From 8a042fb578937db031f0178aa593c3f1b95e7a87 Mon Sep 17 00:00:00 2001
From: tristan <tristan@yuno.malio.fr>
Date: Mon, 29 Jun 2026 10:52:02 +0200
Subject: [PATCH] =?UTF-8?q?fix(logistique)=20:=20bloque=20les=20caract?=
 =?UTF-8?q?=C3=A8res=20sp=C3=A9ciaux=20dans=20le=20champ=20=C2=AB=20Autre?=
 =?UTF-8?q?=20=C2=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Assert\Regex(FREE_TEXT) sur otherLabel (miroir companyName/competitors) + masque
FREE_TEXT_MASK sur l'input « Autre » (new.vue / edit.vue).
---
 .../pages/weighing-tickets/[id]/edit.vue      |  2 +
 .../logistique/pages/weighing-tickets/new.vue |  2 +
 .../Domain/Entity/WeighingTicket.php          |  2 +
 .../Api/WeighingTicketLifecycleTest.php       | 37 +++++++++++++++++++
 4 files changed, 43 insertions(+)

diff --git a/frontend/modules/logistique/pages/weighing-tickets/[id]/edit.vue b/frontend/modules/logistique/pages/weighing-tickets/[id]/edit.vue
index d42b2bd..bb8bf6d 100644
--- a/frontend/modules/logistique/pages/weighing-tickets/[id]/edit.vue
+++ b/frontend/modules/logistique/pages/weighing-tickets/[id]/edit.vue
@@ -58,6 +58,7 @@
                         <MalioInputText
                             v-else-if="form.counterpartyField.value === 'other'"
                             :model-value="form.otherLabel.value"
+                            :mask="FREE_TEXT_MASK"
                             :label="t('logistique.weighingTickets.form.counterparty.other')"
                             :required="true"
                             :error="errors.otherLabel"
@@ -193,6 +194,7 @@ import { useWeighbridge } from '~/modules/logistique/composables/useWeighbridge'
 import { useWeighingTicket, type WeighingTicketDetail } from '~/modules/logistique/composables/useWeighingTicket'
 import { useWeighingTicketReferentials, type RefOption } from '~/modules/logistique/composables/useWeighingTicketReferentials'
 import { MANUAL_NUMERIC_MASK, PLATE_MASK, FREE_PLATE_MASK } from '~/modules/logistique/utils/weighingMasks'
+import { FREE_TEXT_MASK } from '~/shared/utils/textSanitize'
 import { mapViolationsToRecord } from '~/shared/utils/api'
 
 const { t } = useI18n()
diff --git a/frontend/modules/logistique/pages/weighing-tickets/new.vue b/frontend/modules/logistique/pages/weighing-tickets/new.vue
index 1924638..27021ae 100644
--- a/frontend/modules/logistique/pages/weighing-tickets/new.vue
+++ b/frontend/modules/logistique/pages/weighing-tickets/new.vue
@@ -53,6 +53,7 @@
                     <MalioInputText
                         v-else-if="form.counterpartyField.value === 'other'"
                         :model-value="form.otherLabel.value"
+                        :mask="FREE_TEXT_MASK"
                         :label="t('logistique.weighingTickets.form.counterparty.other')"
                         :required="true"
                         :error="errors.otherLabel"
@@ -182,6 +183,7 @@ import { useWeighingTicketForm, type WeighingBlockState } from '~/modules/logist
 import { useWeighbridge } from '~/modules/logistique/composables/useWeighbridge'
 import { useWeighingTicketReferentials, type RefOption } from '~/modules/logistique/composables/useWeighingTicketReferentials'
 import { MANUAL_NUMERIC_MASK, PLATE_MASK, FREE_PLATE_MASK } from '~/modules/logistique/utils/weighingMasks'
+import { FREE_TEXT_MASK } from '~/shared/utils/textSanitize'
 import { mapViolationsToRecord } from '~/shared/utils/api'
 
 const { t } = useI18n()
diff --git a/src/Module/Logistique/Domain/Entity/WeighingTicket.php b/src/Module/Logistique/Domain/Entity/WeighingTicket.php
index cffeb8a..5d9b2e6 100644
--- a/src/Module/Logistique/Domain/Entity/WeighingTicket.php
+++ b/src/Module/Logistique/Domain/Entity/WeighingTicket.php
@@ -20,6 +20,7 @@ use App\Shared\Domain\Attribute\Auditable;
 use App\Shared\Domain\Contract\BlamableInterface;
 use App\Shared\Domain\Contract\TimestampableInterface;
 use App\Shared\Domain\Trait\TimestampableBlamableTrait;
+use App\Shared\Domain\Validation\TextInputPattern;
 use DateTimeImmutable;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Serializer\Attribute\Groups;
@@ -226,6 +227,7 @@ class WeighingTicket implements TimestampableInterface, BlamableInterface
     /** Libelle libre — requis ssi counterpartyType = AUTRE (RG-5.03). */
     #[ORM\Column(name: 'other_label', length: 255, nullable: true)]
     #[Assert\Length(max: 255, maxMessage: 'Le libellé ne peut pas dépasser {{ limit }} caractères.', normalizer: 'trim')]
+    #[Assert\Regex(pattern: TextInputPattern::FREE_TEXT, message: TextInputPattern::FREE_TEXT_MESSAGE)]
     #[Groups(['weighing_ticket:read', 'weighing_ticket:write'])]
     private ?string $otherLabel = null;
 
diff --git a/tests/Module/Logistique/Api/WeighingTicketLifecycleTest.php b/tests/Module/Logistique/Api/WeighingTicketLifecycleTest.php
index 8439d66..8d93604 100644
--- a/tests/Module/Logistique/Api/WeighingTicketLifecycleTest.php
+++ b/tests/Module/Logistique/Api/WeighingTicketLifecycleTest.php
@@ -79,6 +79,43 @@ final class WeighingTicketLifecycleTest extends AbstractWeighingTicketApiTestCas
         self::assertNull($body['counterpartyType'] ?? null);
     }
 
+    public function testOtherLabelWithSpecialCharsIsRejected(): void
+    {
+        $http = $this->authManageOnSite($this->siteByCode('86'));
+
+        // Le back reste l'autorite (le masque front FREE_TEXT_MASK filtre deja a la
+        // frappe) : un libelle « Autre » avec des caracteres parasites -> 422 sur
+        // otherLabel (Assert\Regex FREE_TEXT), mappee inline cote front (ERP-101).
+        $response = $this->postTicket($http, [
+            'counterpartyType' => 'AUTRE',
+            'otherLabel'       => 'Chantier ~#|<>{}',
+            'emptyDate'        => '2026-06-17T09:00:00+02:00',
+            'emptyWeight'      => 7150,
+            'emptyMode'        => 'AUTO',
+        ]);
+
+        self::assertResponseStatusCodeSame(422);
+        self::assertViolationOnPath($response, 'otherLabel');
+    }
+
+    public function testOtherLabelLegitimateIsAccepted(): void
+    {
+        $http = $this->authManageOnSite($this->siteByCode('86'));
+
+        // Lettres accentuees, chiffres, espaces, parentheses, °, & : tout autorise
+        // par FREE_TEXT (miroir des raisons sociales Client/Fournisseur).
+        $body = $this->postTicket($http, [
+            'counterpartyType' => 'AUTRE',
+            'otherLabel'       => 'Chantier Léon (Pôle n°2) & Cie',
+            'emptyDate'        => '2026-06-17T09:00:00+02:00',
+            'emptyWeight'      => 7150,
+            'emptyMode'        => 'AUTO',
+        ])->toArray();
+
+        self::assertResponseStatusCodeSame(201);
+        self::assertSame('Chantier Léon (Pôle n°2) & Cie', $body['otherLabel']);
+    }
+
     public function testValidateRequiresCounterparty(): void
     {
         $http = $this->authManageOnSite($this->siteByCode('86'));