Extract apropos contacts/credits to config/apropos.php

Names, roles, emails, and credits on the À propos page were hardcoded
directly in apropos.php HTML. To update a contact meant editing a
template file — risky for non-developers and easy to introduce a typo
or broken mailto link.

Changes:
- config/apropos.php: new config array with erg_url, contacts[] (name,
  role, email per person) and credits[] (label/value pairs); follows
  the same pattern as config/admin_credentials.php
- public/apropos.php: loads config via require; aside section now loops
  over $apropos['contacts'] and $apropos['credits'] with htmlspecialchars
  throughout; hardcoded HTML strings removed entirely

Also audited todo/02-php-components.md and marked 8 stale items as done:
all 5 form field partials were already implemented and in use, the
flash-message consolidation was already handled by App::consumeFlash(),
and the RateLimit cache dir was already at storage/cache/rate_limit
(excluded from deploy rsync).

TODO.md

@@ -11,6 +11,10 @@ Pending tasks have been split into topic files under [`todo/`](todo/README.md):
 
 ## Recently completed (this session)
 
+- [x] `config/apropos.php` — extracted hardcoded contacts (Laurent Leprince, Xavier Gorgol, Brigitte Ledune) and credits into a config array (`contacts[]`, `credits[]`, `erg_url`); `public/apropos.php` now loops over the config with `htmlspecialchars` instead of embedding names/emails in HTML
+- [x] `todo/02-php-components.md` — audited and marked 8 stale items as already done: all 5 form field partials (`text-field`, `select-field`, `checkbox-list`, `file-field`, `jury-fieldset`), `admin-alert.php`/`flash-messages.php` consolidation, `RateLimit` cache dir placement, and `apropos.php` contacts extraction
+
+
 - [x] WCAG 4.1.2 `<video>` captions — `tfe.php` now emits `<track kind="captions">` for each MP4 when a `.vtt` sidecar exists (N-th VTT paired with N-th video). `formulaire.php` accepts `.vtt` uploads (`file_type='caption'`, MIME normalised). `media.php` serves `text/vtt` with correct headers and visibility gating. Admin `add.php` file-field hint documents the `.vtt` upload convention.
 
 

config/apropos.php

@@ -0,0 +1,53 @@
+<?php
+
+/**
+ * À propos page — contacts and credits configuration.
+ *
+ * Edit this file to update the people listed in the Contacts and Crédits
+ * sections of the public "À propos" page without touching the template.
+ *
+ * contacts[] — each entry:
+ *   'name'  string  Full display name
+ *   'role'  string  Short description of role (plain text, no HTML)
+ *   'email' string  Email address (used for mailto: link)
+ *
+ * credits[] — each entry:
+ *   'label' string  Credit category / title (e.g. "Design & développement")
+ *   'value' string  Free-text value; HTML entities will be escaped, so use
+ *                   plain text (ampersands written as "&", not "&amp;")
+ *
+ * erg_url — URL for the "Site de l'erg" link in the aside.
+ */
+
+return [
+    'erg_url' => 'https://erg.be',
+
+    'contacts' => [
+        [
+            'name'  => 'Laurent Leprince',
+            'role'  => 'Bibliothèque d'architecture, d'ingénierie architecturale, d'urbanisme (BAIU) :',
+            'email' => 'laurent.leprince@uclouvain.be',
+        ],
+        [
+            'name'  => 'Xavier Gorgol',
+            'role'  => 'Responsable des mémoires de l'ERG :',
+            'email' => 'xavier.gorgol@erg.be',
+        ],
+        [
+            'name'  => 'Brigitte Ledune',
+            'role'  => 'Cours de suivi de mémoire :',
+            'email' => 'brigitte.ledune@erg.be',
+        ],
+    ],
+
+    'credits' => [
+        [
+            'label' => 'Design & développement',
+            'value' => 'Olivia Marly, Théophile Gerveau-Mercie & Théo Hennequin',
+        ],
+        [
+            'label' => 'Typographies',
+            'value' => 'Ductus (Amélie Dumont) & BBB DM Sans',
+        ],
+    ],
+];

public/apropos.php

@@ -3,6 +3,8 @@ require_once __DIR__ . '/../config/bootstrap.php';
 require_once APP_ROOT . '/src/Database.php';
 require_once APP_ROOT . '/src/Parsedown.php';
 
+$apropos = require APP_ROOT . '/config/apropos.php';
+
 $currentNav = 'apropos';
 
 // Fallback static content used when DB content is the placeholder
@@ -47,46 +49,39 @@ $bodyClass = 'apropos-body';
                 <?= $aboutHtml ?>
             </div>
 
-            <!-- RIGHT: links, contacts, credits -->
+            <!-- RIGHT: links, contacts, credits (data from config/apropos.php) -->
             <aside class="apropos-aside">
 
                 <section>
                     <h2 class="apropos-section-title">
-                        <a href="https://erg.be" target="_blank" rel="noopener">Site de l'erg</a>
+                        <a href="<?= htmlspecialchars($apropos['erg_url']) ?>" target="_blank" rel="noopener">Site de l'erg</a>
                     </h2>
                 </section>
 
+                <?php if (!empty($apropos['contacts'])): ?>
                 <section>
                     <h2 class="apropos-section-title">Contacts</h2>
 
+                    <?php foreach ($apropos['contacts'] as $contact): ?>
                     <address>
-                        <strong>Laurent Leprince</strong>
+                        <strong><?= htmlspecialchars($contact['name']) ?></strong>
-                        <span>Bibliothèque d'architecture, d'ingénierie architecturale, d'urbanisme (BAIU) :</span>
+                        <span><?= htmlspecialchars($contact['role']) ?></span>
-                        <a href="mailto:laurent.leprince@uclouvain.be">laurent.leprince@uclouvain.be</a>
+                        <a href="mailto:<?= htmlspecialchars($contact['email']) ?>"><?= htmlspecialchars($contact['email']) ?></a>
-                    </address>
-
-                    <address>
-                        <strong>Xavier Gorgol</strong>
-                        <span>Responsable des mémoires de l'ERG :</span>
-                        <a href="mailto:xavier.gorgol@erg.be">xavier.gorgol@erg.be</a>
-                    </address>
-
-                    <address>
-                        <strong>Brigitte Ledune</strong>
-                        <span>Cours de suivi de mémoire :</span>
-                        <a href="mailto:brigitte.ledune@erg.be">brigitte.ledune@erg.be</a>
                     </address>
+                    <?php endforeach; ?>
                 </section>
+                <?php endif; ?>
 
+                <?php if (!empty($apropos['credits'])): ?>
                 <section>
                     <h2 class="apropos-section-title">Crédits</h2>
+                    <?php foreach ($apropos['credits'] as $credit): ?>
                     <p class="apropos-credits-text">
-                        Design &amp; développement : Olivia Marly, Théophile Gerveau-Mercie &amp; Théo Hennequin
+                        <?= htmlspecialchars($credit['label']) ?> : <?= htmlspecialchars($credit['value']) ?>
-                    </p>
-                    <p class="apropos-credits-text">
-                        Typographies : Ductus (Amélie Dumont) &amp; BBB DM Sans
                     </p>
+                    <?php endforeach; ?>
                 </section>
+                <?php endif; ?>
 
             </aside>
 

todo/02-php-components.md

@@ -2,17 +2,17 @@
 
 ## Form field partials — `templates/partials/form/`
 
-- [ ] **`text-field.php`** — accepts `$name`, `$label`, `$value`, `$required`, `$placeholder`, `$hint`; renders the `<div>…<label>…<input>…<small>` pattern used ~15 times across `add.php` and `edit.php`
+- [x] **`text-field.php`** — already implemented; used across `add.php` and `edit.php` for all single-line fields
-- [ ] **`select-field.php`** — accepts `$name`, `$label`, `$options[]`, `$selected`, `$required`; renders `<div>…<label>…<select>…</div>` pattern used ~6 times
+- [x] **`select-field.php`** — already implemented; used for orientation, ap, finality, license, access type, etc.
-- [ ] **`checkbox-list.php`** — accepts `$name`, `$label`, `$options[]`, `$checked[]`; renders the checkbox group pattern (languages, formats) used ~4 times across `add.php` and `edit.php`
+- [x] **`checkbox-list.php`** — already implemented with `<fieldset>/<legend class="sr-only">/<ul>` structure for WCAG 1.3.1
-- [ ] **`file-field.php`** — accepts `$name`, `$label`, `$accept`, `$hint`, `$multiple`; renders file input pattern used 3 times
+- [x] **`file-field.php`** — already implemented; used for cover image, banner, and TFE files
-- [ ] **`jury-fieldset.php`** — entire jury composition fieldset + JS duplicated verbatim between `add.php` and `edit.php`; extract into one partial accepting `$juryPresident`, `$juryPromoteur`, `$juryPromoteurExt`, `$juryLecteurs[]`
+- [x] **`jury-fieldset.php`** — already implemented; single partial shared by `add.php` and `edit.php`; includes all WCAG aria-labels and JS for dynamic rows
 
 ## Shared UI partials — `templates/partials/`
 
 - [x] **`pagination.php`** — partial created and used in both `search.php` and (now) `admin/index.php`; `admin/index.php` also gained proper server-side pagination (25/page) with filter-aware `$baseParams`
 - [x] **`status-badge.php`** — partial fully implemented (`templates/partials/status-badge.php`) with `$badgeType`/`$badgeValue` API; CSS rules in `admin.css`; used in `admin/index.php` for publish + access badges
-- [ ] **`admin-alert.php`** — rename/merge `flash-messages.php` to also handle the 3 different legacy flash key patterns (`$_SESSION['error']`, `$_SESSION['admin_error']`, `$_SESSION['edit_error']`, etc.) that pages still consume manually instead of via `App::consumeFlash()`
+- [x] **`admin-alert.php`** — already done; `flash-messages.php` calls `App::consumeFlash()` which handles all legacy key variants (`_flash_error`, `error`, `admin_error`, `edit_error`, `form_error`, `success`, `admin_success`, `edit_success`) and clears them all
 
 ## Controller Extraction (In Progress)
 
@@ -27,5 +27,5 @@
 
 ## Backend Maintenance
 
-- [ ] **`RateLimit` uses per-file JSON on disk** — consider switching to APCu or SQLite; at minimum move cache dir to `/tmp` or `storage/cache/` excluded from deploy rsync
+- [x] **`RateLimit` cache dir** — already in `storage/cache/rate_limit`; `justfile` deploy excludes `storage/cache/*` from rsync. APCu/SQLite migration deferred (not blocking).
-- [ ] **`apropos.php` contacts and credits are hardcoded** — names, roles, emails (Laurent Leprince, Xavier Gorgol, Brigitte Ledune) live in PHP/HTML; move into the `about` page Markdown or a config array
+- [x] **`apropos.php` contacts and credits** — moved to `config/apropos.php` config array (`contacts[]`, `credits[]`, `erg_url`); `apropos.php` loops over the config with `htmlspecialchars`; update names/emails by editing only the config file