```

[DEL] docs(file/topic): Supprime favicon et manifest inutilisés.
[FEAT] feat(file/topic): Ajoute PWA bundle et CSP pour la sécurité.
```

.gitignore

@@ -35,3 +35,13 @@ coverage/
 /public/build
 bun.lock
 bun.lockd
+
+###> spomky-labs/pwa-bundle ###
+/public/idb
+/public/pwa
+/public/workbox
+/public/favicon.ico
+/public/site.webmanifest
+/public/site.*.webmanifest
+/public/sw.js
+###< spomky-labs/pwa-bundle ###

ansible/templates/caddy.j2

@@ -19,11 +19,6 @@ www.e-cosplay.fr {
     }
     header {
         -X-Robots-Tag
-        Permissions-Policy "accelerometer=(), autoplay=(), encrypted-media=(), geolocation=(), gyroscope=(), magnetometer=(), midi=(), payment=(), publickey-credentials-get=(), usb=(), screen-wake-lock=(), xr-spatial-tracking=(), bluetooth=(), gamepad=()"
-        Content-Security-Policy "base-uri 'self'; default-src 'self'; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://challenges.cloudflare.com https://sentry.esy-web.dev https://www.e-cosplay.fr https://datas.e-cosplay.fr https://chat.esy-web.dev https://*.cloudflareinsights.com https://storage.googleapis.com https://*.trustpilot.com https://climate.stripe.com; font-src 'self' https://cdnjs.cloudflare.com https://fonts.gstatic.com;connect-src https://browser.sentry-cdn.com https://*.e-cosplay.fr https://*.cloudflareinsights.com https://fonts.googleapis.com https://widget.trustpilot.com/ https://challenges.cloudflare.com https://chat.esy-web.dev; frame-src 'self' https://challenges.cloudflare.com https://*.trustpilot.com https://chat.esy-web.dev https://climate.stripe.com; worker-src 'self' blob:;"
-        Cross-Origin-Embedder-Policy ""
-        Cross-Origin-Opener-Policy ""
-        Cross-Origin-Resource-Policy ""
         X-Frame-Options "SAMEORIGIN"
         X-Content-Type-options "nosniff"
     }

assets/app.js

@@ -1,7 +1,7 @@
 import './app.scss'
 import * as Turbo from "@hotwired/turbo"
 import '@grafikart/drop-files-element'
-import {PaymentForm} from './PaymentForm'
+import {PaymentForm} from './PaymentForm.js'
 import * as Sentry from "@sentry/browser";
 
 // --- CONFIGURATION ET ETAT ---
@@ -244,10 +244,6 @@ document.addEventListener('DOMContentLoaded', () => {
             window.chatwootSDK.run({ websiteToken: '6uFX3g3qybyvSt3PAQUMgkm4', baseUrl: BASE_URL_WOOT });
         };
     }
-    const env = document.querySelector('meta[name="env"]');
-    if (env && env.getAttribute('content') === "prod" && 'serviceWorker' in navigator) {
-        navigator.serviceWorker.register('/sw.js');
-    }
 });
 
 document.addEventListener('turbo:load', () => {

composer.json

@@ -37,6 +37,7 @@
         "mittwald/vault-php": "^3.0.2",
         "mobiledetect/mobiledetectlib": "^4.8.09",
         "nelmio/cors-bundle": "^2.6",
+        "nelmio/security-bundle": "^3.8",
         "ovh/ovh": ">=3.5",
         "pear/net_dns2": ">=2.0.7",
         "phpdocumentor/reflection-docblock": "^5.6.4",
@@ -47,6 +48,7 @@
         "sentry/sentry-symfony": "^5.6",
         "setasign/fpdi": "^2.6.4",
         "spatie/mjml-php": "^1.2.5",
+        "spomky-labs/pwa-bundle": "^1.4",
         "stancer/stancer": ">=2.0.1",
         "stevenmaguire/oauth2-keycloak": "^5.1",
         "stripe/stripe-php": "^19.0",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "403d821dbd4191efa1335b197d907faf",
+    "content-hash": "4dc12dab62324c75da229e1da20b6ebf",
     "packages": [
         {
             "name": "adam-paterson/oauth2-stripe",
@@ -758,6 +758,78 @@
             },
             "time": "2024-09-10T14:09:25+00:00"
         },
+        {
+            "name": "composer/ca-bundle",
+            "version": "1.5.10",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/composer/ca-bundle.git",
+                "reference": "961a5e4056dd2e4a2eedcac7576075947c28bf63"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/composer/ca-bundle/zipball/961a5e4056dd2e4a2eedcac7576075947c28bf63",
+                "reference": "961a5e4056dd2e4a2eedcac7576075947c28bf63",
+                "shasum": ""
+            },
+            "require": {
+                "ext-openssl": "*",
+                "ext-pcre": "*",
+                "php": "^7.2 || ^8.0"
+            },
+            "require-dev": {
+                "phpstan/phpstan": "^1.10",
+                "phpunit/phpunit": "^8 || ^9",
+                "psr/log": "^1.0 || ^2.0 || ^3.0",
+                "symfony/process": "^4.0 || ^5.0 || ^6.0 || ^7.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "1.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Composer\\CaBundle\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Jordi Boggiano",
+                    "email": "j.boggiano@seld.be",
+                    "homepage": "http://seld.be"
+                }
+            ],
+            "description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.",
+            "keywords": [
+                "cabundle",
+                "cacert",
+                "certificate",
+                "ssl",
+                "tls"
+            ],
+            "support": {
+                "irc": "irc://irc.freenode.org/composer",
+                "issues": "https://github.com/composer/ca-bundle/issues",
+                "source": "https://github.com/composer/ca-bundle/tree/1.5.10"
+            },
+            "funding": [
+                {
+                    "url": "https://packagist.com",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/composer",
+                    "type": "github"
+                }
+            ],
+            "time": "2025-12-08T15:06:51+00:00"
+        },
         {
             "name": "composer/pcre",
             "version": "3.3.2",
@@ -6169,6 +6241,80 @@
             },
             "time": "2025-10-23T06:57:22+00:00"
         },
+        {
+            "name": "nelmio/security-bundle",
+            "version": "v3.8.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/nelmio/NelmioSecurityBundle.git",
+                "reference": "2fafee1cdda1d5952554c44eef4c3c8566d56f40"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/nelmio/NelmioSecurityBundle/zipball/2fafee1cdda1d5952554c44eef4c3c8566d56f40",
+                "reference": "2fafee1cdda1d5952554c44eef4c3c8566d56f40",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.4 || ^8.0",
+                "symfony/deprecation-contracts": "^2.5 || ^3",
+                "symfony/framework-bundle": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "symfony/http-kernel": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "symfony/security-core": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "symfony/security-csrf": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "symfony/security-http": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "symfony/yaml": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "ua-parser/uap-php": "^3.4.4"
+            },
+            "require-dev": {
+                "phpstan/phpstan": "^2.0",
+                "phpstan/phpstan-deprecation-rules": "^2.0",
+                "phpstan/phpstan-phpunit": "^2.0",
+                "phpstan/phpstan-strict-rules": "^2.0",
+                "phpstan/phpstan-symfony": "^2.0",
+                "phpunit/phpunit": "^9.5 || ^10.1 || ^11.0",
+                "psr/cache": "^1.0 || ^2.0 || ^3.0",
+                "symfony/browser-kit": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "symfony/cache": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "symfony/phpunit-bridge": "^6.3 || ^7.0 || ^8.0",
+                "symfony/twig-bundle": "^5.4 || ^6.3 || ^7.0 || ^8.0",
+                "twig/twig": "^2.10 || ^3.0"
+            },
+            "type": "symfony-bundle",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "3.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Nelmio\\SecurityBundle\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nelmio",
+                    "homepage": "http://nelm.io"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://github.com/nelmio/NelmioSecurityBundle/contributors"
+                }
+            ],
+            "description": "Extra security-related features for Symfony: signed/encrypted cookies, HTTPS/SSL/HSTS handling, cookie session storage, ...",
+            "keywords": [
+                "security"
+            ],
+            "support": {
+                "issues": "https://github.com/nelmio/NelmioSecurityBundle/issues",
+                "source": "https://github.com/nelmio/NelmioSecurityBundle/tree/v3.8.0"
+            },
+            "time": "2026-01-14T19:38:55+00:00"
+        },
         {
             "name": "nesbot/carbon",
             "version": "3.10.3",
@@ -8492,6 +8638,115 @@
             ],
             "time": "2025-10-22T08:24:34+00:00"
         },
+        {
+            "name": "spomky-labs/pwa-bundle",
+            "version": "1.4.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Spomky-Labs/pwa-bundle.git",
+                "reference": "e2dd45a098a3e86d0637e5188c8d616d6c99cdb9"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Spomky-Labs/pwa-bundle/zipball/e2dd45a098a3e86d0637e5188c8d616d6c99cdb9",
+                "reference": "e2dd45a098a3e86d0637e5188c8d616d6c99cdb9",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.2",
+                "phpdocumentor/reflection-docblock": "^5.3|^6.0",
+                "psr/log": "^1.1|^2.0|^3.0",
+                "symfony/asset": "^6.4|^7.0|^8.0",
+                "symfony/asset-mapper": "^6.4|^7.0|^8.0",
+                "symfony/config": "^6.4|^7.0|^8.0",
+                "symfony/dependency-injection": "^6.4|^7.0|^8.0",
+                "symfony/deprecation-contracts": "^3.5",
+                "symfony/http-kernel": "^6.4|^7.0|^8.0",
+                "symfony/property-access": "^6.4|^7.0|^8.0",
+                "symfony/property-info": "^6.4|^7.0|^8.0",
+                "symfony/routing": "^6.4|^7.0|^8.0",
+                "symfony/serializer": "^6.4|^7.0|^8.0",
+                "symfony/service-contracts": "^3.0",
+                "twig/twig": "^3.8"
+            },
+            "require-dev": {
+                "matthiasnoback/symfony-config-test": "^5.1|^6.0",
+                "monolog/monolog": "^3.0",
+                "nelmio/security-bundle": "^3.3",
+                "symfony/console": "^6.4|^7.0|^8.0",
+                "symfony/event-dispatcher": "^6.4|^7.0|^8.0",
+                "symfony/filesystem": "^6.4|^7.0|^8.0",
+                "symfony/finder": "^6.4|^7.0|^8.0",
+                "symfony/framework-bundle": "^7.0|^8.0",
+                "symfony/mime": "^6.4|^7.0|^8.0",
+                "symfony/monolog-bridge": "^6.4|^7.0|^8.0",
+                "symfony/monolog-bundle": "^3.10|^4.0",
+                "symfony/translation": "^6.4|^7.0|^8.0",
+                "symfony/twig-bundle": "^7.0|^8.0",
+                "symfony/ux-icons": "^2.29",
+                "symfony/yaml": "^6.4|^7.0|^8.0"
+            },
+            "suggest": {
+                "ext-gd": "Required to generate icons (or Imagick).",
+                "ext-imagick": "Required to generate icons (or GD).",
+                "symfony/filesystem": "For generating and manipulating icons or screenshots",
+                "symfony/mime": "For generating and manipulating icons or screenshots",
+                "symfony/ux-icons": "For using SVG icons (e.g. for shortcuts)"
+            },
+            "type": "symfony-bundle",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/spomky-labs/pwa-bundle",
+                    "name": "spomky-labs/pwa-bundle"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "SpomkyLabs\\PwaBundle\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Florent Morselli",
+                    "homepage": "https://github.com/Spomky"
+                },
+                {
+                    "name": "All contributors",
+                    "homepage": "https://github.com/spomky-labs/pwa-bundle/contributors"
+                }
+            ],
+            "description": "Progressive Web App Manifest Generator Bundle for Symfony.",
+            "homepage": "https://github.com/spomky-labs",
+            "keywords": [
+                "bundle",
+                "pwa",
+                "symfony",
+                "symfony-ux"
+            ],
+            "support": {
+                "issues": "https://github.com/Spomky-Labs/pwa-bundle/issues",
+                "source": "https://github.com/Spomky-Labs/pwa-bundle/tree/1.4.0"
+            },
+            "funding": [
+                {
+                    "url": "https://www.buymeacoffee.com/FlorentMorselli",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/Spomky",
+                    "type": "github"
+                },
+                {
+                    "url": "https://www.patreon.com/FlorentMorselli",
+                    "type": "patreon"
+                }
+            ],
+            "time": "2026-01-09T10:52:16+00:00"
+        },
         {
             "name": "stancer/stancer",
             "version": "v2.0.1",
@@ -14914,6 +15169,69 @@
             ],
             "time": "2025-10-29T15:56:47+00:00"
         },
+        {
+            "name": "ua-parser/uap-php",
+            "version": "v3.10.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/ua-parser/uap-php.git",
+                "reference": "f44bdd1b38198801cf60b0681d2d842980e47af5"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/ua-parser/uap-php/zipball/f44bdd1b38198801cf60b0681d2d842980e47af5",
+                "reference": "f44bdd1b38198801cf60b0681d2d842980e47af5",
+                "shasum": ""
+            },
+            "require": {
+                "composer/ca-bundle": "^1.1",
+                "php": "^7.2 || ^8.0"
+            },
+            "require-dev": {
+                "phpstan/phpstan": "^0.12.33",
+                "phpunit/phpunit": "^8 || ^9",
+                "symfony/console": "^3.4 || ^4.2 || ^4.3 || ^5.0",
+                "symfony/filesystem": "^3.4 || ^4.2 ||  ^4.3 || ^5.0",
+                "symfony/finder": "^3.4 || ^4.2 || ^4.3 || ^5.0",
+                "symfony/yaml": "^3.4 || ^4.2 || ^4.3 || ^5.0",
+                "vimeo/psalm": "^3.12"
+            },
+            "suggest": {
+                "symfony/console": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0",
+                "symfony/filesystem": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0",
+                "symfony/finder": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0",
+                "symfony/yaml": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0"
+            },
+            "bin": [
+                "bin/uaparser"
+            ],
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "UAParser\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Dave Olsen",
+                    "email": "dmolsen@gmail.com"
+                },
+                {
+                    "name": "Lars Strojny",
+                    "email": "lars@strojny.net"
+                }
+            ],
+            "description": "A multi-language port of Browserscope's user agent parser.",
+            "support": {
+                "issues": "https://github.com/ua-parser/uap-php/issues",
+                "source": "https://github.com/ua-parser/uap-php/tree/v3.10.0"
+            },
+            "time": "2025-07-17T15:43:24+00:00"
+        },
         {
             "name": "vich/uploader-bundle",
             "version": "v2.8.1",

config/bundles.php

@@ -20,4 +20,6 @@ return [
     Sentry\SentryBundle\SentryBundle::class => ['prod' => true],
     PixelOpen\CloudflareTurnstileBundle\PixelOpenCloudflareTurnstileBundle::class => ['all' => true],
     KnpU\OAuth2ClientBundle\KnpUOAuth2ClientBundle::class => ['all' => true],
+    SpomkyLabs\PwaBundle\SpomkyLabsPwaBundle::class => ['all' => true],
+    Nelmio\SecurityBundle\NelmioSecurityBundle::class => ['all' => true],
 ];

config/packages/dev/nelmio_security.yaml

@@ -0,0 +1,8 @@
+nelmio_security:
+    csp:
+        enforce:
+            script-src:
+                - "http://localhost:5173"
+            connect-src:
+                - "ws://localhost:5173/"  # Autorise le WebSocket de Vite
+

config/packages/dev/pwa.yaml

@@ -0,0 +1,3 @@
+pwa:
+    serviceworker:
+        enabled: false

config/packages/nelmio_security.yaml

@@ -0,0 +1,61 @@
+nelmio_security:
+    # Content Security Policy (CSP)
+    referrer_policy:
+        enabled: true
+        policies:
+            - 'strict-origin-when-cross-origin'
+    permissions_policy:
+        enabled: true
+        policies:
+            camera: [self]         # Correct : sans les guillemets simples internes
+            microphone: [self]     # Correct
+            geolocation: [self]    # Correct
+            fullscreen: [self]     # Correct
+            payment: [self]        # Correct
+            # Si tu veux bloquer une fonction pour tout le monde :
+            usb: []
+    csp:
+        hash:
+            algorithm: 'sha256'
+        enforce:
+            default-src: ["'self'"]
+            worker-src: ["'self'"]
+            script-src:
+                - "'self'"
+                - "nonce"
+                - "https://sentry.esy-web.dev"
+                - "https://chat.esy-web.dev"
+                - "https://static.cloudflareinsights.com"
+                - "https://challenges.cloudflare.com"
+            connect-src:
+                - "'self'"
+                - "https://sentry.esy-web.dev"
+                - "https://chat.esy-web.dev"
+                - "https://auth.esy-web.dev"
+                - "https://cloudflareinsights.com"
+                - "https://challenges.cloudflare.com"
+                - "https://tools-security.esy-web.dev"
+                - "https://checkout.stripe.com/"
+            frame-src:
+                - "'self'"
+                - "https://chat.esy-web.dev"
+                - "https://challenges.cloudflare.com"
+                - "https://climate.stripe.com/"
+            style-src:
+                - "'self'"
+                - "'unsafe-inline'"
+                - "https://fonts.googleapis.com"
+                - "https://chat.esy-web.dev"
+                - "https://cdnjs.cloudflare.com"
+            img-src:
+                - "'self'"
+                - "data:"
+                - "https://chat.esy-web.dev"
+            font-src:
+                - "'self'"
+                - "data:"
+                - 'https://fonts.gstatic.com'
+                - "https://cdnjs.cloudflare.com/"
+            frame-ancestors: ["'none'"]
+            # Optionnel : forcer le passage en HTTPS
+            upgrade-insecure-requests: false

config/packages/pwa.yaml

@@ -0,0 +1,23 @@
+pwa:
+    asset_compiler: false # Default to true. Will change to false in 2.0.0.
+    image_processor: 'pwa.image_processor.gd' # Or 'pwa.image_processor.gd'
+    favicons:
+        enabled: true
+        src: '%kernel.project_dir%/public/assets/notif.png'
+    serviceworker:
+        enabled: true
+        scope: "/"
+        use_cache: false
+        skip_waiting: true
+    manifest:
+        enabled: true
+        name: "E-Cosplay"
+        short_name: "PWA"
+        start_url: "app_home"
+        display: "standalone"
+        background_color: "#ffffff"
+        theme_color: "#4285f4"
+        categories: ['games','multimedia','social networking']
+        icons:
+            - src: '%kernel.project_dir%/public/assets/notif.png'
+              sizes: [192]

config/services.yaml

@@ -20,6 +20,8 @@ services:
         arguments:
             $manifest: '%kernel.project_dir%/public/build/.vite/manifest.json'
             $cache: '@vite_cache_pool'
+            $cspListener: '@nelmio_security.csp_listener'
+
     # add more service definitions when explicit configuration is needed
     # please note that last definitions always *replace* previous ones
     App\VichUploader\Namer\Account\AvatarName:

package.json

@@ -11,7 +11,10 @@
     },
     "devDependencies": {
         "@hotwired/stimulus": "^3.2.2",
+        "@spomky-labs/pwa-bundle": "file:vendor/spomky-labs/pwa-bundle/assets",
         "@tailwindcss/postcss": "^4.1.17",
+        "idb": "^8.0",
+        "idb-keyval": "^6.2",
         "postcss": "^8.5.6",
         "postcss-scss": "^4.0.9",
         "rollup-plugin-javascript-obfuscator": "^1.0.4",