-}
-
-async function removeDocument(report: CommercialReport, id: number): Promise<void> {
-    await documentService.remove(id)
-    await reload()
+    loading.value = false
 }
 
 onMounted(reload)

frontend/modules/directory/components/ConfirmDeleteModal.vue

@@ -0,0 +1,58 @@
+<template>
+    <Teleport v-if="modelValue" to="body">
+        <Transition name="modal" appear>
+            <div class="fixed inset-0 z-50 flex items-center justify-center">
+                <div class="absolute inset-0 bg-black/30" @click="cancel" />
+                <div class="relative z-10 w-full max-w-md rounded-lg bg-white p-6 shadow-xl">
+                    <h3 class="text-lg font-bold text-neutral-900">{{ title }}</h3>
+                    <p class="mt-3 text-sm text-neutral-600">
+                        {{ message }}
+                    </p>
+                    <div class="mt-6 flex justify-end gap-3">
+                        <MalioButton
+                            variant="tertiary"
+                            :label="$t('common.cancel')"
+                            button-class="w-auto px-4"
+                            @click="cancel"
+                        />
+                        <MalioButton
+                            variant="danger"
+                            :label="$t('common.delete')"
+                            button-class="w-auto px-4"
+                            @click="$emit('confirm')"
+                        />
+                    </div>
+                </div>
+            </div>
+        </Transition>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+defineProps<{
+    modelValue: boolean
+    title: string
+    message: string
+}>()
+
+const emit = defineEmits<{
+    (e: 'update:modelValue', value: boolean): void
+    (e: 'confirm'): void
+}>()
+
+function cancel() {
+    emit('update:modelValue', false)
+}
+</script>
+
+<style scoped>
+.modal-enter-active,
+.modal-leave-active {
+    transition: opacity 0.2s ease;
+}
+
+.modal-enter-from,
+.modal-leave-to {
+    opacity: 0;
+}
+</style>

frontend/modules/directory/components/ProspectDrawer.vue

@@ -6,41 +6,11 @@
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="form.name"
-                :label="$t('prospects.fields.name')"
+                label="Nom société"
                 input-class="w-full"
                 :error="touched.name && !form.name.trim() ? $t('prospects.validation.nameRequired') : ''"
                 @blur="touched.name = true"
             />
-            <MalioInputText
-                v-model="form.company"
-                :label="$t('prospects.fields.company')"
-                input-class="w-full"
-            />
-            <MalioInputText
-                v-model="form.email"
-                :label="$t('prospects.fields.email')"
-                input-class="w-full"
-            />
-            <MalioInputText
-                v-model="form.phone"
-                :label="$t('prospects.fields.phone')"
-                input-class="w-full"
-            />
-            <MalioSelect
-                v-model="form.status"
-                :label="$t('prospects.fields.status')"
-                :options="statusOptions"
-                group-class="w-full"
-            />
-            <MalioInputText
-                v-model="form.source"
-                :label="$t('prospects.fields.source')"
-                input-class="w-full"
-            />
-            <MalioInputTextArea
-                v-model="form.notes"
-                :label="$t('prospects.fields.notes')"
-            />
 
             <div class="mt-6 flex items-center justify-between gap-2">
                 <MalioButton
@@ -69,7 +39,7 @@
 </template>
 
 <script setup lang="ts">
-import type { Prospect, ProspectStatus, ProspectWrite } from '~/modules/directory/services/dto/prospect'
+import type { Prospect, ProspectWrite } from '~/modules/directory/services/dto/prospect'
 import { useProspectService } from '~/modules/directory/services/prospects'
 
 const props = defineProps<{
@@ -82,8 +52,6 @@ const emit = defineEmits<{
     (e: 'saved'): void
 }>()
 
-const { t } = useI18n()
-
 const isOpen = computed({
     get: () => props.modelValue,
     set: (v) => emit('update:modelValue', v),
@@ -93,30 +61,8 @@ const isEditing = computed(() => !!props.prospect)
 const isConverted = computed(() => !!props.prospect?.convertedClient)
 const isSubmitting = ref(false)
 
-const statusOptions = [
-    { label: t('prospects.status.new'), value: 'new' },
-    { label: t('prospects.status.contacted'), value: 'contacted' },
-    { label: t('prospects.status.qualified'), value: 'qualified' },
-    { label: t('prospects.status.won'), value: 'won' },
-    { label: t('prospects.status.lost'), value: 'lost' },
-]
-
-const form = reactive<{
-    name: string
-    company: string
-    email: string
-    phone: string
-    status: ProspectStatus
-    source: string
-    notes: string
-}>({
+const form = reactive({
     name: '',
-    company: '',
-    email: '',
-    phone: '',
-    status: 'new',
-    source: '',
-    notes: '',
 })
 
 const touched = reactive({
@@ -125,23 +71,7 @@ const touched = reactive({
 
 watch(() => props.modelValue, (open) => {
     if (open) {
-        if (props.prospect) {
-            form.name = props.prospect.name ?? ''
-            form.company = props.prospect.company ?? ''
-            form.email = props.prospect.email ?? ''
-            form.phone = props.prospect.phone ?? ''
-            form.status = props.prospect.status ?? 'new'
-            form.source = props.prospect.source ?? ''
-            form.notes = props.prospect.notes ?? ''
-        } else {
-            form.name = ''
-            form.company = ''
-            form.email = ''
-            form.phone = ''
-            form.status = 'new'
-            form.source = ''
-            form.notes = ''
-        }
+        form.name = props.prospect?.name ?? ''
         touched.name = false
     }
 })
@@ -156,12 +86,6 @@ async function handleSubmit() {
     try {
         const payload: ProspectWrite = {
             name: form.name.trim(),
-            company: form.company.trim() || null,
-            email: form.email.trim() || null,
-            phone: form.phone.trim() || null,
-            status: form.status,
-            source: form.source.trim() || null,
-            notes: form.notes.trim() || null,
         }
 
         if (isEditing.value && props.prospect) {

frontend/modules/directory/components/ReportDocumentList.vue

@@ -15,7 +15,7 @@
                 {{ doc.originalName }}
             </a>
             <MalioButtonIcon
-                v-if="isAdmin"
+                v-if="canManage"
                 icon="mdi:trash-can-outline"
                 button-class="!text-red-600"
                 :aria-label="$t('common.delete')"
@@ -32,7 +32,7 @@
 import type { ReportDocument } from '~/modules/directory/services/dto/report-document'
 import { useReportDocumentService } from '~/modules/directory/services/report-documents'
 
-defineProps<{ documents: ReportDocument[], isAdmin: boolean }>()
+defineProps<{ documents: ReportDocument[], canManage: boolean }>()
 defineEmits<{ delete: [id: number] }>()
 
 const { getDownloadUrl } = useReportDocumentService()

frontend/modules/directory/pages/directory/clients/[id].vue

@@ -8,6 +8,36 @@
         <p v-if="loading">{{ $t('common.loading') }}</p>
         <template v-else-if="client">
             <MalioTabList v-model="activeTab" :tabs="tabs">
+                <template #info>
+                    <div class="flex flex-col gap-4 pt-6">
+                        <div class="relative grid grid-cols-2 gap-x-[44px] gap-y-4 rounded-lg bg-white px-7 py-5 shadow-[0_4px_4px_0_rgba(0,0,0,0.10)]">
+                            <MalioInputText
+                                v-model="info.name"
+                                class="col-span-2"
+                                :label="$t('directory.info.fields.name')"
+                                :error="infoTouched.name && !info.name.trim() ? $t('directory.validation.nameRequired') : ''"
+                                @blur="infoTouched.name = true"
+                            />
+                            <MalioInputText
+                                v-model="info.email"
+                                :label="$t('directory.info.fields.email')"
+                            />
+                            <MalioInputText
+                                v-model="info.phone"
+                                :label="$t('directory.info.fields.phone')"
+                            />
+                        </div>
+                        <div class="flex justify-center pt-2">
+                            <MalioButton
+                                button-class="w-auto px-6"
+                                :label="$t('common.save')"
+                                :disabled="savingInfo"
+                                @click="saveInfo"
+                            />
+                        </div>
+                    </div>
+                </template>
+
                 <template #contact>
                     <div class="flex flex-col gap-4 pt-6">
                         <DirectoryContactBlock
@@ -69,7 +99,7 @@
                 </template>
 
                 <template #report>
-                    <CommercialReportTab :owner="owner" :is-admin="true" />
+                    <CommercialReportTab :owner="owner" :can-manage="canManage" />
                 </template>
             </MalioTabList>
         </template>
@@ -107,22 +137,50 @@ const {
     load,
 } = useDirectoryDetail(owner)
 
+const { can } = usePermissions()
+const canManage = computed(() => can('directory.clients.manage'))
+
 const client = ref<Client | null>(null)
 const loading = ref(true)
 
-const activeTab = ref('contact')
+const activeTab = ref('info')
 const tabs = [
+    { key: 'info', label: t('directory.tabs.info'), icon: 'mdi:information-outline' },
     { key: 'contact', label: t('directory.tabs.contact'), icon: 'mdi:account-outline' },
     { key: 'address', label: t('directory.tabs.address'), icon: 'mdi:map-marker-outline' },
     { key: 'report', label: t('directory.tabs.report'), icon: 'mdi:file-document-outline' },
 ]
 
+// Champs de base de la fiche, édités en mémoire et persistés au clic sur
+// « Enregistrer » (PATCH), comme les onglets Contact/Adresse.
+const info = reactive({ name: '', email: '', phone: '' })
+const infoTouched = reactive({ name: false })
+const savingInfo = ref(false)
+
+async function saveInfo(): Promise<void> {
+    infoTouched.name = true
+    if (!info.name.trim() || savingInfo.value) return
+    savingInfo.value = true
+    try {
+        client.value = await clientService.update(id, {
+            name: info.name.trim(),
+            email: info.email.trim() || null,
+            phone: info.phone.trim() || null,
+        })
+    } finally {
+        savingInfo.value = false
+    }
+}
+
 function goBack(): void {
     router.push('/directory')
 }
 
 onMounted(async () => {
     client.value = await clientService.getById(id)
+    info.name = client.value.name ?? ''
+    info.email = client.value.email ?? ''
+    info.phone = client.value.phone ?? ''
     await load()
     loading.value = false
 })

frontend/modules/directory/pages/directory/index.vue

@@ -31,6 +31,17 @@
                         <template #cell-phone="{ item }">
                             {{ (item as Client).phone ?? '—' }}
                         </template>
+                        <template #cell-actions="{ item }">
+                            <div class="flex justify-end" @click.stop>
+                                <MalioButtonIcon
+                                    icon="mdi:trash-can-outline"
+                                    :aria-label="$t('common.delete')"
+                                    button-class="!bg-red-100 !text-red-700"
+                                    :icon-size="18"
+                                    @click="askDeleteClient(item as Client)"
+                                />
+                            </div>
+                        </template>
                     </MalioDataTable>
                 </div>
             </template>
@@ -75,20 +86,23 @@
                             {{ (item as ProspectRow).phone ?? '—' }}
                         </template>
                         <template #cell-actions="{ item }">
-                            <div
-                                v-if="!(item as ProspectRow).convertedClient"
-                                class="flex justify-end"
-                                @click.stop
-                            >
+                            <div class="flex justify-end gap-2" @click.stop>
                                 <MalioButtonIcon
+                                    v-if="!(item as ProspectRow).convertedClient"
                                     icon="mdi:account-convert"
                                     :aria-label="$t('prospects.convert')"
                                     button-class="!bg-green-100 !text-green-700"
                                     :icon-size="18"
                                     @click="convertProspect(item as ProspectRow)"
                                 />
+                                <MalioButtonIcon
+                                    icon="mdi:trash-can-outline"
+                                    :aria-label="$t('common.delete')"
+                                    button-class="!bg-red-100 !text-red-700"
+                                    :icon-size="18"
+                                    @click="askDeleteProspect(item as ProspectRow)"
+                                />
                             </div>
-                            <span v-else class="text-neutral-300">—</span>
                         </template>
                     </MalioDataTable>
                 </div>
@@ -105,6 +119,13 @@
             :prospect="selectedProspect"
             @saved="onProspectSaved"
         />
+
+        <ConfirmDeleteModal
+            v-model="deleteModalOpen"
+            :title="deleteModalTitle"
+            :message="deleteModalMessage"
+            @confirm="confirmDelete"
+        />
     </div>
 </template>
 
@@ -139,6 +160,7 @@ const clientColumns = [
     { key: 'name', label: t('prospects.fields.name') },
     { key: 'email', label: t('prospects.fields.email') },
     { key: 'phone', label: t('prospects.fields.phone') },
+    { key: 'actions', label: '' },
 ]
 
 async function loadClients() {
@@ -225,6 +247,54 @@ async function onProspectSaved() {
     await Promise.all([loadProspects(), loadClients()])
 }
 
+// --- Suppression (clients & prospects) ---
+type DeleteTarget =
+    | { type: 'client'; item: Client }
+    | { type: 'prospect'; item: Prospect }
+
+const deleteModalOpen = ref(false)
+const deleteTarget = ref<DeleteTarget | null>(null)
+
+const deleteModalTitle = computed(() =>
+    deleteTarget.value?.type === 'prospect'
+        ? t('prospects.deleteConfirmTitle')
+        : t('clients.deleteConfirmTitle'),
+)
+
+const deleteModalMessage = computed(() => {
+    if (!deleteTarget.value) return ''
+    const name = deleteTarget.value.item.name
+    return deleteTarget.value.type === 'prospect'
+        ? t('prospects.deleteConfirmMessage', { name })
+        : t('clients.deleteConfirmMessage', { name })
+})
+
+function askDeleteClient(item: Client) {
+    deleteTarget.value = { type: 'client', item }
+    deleteModalOpen.value = true
+}
+
+function askDeleteProspect(item: Prospect) {
+    deleteTarget.value = { type: 'prospect', item }
+    deleteModalOpen.value = true
+}
+
+async function confirmDelete() {
+    const target = deleteTarget.value
+    if (!target) return
+
+    if (target.type === 'client') {
+        await clientService.remove(target.item.id)
+        await loadClients()
+    } else {
+        await prospectService.remove(target.item.id)
+        await loadProspects()
+    }
+
+    deleteModalOpen.value = false
+    deleteTarget.value = null
+}
+
 watch(statusFilter, loadProspects)
 
 onMounted(async () => {

frontend/modules/directory/pages/directory/prospects/[id].vue

@@ -8,6 +8,56 @@
         <p v-if="loading">{{ $t('common.loading') }}</p>
         <template v-else-if="prospect">
             <MalioTabList v-model="activeTab" :tabs="tabs">
+                <template #info>
+                    <div class="flex flex-col gap-4 pt-6">
+                        <div class="relative grid grid-cols-2 gap-x-[44px] gap-y-4 rounded-lg bg-white px-7 py-5 shadow-[0_4px_4px_0_rgba(0,0,0,0.10)]">
+                            <MalioInputText
+                                v-model="info.name"
+                                class="col-span-2"
+                                :label="$t('prospects.fields.name')"
+                                :error="infoTouched.name && !info.name.trim() ? $t('prospects.validation.nameRequired') : ''"
+                                @blur="infoTouched.name = true"
+                            />
+                            <MalioInputText
+                                v-model="info.company"
+                                :label="$t('prospects.fields.company')"
+                            />
+                            <MalioSelect
+                                v-model="info.status"
+                                :label="$t('prospects.fields.status')"
+                                :options="statusOptions"
+                                group-class="w-full"
+                            />
+                            <MalioInputText
+                                v-model="info.email"
+                                :label="$t('prospects.fields.email')"
+                            />
+                            <MalioInputText
+                                v-model="info.phone"
+                                :label="$t('prospects.fields.phone')"
+                            />
+                            <MalioInputText
+                                v-model="info.source"
+                                class="col-span-2"
+                                :label="$t('prospects.fields.source')"
+                            />
+                            <MalioInputTextArea
+                                v-model="info.notes"
+                                class="col-span-2"
+                                :label="$t('prospects.fields.notes')"
+                            />
+                        </div>
+                        <div class="flex justify-center pt-2">
+                            <MalioButton
+                                button-class="w-auto px-6"
+                                :label="$t('common.save')"
+                                :disabled="savingInfo"
+                                @click="saveInfo"
+                            />
+                        </div>
+                    </div>
+                </template>
+
                 <template #contact>
                     <div class="flex flex-col gap-4 pt-6">
                         <DirectoryContactBlock
@@ -69,7 +119,7 @@
                 </template>
 
                 <template #report>
-                    <CommercialReportTab :owner="owner" :is-admin="true" />
+                    <CommercialReportTab :owner="owner" :can-manage="canManage" />
                 </template>
             </MalioTabList>
         </template>
@@ -77,7 +127,7 @@
 </template>
 
 <script setup lang="ts">
-import type { Prospect } from '~/modules/directory/services/dto/prospect'
+import type { Prospect, ProspectStatus } from '~/modules/directory/services/dto/prospect'
 import { useProspectService } from '~/modules/directory/services/prospects'
 
 definePageMeta({ middleware: ['admin'] })
@@ -107,22 +157,74 @@ const {
     load,
 } = useDirectoryDetail(owner)
 
+const { can } = usePermissions()
+const canManage = computed(() => can('directory.prospects.manage'))
+
 const prospect = ref<Prospect | null>(null)
 const loading = ref(true)
 
-const activeTab = ref('contact')
+const activeTab = ref('info')
 const tabs = [
+    { key: 'info', label: t('directory.tabs.info'), icon: 'mdi:information-outline' },
     { key: 'contact', label: t('directory.tabs.contact'), icon: 'mdi:account-outline' },
     { key: 'address', label: t('directory.tabs.address'), icon: 'mdi:map-marker-outline' },
     { key: 'report', label: t('directory.tabs.report'), icon: 'mdi:file-document-outline' },
 ]
 
+const statusOptions = [
+    { label: t('prospects.status.new'), value: 'new' },
+    { label: t('prospects.status.contacted'), value: 'contacted' },
+    { label: t('prospects.status.qualified'), value: 'qualified' },
+    { label: t('prospects.status.won'), value: 'won' },
+    { label: t('prospects.status.lost'), value: 'lost' },
+]
+
+// Champs de base de la fiche, édités en mémoire et persistés au clic sur
+// « Enregistrer » (PATCH), comme les onglets Contact/Adresse.
+const info = reactive<{
+    name: string
+    company: string
+    email: string
+    phone: string
+    status: ProspectStatus
+    source: string
+    notes: string
+}>({ name: '', company: '', email: '', phone: '', status: 'new', source: '', notes: '' })
+const infoTouched = reactive({ name: false })
+const savingInfo = ref(false)
+
+async function saveInfo(): Promise<void> {
+    infoTouched.name = true
+    if (!info.name.trim() || savingInfo.value) return
+    savingInfo.value = true
+    try {
+        prospect.value = await prospectService.update(id, {
+            name: info.name.trim(),
+            company: info.company.trim() || null,
+            email: info.email.trim() || null,
+            phone: info.phone.trim() || null,
+            status: info.status,
+            source: info.source.trim() || null,
+            notes: info.notes.trim() || null,
+        })
+    } finally {
+        savingInfo.value = false
+    }
+}
+
 function goBack(): void {
     router.push('/directory')
 }
 
 onMounted(async () => {
     prospect.value = await prospectService.getById(id)
+    info.name = prospect.value.name ?? ''
+    info.company = prospect.value.company ?? ''
+    info.email = prospect.value.email ?? ''
+    info.phone = prospect.value.phone ?? ''
+    info.status = prospect.value.status ?? 'new'
+    info.source = prospect.value.source ?? ''
+    info.notes = prospect.value.notes ?? ''
     await load()
     loading.value = false
 })

frontend/modules/directory/services/dto/client.ts

@@ -8,6 +8,6 @@ export type Client = {
 
 export type ClientWrite = {
     name: string
-    email: string | null
-    phone: string | null
+    email?: string | null
+    phone?: string | null
 }

frontend/modules/directory/services/dto/prospect.ts

@@ -19,10 +19,10 @@ export type Prospect = {
 
 export type ProspectWrite = {
     name: string
-    company: string | null
-    email: string | null
-    phone: string | null
-    status: ProspectStatus
-    source: string | null
-    notes: string | null
+    company?: string | null
+    email?: string | null
+    phone?: string | null
+    status?: ProspectStatus
+    source?: string | null
+    notes?: string | null
 }

src/Module/Absence/Infrastructure/Command/AccrueLeaveCommand.php

@@ -111,9 +111,18 @@ class AccrueLeaveCommand extends Command
                 $previousBalance = null !== $previousPeriod
                     ? $this->balanceRepository->findOneForPeriod($user, AbsenceType::PaidLeave, $previousPeriod)
                     : null;
-                $balance->setAcquired(
-                    null !== $previousBalance ? $previousBalance->getAcquiring() : $profile->getInitialLeaveBalance(),
-                );
+
+                if (null !== $previousBalance) {
+                    // Only the days *not yet taken* carry over. Leave is charged
+                    // oldest-first: it first consumes the previous "acquired"
+                    // (N-2) bucket — which expires at roll-over anyway — so only
+                    // days taken beyond that bucket eat into the carry-over.
+                    $carryOver = $previousBalance->getAcquiring()
+                        - max(0.0, $previousBalance->getTaken() - $previousBalance->getAcquired());
+                    $balance->setAcquired(max(0.0, $carryOver));
+                } else {
+                    $balance->setAcquired($profile->getInitialLeaveBalance());
+                }
             }
 
             if ($monthKey === $balance->getLastAccruedMonth()) {

src/Module/Core/Infrastructure/Security/PermissionVoter.php

@@ -14,7 +14,9 @@ use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  */
 final class PermissionVoter extends Voter
 {
-    private const string PATTERN = '/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/';
+    // Les codes de permission sont au format module.resource.action où chaque
+    // segment peut contenir des tirets (ex. project-management, time-tracking).
+    private const string PATTERN = '/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)+$/';
 
     protected function supports(string $attribute, mixed $subject): bool
     {

src/Module/Directory/Domain/Entity/Address.php

@@ -23,11 +23,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[Auditable]
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
+        new Get(security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
+        new Post(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
+        new Patch(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
+        new Delete(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
     ],
     normalizationContext: ['groups' => ['address:read']],
     denormalizationContext: ['groups' => ['address:write']],

src/Module/Directory/Domain/Entity/Client.php

@@ -25,11 +25,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[Auditable]
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('directory.clients.view')"),
+        new Get(security: "is_granted('directory.clients.view')"),
+        new Post(security: "is_granted('directory.clients.manage')"),
+        new Patch(security: "is_granted('directory.clients.manage')"),
+        new Delete(security: "is_granted('directory.clients.manage')"),
     ],
     normalizationContext: ['groups' => ['client:read']],
     denormalizationContext: ['groups' => ['client:write']],

src/Module/Directory/Domain/Entity/CommercialReport.php

@@ -26,11 +26,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
+        new Get(security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
+        new Post(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
+        new Patch(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
+        new Delete(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
     ],
     normalizationContext: ['groups' => ['commercial_report:read']],
     denormalizationContext: ['groups' => ['commercial_report:write']],

src/Module/Directory/Domain/Entity/Contact.php

@@ -23,11 +23,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[Auditable]
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
+        new Get(security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
+        new Post(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
+        new Patch(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
+        new Delete(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
     ],
     normalizationContext: ['groups' => ['contact:read']],
     denormalizationContext: ['groups' => ['contact:write']],

src/Module/Directory/Domain/Entity/Prospect.php

@@ -27,14 +27,14 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[Auditable]
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('directory.prospects.view')"),
+        new Get(security: "is_granted('directory.prospects.view')"),
+        new Post(security: "is_granted('directory.prospects.manage')"),
+        new Patch(security: "is_granted('directory.prospects.manage')"),
+        new Delete(security: "is_granted('directory.prospects.manage')"),
         new Post(
             uriTemplate: '/prospects/{id}/convert',
-            security: "is_granted('ROLE_ADMIN')",
+            security: "is_granted('directory.prospects.manage')",
             processor: ConvertProspectProcessor::class,
         ),
     ],

src/Module/Directory/Domain/Entity/ReportDocument.php

@@ -20,14 +20,14 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
+        new Get(security: "is_granted('directory.clients.view') or is_granted('directory.prospects.view')"),
         new Post(
-            security: "is_granted('ROLE_ADMIN')",
+            security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')",
             processor: ReportDocumentProcessor::class,
             deserialize: false,
         ),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new Delete(security: "is_granted('directory.clients.manage') or is_granted('directory.prospects.manage')"),
     ],
     normalizationContext: ['groups' => ['report_document:read']],
     denormalizationContext: ['groups' => ['report_document:write']],

src/Module/ProjectManagement/Domain/Entity/Project.php

@@ -30,18 +30,18 @@ use Symfony\Component\Validator\Constraints as Assert;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view')"),
+        new Get(security: "is_granted('project-management.projects.view')"),
         new Post(
-            security: "is_granted('ROLE_ADMIN')",
+            security: "is_granted('project-management.projects.manage')",
             denormalizationContext: ['groups' => ['project:write', 'project:create']],
         ),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new Patch(security: "is_granted('project-management.projects.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage')"),
         new Post(
             uriTemplate: '/projects/{id}/switch-workflow',
             uriVariables: ['id' => new Link(fromClass: Project::class)],
-            security: "is_granted('ROLE_ADMIN')",
+            security: "is_granted('project-management.projects.manage')",
             input: false,
             output: SwitchWorkflowOutput::class,
             normalizationContext: ['groups' => ['switch_workflow:read']],

src/Module/ProjectManagement/Domain/Entity/Task.php

@@ -33,11 +33,11 @@ use Symfony\Component\Validator\Context\ExecutionContextInterface;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')", processor: TaskNumberProcessor::class),
-        new Patch(security: "is_granted('ROLE_ADMIN')", processor: TaskCalendarProcessor::class),
-        new Delete(security: "is_granted('ROLE_ADMIN')", processor: TaskCalendarProcessor::class),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.tasks.manage')", processor: TaskNumberProcessor::class),
+        new Patch(security: "is_granted('project-management.tasks.manage')", processor: TaskCalendarProcessor::class),
+        new Delete(security: "is_granted('project-management.tasks.manage')", processor: TaskCalendarProcessor::class),
     ],
     normalizationContext: ['groups' => ['task:read']],
     denormalizationContext: ['groups' => ['task:write']],

src/Module/ProjectManagement/Domain/Entity/TaskDocument.php

@@ -21,14 +21,14 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')", provider: TaskDocumentProvider::class),
-        new Get(security: "is_granted('ROLE_USER')", provider: TaskDocumentProvider::class),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.tasks.view')", provider: TaskDocumentProvider::class),
+        new Get(security: "is_granted('project-management.tasks.view')", provider: TaskDocumentProvider::class),
         new Post(
-            security: "is_granted('ROLE_ADMIN')",
+            security: "is_granted('project-management.tasks.manage')",
             processor: TaskDocumentProcessor::class,
             deserialize: false,
         ),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new Delete(security: "is_granted('project-management.tasks.manage')"),
     ],
     normalizationContext: ['groups' => ['task_document:read']],
     denormalizationContext: ['groups' => ['task_document:write']],

src/Module/ProjectManagement/Domain/Entity/TaskEffort.php

@@ -16,11 +16,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Patch(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
     ],
     normalizationContext: ['groups' => ['task_effort:read']],
     denormalizationContext: ['groups' => ['task_effort:write']],

src/Module/ProjectManagement/Domain/Entity/TaskGroup.php

@@ -19,11 +19,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Patch(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
     ],
     normalizationContext: ['groups' => ['task_group:read']],
     denormalizationContext: ['groups' => ['task_group:write']],

src/Module/ProjectManagement/Domain/Entity/TaskPriority.php

@@ -16,11 +16,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Patch(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
     ],
     normalizationContext: ['groups' => ['task_priority:read']],
     denormalizationContext: ['groups' => ['task_priority:write']],

src/Module/ProjectManagement/Domain/Entity/TaskRecurrence.php

@@ -20,11 +20,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Patch(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
     ],
     normalizationContext: ['groups' => ['task_recurrence:read']],
     denormalizationContext: ['groups' => ['task_recurrence:write']],

src/Module/ProjectManagement/Domain/Entity/TaskStatus.php

@@ -18,11 +18,11 @@ use Symfony\Component\Validator\Constraints as Assert;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Patch(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
     ],
     normalizationContext: ['groups' => ['task_status:read']],
     denormalizationContext: ['groups' => ['task_status:write']],

src/Module/ProjectManagement/Domain/Entity/TaskTag.php

@@ -17,11 +17,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Patch(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
     ],
     normalizationContext: ['groups' => ['task_tag:read']],
     denormalizationContext: ['groups' => ['task_tag:write']],

src/Module/ProjectManagement/Domain/Entity/Workflow.php

@@ -21,11 +21,11 @@ use Symfony\Component\Validator\Constraints as Assert;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_ADMIN')"),
-        new Patch(security: "is_granted('ROLE_ADMIN')"),
-        new Delete(security: "is_granted('ROLE_ADMIN')", processor: WorkflowDeleteProcessor::class),
+        new GetCollection(paginationEnabled: false, security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Get(security: "is_granted('project-management.projects.view') or is_granted('project-management.tasks.view')"),
+        new Post(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Patch(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')"),
+        new Delete(security: "is_granted('project-management.projects.manage') or is_granted('project-management.tasks.manage')", processor: WorkflowDeleteProcessor::class),
     ],
     normalizationContext: ['groups' => ['workflow:read']],
     denormalizationContext: ['groups' => ['workflow:write']],

src/Module/TimeTracking/Domain/Entity/TimeEntry.php

@@ -31,13 +31,13 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new GetCollection(security: "is_granted('time-tracking.entries.view')"),
         new GetCollection(
             name: 'time_entries_range',
             uriTemplate: '/time_entries/range',
             description: 'List time entries for a bounded date range without pagination (used by the time-tracking calendar)',
             paginationEnabled: false,
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('time-tracking.entries.view')",
         ),
         new GetCollection(
             name: 'active_time_entry',
@@ -45,12 +45,12 @@ use Symfony\Component\Serializer\Attribute\Groups;
             provider: ActiveTimeEntryProvider::class,
             description: 'Get the active timer for the current user',
             paginationEnabled: false,
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('time-tracking.entries.view')",
         ),
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_USER')"),
-        new Patch(security: "is_granted('ROLE_ADMIN') or object.getUser() == user"),
-        new Delete(security: "is_granted('ROLE_ADMIN') or object.getUser() == user"),
+        new Get(security: "is_granted('time-tracking.entries.view')"),
+        new Post(security: "is_granted('time-tracking.entries.manage')"),
+        new Patch(security: "is_granted('ROLE_ADMIN') or (is_granted('time-tracking.entries.manage') and object.getUser() == user)"),
+        new Delete(security: "is_granted('ROLE_ADMIN') or (is_granted('time-tracking.entries.manage') and object.getUser() == user)"),
     ],
     normalizationContext: ['groups' => ['time_entry:read']],
     denormalizationContext: ['groups' => ['time_entry:write']],

src/Module/TimeTracking/TimeTrackingModule.php

@@ -26,15 +26,13 @@ final class TimeTrackingModule implements ModuleInterface
     /**
      * Permissions RBAC fin du Module TimeTracking (2.1).
      *
-     * Additif : alimente le catalogue RBAC. La sécurité des opérations API
-     * reste en ROLE_USER (non recâblée ici).
-     *
      * @return list<array{code: string, label: string}>
      */
     public static function permissions(): array
     {
         return [
             ['code' => 'time-tracking.entries.view', 'label' => 'Voir les saisies de temps'],
+            ['code' => 'time-tracking.entries.manage', 'label' => 'Gérer les saisies de temps'],
             ['code' => 'time-tracking.entries.export', 'label' => 'Exporter les saisies de temps'],
         ];
     }

tests/Functional/Command/AccrueLeaveCommandTest.php

@@ -0,0 +1,120 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Functional\Command;
+
+use App\Module\Absence\Domain\Entity\AbsenceBalance;
+use App\Module\Absence\Domain\Enum\AbsenceType;
+use App\Module\Absence\Infrastructure\Command\AccrueLeaveCommand;
+use App\Module\Absence\Infrastructure\Doctrine\DoctrineAbsenceBalanceRepository;
+use App\Module\Core\Domain\Entity\User;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
+use Symfony\Component\Console\Tester\CommandTester;
+
+/**
+ * Covers the period roll-over: when a new reference period opens, the previous
+ * period's "en cours d'acquisition" (N) becomes the new "acquired" (N-1), but
+ * only for the days that were not already taken.
+ *
+ * @internal
+ */
+class AccrueLeaveCommandTest extends KernelTestCase
+{
+    private EntityManagerInterface $em;
+    private DoctrineAbsenceBalanceRepository $balances;
+
+    protected function setUp(): void
+    {
+        self::bootKernel();
+        $this->em       = self::getContainer()->get(EntityManagerInterface::class);
+        $this->balances = self::getContainer()->get(DoctrineAbsenceBalanceRepository::class);
+    }
+
+    /**
+     * Tristan's real case: 9.75 accruing, 1 day taken, nothing previously
+     * acquired → the day taken eats into the carry-over, so 8.75 rolls over
+     * (not 9.75).
+     */
+    public function testCarryOverDeductsTakenDays(): void
+    {
+        $user = $this->createEmployee();
+        $this->seedPreviousBalance($user, acquired: 0.0, acquiring: 9.75, taken: 1.0);
+
+        $this->runForJune2026();
+
+        $rolled = $this->balances->findOneForPeriod($user, AbsenceType::PaidLeave, '2026-2027');
+        self::assertNotNull($rolled);
+        self::assertEqualsWithDelta(8.75, $rolled->getAcquired(), 0.0001);
+    }
+
+    /**
+     * Leave is charged oldest-first: the 3 days taken come out of the expiring
+     * N-2 "acquired" bucket (5), so the full 10 accruing days carry over intact.
+     */
+    public function testCarryOverChargesOldestBucketFirst(): void
+    {
+        $user = $this->createEmployee();
+        $this->seedPreviousBalance($user, acquired: 5.0, acquiring: 10.0, taken: 3.0);
+
+        $this->runForJune2026();
+
+        $rolled = $this->balances->findOneForPeriod($user, AbsenceType::PaidLeave, '2026-2027');
+        self::assertNotNull($rolled);
+        self::assertEqualsWithDelta(10.0, $rolled->getAcquired(), 0.0001);
+    }
+
+    /** No day taken → the whole accruing bucket carries over. */
+    public function testFullCarryOverWhenNothingTaken(): void
+    {
+        $user = $this->createEmployee();
+        $this->seedPreviousBalance($user, acquired: 0.0, acquiring: 10.0, taken: 0.0);
+
+        $this->runForJune2026();
+
+        $rolled = $this->balances->findOneForPeriod($user, AbsenceType::PaidLeave, '2026-2027');
+        self::assertNotNull($rolled);
+        self::assertEqualsWithDelta(10.0, $rolled->getAcquired(), 0.0001);
+    }
+
+    private function createEmployee(): User
+    {
+        $user = new User();
+        $user->setUsername('accrue-test-'.uniqid());
+        $user->setPassword('x');
+        $user->setRoles(['ROLE_USER']);
+        $user->setIsEmployee(true);
+        $user->setHireDate(new DateTimeImmutable('2024-01-01'));
+        $user->setReferencePeriodStart('06-01');
+        $user->setAnnualLeaveDays(25.0);
+        $user->setWorkTimeRatio(1.0);
+        $user->setInitialLeaveBalance(0.0);
+        $this->em->persist($user);
+        $this->em->flush();
+
+        return $user;
+    }
+
+    private function seedPreviousBalance(User $user, float $acquired, float $acquiring, float $taken): void
+    {
+        $balance = new AbsenceBalance();
+        $balance->setUser($user);
+        $balance->setType(AbsenceType::PaidLeave);
+        $balance->setPeriod('2025-2026');
+        $balance->setAcquired($acquired);
+        $balance->setAcquiring($acquiring);
+        $balance->setTaken($taken);
+        $this->em->persist($balance);
+        $this->em->flush();
+    }
+
+    private function runForJune2026(): void
+    {
+        $command = self::getContainer()->get(AccrueLeaveCommand::class);
+        $tester  = new CommandTester($command);
+        $tester->execute(['--month' => '2026-06']);
+        self::assertSame(0, $tester->getStatusCode());
+    }
+}

tests/Functional/Module/ProjectManagement/ProjectAccessControlTest.php

@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Functional\Module\ProjectManagement;
+
+use App\Module\Core\Domain\Entity\Permission;
+use App\Module\Core\Domain\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+
+/**
+ * Vérifie que les ressources métier sont bien gardées par les permissions RBAC
+ * granulaires et non plus par le simple ROLE_USER.
+ *
+ * @internal
+ */
+final class ProjectAccessControlTest extends WebTestCase
+{
+    public function testAuthenticatedUserWithoutPermissionIsForbidden(): void
+    {
+        $client = self::createClient();
+        $em     = self::getContainer()->get(EntityManagerInterface::class);
+
+        $user = $this->createPlainUser($em, 'proj-noperm-'.uniqid());
+        $em->flush();
+        $client->loginUser($user);
+
+        $client->request('GET', '/api/projects');
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testUserWithViewPermissionCanListProjects(): void
+    {
+        $client = self::createClient();
+        $em     = self::getContainer()->get(EntityManagerInterface::class);
+
+        $permission = $em->getRepository(Permission::class)->findOneBy(['code' => 'project-management.projects.view']);
+        self::assertInstanceOf(Permission::class, $permission, 'Le catalogue de permissions doit contenir project-management.projects.view (lancer app:sync-permissions).');
+
+        $user = $this->createPlainUser($em, 'proj-view-'.uniqid());
+        $user->addDirectPermission($permission);
+        $em->flush();
+        $client->loginUser($user);
+
+        $client->request('GET', '/api/projects');
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testViewPermissionDoesNotGrantWrite(): void
+    {
+        $client = self::createClient();
+        $em     = self::getContainer()->get(EntityManagerInterface::class);
+
+        $permission = $em->getRepository(Permission::class)->findOneBy(['code' => 'project-management.projects.view']);
+        self::assertInstanceOf(Permission::class, $permission);
+
+        $user = $this->createPlainUser($em, 'proj-noWrite-'.uniqid());
+        $user->addDirectPermission($permission);
+        $em->flush();
+        $client->loginUser($user);
+
+        $client->request('POST', '/api/projects', server: [
+            'CONTENT_TYPE' => 'application/ld+json',
+        ], content: json_encode(['name' => 'Should be denied']));
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    private function createPlainUser(EntityManagerInterface $em, string $username): User
+    {
+        $user = new User();
+        $user->setUsername($username);
+        $user->setPassword('x');
+        $user->setRoles(['ROLE_USER']);
+        $em->persist($user);
+
+        return $user;
+    }
+}