Fix ESLint globals, parseFloat to Number.parseFloat, label for, add AccountController coverage tests

- Add setTimeout, globalThis, navigator, fetch, caches etc to ESLint globals
- Use Number.parseFloat in event-map.js
- Add for attribute to admin events search label
- Add tests: events search, toggle/delete access denied for other user

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

assets/modules/event-map.js

@@ -30,8 +30,8 @@ function geocodeAndRender(address, mapEl) {
                 return
             }
 
-            const lat = parseFloat(data[0].lat)
+            const lat = Number.parseFloat(data[0].lat)
-            const lon = parseFloat(data[0].lon)
+            const lon = Number.parseFloat(data[0].lon)
 
             const map = L.map(mapEl).setView([lat, lon], 16)
 

eslint.config.js

@@ -6,6 +6,15 @@ export default [
                 document: "readonly",
                 window: "readonly",
                 console: "readonly",
+                setTimeout: "readonly",
+                globalThis: "readonly",
+                navigator: "readonly",
+                fetch: "readonly",
+                caches: "readonly",
+                Request: "readonly",
+                Response: "readonly",
+                BroadcastChannel: "readonly",
+                DOMParser: "readonly",
             },
         },
         rules: {

templates/admin/events.html.twig

@@ -8,8 +8,8 @@
     <div class="admin-card mb-8">
         <form method="get" action="{{ path('app_admin_events') }}" class="flex flex-wrap gap-3 items-end">
             <div class="flex-1 min-w-[200px]">
-                <label class="admin-form-label font-black uppercase text-gray-400 mb-1 block">Rechercher</label>
+                <label for="admin_event_search" class="admin-form-label font-black uppercase text-gray-400 mb-1 block">Rechercher</label>
-                <input type="text" name="q" value="{{ searchQuery }}" class="admin-form-input" placeholder="Titre, ville, organisateur...">
+                <input type="text" id="admin_event_search" name="q" value="{{ searchQuery }}" class="admin-form-input" placeholder="Titre, ville, organisateur...">
             </div>
             <div class="flex gap-2">
                 <button type="submit" class="admin-btn-search font-black uppercase text-xs tracking-widest">Rechercher</button>

tests/Controller/AccountControllerTest.php

@@ -690,6 +690,86 @@ class AccountControllerTest extends WebTestCase
         self::assertResponseRedirects('/mon-compte/evenement/'.$event->getId().'/modifier');
     }
 
+    public function testEventsSearchReturnsSuccess(): void
+    {
+        $client = static::createClient();
+        $user = $this->createUser(['ROLE_ORGANIZER'], true);
+
+        $client->loginUser($user);
+        $client->request('GET', '/mon-compte?tab=events&q=brocante');
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testToggleOnlineDeniedForOtherUser(): void
+    {
+        $client = static::createClient();
+        $em = static::getContainer()->get(EntityManagerInterface::class);
+        $owner = $this->createUser(['ROLE_ORGANIZER'], true);
+        $other = $this->createUser(['ROLE_ORGANIZER'], true);
+
+        $event = new \App\Entity\Event();
+        $event->setAccount($owner);
+        $event->setTitle('Toggle Denied');
+        $event->setStartAt(new \DateTimeImmutable('2026-08-01 10:00'));
+        $event->setEndAt(new \DateTimeImmutable('2026-08-01 18:00'));
+        $event->setAddress('1 rue');
+        $event->setZipcode('75001');
+        $event->setCity('Paris');
+        $em->persist($event);
+        $em->flush();
+
+        $client->loginUser($other);
+        $client->request('POST', '/mon-compte/evenement/'.$event->getId().'/en-ligne');
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testToggleSecretDeniedForOtherUser(): void
+    {
+        $client = static::createClient();
+        $em = static::getContainer()->get(EntityManagerInterface::class);
+        $owner = $this->createUser(['ROLE_ORGANIZER'], true);
+        $other = $this->createUser(['ROLE_ORGANIZER'], true);
+
+        $event = new \App\Entity\Event();
+        $event->setAccount($owner);
+        $event->setTitle('Secret Denied');
+        $event->setStartAt(new \DateTimeImmutable('2026-08-01 10:00'));
+        $event->setEndAt(new \DateTimeImmutable('2026-08-01 18:00'));
+        $event->setAddress('1 rue');
+        $event->setZipcode('75001');
+        $event->setCity('Paris');
+        $em->persist($event);
+        $em->flush();
+
+        $client->loginUser($other);
+        $client->request('POST', '/mon-compte/evenement/'.$event->getId().'/secret');
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testDeleteEventDeniedForOtherUser(): void
+    {
+        $client = static::createClient();
+        $em = static::getContainer()->get(EntityManagerInterface::class);
+        $owner = $this->createUser(['ROLE_ORGANIZER'], true);
+        $other = $this->createUser(['ROLE_ORGANIZER'], true);
+
+        $event = new \App\Entity\Event();
+        $event->setAccount($owner);
+        $event->setTitle('Delete Denied');
+        $event->setStartAt(new \DateTimeImmutable('2026-08-01 10:00'));
+        $event->setEndAt(new \DateTimeImmutable('2026-08-01 18:00'));
+        $event->setAddress('1 rue');
+        $event->setZipcode('75001');
+        $event->setCity('Paris');
+        $em->persist($event);
+        $em->flush();
+
+        $client->loginUser($other);
+        $client->request('POST', '/mon-compte/evenement/'.$event->getId().'/supprimer');
+        self::assertResponseStatusCodeSame(403);
+    }
+
     /**
      * @param list<string> $roles
      */