Merge pull request '[#NUMERO_TICKET] TITRE TICKET' (#2 ) from develop into main

Reviewed-on: #2
chore : bump version to v0.3.1
2026-03-18 13:16:19 +00:00 · 2026-03-18 14:13:21 +01:00 · 2026-03-18 14:13:12 +01:00 · 2026-03-18 14:11:00 +01:00 · 2026-03-18 11:50:31 +01:00 · 2026-03-18 11:50:21 +01:00
102 changed files with 1023 additions and 929 deletions
--- a/.env
+++ b/.env
@@ -1,5 +1,5 @@
 APP_ENV=dev
-APP_SECRET="a64f5614357bf56aecb1d7470e431535"
+APP_SECRET="change_me_in_env_local"
 APP_DEBUG=1

 DEFAULT_URI=http://localhost/
@@ -11,7 +11,7 @@ CORS_ALLOW_ORIGIN='^https?://(localhost|127.0.0.1)(:[0-9]+)?$'
 ###> lexik/jwt-authentication-bundle ###
 JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
 JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
-JWT_PASSPHRASE=c2dbeec8fa8255bdab24e88b9fc1e57927740c429ae3b930d03e51b92e13a85f
+JWT_PASSPHRASE=change_me_in_env_local
 JWT_COOKIE_SECURE=0
 JWT_TOKEN_TTL=86400
 JWT_COOKIE_TTL=86400
@@ -20,4 +20,4 @@ JWT_COOKIE_TTL=86400

 DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:${POSTGRES_PORT}/${POSTGRES_DB}?serverVersion=16&charset=utf8"

-ENCRYPTION_KEY=aaaaaaaaa
+ENCRYPTION_KEY=change_me_in_env_local
--- a/.env.example
+++ b/.env.example
@@ -0,0 +1,99 @@
+###############################################################################
+# Lesstime — Fichier d'environnement de reference
+#
+# Copiez ce fichier en .env.local et remplissez les valeurs sensibles.
+# Les valeurs par defaut dans .env suffisent pour le developpement ;
+# seuls les secrets (APP_SECRET, JWT_PASSPHRASE, ENCRYPTION_KEY) doivent
+# etre definis dans .env.local.
+#
+# Ne commitez JAMAIS de vrais secrets dans .env ou .env.example.
+###############################################################################
+
+# ===========================================================================
+# App
+# ===========================================================================
+
+# Environnement Symfony : dev, test, prod
+APP_ENV=dev
+
+# Secret applicatif Symfony (32 chars hex) — a generer pour chaque installation
+# Generer avec : php -r "echo bin2hex(random_bytes(16));"
+APP_SECRET="change_me_in_env_local"
+
+# Active/desactive le mode debug (1 = oui, 0 = non)
+APP_DEBUG=1
+
+# URI par defaut de l'application (utilise pour les liens absolus)
+DEFAULT_URI=http://localhost/
+
+# ===========================================================================
+# CORS (nelmio/cors-bundle)
+# ===========================================================================
+
+# Origines autorisees pour les requetes cross-origin (regex)
+CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
+
+# ===========================================================================
+# JWT (lexik/jwt-authentication-bundle)
+# ===========================================================================
+
+# Chemin vers la cle privee RSA pour signer les tokens JWT
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+
+# Chemin vers la cle publique RSA pour verifier les tokens JWT
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+
+# Passphrase de la cle privee JWT — a generer pour chaque installation
+# Generer avec : php -r "echo bin2hex(random_bytes(32));"
+JWT_PASSPHRASE=change_me_in_env_local
+
+# Cookie securise (1 = HTTPS uniquement, 0 = HTTP autorise — dev seulement)
+JWT_COOKIE_SECURE=0
+
+# Duree de vie du token JWT en secondes (86400 = 24h)
+JWT_TOKEN_TTL=86400
+
+# Duree de vie du cookie JWT en secondes (86400 = 24h)
+JWT_COOKIE_TTL=86400
+
+# ===========================================================================
+# Base de donnees (Doctrine / PostgreSQL)
+# ===========================================================================
+
+# Les variables POSTGRES_* sont definies dans docker/.env.docker
+# et injectees automatiquement par Docker Compose.
+# DATABASE_URL est construite a partir de ces variables.
+DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:${POSTGRES_PORT}/${POSTGRES_DB}?serverVersion=16&charset=utf8"
+
+# ===========================================================================
+# Chiffrement
+# ===========================================================================
+
+# Cle de chiffrement pour les donnees sensibles (64 chars hex = 256 bits)
+# Generer avec : php -r "echo bin2hex(random_bytes(32));"
+ENCRYPTION_KEY=change_me_in_env_local
+
+# ===========================================================================
+# Docker (docker/.env.docker)
+#
+# Ces variables sont lues par Docker Compose. Voir docker/.env.docker
+# pour les valeurs par defaut. Creez docker/.env.docker.local pour
+# surcharger localement.
+# ===========================================================================
+
+# DOCKER_APP_NAME=lesstime
+# DOCKER_PHP_VERSION=8.4.6
+# DOCKER_NODE_VERSION=24.12.0
+# APP_USER=www-data
+# POSTGRES_DB=lesstime
+# POSTGRES_USER=root
+# POSTGRES_PASSWORD=root
+# POSTGRES_PORT=5435
+# XDEBUG_CLIENT_HOST=host.docker.internal
+
+# ===========================================================================
+# Frontend (frontend/.env)
+# ===========================================================================
+
+# Base URL de l'API pour le client Nuxt (relative, proxifiee par Nginx)
+# NUXT_PUBLIC_API_BASE=/api
--- a/.gitea/workflows/release-artefact.yml
+++ b/.gitea/workflows/release-artefact.yml
@@ -51,7 +51,6 @@ jobs:
            migrations \
            public \
            src \
-            templates \
            vendor \
            composer.json \
            composer.lock \
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,11 @@
 ###> lexik/jwt-authentication-bundle ###
 /config/jwt/*.pem
 ###< lexik/jwt-authentication-bundle ###
+
+###> ide ###
+.idea/
+###< ide ###
+
+###> docker local ###
+docker/.env.docker.local
+###< docker local ###
--- a/.idea/.gitignore
+++ b/.idea/.gitignore
@@ -1,10 +0,0 @@
-# Default ignored files
-/shelf/
-/workspace.xml
-# Ignored default folder with query files
-/queries/
-# Datasource local storage ignored files
-/dataSources/
-/dataSources.local.xml
-# Editor-based HTTP Client requests
-/httpRequests/
--- a/.idea/Lesstime.iml
+++ b/.idea/Lesstime.iml
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module type="WEB_MODULE" version="4">
-  <component name="NewModuleRootManager">
-    <content url="file://$MODULE_DIR$" />
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>
--- a/.idea/db-forest-config.xml
+++ b/.idea/db-forest-config.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="db-tree-configuration">
-    <option name="data" value="----------------------------------------&#10;1:0:9cad43df-2147-4989-b7a4-443067034884&#10;2:0:ae622167-c834-4e7b-87a5-c1721036f5dc&#10;3:0:f407a514-c6b4-4b26-9555-445a85892502&#10;4:0:09e221b8-067a-488b-9c1d-4e155a333079&#10;" />
-  </component>
-</project>
--- a/.idea/material_theme_project_new.xml
+++ b/.idea/material_theme_project_new.xml
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="MaterialThemeProjectNewConfig">
-    <option name="metadata">
-      <MTProjectMetadataState>
-        <option name="userId" value="386cba74:19cc24e9181:-799b" />
-      </MTProjectMetadataState>
-    </option>
-  </component>
-</project>
--- a/.idea/modules.xml
+++ b/.idea/modules.xml
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ProjectModuleManager">
-    <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/Lesstime.iml" filepath="$PROJECT_DIR$/.idea/Lesstime.iml" />
-    </modules>
-  </component>
-</project>
--- a/.idea/php.xml
+++ b/.idea/php.xml
@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="MessDetectorOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PHPCSFixerOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PHPCodeSnifferOptionsConfiguration">
-    <option name="highlightLevel" value="WARNING" />
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PhpProjectSharedConfiguration" php_language_level="8.4" />
-  <component name="PhpStanOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-  <component name="PsalmOptionsConfiguration">
-    <option name="transferred" value="true" />
-  </component>
-</project>
--- a/.idea/vcs.xml
+++ b/.idea/vcs.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="VcsDirectoryMappings">
-    <mapping directory="$PROJECT_DIR$" vcs="Git" />
-  </component>
-</project>
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -12,7 +12,7 @@ Application de gestion de projet. Monorepo Symfony 8 (API Platform 4) + Nuxt 4.
 ## Structure

 ```
-src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration, ClientTicket, Notification, TaskDocument)
+src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration, ClientTicket, Notification, TaskDocument, BookStackConfiguration, TaskBookStackLink)
 src/ApiResource/     # Ressources API Platform (si découplées des entités)
 src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, ClientTicket*Provider/Processor, NotificationProvider, Gitea*Provider, Gitea*Processor)
 src/Service/         # Services métier (NotificationService)
--- a/composer.json
+++ b/composer.json
@@ -29,10 +29,10 @@
        "symfony/monolog-bundle": "^4.0",
        "symfony/property-access": "8.0.*",
        "symfony/property-info": "8.0.*",
+        "symfony/rate-limiter": "8.0.*",
        "symfony/runtime": "8.0.*",
        "symfony/security-bundle": "8.0.*",
        "symfony/serializer": "8.0.*",
-        "symfony/twig-bundle": "8.0.*",
        "symfony/validator": "8.0.*",
        "symfony/yaml": "8.0.*"
    },
@@ -91,8 +91,6 @@
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^4.3",
        "friendsofphp/php-cs-fixer": "^3.94",
-        "phpunit/phpunit": "^13.0",
-        "symfony/browser-kit": "8.0.*",
-        "symfony/css-selector": "8.0.*"
+        "phpunit/phpunit": "^13.0"
    }
 }
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "6fd67ba307d74fa0bcb9e6b9bf72f8bc",
+    "content-hash": "1a611b09459bb0625242a9a0ea223107",
    "packages": [
        {
            "name": "api-platform/doctrine-common",
@@ -6048,6 +6048,77 @@
            ],
            "time": "2025-12-08T08:00:13+00:00"
        },
+        {
+            "name": "symfony/options-resolver",
+            "version": "v8.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/options-resolver.git",
+                "reference": "d2b592535ffa6600c265a3893a7f7fd2bad82dd7"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/options-resolver/zipball/d2b592535ffa6600c265a3893a7f7fd2bad82dd7",
+                "reference": "d2b592535ffa6600c265a3893a7f7fd2bad82dd7",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.4",
+                "symfony/deprecation-contracts": "^2.5|^3"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\OptionsResolver\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Fabien Potencier",
+                    "email": "fabien@symfony.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Provides an improved replacement for the array_replace PHP function",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "config",
+                "configuration",
+                "options"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/options-resolver/tree/v8.0.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-11-12T15:55:31+00:00"
+        },
        {
            "name": "symfony/password-hasher",
            "version": "v8.0.6",
@@ -6877,6 +6948,80 @@
            ],
            "time": "2026-01-03T23:40:55+00:00"
        },
+        {
+            "name": "symfony/rate-limiter",
+            "version": "v8.0.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/rate-limiter.git",
+                "reference": "1f8159c50b55e78810f5a8f60889d0b6b3a11deb"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/rate-limiter/zipball/1f8159c50b55e78810f5a8f60889d0b6b3a11deb",
+                "reference": "1f8159c50b55e78810f5a8f60889d0b6b3a11deb",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.4",
+                "symfony/options-resolver": "^7.4|^8.0"
+            },
+            "require-dev": {
+                "psr/cache": "^1.0|^2.0|^3.0",
+                "symfony/lock": "^7.4|^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\RateLimiter\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Wouter de Jong",
+                    "email": "wouter@wouterj.nl"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Provides a Token Bucket implementation to rate limit input and output in your application",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "limiter",
+                "rate-limiter"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/rate-limiter/tree/v8.0.7"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-03-04T13:55:34+00:00"
+        },
        {
            "name": "symfony/routing",
            "version": "v8.0.6",
@@ -7802,197 +7947,6 @@
            ],
            "time": "2025-07-15T13:41:35+00:00"
        },
-        {
-            "name": "symfony/twig-bridge",
-            "version": "v8.0.7",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/symfony/twig-bridge.git",
-                "reference": "e0539400f53d8305945c06eba7e8df007402f5e2"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/twig-bridge/zipball/e0539400f53d8305945c06eba7e8df007402f5e2",
-                "reference": "e0539400f53d8305945c06eba7e8df007402f5e2",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=8.4",
-                "symfony/translation-contracts": "^2.5|^3",
-                "twig/twig": "^3.21"
-            },
-            "conflict": {
-                "phpdocumentor/reflection-docblock": "<5.2|>=7",
-                "phpdocumentor/type-resolver": "<1.5.1",
-                "symfony/form": "<7.4.4|>8.0,<8.0.4"
-            },
-            "require-dev": {
-                "egulias/email-validator": "^2.1.10|^3|^4",
-                "league/html-to-markdown": "^5.0",
-                "phpdocumentor/reflection-docblock": "^5.2|^6.0",
-                "symfony/asset": "^7.4|^8.0",
-                "symfony/asset-mapper": "^7.4|^8.0",
-                "symfony/console": "^7.4|^8.0",
-                "symfony/dependency-injection": "^7.4|^8.0",
-                "symfony/emoji": "^7.4|^8.0",
-                "symfony/expression-language": "^7.4|^8.0",
-                "symfony/finder": "^7.4|^8.0",
-                "symfony/form": "^7.4.4|^8.0.4",
-                "symfony/html-sanitizer": "^7.4|^8.0",
-                "symfony/http-foundation": "^7.4|^8.0",
-                "symfony/http-kernel": "^7.4|^8.0",
-                "symfony/intl": "^7.4|^8.0",
-                "symfony/mime": "^7.4|^8.0",
-                "symfony/polyfill-intl-icu": "^1.0",
-                "symfony/property-info": "^7.4|^8.0",
-                "symfony/routing": "^7.4|^8.0",
-                "symfony/security-acl": "^2.8|^3.0",
-                "symfony/security-core": "^7.4|^8.0",
-                "symfony/security-csrf": "^7.4|^8.0",
-                "symfony/security-http": "^7.4|^8.0",
-                "symfony/serializer": "^7.4|^8.0",
-                "symfony/stopwatch": "^7.4|^8.0",
-                "symfony/translation": "^7.4|^8.0",
-                "symfony/validator": "^7.4|^8.0",
-                "symfony/web-link": "^7.4|^8.0",
-                "symfony/workflow": "^7.4|^8.0",
-                "symfony/yaml": "^7.4|^8.0",
-                "twig/cssinliner-extra": "^3",
-                "twig/inky-extra": "^3",
-                "twig/markdown-extra": "^3"
-            },
-            "type": "symfony-bridge",
-            "autoload": {
-                "psr-4": {
-                    "Symfony\\Bridge\\Twig\\": ""
-                },
-                "exclude-from-classmap": [
-                    "/Tests/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com"
-                },
-                {
-                    "name": "Symfony Community",
-                    "homepage": "https://symfony.com/contributors"
-                }
-            ],
-            "description": "Provides integration for Twig with various Symfony components",
-            "homepage": "https://symfony.com",
-            "support": {
-                "source": "https://github.com/symfony/twig-bridge/tree/v8.0.7"
-            },
-            "funding": [
-                {
-                    "url": "https://symfony.com/sponsor",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/fabpot",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/nicolas-grekas",
-                    "type": "github"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2026-03-04T15:37:12+00:00"
-        },
-        {
-            "name": "symfony/twig-bundle",
-            "version": "v8.0.4",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/symfony/twig-bundle.git",
-                "reference": "5a68f2e0e06996514bf04900c3982b93b42487af"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/twig-bundle/zipball/5a68f2e0e06996514bf04900c3982b93b42487af",
-                "reference": "5a68f2e0e06996514bf04900c3982b93b42487af",
-                "shasum": ""
-            },
-            "require": {
-                "composer-runtime-api": ">=2.1",
-                "php": ">=8.4",
-                "symfony/config": "^7.4|^8.0",
-                "symfony/dependency-injection": "^7.4|^8.0",
-                "symfony/http-foundation": "^7.4|^8.0",
-                "symfony/http-kernel": "^7.4|^8.0",
-                "symfony/twig-bridge": "^7.4|^8.0"
-            },
-            "require-dev": {
-                "symfony/asset": "^7.4|^8.0",
-                "symfony/expression-language": "^7.4|^8.0",
-                "symfony/finder": "^7.4|^8.0",
-                "symfony/form": "^7.4|^8.0",
-                "symfony/framework-bundle": "^7.4|^8.0",
-                "symfony/routing": "^7.4|^8.0",
-                "symfony/runtime": "^7.4|^8.0",
-                "symfony/stopwatch": "^7.4|^8.0",
-                "symfony/translation": "^7.4|^8.0",
-                "symfony/web-link": "^7.4|^8.0",
-                "symfony/yaml": "^7.4|^8.0"
-            },
-            "type": "symfony-bundle",
-            "autoload": {
-                "psr-4": {
-                    "Symfony\\Bundle\\TwigBundle\\": ""
-                },
-                "exclude-from-classmap": [
-                    "/Tests/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com"
-                },
-                {
-                    "name": "Symfony Community",
-                    "homepage": "https://symfony.com/contributors"
-                }
-            ],
-            "description": "Provides a tight integration of Twig into the Symfony full-stack framework",
-            "homepage": "https://symfony.com",
-            "support": {
-                "source": "https://github.com/symfony/twig-bundle/tree/v8.0.4"
-            },
-            "funding": [
-                {
-                    "url": "https://symfony.com/sponsor",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/fabpot",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/nicolas-grekas",
-                    "type": "github"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2026-01-06T12:43:21+00:00"
-        },
        {
            "name": "symfony/type-info",
            "version": "v8.0.7",
@@ -8574,85 +8528,6 @@
            ],
            "time": "2026-02-09T10:14:57+00:00"
        },
-        {
-            "name": "twig/twig",
-            "version": "v3.23.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/twigphp/Twig.git",
-                "reference": "a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9",
-                "reference": "a64dc5d2cc7d6cafb9347f6cd802d0d06d0351c9",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=8.1.0",
-                "symfony/deprecation-contracts": "^2.5|^3",
-                "symfony/polyfill-ctype": "^1.8",
-                "symfony/polyfill-mbstring": "^1.3"
-            },
-            "require-dev": {
-                "phpstan/phpstan": "^2.0",
-                "psr/container": "^1.0|^2.0",
-                "symfony/phpunit-bridge": "^5.4.9|^6.4|^7.0"
-            },
-            "type": "library",
-            "autoload": {
-                "files": [
-                    "src/Resources/core.php",
-                    "src/Resources/debug.php",
-                    "src/Resources/escaper.php",
-                    "src/Resources/string_loader.php"
-                ],
-                "psr-4": {
-                    "Twig\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "BSD-3-Clause"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com",
-                    "homepage": "http://fabien.potencier.org",
-                    "role": "Lead Developer"
-                },
-                {
-                    "name": "Twig Team",
-                    "role": "Contributors"
-                },
-                {
-                    "name": "Armin Ronacher",
-                    "email": "armin.ronacher@active-4.com",
-                    "role": "Project Founder"
-                }
-            ],
-            "description": "Twig, the flexible, fast, and secure template language for PHP",
-            "homepage": "https://twig.symfony.com",
-            "keywords": [
-                "templating"
-            ],
-            "support": {
-                "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v3.23.0"
-            },
-            "funding": [
-                {
-                    "url": "https://github.com/fabpot",
-                    "type": "github"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/twig/twig",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2026-01-23T21:00:41+00:00"
-        },
        {
            "name": "webmozart/assert",
            "version": "2.1.6",
@@ -11711,288 +11586,6 @@
            ],
            "time": "2024-10-20T05:08:20+00:00"
        },
-        {
-            "name": "symfony/browser-kit",
-            "version": "v8.0.4",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/symfony/browser-kit.git",
-                "reference": "0d998c101e1920fc68572209d1316fec0db728ef"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/browser-kit/zipball/0d998c101e1920fc68572209d1316fec0db728ef",
-                "reference": "0d998c101e1920fc68572209d1316fec0db728ef",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=8.4",
-                "symfony/dom-crawler": "^7.4|^8.0"
-            },
-            "require-dev": {
-                "symfony/css-selector": "^7.4|^8.0",
-                "symfony/http-client": "^7.4|^8.0",
-                "symfony/mime": "^7.4|^8.0",
-                "symfony/process": "^7.4|^8.0"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Symfony\\Component\\BrowserKit\\": ""
-                },
-                "exclude-from-classmap": [
-                    "/Tests/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com"
-                },
-                {
-                    "name": "Symfony Community",
-                    "homepage": "https://symfony.com/contributors"
-                }
-            ],
-            "description": "Simulates the behavior of a web browser, allowing you to make requests, click on links and submit forms programmatically",
-            "homepage": "https://symfony.com",
-            "support": {
-                "source": "https://github.com/symfony/browser-kit/tree/v8.0.4"
-            },
-            "funding": [
-                {
-                    "url": "https://symfony.com/sponsor",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/fabpot",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/nicolas-grekas",
-                    "type": "github"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2026-01-13T13:06:50+00:00"
-        },
-        {
-            "name": "symfony/css-selector",
-            "version": "v8.0.6",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/symfony/css-selector.git",
-                "reference": "2a178bf80f05dbbe469a337730eba79d61315262"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/css-selector/zipball/2a178bf80f05dbbe469a337730eba79d61315262",
-                "reference": "2a178bf80f05dbbe469a337730eba79d61315262",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=8.4"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Symfony\\Component\\CssSelector\\": ""
-                },
-                "exclude-from-classmap": [
-                    "/Tests/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com"
-                },
-                {
-                    "name": "Jean-François Simon",
-                    "email": "jeanfrancois.simon@sensiolabs.com"
-                },
-                {
-                    "name": "Symfony Community",
-                    "homepage": "https://symfony.com/contributors"
-                }
-            ],
-            "description": "Converts CSS selectors to XPath expressions",
-            "homepage": "https://symfony.com",
-            "support": {
-                "source": "https://github.com/symfony/css-selector/tree/v8.0.6"
-            },
-            "funding": [
-                {
-                    "url": "https://symfony.com/sponsor",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/fabpot",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/nicolas-grekas",
-                    "type": "github"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2026-02-17T13:07:04+00:00"
-        },
-        {
-            "name": "symfony/dom-crawler",
-            "version": "v8.0.6",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/symfony/dom-crawler.git",
-                "reference": "7f504fe7fb7fa5fee40a653104842cf6f851a6d8"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/dom-crawler/zipball/7f504fe7fb7fa5fee40a653104842cf6f851a6d8",
-                "reference": "7f504fe7fb7fa5fee40a653104842cf6f851a6d8",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=8.4",
-                "symfony/polyfill-ctype": "^1.8",
-                "symfony/polyfill-mbstring": "^1.0"
-            },
-            "require-dev": {
-                "symfony/css-selector": "^7.4|^8.0"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Symfony\\Component\\DomCrawler\\": ""
-                },
-                "exclude-from-classmap": [
-                    "/Tests/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com"
-                },
-                {
-                    "name": "Symfony Community",
-                    "homepage": "https://symfony.com/contributors"
-                }
-            ],
-            "description": "Eases DOM navigation for HTML and XML documents",
-            "homepage": "https://symfony.com",
-            "support": {
-                "source": "https://github.com/symfony/dom-crawler/tree/v8.0.6"
-            },
-            "funding": [
-                {
-                    "url": "https://symfony.com/sponsor",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/fabpot",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/nicolas-grekas",
-                    "type": "github"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2026-02-17T13:07:04+00:00"
-        },
-        {
-            "name": "symfony/options-resolver",
-            "version": "v8.0.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/symfony/options-resolver.git",
-                "reference": "d2b592535ffa6600c265a3893a7f7fd2bad82dd7"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/options-resolver/zipball/d2b592535ffa6600c265a3893a7f7fd2bad82dd7",
-                "reference": "d2b592535ffa6600c265a3893a7f7fd2bad82dd7",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=8.4",
-                "symfony/deprecation-contracts": "^2.5|^3"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Symfony\\Component\\OptionsResolver\\": ""
-                },
-                "exclude-from-classmap": [
-                    "/Tests/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Fabien Potencier",
-                    "email": "fabien@symfony.com"
-                },
-                {
-                    "name": "Symfony Community",
-                    "homepage": "https://symfony.com/contributors"
-                }
-            ],
-            "description": "Provides an improved replacement for the array_replace PHP function",
-            "homepage": "https://symfony.com",
-            "keywords": [
-                "config",
-                "configuration",
-                "options"
-            ],
-            "support": {
-                "source": "https://github.com/symfony/options-resolver/tree/v8.0.0"
-            },
-            "funding": [
-                {
-                    "url": "https://symfony.com/sponsor",
-                    "type": "custom"
-                },
-                {
-                    "url": "https://github.com/fabpot",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/nicolas-grekas",
-                    "type": "github"
-                },
-                {
-                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
-                    "type": "tidelift"
-                }
-            ],
-            "time": "2025-11-12T15:55:31+00:00"
-        },
        {
            "name": "symfony/process",
            "version": "v8.0.5",
--- a/config/bundles.php
+++ b/config/bundles.php
@@ -12,11 +12,9 @@ use Symfony\AI\McpBundle\McpBundle;
 use Symfony\Bundle\FrameworkBundle\FrameworkBundle;
 use Symfony\Bundle\MonologBundle\MonologBundle;
 use Symfony\Bundle\SecurityBundle\SecurityBundle;
-use Symfony\Bundle\TwigBundle\TwigBundle;

 return [
    FrameworkBundle::class              => ['all' => true],
-    TwigBundle::class                   => ['all' => true],
    SecurityBundle::class               => ['all' => true],
    DoctrineBundle::class               => ['all' => true],
    DoctrineMigrationsBundle::class     => ['all' => true],
--- a/config/packages/api_platform.yaml
+++ b/config/packages/api_platform.yaml
@@ -1,5 +1,5 @@
 api_platform:
-    title: Hello API Platform
+    title: Lesstime API
    version: 1.0.0
    formats:
        jsonld: ['application/ld+json']
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -22,6 +22,9 @@ security:
            pattern: ^/login_check
            stateless: true
            provider: app_user_provider
+            login_throttling:
+                max_attempts: 5
+                interval: '1 minute'
            json_login:
                check_path: /login_check
                username_path: username
--- a/config/packages/twig.yaml
+++ b/config/packages/twig.yaml
@@ -1,6 +0,0 @@
-twig:
-    file_name_pattern: '*.twig'
-
-when@test:
-    twig:
-        strict_variables: true
--- a/config/version.yaml
+++ b/config/version.yaml
@@ -1,2 +1,2 @@
 parameters:
-    app.version: '0.2.5'
+    app.version: '0.3.1'
--- a/docker/.env.docker.local
+++ b/docker/.env.docker.local
@@ -1,9 +0,0 @@
-DOCKER_APP_NAME=lesstime
-DOCKER_PHP_VERSION=8.4.6
-DOCKER_NODE_VERSION=24.12.0
-APP_USER=www-data
-POSTGRES_DB=lesstime
-POSTGRES_USER=root
-POSTGRES_PASSWORD=root
-POSTGRES_PORT=5435
-XDEBUG_CLIENT_HOST=192.168.0.124
--- a/frontend/components/admin/AdminClientTicketTab.vue
+++ b/frontend/components/admin/AdminClientTicketTab.vue
@@ -274,25 +274,22 @@ const availableStatusTransitions = computed(() => {
 })

 function getProjectName(iri: string): string {
-    const match = iri.match(/\/api\/projects\/(\d+)/)
-    if (!match) return ''
-    const id = Number(match[1])
+    const id = extractIdFromIri(iri)
+    if (!id) return ''
    return projects.value.find(p => p.id === id)?.name ?? ''
 }

 function getSubmitterName(iri: string | null): string {
    if (!iri) return '-'
-    const match = iri.match(/\/api\/users\/(\d+)/)
-    if (!match) return ''
-    const id = Number(match[1])
+    const id = extractIdFromIri(iri)
+    if (!id) return ''
    return users.value.find(u => u.id === id)?.username ?? ''
 }

 function getSubmitterUser(iri: string | null): UserData | undefined {
    if (!iri) return undefined
-    const match = iri.match(/\/api\/users\/(\d+)/)
-    if (!match) return undefined
-    const id = Number(match[1])
+    const id = extractIdFromIri(iri)
+    if (!id) return undefined
    return users.value.find(u => u.id === id)
 }

--- a/frontend/components/client-ticket/ClientTicketDetailModal.vue
+++ b/frontend/components/client-ticket/ClientTicketDetailModal.vue
@@ -73,6 +73,7 @@
                                    v-model="editForm.description"
                                    rows="5"
                                    class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
+                                    style="resize: vertical; min-height: 140px; max-height: 500px"
                                />
                            </div>

@@ -191,7 +192,7 @@
 </template>

 <script setup lang="ts">
-import type { ClientTicket } from '~/services/dto/client-ticket'
+import type { ClientTicket, ClientTicketWrite } from '~/services/dto/client-ticket'
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
 import { useClientTicketService } from '~/services/client-tickets'
@@ -243,7 +244,7 @@ const canEdit = computed(() => {
    if (!sub) return false
    // submittedBy can be an IRI string or an embedded object
    if (typeof sub === 'string') return sub === `/api/users/${userId}`
-    if (typeof sub === 'object' && 'id' in sub) return (sub as any).id === userId
+    if (typeof sub === 'object' && 'id' in sub) return (sub as { id: number }).id === userId
    return false
 })

@@ -270,7 +271,7 @@ async function saveEdit() {
        if (props.ticket.type === 'bug') {
            data.url = editForm.url || null
        }
-        await clientTicketService.update(props.ticket.id, data as any)
+        await clientTicketService.update(props.ticket.id, data as Partial<ClientTicketWrite>)
        isEditing.value = false
        emit('refresh')
    } finally {
--- a/frontend/components/client/ClientDrawer.vue
+++ b/frontend/components/client/ClientDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un client' : 'Ajouter un client'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('clients.editClient') : $t('clients.addClient')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.name"
--- a/frontend/components/project/ProjectDrawer.vue
+++ b/frontend/components/project/ProjectDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un projet' : 'Ajouter un projet'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('projects.editProject') : $t('projects.addProject')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.code"
@@ -64,7 +64,7 @@
            </div>
        </form>

-        <div v-if="isEditing && project" class="mt-6 border-t border-neutral-200 pt-4">
+        <div v-if="isEditing && project" class="mt-6 border-t border-neutral-200 pt-4 flex items-center justify-between">
            <button
                class="flex items-center gap-2 text-sm text-neutral-500 hover:text-amber-600"
                :disabled="isSubmitting"
@@ -73,7 +73,21 @@
                <Icon :name="project.archived ? 'mdi:archive-arrow-up-outline' : 'mdi:archive-arrow-down-outline'" size="18" />
                {{ project.archived ? 'Désarchiver' : 'Archiver' }}
            </button>
+            <button
+                v-if="project.taskCount === 0"
+                class="flex items-center gap-2 text-sm text-neutral-500 hover:text-red-600"
+                :disabled="isSubmitting"
+                @click="confirmDeleteOpen = true"
+            >
+                <Icon name="mdi:delete-outline" size="18" />
+                {{ $t('common.delete') }}
+            </button>
        </div>
+
+        <ConfirmDeleteProjectModal
+            v-model="confirmDeleteOpen"
+            @confirm="handleDelete"
+        />
    </AppDrawer>
 </template>

@@ -104,6 +118,7 @@ const isOpen = computed({

 const isEditing = computed(() => !!props.project)
 const isSubmitting = ref(false)
+const confirmDeleteOpen = ref(false)

 const { listRepositories } = useGiteaService()
 const giteaRepos = ref<GiteaRepository[]>([])
@@ -164,7 +179,7 @@ watch(() => props.modelValue, (open) => {
    }
 })

-const { create, update } = useProjectService()
+const { create, update, remove } = useProjectService()

 async function handleSubmit() {
    touched.name = true
@@ -213,6 +228,19 @@ async function handleSubmit() {
    }
 }

+async function handleDelete() {
+    if (!props.project) return
+    isSubmitting.value = true
+    try {
+        await remove(props.project.id)
+        emit('saved')
+        isOpen.value = false
+    } finally {
+        confirmDeleteOpen.value = false
+        isSubmitting.value = false
+    }
+}
+
 async function handleArchiveToggle() {
    if (!props.project) return
    isSubmitting.value = true
--- a/frontend/components/task/TaskDrawer.vue
+++ b/frontend/components/task/TaskDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un ticket' : 'Ajouter un ticket'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('tasks.editTask') : $t('tasks.addTask')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.title"
@@ -267,7 +267,7 @@ async function handleArchive() {
    if (timerStore.activeEntry?.task) {
        const taskIri = typeof timerStore.activeEntry.task === 'string'
            ? timerStore.activeEntry.task
-            : (timerStore.activeEntry.task as any)?.['@id'] ?? `/api/tasks/${(timerStore.activeEntry.task as any)?.id}`
+            : (timerStore.activeEntry.task as Task)?.['@id'] ?? `/api/tasks/${(timerStore.activeEntry.task as Task)?.id}`
        if (taskIri === `/api/tasks/${props.task.id}`) {
            await timerStore.stop()
        }
--- a/frontend/components/task/TaskEffortDrawer.vue
+++ b/frontend/components/task/TaskEffortDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un effort' : 'Ajouter un effort'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('taskEfforts.editEffort') : $t('taskEfforts.addEffort')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.label"
--- a/frontend/components/task/TaskGroupDrawer.vue
+++ b/frontend/components/task/TaskGroupDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un groupe' : 'Ajouter un groupe'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('taskGroups.editGroup') : $t('taskGroups.addGroup')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.title"
--- a/frontend/components/task/TaskModal.vue
+++ b/frontend/components/task/TaskModal.vue
@@ -24,7 +24,7 @@
                                    {{ task.project.code }}-{{ task.number }}
                                </span>
                                <h2 class="text-lg font-bold tracking-tight text-neutral-900">
-                                    {{ isEditing ? 'Modifier un ticket' : 'Ajouter un ticket' }}
+                                    {{ isEditing ? $t('tasks.editTask') : $t('tasks.addTask') }}
                                </h2>
                            </div>
                            <button
@@ -156,7 +156,12 @@
                            <MalioInputTextArea
                                v-model="form.description"
                                label="Description"
-                                :size="3"
+                                :size="5"
+                                resize="vertical"
+                                :min-resize-height="140"
+                                :max-resize-height="500"
+                                min-resize-width="100%"
+                                max-resize-width="100%"
                            />
                        </div>

@@ -568,7 +573,7 @@ async function handleArchive() {
    if (timerStore.activeEntry?.task) {
        const taskIri = typeof timerStore.activeEntry.task === 'string'
            ? timerStore.activeEntry.task
-            : (timerStore.activeEntry.task as any)?.['@id'] ?? `/api/tasks/${(timerStore.activeEntry.task as any)?.id}`
+            : (timerStore.activeEntry.task as Task)?.['@id'] ?? `/api/tasks/${(timerStore.activeEntry.task as Task)?.id}`
        if (taskIri === `/api/tasks/${props.task.id}`) {
            await timerStore.stop()
        }
--- a/frontend/components/task/TaskPriorityDrawer.vue
+++ b/frontend/components/task/TaskPriorityDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier une priorité' : 'Ajouter une priorité'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('taskPriorities.editPriority') : $t('taskPriorities.addPriority')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.label"
--- a/frontend/components/task/TaskStatusDrawer.vue
+++ b/frontend/components/task/TaskStatusDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un statut' : 'Ajouter un statut'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('taskStatuses.editStatus') : $t('taskStatuses.addStatus')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.label"
--- a/frontend/components/task/TaskTagDrawer.vue
+++ b/frontend/components/task/TaskTagDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un tag' : 'Ajouter un tag'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('taskTags.editTag') : $t('taskTags.addTag')">
        <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
            <MalioInputText
                v-model="form.label"
--- a/frontend/components/time-tracking/TimeEntryBlock.vue
+++ b/frontend/components/time-tracking/TimeEntryBlock.vue
@@ -1,7 +1,7 @@
 <template>
    <div
        ref="blockEl"
-        class="absolute z-10 cursor-pointer rounded-md text-xs text-white shadow-sm select-none"
+        class="absolute z-10 cursor-pointer rounded-md text-xs shadow-sm select-none"
        :style="blockStyle"
        :class="{ 'opacity-40': isDragSource }"
        @contextmenu.prevent="emit('contextmenu', $event, entry)"
@@ -17,38 +17,33 @@
            <div class="absolute bottom-0 left-1/2 -translate-x-1/2 h-[3px] w-8 rounded-full bg-black/0 group-hover:bg-black/20 transition" />
        </div>

-        <div class="px-1.5 py-0.5 h-full overflow-hidden">
-            <!-- Full display: title + project + type dot + duration -->
-            <template v-if="sizeLevel >= 3">
-                <div class="flex items-center gap-1">
-                    <div class="font-semibold truncate">{{ entry.title || 'Sans titre' }}</div>
-                    <span class="ml-auto shrink-0 text-[10px] tabular-nums opacity-80">{{ duration }}</span>
-                </div>
-                <div v-if="entry.project" class="truncate text-[10px] opacity-80">{{ entry.project.name }}</div>
-                <div v-if="entry.tags.length" class="mt-0.5 flex items-center gap-1 overflow-hidden">
+        <div class="flex flex-col h-full overflow-hidden px-1.5 py-1">
+            <!-- Top: title + project -->
+            <div class="min-w-0">
+                <div v-if="sizeLevel >= 1" class="font-bold truncate leading-tight" style="color: #0A2168">{{ entry.title || $t('common.untitled') }}</div>
+                <div v-if="sizeLevel >= 2 && entry.project" class="truncate text-[10px] font-semibold opacity-80 leading-tight">{{ entry.project.name }}</div>
+            </div>
+
+            <!-- Spacer -->
+            <div class="flex-1" />
+
+            <!-- Bottom: tags left, duration right -->
+            <div v-if="sizeLevel >= 3" class="flex items-end justify-between gap-1 min-w-0">
+                <div v-if="entry.tags.length" class="flex items-center gap-1 overflow-hidden min-w-0">
                    <span
                        v-for="tag in entry.tags"
                        :key="tag.id"
-                        class="inline-flex items-center gap-0.5 truncate text-[9px] opacity-90"
+                        class="inline-flex shrink-0 items-center gap-0.5 rounded-full px-1.5 py-0.5 text-[9px] font-bold text-white"
+                        :style="{ backgroundColor: tag.color }"
                    >
-                        <span class="inline-block h-1.5 w-1.5 shrink-0 rounded-full" :style="{ backgroundColor: tag.color }" />
                        {{ tag.label }}
                    </span>
                </div>
-            </template>
-
-            <!-- Medium: title + duration -->
-            <template v-else-if="sizeLevel === 2">
-                <div class="font-semibold truncate">{{ entry.title || 'Sans titre' }}</div>
-                <div class="text-[10px] tabular-nums opacity-80">{{ duration }}</div>
-            </template>
-
-            <!-- Small: title only -->
-            <template v-else-if="sizeLevel === 1">
-                <div class="font-semibold truncate text-[10px] leading-tight">{{ entry.title || 'Sans titre' }}</div>
-            </template>
-
-            <!-- Tiny: just a colored bar, no text -->
+                <span class="shrink-0 text-[10px] tabular-nums font-bold" style="color: #0A2168">{{ duration }}</span>
+            </div>
+            <div v-else-if="sizeLevel === 2" class="flex items-end justify-end">
+                <span class="shrink-0 text-[10px] tabular-nums font-bold" style="color: #0A2168">{{ duration }}</span>
+            </div>
        </div>

        <!-- Resize handle bottom (outside block) -->
@@ -116,10 +111,11 @@ const sizeLevel = computed(() => {
    return 0
 })

+const hasProject = computed(() => !!props.entry.project)
+
 const blockStyle = computed(() => {
    const startMinutes = startDate.value.getHours() * 60 + startDate.value.getMinutes() + resizeTopDeltaMinutes.value
    const topPx = ((startMinutes - props.dayStartHour * 60) / 60) * props.hourHeight
-    const bgColor = props.entry.project?.color ?? '#94a3b8'

    const col = props.columnIndex ?? 0
    const total = props.totalColumns ?? 1
@@ -127,13 +123,28 @@ const blockStyle = computed(() => {
    const leftPercent = (col / total) * 100
    const widthPercent = (1 / total) * 100

-    return {
+    const base: Record<string, string> = {
        top: `${topPx}px`,
        height: `${heightPx.value}px`,
-        backgroundColor: bgColor,
        left: `calc(${leftPercent}% + ${gapPx}px)`,
        width: `calc(${widthPercent}% - ${gapPx * 2}px)`,
    }
+
+    if (hasProject.value) {
+        const hex = props.entry.project!.color.replace('#', '')
+        const r = parseInt(hex.substring(0, 2), 16)
+        const g = parseInt(hex.substring(2, 4), 16)
+        const b = parseInt(hex.substring(4, 6), 16)
+        base.backgroundColor = `rgb(${Math.round(r + (255 - r) * 0.6)}, ${Math.round(g + (255 - g) * 0.6)}, ${Math.round(b + (255 - b) * 0.6)})`
+        base.color = `rgb(${r}, ${g}, ${b})`
+    } else {
+        base.backgroundColor = '#e5e7eb'
+        base.backgroundImage = 'repeating-conic-gradient(#d1d5db 0% 25%, #f3f4f6 0% 50%)'
+        base.backgroundSize = '12px 12px'
+        base.color = '#6b7280'
+    }
+
+    return base
 })

 // --- Click / Drag detection ---
--- a/frontend/components/time-tracking/TimeEntryDrawer.vue
+++ b/frontend/components/time-tracking/TimeEntryDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un temps' : 'Ajouter une Activité'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('timeEntries.editEntry') : $t('timeEntries.addEntry')">
        <form class="space-y-4" @submit.prevent="onSubmit">
            <div>
                <label class="mb-1 block text-sm font-semibold text-neutral-700">Titre</label>
@@ -117,7 +117,7 @@
 </template>

 <script setup lang="ts">
-import type { TimeEntry } from '~/services/dto/time-entry'
+import type { TimeEntry, TimeEntryWrite } from '~/services/dto/time-entry'
 import type { UserData } from '~/services/dto/user-data'
 import type { Project } from '~/services/dto/project'
 import type { TaskTag } from '~/services/dto/task-tag'
@@ -257,7 +257,7 @@ async function onSubmit() {
    if (isEditing.value && props.entry) {
        await update(props.entry.id, payload)
    } else {
-        await create(payload as any)
+        await create(payload as TimeEntryWrite)
    }

    emit('saved')
--- a/frontend/components/time-tracking/TimeEntryList.vue
+++ b/frontend/components/time-tracking/TimeEntryList.vue
@@ -1,7 +1,7 @@
 <template>
    <div class="space-y-2">
        <div v-if="entries.length === 0" class="rounded-lg border border-neutral-200 bg-neutral-50 py-12 text-center text-sm text-neutral-400">
-            Aucune activité pour cette période
+            {{ $t('timeEntries.noEntries') }}
        </div>

        <div
@@ -20,7 +20,7 @@
            <div class="min-w-0 flex-1">
                <div class="flex items-center gap-2">
                    <span class="truncate text-sm font-semibold text-neutral-900">
-                        {{ entry.title || 'Sans titre' }}
+                        {{ entry.title || $t('common.untitled') }}
                    </span>
                    <span
                        v-for="tag in entry.tags"
@@ -56,7 +56,7 @@
            <!-- Delete action -->
            <button
                class="shrink-0 rounded-md p-1.5 text-neutral-300 opacity-0 transition hover:bg-red-50 hover:text-red-500 group-hover:opacity-100"
-                title="Supprimer"
+                :title="$t('common.delete')"
                @click.stop="emit('deleteEntry', entry)"
            >
                <Icon name="mdi:delete-outline" size="18" />
--- a/frontend/components/time-tracking/TimeTrackingCalendar.vue
+++ b/frontend/components/time-tracking/TimeTrackingCalendar.vue
@@ -1,27 +1,27 @@
 <template>
    <div ref="calendarEl" class="relative flex h-full flex-col rounded-lg border border-neutral-200 bg-white">
-        <!-- Day headers -->
-        <div
-            class="z-20 flex flex-shrink-0 border-b border-neutral-200 bg-white rounded-t-lg"
-        >
-            <div class="w-16 shrink-0 border-r border-neutral-200" />
-            <div
-                v-for="day in days"
-                :key="day.dateStr"
-                class="flex-1 border-r border-neutral-100 py-2 text-center"
-            >
-                <div class="text-lg font-bold" :class="isToday(day.date) ? 'text-orange-500' : 'text-neutral-900'">
-                    {{ day.dayNum }}
+        <!-- Grid body with sticky header -->
+        <div ref="gridBodyEl" class="relative min-h-0 flex-1 overflow-y-auto">
+            <!-- Day headers (sticky inside scroll container) -->
+            <div class="sticky top-0 z-20 flex border-b border-neutral-200 bg-white rounded-t-lg">
+                <div class="w-16 shrink-0 border-r border-neutral-200" />
+                <div
+                    v-for="day in days"
+                    :key="'header-' + day.dateStr"
+                    class="flex-1 border-r border-neutral-100 py-2 text-center"
+                >
+                    <div class="text-lg font-bold" :class="isToday(day.date) ? 'text-orange-500' : 'text-neutral-900'">
+                        {{ day.dayNum }}
+                    </div>
+                    <div class="text-xs" :class="isToday(day.date) ? 'text-orange-500' : 'text-neutral-500'">
+                        {{ day.label }}
+                    </div>
+                    <div class="text-[10px] text-neutral-400">{{ day.totalFormatted }}</div>
                </div>
-                <div class="text-xs" :class="isToday(day.date) ? 'text-orange-500' : 'text-neutral-500'">
-                    {{ day.label }}
-                </div>
-                <div class="text-[10px] text-neutral-400">{{ day.totalFormatted }}</div>
            </div>
-        </div>

-        <!-- Grid body -->
-        <div ref="gridBodyEl" class="relative flex min-h-0 flex-1 overflow-y-auto">
+            <!-- Columns -->
+            <div class="relative flex">
            <!-- Hour labels -->
            <div class="w-16 shrink-0">
                <div
@@ -99,7 +99,7 @@
                            :style="{ backgroundColor: entry.project?.color ?? '#94a3b8' }"
                        />
                        <div class="min-w-0">
-                            <div class="truncate text-xs font-medium text-neutral-800">{{ entry.title || 'Sans titre' }}</div>
+                            <div class="truncate text-xs font-medium text-neutral-800">{{ entry.title || $t('common.untitled') }}</div>
                            <div class="text-[10px] text-neutral-500">
                                {{ formatTime(entry.startedAt) }} – {{ entry.stoppedAt ? formatTime(entry.stoppedAt) : '...' }}
                            </div>
@@ -134,13 +134,16 @@
                    <div class="text-[10px] opacity-90">{{ dragState.timeLabel }}</div>
                </div>
            </div>
-        </div>
+        </div><!-- end columns flex -->
+        </div><!-- end gridBodyEl -->
    </div>
 </template>

 <script setup lang="ts">
 import type { TimeEntry } from '~/services/dto/time-entry'

+const { t } = useI18n()
+
 const props = defineProps<{
    entries: TimeEntry[]
    startDate: Date
@@ -459,7 +462,7 @@ function onMoveStart(payload: { entry: TimeEntry; offsetY: number }, sourceDayIn
    dragState.value = {
        entryId: entry.id,
        entry,
-        title: entry.title || 'Sans titre',
+        title: entry.title || t('common.untitled'),
        color: entry.project?.color ?? '#94a3b8',
        durationMinutes,
        ghostHeightPx: Math.max((durationMinutes / 60) * hourHeight, 20),
--- a/frontend/components/ui/AppTopNav.vue
+++ b/frontend/components/ui/AppTopNav.vue
@@ -1,5 +1,5 @@
 <template>
-  <header class="border-b border-neutral-200 bg-primary-500 p-3 text-white sm:p-5">
+  <header class="border-b border-neutral-200 bg-primary-500 px-3 py-2 text-white sm:px-5 sm:py-2 max-h-[60px]">
    <div class="flex h-full items-center justify-between">
      <button
        class="rounded-md p-2 text-white hover:bg-primary-600 transition-colors lg:hidden"
@@ -7,6 +7,17 @@
      >
        <Icon name="mdi:menu" size="24" />
      </button>
+      <div class="hidden items-center gap-2 lg:flex">
+        <h1 class="text-lg font-bold tracking-tight">{{ appTitle }}</h1>
+        <button
+          type="button"
+          class="rounded-md p-1 text-white/60 transition-colors hover:bg-primary-600 hover:text-white"
+          :title="appTitle === 'NeauTime' ? 'Switch to Lesstime' : 'Switch to NeauTime'"
+          @click="toggleTitle"
+        >
+          <Icon name="mdi:swap-horizontal" size="18" />
+        </button>
+      </div>
      <div class="ml-auto flex items-center gap-4 text-xl text-white sm:gap-8">
        <NotificationBell />
        <div class="group relative flex gap-2 sm:gap-4">
@@ -45,6 +56,13 @@ defineProps<{
 const auth = useAuthStore()
 const ui = useUiStore()

+const appTitle = ref(localStorage.getItem('appTitle') || 'NeauTime')
+
+function toggleTitle() {
+  appTitle.value = appTitle.value === 'NeauTime' ? 'Lesstime' : 'NeauTime'
+  localStorage.setItem('appTitle', appTitle.value)
+}
+
 async function handleLogout() {
  await auth.logout()
  await navigateTo('/login')
--- a/frontend/components/ui/ConfirmDeleteProjectModal.vue
+++ b/frontend/components/ui/ConfirmDeleteProjectModal.vue
@@ -0,0 +1,58 @@
+<template>
+    <Teleport v-if="modelValue" to="body">
+        <Transition name="modal" appear>
+            <div class="fixed inset-0 z-50 flex items-center justify-center">
+                <div class="absolute inset-0 bg-black/30" @click="cancel" />
+                <div class="relative z-10 w-full max-w-md rounded-lg bg-white p-6 shadow-xl">
+                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('projects.deleteConfirmTitle') }}</h3>
+                    <p class="mt-3 text-sm text-neutral-600">
+                        {{ $t('projects.deleteConfirmMessage') }}
+                    </p>
+                    <div class="mt-6 flex justify-end gap-3">
+                        <button
+                            type="button"
+                            class="rounded-md border border-neutral-300 px-4 py-2 text-sm font-semibold text-neutral-700 hover:bg-neutral-50"
+                            @click="cancel"
+                        >
+                            {{ $t('common.cancel') }}
+                        </button>
+                        <button
+                            type="button"
+                            class="rounded-md bg-red-600 px-4 py-2 text-sm font-semibold text-white hover:bg-red-700"
+                            @click="$emit('confirm')"
+                        >
+                            {{ $t('common.delete') }}
+                        </button>
+                    </div>
+                </div>
+            </div>
+        </Transition>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+defineProps<{
+    modelValue: boolean
+}>()
+
+const emit = defineEmits<{
+    (e: 'update:modelValue', value: boolean): void
+    (e: 'confirm'): void
+}>()
+
+function cancel() {
+    emit('update:modelValue', false)
+}
+</script>
+
+<style scoped>
+.modal-enter-active,
+.modal-leave-active {
+    transition: opacity 0.2s ease;
+}
+
+.modal-enter-from,
+.modal-leave-to {
+    opacity: 0;
+}
+</style>
--- a/frontend/components/ui/ConfirmDeleteStatusModal.vue
+++ b/frontend/components/ui/ConfirmDeleteStatusModal.vue
@@ -4,19 +4,18 @@
            <div class="fixed inset-0 z-50 flex items-center justify-center">
                <div class="absolute inset-0 bg-black/30" @click="cancel" />
                <div class="relative z-10 w-full max-w-md rounded-lg bg-white p-6 shadow-xl">
-                    <h3 class="text-lg font-bold text-neutral-900">Supprimer le statut « {{ statusLabel }} »</h3>
+                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('taskStatuses.deleteStatus', { label: statusLabel }) }}</h3>

                    <p class="mt-3 text-sm text-neutral-600">
-                        {{ taskCount }} tâche{{ taskCount > 1 ? 's sont liées' : ' est liée' }} à ce statut.
-                        Choisissez où les déplacer :
+                        {{ taskCount > 1 ? $t('taskStatuses.linkedTasksPlural', { count: taskCount }) : $t('taskStatuses.linkedTasks', { count: taskCount }) }}
                    </p>

                    <div class="mt-4">
                        <MalioSelect
                            v-model="targetStatusId"
                            :options="targetOptions"
-                            label="Déplacer vers"
-                            empty-option-label="Backlog (sans statut)"
+                            :label="$t('taskStatuses.moveTo')"
+                            :empty-option-label="$t('taskStatuses.backlog')"
                            min-width="w-full"
                        />
                    </div>
@@ -27,7 +26,7 @@
                            class="rounded-md border border-neutral-300 px-4 py-2 text-sm font-semibold text-neutral-700 hover:bg-neutral-50"
                            @click="cancel"
                        >
-                            Annuler
+                            {{ $t('common.cancel') }}
                        </button>
                        <button
                            type="button"
@@ -35,7 +34,7 @@
                            :disabled="isProcessing"
                            @click="confirm"
                        >
-                            Supprimer
+                            {{ $t('common.delete') }}
                        </button>
                    </div>
                </div>
--- a/frontend/components/ui/DateFilter.vue
+++ b/frontend/components/ui/DateFilter.vue
@@ -15,22 +15,6 @@
        >
            <template #trigger>
                <div class="flex items-center gap-1">
-                    <div class="flex shrink-0 overflow-hidden rounded-md border border-neutral-300">
-                        <button
-                            class="px-2 py-[7px] text-xs font-medium transition"
-                            :class="mode === 'day' ? 'bg-primary-500 text-white' : 'text-neutral-500 hover:bg-neutral-100'"
-                            @click.stop="switchMode('day')"
-                        >
-                            {{ t('common.day') }}
-                        </button>
-                        <button
-                            class="px-2 py-[7px] text-xs font-medium transition"
-                            :class="mode === 'week' ? 'bg-primary-500 text-white' : 'text-neutral-500 hover:bg-neutral-100'"
-                            @click.stop="switchMode('week')"
-                        >
-                            {{ t('common.weekShort') }}
-                        </button>
-                    </div>
                    <div class="relative cursor-pointer">
                        <input
                            :value="displayValue"
@@ -85,6 +69,7 @@ const { t } = useI18n()
 const props = defineProps<{
    modelValue?: Date | [Date, Date] | null
    placeholder?: string
+    pickerMode?: 'day' | 'week'
 }>()

 const emit = defineEmits<{
@@ -92,7 +77,7 @@ const emit = defineEmits<{
 }>()

 const datepicker = ref<InstanceType<typeof VueDatePicker> | null>(null)
-const mode = ref<'day' | 'week'>('week')
+const mode = computed(() => props.pickerMode ?? 'week')
 const internalValue = ref<Date | Date[] | null>(null)

 const displayValue = computed(() => {
@@ -133,13 +118,6 @@ function formatShortDate(d: Date): string {
    return `${day}/${month}`
 }

-function switchMode(newMode: 'day' | 'week') {
-    if (mode.value === newMode) return
-    mode.value = newMode
-    internalValue.value = null
-    emit('update:modelValue', null)
-}
-
 function onUpdate(value: Date | Date[] | null) {
    if (!value) {
        emit('update:modelValue', null)
@@ -163,7 +141,6 @@ function onClear() {
 }

 function selectToday() {
-    mode.value = 'day'
    const today = new Date()
    today.setHours(0, 0, 0, 0)
    internalValue.value = today
@@ -171,7 +148,6 @@ function selectToday() {
 }

 function selectThisWeek() {
-    mode.value = 'week'
    const now = new Date()
    const day = now.getDay()
    const monday = new Date(now)
--- a/frontend/components/ui/SidebarTimer.vue
+++ b/frontend/components/ui/SidebarTimer.vue
@@ -1,11 +1,11 @@
 <template>
    <button
-        class="flex w-full items-center justify-center gap-2 rounded-md py-2 text-sm font-semibold text-white transition"
+        class="flex items-center justify-center gap-2 text-sm font-semibold text-white transition"
        :class="[
            timerStore.isRunning
                ? 'bg-[#F18619] hover:bg-[#d97314]'
                : 'bg-primary-500 hover:bg-primary-600',
-            collapsed ? 'px-2' : 'px-4'
+            collapsed ? 'mx-auto h-10 w-10 rounded-full' : 'w-full rounded-md px-4 py-2'
        ]"
        :title="timerStore.isRunning ? 'Arrêter le timer' : 'Démarrer un timer'"
        @click="timerStore.isRunning ? timerStore.stop() : timerStore.start()"
--- a/frontend/components/user/UserDrawer.vue
+++ b/frontend/components/user/UserDrawer.vue
@@ -1,5 +1,5 @@
 <template>
-    <AppDrawer v-model="isOpen" :title="isEditing ? 'Modifier un utilisateur' : 'Ajouter un utilisateur'">
+    <AppDrawer v-model="isOpen" :title="isEditing ? $t('users.editUser') : $t('users.addUser')">
        <form class="flex flex-col gap-2" @submit.prevent="handleSubmit">
            <MalioInputText
                v-model="form.username"
@@ -90,6 +90,8 @@ import { useProjectService } from '~/services/projects'
 import type { Client } from '~/services/dto/client'
 import type { Project } from '~/services/dto/project'

+const { t } = useI18n()
+
 const props = defineProps<{
    modelValue: boolean
    item: UserData | null
@@ -114,7 +116,7 @@ const clients = ref<Client[]>([])
 const allProjects = ref<Project[]>([])

 const clientOptions = computed(() => [
-    { label: 'Aucun client', value: null as number | null },
+    { label: t('common.noClient'), value: null as number | null },
    ...clients.value.map((c) => ({ label: c.name, value: c.id as number | null })),
 ])

@@ -146,6 +148,13 @@ function onClientChange(value: number | null) {
    }
 }

+watch(() => form.roles, (roles) => {
+    if (!roles.includes('ROLE_CLIENT')) {
+        form.clientId = null
+        form.allowedProjectIds = []
+    }
+})
+
 watch(() => props.modelValue, async (open) => {
    if (open) {
        if (props.item) {
@@ -187,10 +196,12 @@ async function handleSubmit() {
            username: form.username.trim(),
            roles: form.roles,
            client: form.clientId !== null ? `/api/clients/${form.clientId}` : null,
-            allowedProjects: form.allowedProjectIds.map((id) => `/api/projects/${id}`),
+            allowedProjects: form.clientId !== null
+                ? form.allowedProjectIds.map((id) => `/api/projects/${id}`)
+                : [],
        }
        if (form.password) {
-            payload.password = form.password
+            payload.plainPassword = form.password
        }

        if (isEditing.value && props.item) {
--- a/frontend/composables/useApi.ts
+++ b/frontend/composables/useApi.ts
@@ -177,13 +177,16 @@ export function useApi(): ApiClient {
  ) {
    const needsJsonBody = method === 'POST' || method === 'PUT'
    const needsMergePatch = method === 'PATCH'
+    const isFormData = typeof FormData !== 'undefined' && options.body instanceof FormData

    const headers = new Headers(options.headers as HeadersInit | undefined)

-    if (needsMergePatch && !headers.has('Content-Type')) {
-      headers.set('Content-Type', 'application/merge-patch+json')
-    } else if (needsJsonBody && !headers.has('Content-Type')) {
-      headers.set('Content-Type', 'application/json')
+    if (!isFormData) {
+      if (needsMergePatch && !headers.has('Content-Type')) {
+        headers.set('Content-Type', 'application/merge-patch+json')
+      } else if (needsJsonBody && !headers.has('Content-Type')) {
+        headers.set('Content-Type', 'application/json')
+      }
    }

    return client<T>(url, { ...options, method, headers })
--- a/frontend/composables/useAvatarService.ts
+++ b/frontend/composables/useAvatarService.ts
@@ -5,11 +5,13 @@ export function useAvatarService() {
        const formData = new FormData()
        formData.append('file', file, 'avatar.png')

-        return $fetch(`/api/users/${userId}/avatar`, {
-            method: 'POST',
-            body: formData,
-            credentials: 'include',
-        })
+        return api.post<{ avatarUrl: string }>(
+            `/users/${userId}/avatar`,
+            formData as unknown as Record<string, unknown>,
+            {
+                toastSuccessKey: 'profile.avatarUpdated',
+            }
+        )
    }

    async function remove(userId: number): Promise<void> {
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -22,43 +22,69 @@
    "clients": {
        "created": "Client créé avec succès.",
        "updated": "Client mis à jour avec succès.",
-        "deleted": "Client supprimé avec succès."
+        "deleted": "Client supprimé avec succès.",
+        "addClient": "Ajouter un client",
+        "editClient": "Modifier un client"
    },
    "projects": {
+        "title": "Projets",
        "created": "Projet créé avec succès.",
        "updated": "Projet mis à jour avec succès.",
        "deleted": "Projet supprimé avec succès.",
        "archived": "Projet archivé avec succès.",
        "unarchived": "Projet désarchivé avec succès.",
        "showArchived": "Voir les projets archivés",
-        "hideArchived": "Masquer les projets archivés"
+        "hideArchived": "Masquer les projets archivés",
+        "noProjects": "Aucun projet trouvé.",
+        "noArchivedProjects": "Aucun projet archivé.",
+        "addProject": "Ajouter un projet",
+        "addProjectShort": "Projet",
+        "editProject": "Modifier un projet",
+        "deleteConfirmTitle": "Supprimer le projet",
+        "deleteConfirmMessage": "Êtes-vous sûr de vouloir supprimer ce projet ? Cette action est irréversible.",
+        "cannotDelete": "Impossible de supprimer un projet contenant des tickets."
    },
    "taskStatuses": {
        "created": "Statut créé avec succès.",
        "updated": "Statut mis à jour avec succès.",
-        "deleted": "Statut supprimé avec succès."
+        "deleted": "Statut supprimé avec succès.",
+        "addStatus": "Ajouter un statut",
+        "editStatus": "Modifier un statut",
+        "deleteStatus": "Supprimer le statut « {label} »",
+        "linkedTasks": "{count} tâche est liée à ce statut. Choisissez où les déplacer :",
+        "linkedTasksPlural": "{count} tâches sont liées à ce statut. Choisissez où les déplacer :",
+        "moveTo": "Déplacer vers",
+        "backlog": "Backlog (sans statut)"
    },
    "taskEfforts": {
        "created": "Effort créé avec succès.",
        "updated": "Effort mis à jour avec succès.",
-        "deleted": "Effort supprimé avec succès."
+        "deleted": "Effort supprimé avec succès.",
+        "addEffort": "Ajouter un effort",
+        "editEffort": "Modifier un effort"
    },
    "taskPriorities": {
        "created": "Priorité créée avec succès.",
        "updated": "Priorité mise à jour avec succès.",
-        "deleted": "Priorité supprimée avec succès."
+        "deleted": "Priorité supprimée avec succès.",
+        "addPriority": "Ajouter une priorité",
+        "editPriority": "Modifier une priorité"
    },
    "taskTags": {
        "created": "Tag créé avec succès.",
        "updated": "Tag mis à jour avec succès.",
-        "deleted": "Tag supprimé avec succès."
+        "deleted": "Tag supprimé avec succès.",
+        "addTag": "Ajouter un tag",
+        "editTag": "Modifier un tag"
    },
    "taskGroups": {
        "created": "Groupe créé avec succès.",
        "updated": "Groupe mis à jour avec succès.",
        "deleted": "Groupe supprimé avec succès.",
        "archived": "Groupe archivé avec succès.",
-        "unarchived": "Groupe désarchivé avec succès."
+        "unarchived": "Groupe désarchivé avec succès.",
+        "addGroup": "Ajouter un groupe",
+        "editGroup": "Modifier un groupe"
    },
    "taskDocuments": {
        "title": "Documents",
@@ -78,17 +104,24 @@
        "archived": "Ticket archivé avec succès.",
        "unarchived": "Ticket désarchivé avec succès.",
        "deleteConfirmTitle": "Supprimer le ticket",
-        "deleteConfirmMessage": "Êtes-vous sûr de vouloir supprimer ce ticket ? Cette action est irréversible."
+        "deleteConfirmMessage": "Êtes-vous sûr de vouloir supprimer ce ticket ? Cette action est irréversible.",
+        "addTask": "Ajouter un ticket",
+        "editTask": "Modifier un ticket"
    },
    "users": {
        "created": "Utilisateur créé avec succès.",
        "updated": "Utilisateur mis à jour avec succès.",
-        "deleted": "Utilisateur supprimé avec succès."
+        "deleted": "Utilisateur supprimé avec succès.",
+        "addUser": "Ajouter un utilisateur",
+        "editUser": "Modifier un utilisateur"
    },
    "timeEntries": {
        "created": "Temps enregistré",
        "updated": "Temps modifié",
-        "deleted": "Temps supprimé"
+        "deleted": "Temps supprimé",
+        "noEntries": "Aucune activité pour cette période",
+        "addEntry": "Ajouter une Activité",
+        "editEntry": "Modifier un temps"
    },
    "archive": {
        "title": "Archives",
@@ -169,7 +202,12 @@
        "cancel": "Annuler",
        "save": "Enregistrer",
        "edit": "Modifier",
+        "delete": "Supprimer",
+        "add": "Ajouter",
        "loading": "Chargement...",
+        "archived": "Archivé",
+        "noClient": "Aucun client",
+        "untitled": "Sans titre",
        "dateFilter": "Date",
        "today": "Aujourd'hui",
        "thisWeek": "Cette semaine",
--- a/frontend/layouts/default.vue
+++ b/frontend/layouts/default.vue
@@ -17,7 +17,7 @@
                    ui.sidebarOpen ? 'w-64 translate-x-0' : '-translate-x-full',
                ]"
            >
-                <div class="flex items-center justify-between overflow-hidden" :class="sidebarIsCollapsed ? 'p-2 justify-center' : ''">
+                <div class="flex items-center overflow-hidden" :class="sidebarIsCollapsed ? 'justify-center p-3' : 'justify-between'">
                    <img
                        v-if="!sidebarIsCollapsed"
                        src="/malio.png"
@@ -26,9 +26,9 @@
                    />
                    <img
                        v-else
-                        src="/malio.png"
+                        src="/LOGO_CARRE.png"
                        alt="Logo"
-                        class="h-8 w-8 object-cover object-left"
+                        class="w-[46px] h-[55px]"
                    />
                    <button
                        class="mr-2 rounded-md p-2 text-neutral-500 hover:bg-neutral-200 hover:text-neutral-700 transition-colors lg:hidden"
@@ -90,7 +90,7 @@
                    </template>
                    <SidebarLink
                        to="/time-tracking"
-                        icon="mdi:clock-outline"
+                        icon="mdi:calendar-edit-outline"
                        label="Suivi de temps"
                        :collapsed="sidebarIsCollapsed"
                        @click="ui.closeMobileSidebar()"
@@ -108,19 +108,21 @@
                    <SidebarTimer :collapsed="sidebarIsCollapsed" />
                </div>

-                <div class="flex flex-col gap-2 items-center p-4">
+                <div class="flex items-center justify-center p-4">
                    <p v-if="!sidebarIsCollapsed" class="font-bold">v {{ version }}</p>
-                    <button
-                        class="hidden items-center justify-center rounded-md p-2 text-neutral-500 hover:bg-neutral-200 hover:text-neutral-700 transition-colors lg:flex"
-                        :title="ui.sidebarCollapsed ? 'Ouvrir le menu' : 'Réduire le menu'"
-                        @click="ui.toggleSidebar()"
-                    >
-                        <Icon
-                            :name="ui.sidebarCollapsed ? 'mdi:chevron-right' : 'mdi:chevron-left'"
-                            size="20"
-                        />
-                    </button>
                </div>
+
+                <!-- Collapse toggle button centered vertically on the sidebar edge -->
+                <button
+                    class="absolute top-1/2 -right-4 z-10 hidden h-8 w-8 -translate-y-1/2 items-center justify-center rounded-full border border-neutral-200 bg-white text-neutral-400 shadow-sm hover:text-neutral-700 transition-colors lg:flex"
+                    :title="ui.sidebarCollapsed ? 'Ouvrir le menu' : 'Réduire le menu'"
+                    @click="ui.toggleSidebar()"
+                >
+                    <Icon
+                        :name="ui.sidebarCollapsed ? 'mdi:chevron-right' : 'mdi:chevron-left'"
+                        size="18"
+                    />
+                </button>
            </aside>

            <div class="h-full flex-1 flex flex-col min-h-0 min-w-0">
@@ -148,6 +150,7 @@ import type { UserData } from '~/services/dto/user-data'
 import type { Project } from '~/services/dto/project'
 import type { TaskTag } from '~/services/dto/task-tag'
 import { useAppVersion } from '~/composables/useAppVersion'
+import type { HydraCollection } from '~/utils/api'
 import { extractHydraMembers } from '~/utils/api'

 const auth = useAuthStore()
@@ -211,9 +214,9 @@ async function loadRefData() {
    if (refData.loaded) return
    const api = useApi()
    const [usersData, projectsData, typesData] = await Promise.all([
-        api.get<any>('/users'),
-        api.get<any>('/projects'),
-        api.get<any>('/task_tags'),
+        api.get<HydraCollection<UserData>>('/users'),
+        api.get<HydraCollection<Project>>('/projects'),
+        api.get<HydraCollection<TaskTag>>('/task_tags'),
    ])
    refData.users = extractHydraMembers(usersData)
    refData.projects = extractHydraMembers(projectsData)
--- a/frontend/middleware/admin.ts
+++ b/frontend/middleware/admin.ts
@@ -0,0 +1,7 @@
+export default defineNuxtRouteMiddleware(() => {
+    const auth = useAuthStore()
+
+    if (!auth.isAuthenticated || !auth.user?.roles?.includes('ROLE_ADMIN')) {
+        return navigateTo('/')
+    }
+})
--- a/frontend/nuxt.config.ts
+++ b/frontend/nuxt.config.ts
@@ -23,14 +23,6 @@ export default defineNuxtConfig({
    devServer: {
        port: 3002,
    },
-    nitro: {
-        devProxy: {
-            '/api': {
-                target: 'http://nginx',
-                changeOrigin: true,
-            },
-        },
-    },
    components: [
        {path: '~/components', pathPrefix: false},
    ],
--- a/frontend/pages/admin.vue
+++ b/frontend/pages/admin.vue
@@ -35,6 +35,7 @@
 </template>

 <script setup lang="ts">
+definePageMeta({ middleware: ['admin'] })
 useHead({ title: 'Administration' })

 const tabs = [
--- a/frontend/pages/index.vue
+++ b/frontend/pages/index.vue
@@ -471,7 +471,7 @@ const lineOptions = {
        legend: { display: false },
        tooltip: {
            callbacks: {
-                label: (ctx: any) => `${formatHours(ctx.raw)}`,
+                label: (ctx: { raw: unknown }) => `${formatHours(ctx.raw as number)}`,
            },
        },
    },
@@ -480,7 +480,7 @@ const lineOptions = {
            beginAtZero: true,
            grid: { color: '#f3f4f6' },
            ticks: {
-                callback: (value: any) => `${value}h`,
+                callback: (value: number | string) => `${value}h`,
            },
        },
        x: {
--- a/frontend/pages/my-tasks.vue
+++ b/frontend/pages/my-tasks.vue
@@ -328,7 +328,7 @@ onMounted(() => {

        <!-- Kanban View -->
        <div v-if="viewMode === 'kanban'">
-            <div class="mt-6 flex gap-3 overflow-x-auto pb-4">
+            <div class="mt-6 flex h-[calc(100vh-260px)] gap-3 overflow-x-auto pb-4">
                <div
                    v-for="status in sortedStatuses"
                    :key="status.id"
@@ -340,24 +340,26 @@ onMounted(() => {
                    @drop.prevent="onDropStatus($event, status)"
                >
                    <div
-                        class="rounded-t-lg px-4 py-3 text-sm font-bold text-white"
+                        class="shrink-0 rounded-t-lg px-4 py-3 text-sm font-bold text-white"
                        :style="{ backgroundColor: status.color }"
                    >
                        {{ status.label }} ({{ tasksByStatus(status.id).length }})
                    </div>
-                    <div class="flex flex-col gap-3 p-3">
-                        <TaskCard
-                            v-for="task in tasksByStatus(status.id)"
-                            :key="task.id"
-                            :task="task"
-                            @click="openTaskEdit(task)"
-                        />
-                        <p
-                            v-if="tasksByStatus(status.id).length === 0"
-                            class="py-4 text-center text-xs text-neutral-400"
-                        >
-                            {{ $t('myTasks.noTasks') }}
-                        </p>
+                    <div class="min-h-0 flex-1 overflow-y-auto p-3">
+                        <div class="flex flex-col gap-3">
+                            <TaskCard
+                                v-for="task in tasksByStatus(status.id)"
+                                :key="task.id"
+                                :task="task"
+                                @click="openTaskEdit(task)"
+                            />
+                            <p
+                                v-if="tasksByStatus(status.id).length === 0"
+                                class="py-4 text-center text-xs text-neutral-400"
+                            >
+                                {{ $t('myTasks.noTasks') }}
+                            </p>
+                        </div>
                    </div>
                </div>
            </div>
--- a/frontend/pages/portal/index.vue
+++ b/frontend/pages/portal/index.vue
@@ -53,10 +53,8 @@ const ticketCountByProject = computed(() => {
    const counts: Record<number, number> = {}
    for (const ticket of tickets.value) {
        if (ticket.status === 'new' || ticket.status === 'in_progress') {
-            // Extract project ID from IRI
-            const match = ticket.project.match(/\/api\/projects\/(\d+)/)
-            if (match) {
-                const projectId = Number(match[1])
+            const projectId = extractIdFromIri(ticket.project)
+            if (projectId) {
                counts[projectId] = (counts[projectId] ?? 0) + 1
            }
        }
--- a/frontend/pages/portal/projects/[id]/index.vue
+++ b/frontend/pages/portal/projects/[id]/index.vue
@@ -31,13 +31,13 @@
        </div>

        <!-- Kanban board -->
-        <div v-else class="mt-4 flex flex-col gap-4 sm:flex-row sm:overflow-x-auto sm:pb-4">
+        <div v-else class="mt-4 flex h-[calc(100vh-200px)] flex-col gap-4 sm:flex-row sm:overflow-x-auto sm:pb-4">
            <div
                v-for="col in columns"
                :key="col.status"
-                class="min-w-0 flex-1 sm:min-w-[280px]"
+                class="flex min-w-0 flex-1 flex-col sm:min-w-[280px]"
            >
-                <div class="mb-3 flex items-center gap-2">
+                <div class="mb-3 flex shrink-0 items-center gap-2">
                    <div class="h-2 w-2 rounded-full" :class="col.dotClass" />
                    <h3 class="text-sm font-bold text-neutral-700">{{ col.label }}</h3>
                    <span class="ml-auto rounded-full bg-neutral-100 px-2 py-0.5 text-xs font-semibold text-neutral-500">
@@ -45,7 +45,7 @@
                    </span>
                </div>
                <div
-                    class="min-h-[60px] space-y-2 rounded-lg border-2 border-transparent p-1 transition-colors"
+                    class="min-h-0 flex-1 space-y-2 overflow-y-auto rounded-lg border-2 border-transparent p-1 transition-colors"
                    :class="dragOverStatus === col.status ? 'border-primary-300 bg-primary-50/50' : ''"
                    @dragover.prevent="onDragOver(col.status)"
                    @dragleave="onDragLeave"
--- a/frontend/pages/portal/projects/[id]/new-ticket.vue
+++ b/frontend/pages/portal/projects/[id]/new-ticket.vue
@@ -41,6 +41,11 @@
                    v-model="form.description"
                    :label="$t('clientTicket.description')"
                    :size="5"
+                    resize="vertical"
+                    :min-resize-height="140"
+                    :max-resize-height="500"
+                    min-resize-width="100%"
+                    max-resize-width="100%"
                />
            </div>

--- a/frontend/pages/projects/[id]/index.vue
+++ b/frontend/pages/projects/[id]/index.vue
@@ -62,7 +62,7 @@
        </div>

        <!-- Kanban -->
-        <div class="mt-6 flex gap-3 overflow-x-auto pb-4">
+        <div class="mt-6 flex h-[calc(100vh-200px)] gap-3 overflow-x-auto pb-4">
            <div
                v-for="status in statuses"
                :key="status.id"
@@ -74,24 +74,26 @@
                @drop.prevent="onDropStatus($event, status)"
            >
                <div
-                    class="rounded-t-lg px-4 py-3 text-sm font-bold text-white"
+                    class="shrink-0 rounded-t-lg px-4 py-3 text-sm font-bold text-white"
                    :style="{ backgroundColor: status.color }"
                >
                    {{ status.label }} ({{ tasksByStatus(status.id).length }})
                </div>
-                <div class="flex flex-col gap-3 p-3">
-                    <TaskCard
-                        v-for="task in tasksByStatus(status.id)"
-                        :key="task.id"
-                        :task="task"
-                        @click="openTaskEdit(task)"
-                    />
-                    <p
-                        v-if="tasksByStatus(status.id).length === 0"
-                        class="py-4 text-center text-xs text-neutral-400"
-                    >
-                        Aucun ticket
-                    </p>
+                <div class="min-h-0 flex-1 overflow-y-auto p-3">
+                    <div class="flex flex-col gap-3">
+                        <TaskCard
+                            v-for="task in tasksByStatus(status.id)"
+                            :key="task.id"
+                            :task="task"
+                            @click="openTaskEdit(task)"
+                        />
+                        <p
+                            v-if="tasksByStatus(status.id).length === 0"
+                            class="py-4 text-center text-xs text-neutral-400"
+                        >
+                            Aucun ticket
+                        </p>
+                    </div>
                </div>
            </div>
        </div>
--- a/frontend/pages/projects/index.vue
+++ b/frontend/pages/projects/index.vue
@@ -2,7 +2,7 @@
    <div>
        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
            <div class="flex flex-wrap items-center justify-between gap-3">
-                <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">Projets</h1>
+                <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ $t('projects.title') }}</h1>
                <div class="flex items-center gap-2 sm:gap-3">
                    <button
                        class="flex items-center gap-1.5 rounded-md px-2 py-2 text-sm font-medium transition sm:px-3"
@@ -18,8 +18,8 @@
                        class="shrink-0 rounded-md bg-primary-500 px-3 py-2 text-xs font-semibold text-white hover:bg-secondary-500 sm:px-4 sm:text-sm"
                        @click="openCreate"
                    >
-                        <span class="hidden sm:inline">+ Ajouter un projet</span>
-                        <span class="sm:hidden">+ Projet</span>
+                        <span class="hidden sm:inline">+ {{ $t('projects.addProject') }}</span>
+                        <span class="sm:hidden">+ {{ $t('projects.addProjectShort') }}</span>
                    </button>
                </div>
            </div>
@@ -29,8 +29,9 @@
            <div
                v-for="project in projects"
                :key="project.id"
-                class="cursor-pointer rounded-[6px] border border-neutral-200 bg-tertiary-500 p-4 shadow-sm transition hover:shadow-md"
+                class="cursor-pointer p-4 shadow-sm transition hover:shadow-md"
                :class="{ 'opacity-60': project.archived }"
+                :style="projectCardStyle(project.color)"
                @click="navigateTo(`/projects/${project.id}`)"
            >
                <div class="flex items-center justify-between">
@@ -40,7 +41,7 @@
                            v-if="project.archived"
                            class="rounded bg-amber-100 px-1.5 py-0.5 text-xs font-medium text-amber-700"
                        >
-                            Archivé
+                            {{ $t('common.archived') }}
                        </span>
                    </div>
                    <button
@@ -59,7 +60,7 @@
                v-if="projects.length === 0 && !isLoading"
                class="col-span-full py-12 text-center text-neutral-400"
            >
-                {{ showArchived ? 'Aucun projet archivé.' : 'Aucun projet trouvé.' }}
+                {{ showArchived ? $t('projects.noArchivedProjects') : $t('projects.noProjects') }}
            </div>
        </div>

@@ -80,6 +81,17 @@ import { useClientService } from '~/services/clients'

 useHead({ title: 'Projets' })

+function projectCardStyle(color: string | null) {
+    const hex = (color || '#222783').replace('#', '')
+    const r = parseInt(hex.substring(0, 2), 16)
+    const g = parseInt(hex.substring(2, 4), 16)
+    const b = parseInt(hex.substring(4, 6), 16)
+    return {
+        borderRadius: '16px',
+        backgroundColor: `rgba(${r}, ${g}, ${b}, 0.08)`,
+    }
+}
+
 const projectService = useProjectService()
 const clientService = useClientService()

--- a/frontend/pages/time-tracking.vue
+++ b/frontend/pages/time-tracking.vue
@@ -17,20 +17,26 @@
                    {{ currentMonthLabel }}
                </h2>

-                <div class="flex shrink-0 items-center gap-1 rounded-md border border-neutral-200">
-                    <button class="px-2 py-1 text-neutral-500 hover:text-neutral-700" @click="navigatePrev">
+                <div class="flex shrink-0 items-center gap-3">
+                    <button class="rounded-full p-1 text-neutral-400 hover:text-neutral-700 transition" @click="navigatePrev">
                        <Icon name="mdi:chevron-left" size="20" />
                    </button>
-                    <button
-                        v-for="mode in (['week', 'day', 'list'] as const)"
-                        :key="mode"
-                        class="px-3 py-1 text-sm font-semibold transition"
-                        :class="viewMode === mode ? 'bg-primary-500 text-white rounded' : 'text-neutral-500 hover:text-neutral-700'"
-                        @click="viewMode = mode"
-                    >
-                        {{ mode === 'week' ? 'Semaine' : mode === 'day' ? 'Jour' : 'Liste' }}
-                    </button>
-                    <button class="px-2 py-1 text-neutral-500 hover:text-neutral-700" @click="navigateNext">
+
+                    <div class="flex items-center rounded-full bg-neutral-100 p-1">
+                        <button
+                            v-for="mode in (['week', 'day', 'list'] as const)"
+                            :key="mode"
+                            class="rounded-full px-4 py-1.5 text-sm font-semibold transition-all"
+                            :class="viewMode === mode
+                                ? 'bg-primary-500 text-white shadow-sm'
+                                : 'text-neutral-500 hover:text-neutral-700'"
+                            @click="viewMode = mode"
+                        >
+                            {{ mode === 'week' ? 'Semaine' : mode === 'day' ? 'Jour' : 'Liste' }}
+                        </button>
+                    </div>
+
+                    <button class="rounded-full p-1 text-neutral-400 hover:text-neutral-700 transition" @click="navigateNext">
                        <Icon name="mdi:chevron-right" size="20" />
                    </button>
                </div>
@@ -71,7 +77,7 @@
                    />
                </div>

-                <DateFilter v-model="selectedDateFilter" />
+                <DateFilter v-model="selectedDateFilter" :picker-mode="viewMode === 'day' ? 'day' : 'week'" />
            </div>
        </div>

@@ -126,6 +132,7 @@ import type { UserData } from '~/services/dto/user-data'
 import type { Project } from '~/services/dto/project'
 import type { TaskTag } from '~/services/dto/task-tag'
 import { useTimeEntryService } from '~/services/time-entries'
+import type { HydraCollection } from '~/utils/api'
 import { extractHydraMembers } from '~/utils/api'

 useHead({ title: 'Suivi des temps' })
@@ -308,9 +315,9 @@ async function loadReferenceData() {
    const api = useApi()

    const [usersData, projectsData, typesData] = await Promise.all([
-        api.get<any>('/users'),
-        api.get<any>('/projects'),
-        api.get<any>('/task_tags'),
+        api.get<HydraCollection<UserData>>('/users'),
+        api.get<HydraCollection<Project>>('/projects'),
+        api.get<HydraCollection<TaskTag>>('/task_tags'),
    ])

    users.value = extractHydraMembers(usersData)
@@ -333,6 +340,7 @@ onMounted(async () => {
 })

 watch(viewMode, () => {
+    selectedDateFilter.value = null
    startDate.value = viewMode.value === 'day' ? startDate.value : getMonday(startDate.value)
    loadEntries()
 })
--- a/frontend/public/LOGO_CARRE.png
+++ b/frontend/public/LOGO_CARRE.png
--- a/frontend/services/dto/project.ts
+++ b/frontend/services/dto/project.ts
@@ -13,6 +13,7 @@ export type Project = {
    bookstackShelfId: number | null
    bookstackShelfName: string | null
    archived: boolean
+    taskCount: number
 }

 export type ProjectWrite = {
--- a/frontend/services/dto/user-data.ts
+++ b/frontend/services/dto/user-data.ts
@@ -12,7 +12,7 @@ export type UserData = {

 export type UserWrite = {
    username: string
-    password?: string
+    plainPassword?: string
    roles: string[]
    client?: string | null
    allowedProjects?: string[]
--- a/frontend/utils/iri.ts
+++ b/frontend/utils/iri.ts
@@ -0,0 +1,11 @@
+/**
+ * Extract the numeric ID from an API Platform IRI string.
+ * Example: "/api/projects/5" → 5
+ */
+export function extractIdFromIri(iri: string | null | undefined): number {
+    if (!iri) return 0
+    const lastSlash = iri.lastIndexOf('/')
+    if (lastSlash === -1) return 0
+    const id = Number(iri.substring(lastSlash + 1))
+    return Number.isFinite(id) ? id : 0
+}
--- a/src/ApiResource/GiteaBranch.php
+++ b/src/ApiResource/GiteaBranch.php
@@ -17,6 +17,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
            uriTemplate: '/tasks/{taskId}/gitea/branches',
            normalizationContext: ['groups' => ['gitea_branch:read']],
            provider: GiteaBranchProvider::class,
+            security: "is_granted('ROLE_USER')",
        ),
        new Post(
            uriTemplate: '/tasks/{taskId}/gitea/branches',
@@ -24,6 +25,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
            normalizationContext: ['groups' => ['gitea_branch:read']],
            provider: GiteaBranchProvider::class,
            processor: GiteaBranchProcessor::class,
+            security: "is_granted('ROLE_USER')",
        ),
    ],
 )]
--- a/src/ApiResource/GiteaBranchName.php
+++ b/src/ApiResource/GiteaBranchName.php
@@ -15,6 +15,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
            uriTemplate: '/tasks/{taskId}/gitea/branch-name/{type}',
            normalizationContext: ['groups' => ['gitea_branch_name:read']],
            provider: GiteaBranchNameProvider::class,
+            security: "is_granted('ROLE_USER')",
        ),
    ],
 )]
--- a/src/ApiResource/GiteaPullRequest.php
+++ b/src/ApiResource/GiteaPullRequest.php
@@ -15,6 +15,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
            uriTemplate: '/tasks/{taskId}/gitea/pull-requests',
            normalizationContext: ['groups' => ['gitea_pr:read']],
            provider: GiteaPullRequestProvider::class,
+            security: "is_granted('ROLE_USER')",
        ),
    ],
 )]
--- a/src/Controller/TaskDocumentDownloadController.php
+++ b/src/Controller/TaskDocumentDownloadController.php
@@ -51,9 +51,12 @@ class TaskDocumentDownloadController extends AbstractController
        $mimeType = $document->getMimeType() ?? 'application/octet-stream';

        // Inline for images and PDFs, attachment for everything else
-        $disposition = str_starts_with($mimeType, 'image/') || 'application/pdf' === $mimeType
-            ? ResponseHeaderBag::DISPOSITION_INLINE
-            : ResponseHeaderBag::DISPOSITION_ATTACHMENT;
+        // SVG files are always served as attachment to prevent XSS via embedded JavaScript
+        $disposition = 'image/svg+xml' === $mimeType
+            ? ResponseHeaderBag::DISPOSITION_ATTACHMENT
+            : (str_starts_with($mimeType, 'image/') || 'application/pdf' === $mimeType
+                ? ResponseHeaderBag::DISPOSITION_INLINE
+                : ResponseHeaderBag::DISPOSITION_ATTACHMENT);

        $response->setContentDisposition($disposition, $document->getOriginalName());
        $response->headers->set('Content-Type', $mimeType);
--- a/src/Controller/UserAvatarController.php
+++ b/src/Controller/UserAvatarController.php
@@ -91,7 +91,7 @@ class UserAvatarController extends AbstractController
        $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
        $mimeMap   = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
        $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
-        $response->headers->set('Cache-Control', 'no-cache, must-revalidate');
+        $response->headers->set('Cache-Control', 'public, max-age=86400');

        return $response;
    }
--- a/src/Doctrine/ProjectAllowedExtension.php
+++ b/src/Doctrine/ProjectAllowedExtension.php
@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Doctrine;
+
+use ApiPlatform\Doctrine\Orm\Extension\QueryCollectionExtensionInterface;
+use ApiPlatform\Doctrine\Orm\Extension\QueryItemExtensionInterface;
+use ApiPlatform\Doctrine\Orm\Util\QueryNameGeneratorInterface;
+use ApiPlatform\Metadata\Operation;
+use App\Entity\Project;
+use App\Entity\User;
+use Doctrine\ORM\QueryBuilder;
+use Symfony\Bundle\SecurityBundle\Security;
+
+final readonly class ProjectAllowedExtension implements QueryCollectionExtensionInterface, QueryItemExtensionInterface
+{
+    public function __construct(
+        private Security $security,
+    ) {}
+
+    public function applyToCollection(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, string $resourceClass, ?Operation $operation = null, array $context = []): void
+    {
+        $this->addWhere($queryBuilder, $resourceClass);
+    }
+
+    public function applyToItem(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, string $resourceClass, array $identifiers, ?Operation $operation = null, array $context = []): void
+    {
+        $this->addWhere($queryBuilder, $resourceClass);
+    }
+
+    private function addWhere(QueryBuilder $queryBuilder, string $resourceClass): void
+    {
+        if (Project::class !== $resourceClass) {
+            return;
+        }
+
+        $user = $this->security->getUser();
+
+        if (!$user instanceof User) {
+            return;
+        }
+
+        // Only restrict for ROLE_CLIENT users who are NOT admins
+        if (!in_array('ROLE_CLIENT', $user->getRoles(), true) || in_array('ROLE_ADMIN', $user->getRoles(), true)) {
+            return;
+        }
+
+        $rootAlias = $queryBuilder->getRootAliases()[0];
+
+        $allowedProjectIds = $user->getAllowedProjects()->map(
+            fn (Project $project) => $project->getId(),
+        )->toArray();
+
+        if ([] === $allowedProjectIds) {
+            $queryBuilder->andWhere('1 = 0');
+
+            return;
+        }
+
+        $queryBuilder
+            ->andWhere($rootAlias.'.id IN (:allowed_project_ids)')
+            ->setParameter('allowed_project_ids', $allowedProjectIds)
+        ;
+    }
+}
--- a/src/Entity/BookStackConfiguration.php
+++ b/src/Entity/BookStackConfiguration.php
@@ -6,6 +6,7 @@ namespace App\Entity;

 use App\Repository\BookStackConfigurationRepository;
 use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Validator\Constraints as Assert;

 #[ORM\Entity(repositoryClass: BookStackConfigurationRepository::class)]
 class BookStackConfiguration
@@ -16,6 +17,7 @@ class BookStackConfiguration
    private ?int $id = null;

    #[ORM\Column(length: 255, nullable: true)]
+    #[Assert\Url]
    private ?string $url = null;

    #[ORM\Column(type: 'text', nullable: true)]
--- a/src/Entity/ClientTicket.php
+++ b/src/Entity/ClientTicket.php
@@ -19,6 +19,7 @@ use Doctrine\Common\Collections\ArrayCollection;
 use Doctrine\Common\Collections\Collection;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Serializer\Attribute\Groups;
+use Symfony\Component\Validator\Constraints as Assert;

 #[ApiResource(
    operations: [
@@ -54,6 +55,27 @@ use Symfony\Component\Serializer\Attribute\Groups;
 )]
 class ClientTicket
 {
+    public const string TYPE_BUG         = 'bug';
+    public const string TYPE_IMPROVEMENT = 'improvement';
+    public const string TYPE_OTHER       = 'other';
+
+    public const array TYPES = [
+        self::TYPE_BUG,
+        self::TYPE_IMPROVEMENT,
+        self::TYPE_OTHER,
+    ];
+
+    public const string STATUS_NEW         = 'new';
+    public const string STATUS_IN_PROGRESS = 'in_progress';
+    public const string STATUS_DONE        = 'done';
+    public const string STATUS_REJECTED    = 'rejected';
+
+    public const array STATUSES = [
+        self::STATUS_NEW,
+        self::STATUS_IN_PROGRESS,
+        self::STATUS_DONE,
+        self::STATUS_REJECTED,
+    ];
    #[ORM\Id]
    #[ORM\GeneratedValue]
    #[ORM\Column]
@@ -66,6 +88,7 @@ class ClientTicket

    #[ORM\Column(length: 20)]
    #[Groups(['client_ticket:read', 'client_ticket:write', 'task:read'])]
+    #[Assert\Choice(choices: self::TYPES)]
    private ?string $type = null;

    #[ORM\Column(length: 255)]
@@ -78,10 +101,12 @@ class ClientTicket

    #[ORM\Column(length: 255, nullable: true)]
    #[Groups(['client_ticket:read', 'client_ticket:write'])]
+    #[Assert\Url]
    private ?string $url = null;

    #[ORM\Column(length: 20)]
    #[Groups(['client_ticket:read', 'client_ticket:write', 'task:read'])]
+    #[Assert\Choice(choices: self::STATUSES)]
    private ?string $status = 'new';

    #[ORM\Column(type: 'text', nullable: true)]
--- a/src/Entity/GiteaConfiguration.php
+++ b/src/Entity/GiteaConfiguration.php
@@ -6,6 +6,7 @@ namespace App\Entity;

 use App\Repository\GiteaConfigurationRepository;
 use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Validator\Constraints as Assert;

 #[ORM\Entity(repositoryClass: GiteaConfigurationRepository::class)]
 class GiteaConfiguration
@@ -16,6 +17,7 @@ class GiteaConfiguration
    private ?int $id = null;

    #[ORM\Column(length: 255, nullable: true)]
+    #[Assert\Url]
    private ?string $url = null;

    #[ORM\Column(type: 'text', nullable: true)]
--- a/src/Entity/Project.php
+++ b/src/Entity/Project.php
@@ -13,6 +13,8 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use App\Repository\ProjectRepository;
+use Doctrine\Common\Collections\ArrayCollection;
+use Doctrine\Common\Collections\Collection;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
 use Symfony\Component\Serializer\Attribute\Groups;
@@ -87,6 +89,15 @@ class Project
    #[Groups(['project:read', 'project:write'])]
    private bool $archived = false;

+    /** @var Collection<int, Task> */
+    #[ORM\OneToMany(targetEntity: Task::class, mappedBy: 'project')]
+    private Collection $tasks;
+
+    public function __construct()
+    {
+        $this->tasks = new ArrayCollection();
+    }
+
    public function getId(): ?int
    {
        return $this->id;
@@ -216,4 +227,10 @@ class Project

        return $this;
    }
+
+    #[Groups(['project:read'])]
+    public function getTaskCount(): int
+    {
+        return $this->tasks->count();
+    }
 }
--- a/src/Entity/Task.php
+++ b/src/Entity/Task.php
@@ -82,7 +82,7 @@ class Task
    #[Groups(['task:read', 'task:write'])]
    private ?TaskGroup $group = null;

-    #[ORM\ManyToOne(targetEntity: Project::class)]
+    #[ORM\ManyToOne(targetEntity: Project::class, inversedBy: 'tasks')]
    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
    #[Groups(['task:read', 'task:write'])]
    private ?Project $project = null;
--- a/src/Entity/TaskBookStackLink.php
+++ b/src/Entity/TaskBookStackLink.php
@@ -7,6 +7,7 @@ namespace App\Entity;
 use App\Repository\TaskBookStackLinkRepository;
 use DateTimeImmutable;
 use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Validator\Constraints as Assert;

 #[ORM\Entity(repositoryClass: TaskBookStackLinkRepository::class)]
 #[ORM\UniqueConstraint(name: 'UNIQ_task_bookstack_link', columns: ['task_id', 'bookstack_id', 'bookstack_type'])]
@@ -31,6 +32,7 @@ class TaskBookStackLink
    private string $title;

    #[ORM\Column(length: 500)]
+    #[Assert\Url]
    private string $url;

    #[ORM\Column]
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -61,9 +61,11 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
    private array $roles = [];

    #[ORM\Column]
-    #[Groups(['user:write'])]
    private ?string $password = null;

+    #[Groups(['user:write'])]
+    private ?string $plainPassword = null;
+
    #[ORM\Column(type: Types::DATETIME_IMMUTABLE)]
    private ?DateTimeImmutable $createdAt = null;

@@ -224,5 +226,20 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
        return '/api/users/'.$this->id.'/avatar';
    }

-    public function eraseCredentials(): void {}
+    public function getPlainPassword(): ?string
+    {
+        return $this->plainPassword;
+    }
+
+    public function setPlainPassword(?string $plainPassword): static
+    {
+        $this->plainPassword = $plainPassword;
+
+        return $this;
+    }
+
+    public function eraseCredentials(): void
+    {
+        $this->plainPassword = null;
+    }
 }
--- a/src/Mcp/Tool/Project/CreateProjectTool.php
+++ b/src/Mcp/Tool/Project/CreateProjectTool.php
@@ -10,6 +10,8 @@ use App\Repository\ClientRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -19,6 +21,7 @@ class CreateProjectTool
    public function __construct(
        private readonly EntityManagerInterface $entityManager,
        private readonly ClientRepository $clientRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -28,6 +31,10 @@ class CreateProjectTool
        ?string $color = null,
        ?int $clientId = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $project = new Project();
        $project->setName($name);
        $project->setCode($code);
--- a/src/Mcp/Tool/Project/GetProjectTool.php
+++ b/src/Mcp/Tool/Project/GetProjectTool.php
@@ -9,6 +9,8 @@ use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -18,10 +20,15 @@ class GetProjectTool
    public function __construct(
        private readonly ProjectRepository $projectRepository,
        private readonly TaskRepository $taskRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(int $id): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $project = $this->projectRepository->find($id);

        if (null === $project) {
--- a/src/Mcp/Tool/Project/ListProjectsTool.php
+++ b/src/Mcp/Tool/Project/ListProjectsTool.php
@@ -7,16 +7,23 @@ namespace App\Mcp\Tool\Project;
 use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-projects', description: 'List all projects with optional archive filter')]
 class ListProjectsTool
 {
    public function __construct(
        private readonly ProjectRepository $projectRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(bool $archived = false): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $projects = $this->projectRepository->findBy(['archived' => $archived], ['name' => 'ASC']);

        return json_encode(array_map(Serializer::project(...), $projects));
--- a/src/Mcp/Tool/Project/UpdateProjectTool.php
+++ b/src/Mcp/Tool/Project/UpdateProjectTool.php
@@ -10,6 +10,8 @@ use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -20,6 +22,7 @@ class UpdateProjectTool
        private readonly ProjectRepository $projectRepository,
        private readonly ClientRepository $clientRepository,
        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -31,6 +34,10 @@ class UpdateProjectTool
        ?int $clientId = null,
        ?bool $archived = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $project = $this->projectRepository->find($id);

        if (null === $project) {
--- a/src/Mcp/Tool/Reference/ListClientsTool.php
+++ b/src/Mcp/Tool/Reference/ListClientsTool.php
@@ -6,16 +6,23 @@ namespace App\Mcp\Tool\Reference;

 use App\Repository\ClientRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-clients', description: 'List all clients with their IDs, names, and emails. Use this to discover valid client IDs for project parameters.')]
 class ListClientsTool
 {
    public function __construct(
        private readonly ClientRepository $clientRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(): string
    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
        $clients = $this->clientRepository->findBy([], ['name' => 'ASC']);

        return json_encode(array_map(fn ($client) => [
--- a/src/Mcp/Tool/Reference/ListUsersTool.php
+++ b/src/Mcp/Tool/Reference/ListUsersTool.php
@@ -6,16 +6,23 @@ namespace App\Mcp\Tool\Reference;

 use App\Repository\UserRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-users', description: 'List all users with their IDs and usernames. Use this to discover valid user IDs for assignee or time entry parameters.')]
 class ListUsersTool
 {
    public function __construct(
        private readonly UserRepository $userRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(): string
    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
        $users = $this->userRepository->findBy([], ['username' => 'ASC']);

        return json_encode(array_map(fn ($user) => [
--- a/src/Mcp/Tool/Task/CreateTaskTool.php
+++ b/src/Mcp/Tool/Task/CreateTaskTool.php
@@ -17,6 +17,8 @@ use App\Repository\UserRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -33,6 +35,7 @@ class CreateTaskTool
        private readonly TaskGroupRepository $taskGroupRepository,
        private readonly TaskTagRepository $taskTagRepository,
        private readonly UserRepository $userRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -46,6 +49,10 @@ class CreateTaskTool
        ?int $groupId = null,
        ?array $tagIds = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $project = $this->projectRepository->find($projectId);
        if (null === $project) {
            throw new InvalidArgumentException(sprintf('Project with ID %d not found.', $projectId));
@@ -54,7 +61,6 @@ class CreateTaskTool
        $task = new Task();
        $task->setProject($project);
        $task->setTitle($title);
-        $task->setNumber($this->taskRepository->findMaxNumberByProjectForUpdate($project) + 1);

        if (null !== $description) {
            $task->setDescription($description);
@@ -104,8 +110,11 @@ class CreateTaskTool
            }
        }

-        $this->entityManager->persist($task);
-        $this->entityManager->flush();
+        $this->entityManager->wrapInTransaction(function () use ($task, $project): void {
+            $task->setNumber($this->taskRepository->findMaxNumberByProjectForUpdate($project) + 1);
+            $this->entityManager->persist($task);
+            $this->entityManager->flush();
+        });

        return json_encode([
            'id'          => $task->getId(),
--- a/src/Mcp/Tool/Task/DeleteTaskTool.php
+++ b/src/Mcp/Tool/Task/DeleteTaskTool.php
@@ -8,6 +8,8 @@ use App\Repository\TaskRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -17,10 +19,15 @@ class DeleteTaskTool
    public function __construct(
        private readonly TaskRepository $taskRepository,
        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
    ) {}

    public function __invoke(int $id): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $task = $this->taskRepository->find($id);

        if (null === $task) {
--- a/src/Mcp/Tool/Task/GetTaskTool.php
+++ b/src/Mcp/Tool/Task/GetTaskTool.php
@@ -8,6 +8,8 @@ use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -16,10 +18,15 @@ class GetTaskTool
 {
    public function __construct(
        private readonly TaskRepository $taskRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(int $id): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $task = $this->taskRepository->find($id);

        if (null === $task) {
--- a/src/Mcp/Tool/Task/ListTasksTool.php
+++ b/src/Mcp/Tool/Task/ListTasksTool.php
@@ -7,12 +7,15 @@ namespace App\Mcp\Tool\Task;
 use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-tasks', description: 'List tasks with optional filters by project, status, assignee, priority, group, tags, and archive state. Returns max 100 results by default, use filters to narrow down.')]
 class ListTasksTool
 {
    public function __construct(
        private readonly TaskRepository $taskRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -25,6 +28,10 @@ class ListTasksTool
        bool $archived = false,
        int $limit = 100,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $limit = min($limit, 200);

        $qb = $this->taskRepository->createQueryBuilder('t')
--- a/src/Mcp/Tool/Task/UpdateTaskTool.php
+++ b/src/Mcp/Tool/Task/UpdateTaskTool.php
@@ -15,6 +15,8 @@ use App\Repository\UserRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -30,6 +32,7 @@ class UpdateTaskTool
        private readonly TaskGroupRepository $taskGroupRepository,
        private readonly TaskTagRepository $taskTagRepository,
        private readonly UserRepository $userRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -44,6 +47,10 @@ class UpdateTaskTool
        ?array $tagIds = null,
        ?bool $archived = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $task = $this->taskRepository->find($id);

        if (null === $task) {
--- a/src/Mcp/Tool/TaskMeta/CreateGroupTool.php
+++ b/src/Mcp/Tool/TaskMeta/CreateGroupTool.php
@@ -10,6 +10,8 @@ use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -19,6 +21,7 @@ class CreateGroupTool
    public function __construct(
        private readonly EntityManagerInterface $entityManager,
        private readonly ProjectRepository $projectRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -27,6 +30,10 @@ class CreateGroupTool
        ?string $description = null,
        ?string $color = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $project = $this->projectRepository->find($projectId);
        if (null === $project) {
            throw new InvalidArgumentException(sprintf('Project with ID %d not found.', $projectId));
--- a/src/Mcp/Tool/TaskMeta/ListEffortsTool.php
+++ b/src/Mcp/Tool/TaskMeta/ListEffortsTool.php
@@ -6,16 +6,23 @@ namespace App\Mcp\Tool\TaskMeta;

 use App\Repository\TaskEffortRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-efforts', description: 'List all task effort levels. Efforts are global (shared across all projects).')]
 class ListEffortsTool
 {
    public function __construct(
        private readonly TaskEffortRepository $taskEffortRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $efforts = $this->taskEffortRepository->findBy([], ['label' => 'ASC']);

        return json_encode(array_map(fn ($e) => [
--- a/src/Mcp/Tool/TaskMeta/ListGroupsTool.php
+++ b/src/Mcp/Tool/TaskMeta/ListGroupsTool.php
@@ -7,16 +7,23 @@ namespace App\Mcp\Tool\TaskMeta;
 use App\Mcp\Tool\Serializer;
 use App\Repository\TaskGroupRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-groups', description: 'List task groups, optionally filtered by project. Groups are per-project (each group belongs to one project).')]
 class ListGroupsTool
 {
    public function __construct(
        private readonly TaskGroupRepository $taskGroupRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(?int $projectId = null, bool $archived = false): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $criteria = ['archived' => $archived];
        if (null !== $projectId) {
            $criteria['project'] = $projectId;
--- a/src/Mcp/Tool/TaskMeta/ListPrioritiesTool.php
+++ b/src/Mcp/Tool/TaskMeta/ListPrioritiesTool.php
@@ -6,16 +6,23 @@ namespace App\Mcp\Tool\TaskMeta;

 use App\Repository\TaskPriorityRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-priorities', description: 'List all task priorities. Priorities are global (shared across all projects).')]
 class ListPrioritiesTool
 {
    public function __construct(
        private readonly TaskPriorityRepository $taskPriorityRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $priorities = $this->taskPriorityRepository->findBy([], ['label' => 'ASC']);

        return json_encode(array_map(fn ($p) => [
--- a/src/Mcp/Tool/TaskMeta/ListStatusesTool.php
+++ b/src/Mcp/Tool/TaskMeta/ListStatusesTool.php
@@ -6,16 +6,23 @@ namespace App\Mcp\Tool\TaskMeta;

 use App\Repository\TaskStatusRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-statuses', description: 'List all task statuses ordered by position. Statuses are global (shared across all projects). Use the returned IDs when creating or updating tasks.')]
 class ListStatusesTool
 {
    public function __construct(
        private readonly TaskStatusRepository $taskStatusRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $statuses = $this->taskStatusRepository->findBy([], ['position' => 'ASC']);

        return json_encode(array_map(fn ($s) => [
--- a/src/Mcp/Tool/TaskMeta/ListTagsTool.php
+++ b/src/Mcp/Tool/TaskMeta/ListTagsTool.php
@@ -6,16 +6,23 @@ namespace App\Mcp\Tool\TaskMeta;

 use App\Repository\TaskTagRepository;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-tags', description: 'List all task tags. Tags are global (shared across all projects).')]
 class ListTagsTool
 {
    public function __construct(
        private readonly TaskTagRepository $taskTagRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $tags = $this->taskTagRepository->findBy([], ['label' => 'ASC']);

        return json_encode(array_map(fn ($t) => [
--- a/src/Mcp/Tool/TaskMeta/UpdateGroupTool.php
+++ b/src/Mcp/Tool/TaskMeta/UpdateGroupTool.php
@@ -9,6 +9,8 @@ use App\Repository\TaskGroupRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -18,6 +20,7 @@ class UpdateGroupTool
    public function __construct(
        private readonly TaskGroupRepository $taskGroupRepository,
        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -27,6 +30,10 @@ class UpdateGroupTool
        ?string $color = null,
        ?bool $archived = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $group = $this->taskGroupRepository->find($id);

        if (null === $group) {
--- a/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
@@ -16,6 +16,8 @@ use DateTimeImmutable;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -30,6 +32,7 @@ class CreateTimeEntryTool
        private readonly TaskTagRepository $taskTagRepository,
        private readonly TimeEntryRepository $timeEntryRepository,
        private readonly ClientTicketRepository $clientTicketRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -43,6 +46,10 @@ class CreateTimeEntryTool
        ?string $description = null,
        ?int $clientTicketId = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $user = $this->userRepository->find($userId);
        if (null === $user) {
            throw new InvalidArgumentException(sprintf('User with ID %d not found.', $userId));
--- a/src/Mcp/Tool/TimeEntry/DeleteTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/DeleteTimeEntryTool.php
@@ -8,6 +8,8 @@ use App\Repository\TimeEntryRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -17,10 +19,15 @@ class DeleteTimeEntryTool
    public function __construct(
        private readonly TimeEntryRepository $timeEntryRepository,
        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
    ) {}

    public function __invoke(int $id): string
    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $entry = $this->timeEntryRepository->find($id);

        if (null === $entry) {
--- a/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
+++ b/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
@@ -8,12 +8,15 @@ use App\Mcp\Tool\Serializer;
 use App\Repository\TimeEntryRepository;
 use DateTimeImmutable;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 #[McpTool(name: 'list-time-entries', description: 'List time entries with optional filters. Duration is computed in minutes and null for active timers.')]
 class ListTimeEntriesTool
 {
    public function __construct(
        private readonly TimeEntryRepository $timeEntryRepository,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -25,6 +28,10 @@ class ListTimeEntriesTool
        ?string $endDate = null,
        int $limit = 100,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $limit = min($limit, 200);

        $qb = $this->timeEntryRepository->createQueryBuilder('te')
--- a/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
@@ -14,6 +14,8 @@ use DateTimeImmutable;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;

 use function sprintf;

@@ -27,6 +29,7 @@ class UpdateTimeEntryTool
        private readonly TaskTagRepository $taskTagRepository,
        private readonly ClientTicketRepository $clientTicketRepository,
        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
    ) {}

    public function __invoke(
@@ -40,6 +43,10 @@ class UpdateTimeEntryTool
        ?string $description = null,
        ?int $clientTicketId = null,
    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
        $entry = $this->timeEntryRepository->find($id);

        if (null === $entry) {
--- a/src/Repository/ClientTicketRepository.php
+++ b/src/Repository/ClientTicketRepository.php
@@ -20,18 +20,26 @@ class ClientTicketRepository extends ServiceEntityRepository
    }

    /**
-     * Returns the next ticket number for a project, using a row-level lock
+     * Returns the max ticket number for a project, using an advisory lock
     * to prevent race conditions when creating tickets concurrently.
     */
-    public function findNextNumberForProjectForUpdate(Project $project): int
+    public function findMaxNumberByProjectForUpdate(Project $project): int
    {
        $conn = $this->getEntityManager()->getConnection();

+        // Use PostgreSQL advisory lock instead of FOR UPDATE
+        // because FOR UPDATE is not allowed with aggregate functions in PostgreSQL.
+        // Offset by 1000000 to avoid collision with task locks on the same project ID.
+        $conn->executeStatement(
+            'SELECT pg_advisory_xact_lock(:lockKey)',
+            ['lockKey' => $project->getId() + 1000000],
+        );
+
        $result = $conn->fetchOne(
-            'SELECT COALESCE(MAX(number), 0) FROM client_ticket WHERE project_id = :project FOR UPDATE',
+            'SELECT COALESCE(MAX(number), 0) FROM client_ticket WHERE project_id = :project',
            ['project' => $project->getId()],
        );

-        return ((int) $result) + 1;
+        return (int) $result;
    }
 }
--- a/src/Repository/TaskRepository.php
+++ b/src/Repository/TaskRepository.php
@@ -20,13 +20,20 @@ class TaskRepository extends ServiceEntityRepository
    }

    /**
-     * Returns the max task number for a project, using a row-level lock
+     * Returns the max task number for a project, using an advisory lock
     * to prevent race conditions when creating tasks concurrently.
     */
    public function findMaxNumberByProjectForUpdate(Project $project): int
    {
        $conn = $this->getEntityManager()->getConnection();

+        // Use PostgreSQL advisory lock (project ID as lock key) instead of FOR UPDATE
+        // because FOR UPDATE is not allowed with aggregate functions in PostgreSQL.
+        $conn->executeStatement(
+            'SELECT pg_advisory_xact_lock(:project)',
+            ['project' => $project->getId()],
+        );
+
        $result = $conn->fetchOne(
            'SELECT COALESCE(MAX(number), 0) FROM task WHERE project_id = :project',
            ['project' => $project->getId()],
--- a/src/State/ClientTicketNumberProcessor.php
+++ b/src/State/ClientTicketNumberProcessor.php
@@ -53,7 +53,8 @@ final readonly class ClientTicketNumberProcessor implements ProcessorInterface

        $now = new DateTimeImmutable();

-        $data->setNumber($this->clientTicketRepository->findNextNumberForProjectForUpdate($project));
+        $maxNumber = $this->clientTicketRepository->findMaxNumberByProjectForUpdate($project);
+        $data->setNumber($maxNumber + 1);
        $data->setSubmittedBy($user);
        $data->setStatus('new');
        $data->setCreatedAt($now);
--- a/src/State/TaskDocumentProcessor.php
+++ b/src/State/TaskDocumentProcessor.php
@@ -25,7 +25,7 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
    private const MAX_FILE_SIZE = 50 * 1024 * 1024; // 50 MB

    private const ALLOWED_MIME_TYPES = [
-        'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/svg+xml',
+        'image/jpeg', 'image/png', 'image/gif', 'image/webp',
        'application/pdf',
        'application/msword',
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
@@ -40,7 +40,7 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface

    private const MIME_TO_EXTENSION = [
        'image/jpeg'                                                                => 'jpg', 'image/png' => 'png', 'image/gif' => 'gif',
-        'image/webp'                                                                => 'webp', 'image/svg+xml' => 'svg',
+        'image/webp'                                                                => 'webp',
        'application/pdf'                                                           => 'pdf',
        'application/msword'                                                        => 'doc',
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document'   => 'docx',
@@ -92,6 +92,11 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
        $clientTicket = null;

        if ('' !== $taskIri) {
+            // ROLE_CLIENT (without ROLE_ADMIN) cannot upload documents directly to tasks
+            if ($this->security->isGranted('ROLE_CLIENT') && !$this->security->isGranted('ROLE_ADMIN')) {
+                throw new AccessDeniedHttpException('Clients can only upload documents to client tickets.');
+            }
+
            $task = $this->entityManager->getRepository(Task::class)->find((int) basename($taskIri));

            if (null === $task) {
--- a/src/State/UserPasswordHasherProcessor.php
+++ b/src/State/UserPasswordHasherProcessor.php
@@ -29,10 +29,11 @@ final readonly class UserPasswordHasherProcessor implements ProcessorInterface
     */
    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
    {
-        $plainPassword = $data->getPassword();
+        $plainPassword = $data->getPlainPassword();

-        if (null !== $plainPassword && !str_starts_with($plainPassword, '$')) {
+        if (null !== $plainPassword && '' !== $plainPassword) {
            $data->setPassword($this->passwordHasher->hashPassword($data, $plainPassword));
+            $data->setPlainPassword(null);
        }

        return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
admin malio	8befb216aa	Merge pull request '[#NUMERO_TICKET] TITRE TICKET' (#2 ) from develop into main Reviewed-on: #2	2026-03-18 13:16:19 +00:00
Matthieu	0113c08a60	chore : bump version to v0.3.1 All checks were successful Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Successful in 1m29s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 14:13:21 +01:00
Matthieu	c176511d97	feat(ui) : add app title with swap button in top nav bar Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 14:13:12 +01:00
Matthieu	64de971872	feat(ui) : improve textarea description fields with vertical resize Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 14:11:00 +01:00
Matthieu	3dcc5c21a2	chore : bump version to v0.3.0 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m17s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 11:50:31 +01:00
Matthieu	47768c0f02	feat(time-tracking) : redesign calendar blocks and view mode switcher Restyle time entry blocks with title on top, project below, tags bottom-left, duration bottom-right. Checkerboard pattern for entries without project. Pill-style view mode switcher. Link DateFilter mode to main view mode and remove redundant toggle. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 11:50:21 +01:00
Matthieu	b278b8a23a	feat(ui) : improve sidebar collapse button, logo and top nav Move sidebar collapse toggle to mid-height floating circle button, use LOGO_CARRE.png when collapsed, make timer button circular when collapsed, reduce app bar height to 60px max. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 11:50:21 +01:00
gitea-actions	4074457499	chore: bump version to v0.2.10 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m27s Details	2026-03-18 10:08:03 +00:00
Matthieu	b29b4d304d	fix(user) : clear allowedProjects when removing ROLE_CLIENT All checks were successful Auto Tag Develop / tag (push) Successful in 6s Details Prevents sending /api/projects/undefined when saving a user after removing client role. Also auto-clears client and projects when ROLE_CLIENT checkbox is unchecked. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 11:07:51 +01:00
Matthieu	dd9db93751	feat(project) : add delete button for empty projects with confirmation modal Adds taskCount virtual field on Project entity, delete button in ProjectDrawer (visible only when taskCount === 0), and a reusable ConfirmDeleteProjectModal. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-18 11:07:41 +01:00
gitea-actions	3e2f3b3cf8	chore: bump version to v0.2.9 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m27s Details	2026-03-17 16:02:42 +00:00
Matthieu	5bf768bc02	feat(ui) : apply pastel project colors on project cards and calendar blocks All checks were successful Auto Tag Develop / tag (push) Successful in 6s Details - Project cards (/projects): 16px radius, pastel background, no border - Time tracking calendar blocks: pastel opaque background, project color text Ticket: LST-29 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 17:02:34 +01:00
Matthieu	77c7ceb064	fix(ci) : remove templates/ from release artefact after twig removal All checks were successful Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Successful in 1m23s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:38:33 +01:00
Matthieu	ac36eeba36	chore : bump version to 0.2.8 Some checks failed Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Failing after 1m21s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:36:06 +01:00
gitea-actions	005b731a97	chore: bump version to v0.2.7 Some checks failed Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Failing after 1m14s Details	2026-03-17 14:27:30 +00:00
Matthieu	3df0b15fe7	docs : update CLAUDE.md with BookStackConfiguration and TaskBookStackLink entities Some checks failed Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Failing after 1m15s Details Ticket: T-019 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	8040245e45	feat(ui) : make kanban column headers sticky with scrollable content Give kanban containers a fixed viewport height. Column headers stay fixed while task cards scroll independently within each column. Ticket: LST-28 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	5d378c1f75	refactor(frontend) : replace any types with concrete TypeScript types Replace 9 occurrences of 'any' with proper types: HydraCollection, Task, ClientTicketWrite, TimeEntryWrite across 7 components. Ticket: T-023 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	8544babf8c	refactor(i18n) : replace hardcoded French strings with i18n keys Replace 30+ hardcoded strings across 15 components with $t() calls. Added keys for common actions, drawers titles, empty states, and modals. Ticket: T-020 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	455121132d	feat(frontend) : admin middleware, fix avatar upload, centralize IRI extraction, remove Nitro proxy - Add admin middleware protecting /admin page (ROLE_ADMIN check) - Fix useAvatarService to use useApi() with FormData detection - Create extractIdFromIri() utility, replace manual IRI parsing - Remove redundant Nitro devProxy (Vite proxy handles dev) Tickets: T-014, T-015, T-017, T-021 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	fd3097cc26	chore(backend) : rate limiting, cache-control, remove twig, clean deps - Add login_throttling on /login_check (5 attempts/min) with symfony/rate-limiter - Add Cache-Control: public, max-age=86400 on avatar responses - Remove symfony/twig-bundle (unused in API-only project) - Remove unused dev deps: symfony/browser-kit, symfony/css-selector - Rename API Platform title to "Lesstime API" Tickets: T-010, T-016, T-022, T-024, T-025 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	ff7cff1d39	fix(backend) : add validation constraints and fix concurrent numbering - Add Assert\Choice on ClientTicket type and status with typed constants - Add Assert\Url on GiteaConfiguration, BookStackConfiguration, TaskBookStackLink, ClientTicket - Fix concurrent task/ticket numbering: use pg_advisory_xact_lock instead of FOR UPDATE with MAX() - Wrap CreateTaskTool numbering in transaction - Harmonize repository contracts: both return max number, caller adds +1 Tickets: T-004, T-008, T-011, T-012 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	ed58a402b0	fix(auth) : use dedicated plainPassword field for password hashing - Add non-persisted plainPassword field to User entity (write-only via API) - Remove direct write access to password field - Update UserPasswordHasherProcessor to hash from plainPassword - Update frontend DTO and UserDrawer component Ticket: T-009 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	2ac815d074	fix(security) : block SVG upload, enforce ROLE_CLIENT restrictions on documents - Block SVG MIME type in TaskDocumentProcessor upload validation - Serve existing SVG files as attachment (defense-in-depth) in download controller - Block ROLE_CLIENT from uploading documents to tasks (only allowed via portal tickets) - Add Doctrine extension to filter projects by allowedProjects for ROLE_CLIENT Tickets: T-003, T-005, T-006 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	e0dfcbdbf8	fix(security) : add role checks on Gitea API resources and all MCP tools - GiteaBranch, GiteaBranchName, GiteaPullRequest: require ROLE_USER - All 22 MCP tools: require ROLE_USER (ROLE_ADMIN for users/clients listing) Tickets: T-002, T-007 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
Matthieu	5db6b1e2b0	fix(security) : replace real secrets in .env with placeholders and create .env.example Secrets moved to .env.local (gitignored). Added .env.example for new developers. Also added .idea/ and docker/.env.docker.local to .gitignore and removed them from tracking. Tickets: T-001, T-013, T-018 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 15:27:16 +01:00
gitea-actions	6e29aeb30f	chore: bump version to v0.2.6 All checks were successful Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Successful in 1m22s Details	2026-03-17 09:38:00 +00:00
Matthieu	cca548dfbc	chore : bump version to 0.2.5 and fix MCP session directory All checks were successful Auto Tag Develop / tag (push) Successful in 5s Details Move MCP session storage from cache dir to var/mcp-sessions so it survives cache:clear operations. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 10:36:04 +01:00