2026-04-01 15:42:52 +02:00
|
|
|
nelmio_security:
|
|
|
|
|
|
|
|
|
|
clickjacking:
|
|
|
|
|
paths:
|
|
|
|
|
'^/.*': DENY
|
|
|
|
|
|
|
|
|
|
content_type:
|
|
|
|
|
nosniff: true
|
|
|
|
|
|
|
|
|
|
referrer_policy:
|
|
|
|
|
enabled: true
|
|
|
|
|
policies:
|
|
|
|
|
- 'no-referrer'
|
|
|
|
|
- 'strict-origin-when-cross-origin'
|
|
|
|
|
|
|
|
|
|
csp:
|
|
|
|
|
enforce:
|
|
|
|
|
level1_fallback: false
|
|
|
|
|
browser_adaptive:
|
|
|
|
|
enabled: false
|
|
|
|
|
report-uri: '%router.request_context.base_url%/my-csp-report'
|
|
|
|
|
frame-ancestors:
|
|
|
|
|
- 'self'
|
|
|
|
|
frame-src:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'https://stripe.com'
|
|
|
|
|
- 'https://*.stripe.com'
|
|
|
|
|
- 'https://js.stripe.com'
|
|
|
|
|
- 'https://cloudflare.com'
|
|
|
|
|
- 'https://*.cloudflareinsights.com'
|
|
|
|
|
- 'https://challenges.cloudflare.com'
|
|
|
|
|
script-src:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'https://static.cloudflareinsights.com'
|
|
|
|
|
- 'https://challenges.cloudflare.com'
|
|
|
|
|
- 'https://cdn.jsdelivr.net'
|
|
|
|
|
- 'https://js.stripe.com'
|
|
|
|
|
- 'unsafe-inline'
|
|
|
|
|
style-src:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'https://fonts.googleapis.com'
|
|
|
|
|
- 'https://cdnjs.cloudflare.com'
|
|
|
|
|
- 'https://cdn.jsdelivr.net'
|
|
|
|
|
- 'unsafe-inline'
|
|
|
|
|
img-src:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'data:'
|
|
|
|
|
- 'https://*.tile.openstreetmap.org'
|
|
|
|
|
- 'https://*.basemaps.cartocdn.com'
|
|
|
|
|
- 'https://cdn.jsdelivr.net'
|
|
|
|
|
worker-src:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'blob:'
|
|
|
|
|
connect-src:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'https://cloudflareinsights.com'
|
|
|
|
|
- 'https://static.cloudflareinsights.com'
|
|
|
|
|
- 'https://challenges.cloudflare.com'
|
|
|
|
|
- 'https://nominatim.openstreetmap.org'
|
|
|
|
|
- 'https://cdn.jsdelivr.net'
|
|
|
|
|
- 'https://api.stripe.com'
|
|
|
|
|
font-src:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'https://cdnjs.cloudflare.com'
|
|
|
|
|
- 'https://fonts.googleapis.com'
|
|
|
|
|
- 'https://fonts.gstatic.com'
|
|
|
|
|
object-src:
|
|
|
|
|
- 'none'
|
|
|
|
|
form-action:
|
|
|
|
|
- 'self'
|
|
|
|
|
- 'https://auth.esy-web.dev'
|
|
|
|
|
- 'https://*.stripe.com'
|
|
|
|
|
- 'https://checkout.stripe.com'
|
|
|
|
|
block-all-mixed-content: true
|
|
|
|
|
|
|
|
|
|
permissions_policy:
|
|
|
|
|
enabled: true
|
|
|
|
|
policies:
|
|
|
|
|
payment: ['self']
|
|
|
|
|
camera: ['self']
|
|
|
|
|
microphone: []
|
|
|
|
|
geolocation: ['self']
|
|
|
|
|
|
|
|
|
|
external_redirects:
|
|
|
|
|
override: /external-redirect
|
|
|
|
|
forward_as: redirUrl
|
|
|
|
|
log: true
|
|
|
|
|
allow_list:
|
|
|
|
|
- cloudflareinsights.com
|
|
|
|
|
- static.cloudflareinsights.com
|
|
|
|
|
- stripe.com
|
|
|
|
|
- connect.stripe.com
|
|
|
|
|
- checkout.stripe.com
|
|
|
|
|
- hooks.stripe.com
|
|
|
|
|
- dashboard.stripe.com
|
|
|
|
|
- auth.esy-web.dev
|
|
|
|
|
- challenges.cloudflare.com
|
feat: gestion complete Devis + Avis de paiement + DocuSeal signature + mails
Devis :
- Entity DevisLine (pos, title, description, priceHt) liee a Devis (OneToMany cascade/orphanRemoval)
- Champs ajoutes sur Devis : customer (ManyToOne), submissionId, state machine (created/send/accepted/refused/cancel), raisonMessage, totaux HT/TVA/TTC, updatedAt, setUpdatedAt public
- Relation Devis <-> Advert changee de ManyToOne a OneToOne nullable
- Vich Attribute (migration Annotation -> Attribute) pour unsignedPdf/signedPdf/auditPdf
- DevisController CRUD complet : create (form repeater lignes + boutons rapides TarificationService), edit, cancel (libere OrderNumber), generate-pdf, send, resend, create-advert, events
- DevisPdf (FPDF/FPDI) : header legacy (logo, num, date, client), body lignes, summary totaux, footer SITECONSEIL + pagination, champ signature DocuSeal sur page devis + derniere page CGV
- OrderNumberService : preview() et generate() reutilisent les OrderNumber non utilises (isUsed=false) en priorite
- OrderNumber::markAsUnused() ajoute
DocuSeal integration devis :
- DocuSealService : sendDevisForSignature (avec completed_redirect_url), resendDevisSignature (archive ancienne submission), getSubmitterSlug, downloadSignedDevis (sauvegarde via Vich UploadedFile test=true)
- WebhookDocuSealController : dispatch par doc_type devis/attestation, handleDevisEvent (form.completed -> STATE_ACCEPTED + download PDF signe/audit, form.declined -> STATE_REFUSED + raison)
- DocusealEvent entity pour tracer form.viewed/started/completed/declined en temps reel
- Page evenements admin /admin/devis/{id}/events avec badges et payload JSON
Signature client :
- DevisProcessController : page publique /devis/process/{id}/{hmac} securisee par HMAC, boutons Signer (redirect DocuSeal) / Refuser (motif optionnel)
- Pages confirmation : signed.html.twig (merci + recap) et refused.html.twig (confirmation refus + motif)
- Nelmio whitelist : signature.esy-web.dev + signature.siteconseil.fr
Avis de paiement :
- Entity AdvertLine (pos, title, description, priceHt) liee a Advert
- Advert refactorise : customer, state, totaux, raisonMessage, submissionId, advertFile (Vich mapping advert_pdf), lines collection, updatedAt
- AdvertController : generate-pdf, send (mail + PJ + lien paiement), resend (rappel), cancel (delie devis, libere OrderNumber), search Meilisearch
- AdvertPdf (FPDF/FPDI) : QR code Endroid pointant vers /order/{numOrder}, texte "Scannez pour payer"
- OrderPaymentController : page publique /order/{numOrder} avec detail prestations, totaux, options paiement (placeholder)
- Creation auto depuis devis signe : copie client, totaux, lignes, meme OrderNumber
Meilisearch :
- Index customer_devis et customer_advert avec searchable (numOrder, customerName, customerEmail, state) et filterable (customerId, state)
- CRUD indexation sur chaque action (create, edit, send, cancel, create-advert)
- Recherche AJAX dans tabs Devis et Avis avec debounce + dropdown glassmorphism
- Sync admin : boutons syncDevis / syncAdverts + compteurs dans /admin/sync
Emails :
- MailerService : VCF auto (fiche contact SARL SITECONSEIL) en PJ sur tous les mails, bloc HTML pieces jointes injecte automatiquement (exclut .asc/.p7z/smime) avec icone trombone + taille fichier
- Templates : devis_to_sign, devis_signed_client/admin (PJ signed+audit), devis_refused_client/admin, advert_send (PJ + bouton paiement), ndd_expiration
- TestMailCommand : option --force-dsn pour envoyer via un DSN SMTP specifique (test prod depuis dev)
Commande NDD :
- app:ndd:check : verifie expiration domaines <= 30j, envoie mail groupe a monitor@siteconseil.fr
- Cron quotidien 8h (docker + ansible)
Divers :
- Titles templates : CRM SITECONSEIL -> SARL SITECONSEIL (52 fichiers)
- VAULT_URL dev = https://kms.esy-web.dev (comme prod)
- app.js : initDevisLines (repeater + drag & drop), initTabSearch, toggle refus devis
- app.scss : styles drag & drop
- setasign/fpdi-fpdf installe pour fusion PDF
- 5 migrations Doctrine
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-07 09:44:35 +02:00
|
|
|
- signature.esy-web.dev
|
feat: comptabilite + prestataires + rapport financier + stats dynamiques
Comptabilite (Super Admin) :
- ComptabiliteController avec 7 exports CSV/JSON compatibles SAGE
(journal ventes, grand livre, FEC, balance agee, reglements,
commissions Stripe 1.5%+0.25E, couts services)
- Export PDF via ComptaPdf (FPDF) avec bloc legal pre-rempli,
tableau pagine, champ signature DocuSeal
- Signature electronique DocuSeal + callback + envoi email signe
avec template dedie (compta_export_signed.html.twig)
- Rapport financier public (RapportFinancierPdf) : recettes par
service, depenses (Stripe, infra, prestataires), bilan excedent/deficit
- Codes comptables clients EC-XXXX (plus de 411xxx)
Prestataires (Super Admin) :
- Entite Prestataire (raisonSociale, siret, email, phone, adresse)
- Entite FacturePrestataire (numFacture, montantHt, montantTtc,
year, month, isPaid, PDF via Vich)
- CRUD complet avec recherche SIRET via proxy API data.gouv.fr
- Commande cron app:reminder:factures-prestataire (5 du mois)
- Factures prestataires integrees dans export couts services
- Sidebar Super Admin : entree Prestataires + Comptabilite
Stats (/admin/stats) :
- Cout prestataire dynamique depuis FacturePrestataire
- Fusion Infra + Prestataire en "Cout de fonctionnement"
- Commission Stripe corrigee (1.5% + 0.25E par transaction)
Divers :
- DocuSealService::sendComptaForSignature() + getApi()
- Customer::generateCodeComptable() format EC-XXXX-XXXXX
- Protection double prefixe EC- a la creation client
- Bouton regenerer PDF cache quand advert state=accepted
- Modals sans script inline (data-modal-open/close dans app.js)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-07 23:39:31 +02:00
|
|
|
- signature.e-cosplay.fr
|