2026-03-22 19:44:44 +01:00
|
|
|
# Task Checkup - E-Ticket
|
|
|
|
|
|
|
|
|
|
## A faire
|
|
|
|
|
|
|
|
|
|
### Billetterie & Commandes
|
Add stock management, order notifications, webhooks, expiration cron, and billet type validation
- Decrement billet quantity after purchase in BilletOrderService::generateOrderTickets
- Block purchase when stock is exhausted (quantity <= 0) in OrderController::buildOrderItems
- Add organizer email notification on new order (order_notification_orga template)
- Add organizer email notification on cancel/refund (order_cancelled_orga template)
- Add ExpirePendingOrdersCommand (app:orders:expire-pending) cron every 5min via Ansible
- Cancels pending orders older than 30 minutes, restores stock, invalidates tickets
- Includes BilletBuyerRepository::findExpiredPending query method
- 3 unit tests covering: no expired orders, stock restoration, unlimited billets
- Add payment_intent.payment_failed webhook: cancels order, logs audit, emails buyer
- Add charge.refunded webhook: sets order to refunded, invalidates tickets, notifies orga and buyer
- Validate billet type (billet/reservation_brocante/vote) against organizer offer
- getAllowedBilletTypes: gratuit=billet only, basic/sur-mesure=all types
- Server-side validation in hydrateBilletFromRequest, UI filtering in templates
- Update TASK_CHECKUP.md: all Billetterie & Commandes items now complete
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 00:12:30 +01:00
|
|
|
- [x] Décrémenter la quantité disponible du billet après achat (stock management)
|
|
|
|
|
- [x] Empêcher l'achat si stock épuisé (vérification côté serveur)
|
|
|
|
|
- [x] Ajouter un email de notification à l'orga quand une commande est passée
|
|
|
|
|
- [x] Ajouter un email de notification à l'orga quand une commande est annulée/remboursée
|
|
|
|
|
- [x] Gérer l'expiration des commandes pending (cron pour annuler après X minutes)
|
|
|
|
|
- [x] Ajouter le webhook `payment_intent.payment_failed` pour gérer les échecs
|
|
|
|
|
- [x] Ajouter le webhook `charge.refunded` pour mettre à jour le statut automatiquement
|
|
|
|
|
- [x] Vérifier le type de billet (billet/reservation_brocante/vote) selon l'offre orga à la création
|
2026-03-22 19:44:44 +01:00
|
|
|
|
|
|
|
|
### Invitations Organisateur
|
2026-03-22 22:50:18 +01:00
|
|
|
- [x] Bloquer l'envoi d'invitations (billets) si Stripe n'est pas validé — non nécessaire car invitations = gratuit (pas de paiement Stripe)
|
2026-03-22 22:49:41 +01:00
|
|
|
- [x] Après inscription via invitation, connecter automatiquement l'utilisateur
|
2026-03-22 22:34:18 +01:00
|
|
|
- [x] Empêcher la double inscription (même email) avec message clair et redirect vers login
|
2026-03-22 22:33:04 +01:00
|
|
|
- [x] Ajouter une notification admin quand un orga accepte/refuse une invitation
|
2026-03-22 19:44:44 +01:00
|
|
|
|
|
|
|
|
### Paiements & Finances
|
2026-03-22 22:23:59 +01:00
|
|
|
- [x] Ajouter le dashboard financier pour l'orga (encaissé, en attente, remboursé, com E-Ticket, com Stripe, net perçu)
|
2026-03-22 22:19:22 +01:00
|
|
|
- [x] Ajouter les virements Stripe (payouts) dans l'onglet de l'orga (déjà en place)
|
Add monthly export CSV + PDF for admin and organizers
- ExportService: monthly stats query, CSV generation, PDF generation via dompdf
- Admin: /admin/export/{year}/{month} (CSV) + /admin/export/{year}/{month}/pdf
- Orga: /mon-compte/export/{year}/{month} (CSV) + /mon-compte/export/{year}/{month}/pdf
- Admin CSV: commande, date, événement, orga, acheteur, billets, total HT, com E-Ticket, com Stripe
- Orga CSV: + net perçu column
- PDF A4 landscape: KPIs + orders table with commissions breakdown
- Buttons in admin dashboard and orga payouts tab (current + previous month)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 22:16:55 +01:00
|
|
|
- [x] Générer un récapitulatif mensuel des ventes (export CSV + PDF, admin et orga)
|
2026-03-22 19:44:44 +01:00
|
|
|
|
|
|
|
|
### Admin
|
2026-03-22 22:09:16 +01:00
|
|
|
- [x] Dashboard admin : stats globales (CA global, commission E-Ticket, commission Stripe, nb commandes, nb billets, nb orgas, revenus net)
|
Add admin orders page with search, status filter, KPIs
- /admin/commandes: paginated list of all orders
- Search by order number, name, email
- Filter by status (pending, paid, cancelled, refunded)
- 4 KPIs: paid count, CA total HT, refunded count, cancelled count
- Table: order number, buyer, event, billets, total, date, status badges
- Navigation link 'Commandes' in admin header
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:25:32 +01:00
|
|
|
- [x] Admin : liste de toutes les commandes avec filtres (recherche, statut, KPIs)
|
2026-03-22 20:53:46 +01:00
|
|
|
- [x] Admin : pouvoir suspendre/réactiver un organisateur (badge, bouton toggle, redirect si suspendu, audit log)
|
2026-03-22 20:49:23 +01:00
|
|
|
- [x] Admin : pouvoir modifier l'offre/commission d'un orga existant
|
2026-03-22 22:05:16 +01:00
|
|
|
- [x] Vérifier que les permissions des sous-comptes sont respectées (scanner, events, tickets)
|
Add audit trail: AuditLog entity, AuditService, admin logs page
- AuditLog entity: action, entityType, entityId, data (JSON), performedBy, ipAddress
- AuditService: logs actions with current user and IP
- Audit on: order_created, order_paid, order_cancelled, order_refunded
- Admin /admin/logs: paginated table with action badges, details, user, IP
- Navigation link 'Logs' in admin header
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 20:48:10 +01:00
|
|
|
- [x] Admin : logs des actions importantes (audit trail: commande, paiement, annulation, remboursement)
|
2026-03-22 19:44:44 +01:00
|
|
|
|
|
|
|
|
### UX & Pages
|
Redesign /tarifs page: 3 offers (free/basic 20EUR/mo/custom), commissions table, examples
- Free: 0 EUR, 1 event, billets standards
- Basic: 20 EUR/mois, events illimites, PDF, invitations
- Sur-mesure: sur devis, design personnalise, brocantes, vote
- Commission examples table: 1, 2, 5, 10, 15, 20 EUR
- Stripe fees + E-Ticket fees breakdown
- Includes section with 6 feature cards
- Neo-brutalist design matching the rest of the app
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 20:36:26 +01:00
|
|
|
- [x] Page /tarifs : détailler les 3 offres (free/basic/custom) avec commissions et exemples
|
2026-03-22 20:33:47 +01:00
|
|
|
- [x] Ajouter la recherche d'événements sur la homepage
|
2026-03-22 20:32:51 +01:00
|
|
|
- [x] Ajouter le filtrage par date/ville sur /evenements
|
2026-03-22 20:29:40 +01:00
|
|
|
- [x] Responsive : pages publiques OK à 320px (flex-wrap, overflow-x-auto, breakpoints)
|
2026-03-22 20:24:18 +01:00
|
|
|
- [x] Ajouter les métadonnées OpenGraph sur toutes les pages publiques (og:title, og:description, og:type, og:url, og:image, twitter:card)
|
2026-03-22 19:51:34 +01:00
|
|
|
- [x] Ajouter le sitemap dynamique avec les événements en ligne
|
2026-03-22 20:24:18 +01:00
|
|
|
- [x] Fix breadcrumb JSON-LD URLs (absolute_url)
|
2026-03-22 19:44:44 +01:00
|
|
|
|
Complete TASK_CHECKUP: security, UX, tests, coverage, accessibility, config externalization
Billetterie:
- Partial refund support (STATUS_PARTIALLY_REFUNDED, refundedAmount field, migration)
- Race condition fix: PESSIMISTIC_WRITE lock on stock decrement in transaction
- Idempotency key on PaymentIntent::create, reuse existing PI if stripeSessionId set
- Disable checkout when event ended (server 400 + template hide)
- Webhook deduplication via cache (24h TTL on stripe event.id)
- Email validation (filter_var) in OrderController guest flow
- JSON cart validation (structure check before processing)
- Invitation expiration after 7 days (isExpired method + landing page message)
- Stripe Checkout fallback when JS fails to load (noscript + redirect)
Config externalization:
- Move Stripe fees (STRIPE_FEE_RATE, STRIPE_FEE_FIXED) and admin email (ADMIN_EMAIL) to .env/services.yaml
- Replace all hardcoded contact@e-cosplay.fr across 13 files
- MailerService: getAdminEmail()/getAdminFrom(), default $from=null resolves to admin
UX & Accessibility:
- ARIA tabs: role=tablist/tab/tabpanel, aria-selected, keyboard nav (arrows, Home, End)
- aria-label on cart +/- buttons and editor toolbar buttons
- tabindex=0 on editor toolbar buttons for keyboard access
- data-confirm handler in app.js (was only in admin.js)
- Cart error feedback on checkout failure
- Billet designer save feedback (loading/success/error states)
- Stock polling every 30s with rupture/low stock badges
- Back to event link on payment page
Security:
- HTML sanitizer: BLOCKED_TAGS list (script, style, iframe, svg, etc.) - content fully removed
- Stripe polling timeout (15s max) with fallback redirect
- Rate limiting on public order access (20/5min)
- .catch() on all fetch() calls (sortable, billet-designer)
Tests (92% PHP, 100% JS lines):
- PCOV added to dev Dockerfile
- Test DB setup: .env.test with DATABASE_URL, Redis auth, Meilisearch key
- Rate limiter disabled in test env
- Makefile: test_db_setup, test_db_reset, run_test_php, run_test_coverage_php/js
- New tests: InvitationFlowTest (21), AuditServiceTest (4), ExportServiceTest (9), InvoiceServiceTest (4)
- New tests: SuspendedUserSubscriberTest, RateLimiterSubscriberTest, MeilisearchServiceTest
- New tests: Stripe webhook payment_failed (6) + charge.refunded (6)
- New tests: BilletBuyer refund, User suspended, OrganizerInvitation expiration
- JS tests: stock polling (6), data-confirm (2), copy-url restore (1), editor ARIA (2), XSS (9), tabs keyboard (9)
- ESLint + PHP CS Fixer: 0 errors
- SonarQube exclusions aligned with vitest coverage config
Infra:
- Meilisearch consistency command (app:meilisearch:check-consistency --fix) + cron daily 3am
- MeilisearchService: getAllDocumentIds(), listIndexes()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:14:06 +01:00
|
|
|
### API Organisateur (portail orga + scanner mobile)
|
|
|
|
|
|
|
|
|
|
#### Authentification & clés API
|
|
|
|
|
- [ ] Ajouter un champ `apiKey` (string 64, unique, nullable) à l'entité User + migration
|
|
|
|
|
- [ ] Page /mon-compte/api : générer, afficher, régénérer, révoquer la clé API (bin2hex(random_bytes(32)))
|
|
|
|
|
- [ ] Créer un `ApiKeyAuthenticator` custom Symfony (header `X-API-Key`) pour les routes `/api/*`
|
|
|
|
|
- [ ] Rate limiting spécifique API (60 req/min par clé)
|
|
|
|
|
- [ ] Audit log à chaque génération/révocation de clé API
|
|
|
|
|
|
|
|
|
|
#### Événements
|
|
|
|
|
- [ ] GET `/api/events` : liste des événements de l'orga (id, title, startAt, endAt, address, city, isOnline, isSecret)
|
|
|
|
|
- [ ] GET `/api/events/{id}` : détail d'un événement avec catégories et billets (nom, prix, quantité, quantité vendue, type)
|
|
|
|
|
- [ ] GET `/api/events/{id}/stats` : stats de l'événement (CA, nb commandes, nb billets vendus, nb billets scannés)
|
|
|
|
|
|
|
|
|
|
#### Commandes
|
|
|
|
|
- [ ] GET `/api/events/{id}/orders` : liste des commandes (orderNumber, status, firstName, lastName, email, totalHT, paidAt, items[])
|
|
|
|
|
- [ ] GET `/api/events/{id}/orders?status=paid` : filtrage par statut (pending, paid, cancelled, refunded)
|
|
|
|
|
- [ ] GET `/api/orders/{orderNumber}` : détail d'une commande avec items et tickets générés
|
|
|
|
|
|
|
|
|
|
#### Scanner (application mobile)
|
|
|
|
|
- [ ] GET `/api/events/{id}/tickets` : liste des billets générés (reference, billetName, state, isInvitation, firstScannedAt, buyerName)
|
|
|
|
|
- [ ] POST `/api/scan` : scanner un billet (body: {reference}) → decode QR, vérifier reference, vérifier state, marquer scanné (firstScannedAt), gérer sortie définitive (hasDefinedExit), retourner infos billet + acheteur
|
|
|
|
|
- [ ] POST `/api/scan/verify` : vérifier un billet sans le scanner (lecture seule, retourne state + infos)
|
|
|
|
|
- [ ] GET `/api/events/{id}/scan-stats` : stats de scan temps réel (nb scannés, nb restants, nb invalides, dernier scan)
|
|
|
|
|
|
|
|
|
|
#### Billets & Stock
|
|
|
|
|
- [ ] GET `/api/events/{id}/billets` : liste des billets avec stock (nom, prix, quantity, quantitéVendue, type, isGeneratedBillet)
|
|
|
|
|
- [ ] PATCH `/api/billets/{id}/stock` : modifier le stock d'un billet (body: {quantity})
|
|
|
|
|
|
|
|
|
|
#### Export
|
|
|
|
|
- [ ] GET `/api/events/{id}/export/orders.csv` : export CSV des commandes de l'événement
|
|
|
|
|
- [ ] GET `/api/events/{id}/export/tickets.csv` : export CSV des billets/entrées scannées
|
|
|
|
|
|
|
|
|
|
#### Réponses & format
|
|
|
|
|
- [ ] Toutes les réponses en JSON avec structure uniforme : `{success: bool, data: {...}, error: ?string}`
|
|
|
|
|
- [ ] Pagination sur les listes (query params: page, limit, max 100)
|
|
|
|
|
- [ ] Codes HTTP standards (200, 201, 400, 401, 403, 404, 429)
|
|
|
|
|
- [ ] Vérifier que l'orga ne peut accéder qu'à ses propres événements/commandes
|
|
|
|
|
|
|
|
|
|
#### Documentation & SDK
|
|
|
|
|
- [ ] Générer un fichier `api-spec.json` (OpenAPI 3.1) décrivant tous les endpoints
|
|
|
|
|
- [ ] Page /mon-compte/api/documentation : afficher la doc interactive (swagger-ui ou redoc)
|
|
|
|
|
- [ ] Tests PHPUnit pour tous les endpoints API (auth, CRUD, scan, edge cases)
|
|
|
|
|
|
|
|
|
|
### Billetterie — Manquants
|
|
|
|
|
- [x] Race condition stock : verrouillage pessimiste (SELECT FOR UPDATE) pour éviter survente en cas de commandes simultanées
|
|
|
|
|
- [x] Remboursement partiel : supporter les refunds partiels Stripe (actuellement tout est marqué remboursé)
|
|
|
|
|
- [x] Désactiver le bouton "Commander" si l'événement est passé (vérifier endAt côté template + serveur)
|
|
|
|
|
- [x] Idempotency key sur PaymentIntent::create pour éviter les doubles charges
|
|
|
|
|
- [x] Déduplication des webhooks Stripe (stocker event.id pour ignorer les doublons)
|
|
|
|
|
- [x] Validation email (filter_var FILTER_VALIDATE_EMAIL) dans OrderController guest flow et RegistrationController
|
|
|
|
|
- [x] Validation JSON robuste dans OrderController::create (json_last_error, structure du panier)
|
|
|
|
|
- [x] Expiration des invitations organisateur (token expiré après 7 jours)
|
|
|
|
|
- [x] Audit log pour les opérations CRUD événement/catégorie/billet (actuellement seuls paiements/commandes sont loguées)
|
|
|
|
|
- [x] Externaliser les taux Stripe (0.015 + 0.25€) et email admin (contact@e-cosplay.fr) dans .env/services.yaml
|
|
|
|
|
|
|
|
|
|
### UX — Manquants
|
|
|
|
|
- [x] Confirmation (data-confirm) sur suppression catégorie, billet, sous-compte, invitation admin
|
|
|
|
|
- [x] Loading state + disable du bouton paiement après clic (éviter double soumission)
|
|
|
|
|
- [x] Préserver les paramètres de recherche (?q=) dans les liens de pagination KnpPaginator (déjà géré par défaut par KnpPaginator)
|
|
|
|
|
- [x] Feedback utilisateur sur erreur panier (cart.js : afficher un message si la création commande échoue)
|
|
|
|
|
- [x] Feedback utilisateur sur sauvegarde design billet (billet-designer.js : aucun retour succès/erreur)
|
|
|
|
|
- [x] Message "Rupture de stock" / "Bientot en rupture" en temps réel sur la page événement
|
|
|
|
|
- [x] Bouton "Retour à l'événement" sur la page /paiement
|
|
|
|
|
|
|
|
|
|
### Accessibilité
|
|
|
|
|
- [x] Ajouter les attributs ARIA sur les onglets (role=tablist, role=tab, aria-selected, keyboard nav)
|
|
|
|
|
- [x] Ajouter aria-label sur les boutons +/- du panier et les boutons toolbar éditeur
|
|
|
|
|
- [x] Rendre les boutons toolbar de l'éditeur accessibles au clavier (tabindex)
|
2026-03-22 19:47:43 +01:00
|
|
|
|
2026-03-22 19:44:44 +01:00
|
|
|
### Sécurité & Performance
|
2026-03-22 20:01:01 +01:00
|
|
|
- [x] Rate limiting sur les routes sensibles (login 5/15min, commande 10/5min, invitation 5/15min, contact 3/10min)
|
Add automatic CSRF protection on all POST forms
- CsrfProtectionSubscriber: auto-injects hidden _csrf_token in HTML responses,
auto-verifies on POST requests
- Excludes: webhooks, JSON APIs, login (has its own CSRF)
- 9 tests covering all cases (GET, excluded, JSON, no token, invalid, valid, inject, non-HTML)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 20:08:02 +01:00
|
|
|
- [x] CSRF token sur tous les formulaires POST (auto-inject + auto-verify)
|
2026-03-22 20:09:11 +01:00
|
|
|
- [x] Cache Meilisearch : invalider quand un événement est modifié (déjà fait via EventIndexService::indexEvent)
|
2026-03-22 20:13:31 +01:00
|
|
|
- [x] Optimiser les requêtes N+1 (stats tab, billets par catégorie)
|
Complete TASK_CHECKUP: security, UX, tests, coverage, accessibility, config externalization
Billetterie:
- Partial refund support (STATUS_PARTIALLY_REFUNDED, refundedAmount field, migration)
- Race condition fix: PESSIMISTIC_WRITE lock on stock decrement in transaction
- Idempotency key on PaymentIntent::create, reuse existing PI if stripeSessionId set
- Disable checkout when event ended (server 400 + template hide)
- Webhook deduplication via cache (24h TTL on stripe event.id)
- Email validation (filter_var) in OrderController guest flow
- JSON cart validation (structure check before processing)
- Invitation expiration after 7 days (isExpired method + landing page message)
- Stripe Checkout fallback when JS fails to load (noscript + redirect)
Config externalization:
- Move Stripe fees (STRIPE_FEE_RATE, STRIPE_FEE_FIXED) and admin email (ADMIN_EMAIL) to .env/services.yaml
- Replace all hardcoded contact@e-cosplay.fr across 13 files
- MailerService: getAdminEmail()/getAdminFrom(), default $from=null resolves to admin
UX & Accessibility:
- ARIA tabs: role=tablist/tab/tabpanel, aria-selected, keyboard nav (arrows, Home, End)
- aria-label on cart +/- buttons and editor toolbar buttons
- tabindex=0 on editor toolbar buttons for keyboard access
- data-confirm handler in app.js (was only in admin.js)
- Cart error feedback on checkout failure
- Billet designer save feedback (loading/success/error states)
- Stock polling every 30s with rupture/low stock badges
- Back to event link on payment page
Security:
- HTML sanitizer: BLOCKED_TAGS list (script, style, iframe, svg, etc.) - content fully removed
- Stripe polling timeout (15s max) with fallback redirect
- Rate limiting on public order access (20/5min)
- .catch() on all fetch() calls (sortable, billet-designer)
Tests (92% PHP, 100% JS lines):
- PCOV added to dev Dockerfile
- Test DB setup: .env.test with DATABASE_URL, Redis auth, Meilisearch key
- Rate limiter disabled in test env
- Makefile: test_db_setup, test_db_reset, run_test_php, run_test_coverage_php/js
- New tests: InvitationFlowTest (21), AuditServiceTest (4), ExportServiceTest (9), InvoiceServiceTest (4)
- New tests: SuspendedUserSubscriberTest, RateLimiterSubscriberTest, MeilisearchServiceTest
- New tests: Stripe webhook payment_failed (6) + charge.refunded (6)
- New tests: BilletBuyer refund, User suspended, OrganizerInvitation expiration
- JS tests: stock polling (6), data-confirm (2), copy-url restore (1), editor ARIA (2), XSS (9), tabs keyboard (9)
- ESLint + PHP CS Fixer: 0 errors
- SonarQube exclusions aligned with vitest coverage config
Infra:
- Meilisearch consistency command (app:meilisearch:check-consistency --fix) + cron daily 3am
- MeilisearchService: getAllDocumentIds(), listIndexes()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:14:06 +01:00
|
|
|
- [x] Sanitisation HTML de l'éditeur : filtrer aussi les attributs (editor.js sanitizeNode ne filtre que les tags)
|
|
|
|
|
- [x] Timeout sur le polling Stripe dans stripe-payment.js (actuellement boucle infinie possible)
|
|
|
|
|
- [x] Rate limiting sur l'accès commande publique (/commande/{orderNumber}/{token})
|
|
|
|
|
|
|
|
|
|
### JS / Assets
|
|
|
|
|
- [x] Ajouter .catch() sur tous les fetch() sans error handler (sortable.js, billet-designer.js)
|
|
|
|
|
- [x] Ajouter un timeout/max retries sur waitForStripe() dans stripe-payment.js
|
2026-03-22 19:44:44 +01:00
|
|
|
|
|
|
|
|
### Tests
|
Complete TASK_CHECKUP: security, UX, tests, coverage, accessibility, config externalization
Billetterie:
- Partial refund support (STATUS_PARTIALLY_REFUNDED, refundedAmount field, migration)
- Race condition fix: PESSIMISTIC_WRITE lock on stock decrement in transaction
- Idempotency key on PaymentIntent::create, reuse existing PI if stripeSessionId set
- Disable checkout when event ended (server 400 + template hide)
- Webhook deduplication via cache (24h TTL on stripe event.id)
- Email validation (filter_var) in OrderController guest flow
- JSON cart validation (structure check before processing)
- Invitation expiration after 7 days (isExpired method + landing page message)
- Stripe Checkout fallback when JS fails to load (noscript + redirect)
Config externalization:
- Move Stripe fees (STRIPE_FEE_RATE, STRIPE_FEE_FIXED) and admin email (ADMIN_EMAIL) to .env/services.yaml
- Replace all hardcoded contact@e-cosplay.fr across 13 files
- MailerService: getAdminEmail()/getAdminFrom(), default $from=null resolves to admin
UX & Accessibility:
- ARIA tabs: role=tablist/tab/tabpanel, aria-selected, keyboard nav (arrows, Home, End)
- aria-label on cart +/- buttons and editor toolbar buttons
- tabindex=0 on editor toolbar buttons for keyboard access
- data-confirm handler in app.js (was only in admin.js)
- Cart error feedback on checkout failure
- Billet designer save feedback (loading/success/error states)
- Stock polling every 30s with rupture/low stock badges
- Back to event link on payment page
Security:
- HTML sanitizer: BLOCKED_TAGS list (script, style, iframe, svg, etc.) - content fully removed
- Stripe polling timeout (15s max) with fallback redirect
- Rate limiting on public order access (20/5min)
- .catch() on all fetch() calls (sortable, billet-designer)
Tests (92% PHP, 100% JS lines):
- PCOV added to dev Dockerfile
- Test DB setup: .env.test with DATABASE_URL, Redis auth, Meilisearch key
- Rate limiter disabled in test env
- Makefile: test_db_setup, test_db_reset, run_test_php, run_test_coverage_php/js
- New tests: InvitationFlowTest (21), AuditServiceTest (4), ExportServiceTest (9), InvoiceServiceTest (4)
- New tests: SuspendedUserSubscriberTest, RateLimiterSubscriberTest, MeilisearchServiceTest
- New tests: Stripe webhook payment_failed (6) + charge.refunded (6)
- New tests: BilletBuyer refund, User suspended, OrganizerInvitation expiration
- JS tests: stock polling (6), data-confirm (2), copy-url restore (1), editor ARIA (2), XSS (9), tabs keyboard (9)
- ESLint + PHP CS Fixer: 0 errors
- SonarQube exclusions aligned with vitest coverage config
Infra:
- Meilisearch consistency command (app:meilisearch:check-consistency --fix) + cron daily 3am
- MeilisearchService: getAllDocumentIds(), listIndexes()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:14:06 +01:00
|
|
|
- [x] Couverture PHP : 92%+ (575 tests, 0 failures — services/entities/subscribers à 100%, controllers à 95%+)
|
|
|
|
|
- [x] Atteindre 100% de couverture JS (100% lines, 99.47% stmts, 93% branches)
|
|
|
|
|
- [x] Ajouter des tests pour le flow d'inscription via invitation
|
|
|
|
|
- [x] Ajouter des tests pour AuditService, ExportService, InvoiceService
|
|
|
|
|
- [x] Ajouter des tests pour les webhooks Stripe (payment_failed, charge.refunded)
|
2026-03-22 19:44:44 +01:00
|
|
|
|
|
|
|
|
### Infrastructure
|
2026-03-22 19:55:35 +01:00
|
|
|
- [x] Configurer les crons pour les backups automatiques (DB + uploads, toutes les 30 min, rétention 1 jour)
|
|
|
|
|
- [x] Ajouter le monitoring des queues Messenger (commande + cron toutes les heures + email admin)
|
Complete TASK_CHECKUP: security, UX, tests, coverage, accessibility, config externalization
Billetterie:
- Partial refund support (STATUS_PARTIALLY_REFUNDED, refundedAmount field, migration)
- Race condition fix: PESSIMISTIC_WRITE lock on stock decrement in transaction
- Idempotency key on PaymentIntent::create, reuse existing PI if stripeSessionId set
- Disable checkout when event ended (server 400 + template hide)
- Webhook deduplication via cache (24h TTL on stripe event.id)
- Email validation (filter_var) in OrderController guest flow
- JSON cart validation (structure check before processing)
- Invitation expiration after 7 days (isExpired method + landing page message)
- Stripe Checkout fallback when JS fails to load (noscript + redirect)
Config externalization:
- Move Stripe fees (STRIPE_FEE_RATE, STRIPE_FEE_FIXED) and admin email (ADMIN_EMAIL) to .env/services.yaml
- Replace all hardcoded contact@e-cosplay.fr across 13 files
- MailerService: getAdminEmail()/getAdminFrom(), default $from=null resolves to admin
UX & Accessibility:
- ARIA tabs: role=tablist/tab/tabpanel, aria-selected, keyboard nav (arrows, Home, End)
- aria-label on cart +/- buttons and editor toolbar buttons
- tabindex=0 on editor toolbar buttons for keyboard access
- data-confirm handler in app.js (was only in admin.js)
- Cart error feedback on checkout failure
- Billet designer save feedback (loading/success/error states)
- Stock polling every 30s with rupture/low stock badges
- Back to event link on payment page
Security:
- HTML sanitizer: BLOCKED_TAGS list (script, style, iframe, svg, etc.) - content fully removed
- Stripe polling timeout (15s max) with fallback redirect
- Rate limiting on public order access (20/5min)
- .catch() on all fetch() calls (sortable, billet-designer)
Tests (92% PHP, 100% JS lines):
- PCOV added to dev Dockerfile
- Test DB setup: .env.test with DATABASE_URL, Redis auth, Meilisearch key
- Rate limiter disabled in test env
- Makefile: test_db_setup, test_db_reset, run_test_php, run_test_coverage_php/js
- New tests: InvitationFlowTest (21), AuditServiceTest (4), ExportServiceTest (9), InvoiceServiceTest (4)
- New tests: SuspendedUserSubscriberTest, RateLimiterSubscriberTest, MeilisearchServiceTest
- New tests: Stripe webhook payment_failed (6) + charge.refunded (6)
- New tests: BilletBuyer refund, User suspended, OrganizerInvitation expiration
- JS tests: stock polling (6), data-confirm (2), copy-url restore (1), editor ARIA (2), XSS (9), tabs keyboard (9)
- ESLint + PHP CS Fixer: 0 errors
- SonarQube exclusions aligned with vitest coverage config
Infra:
- Meilisearch consistency command (app:meilisearch:check-consistency --fix) + cron daily 3am
- MeilisearchService: getAllDocumentIds(), listIndexes()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:14:06 +01:00
|
|
|
- [x] Tâche planifiée de vérification de cohérence de l'index Meilisearch
|