From b5189c0d089f2ddcfcf74cb6b2c9d4b7598e52fe Mon Sep 17 00:00:00 2001
From: Pontoporeia <pontoporeia@happyngreen.fr>
Date: Wed, 29 Apr 2026 21:18:25 +0200
Subject: [PATCH] admin: merge acces-etudiante+file-access into acces.php,
 absorb system.php into parametres.php

---
 TODO.md                                      |  86 +---
 app/public/admin/acces-etudiante.php         |  21 +-
 app/public/admin/acces.php                   |  31 ++
 app/public/admin/actions/acces-etudiante.php |  18 +-
 app/public/admin/actions/access-request.php  |   2 +-
 app/public/admin/file-access.php             |  22 +-
 app/public/admin/parametres.php              |  66 ++++
 app/public/admin/system.php                  |  81 +---
 app/templates/admin/acces.php                | 394 +++++++++++++++++++
 app/templates/admin/parametres.php           | 164 ++++++++
 app/templates/header.php                     |   8 +-
 11 files changed, 684 insertions(+), 209 deletions(-)
 create mode 100644 app/public/admin/acces.php
 create mode 100644 app/templates/admin/acces.php

diff --git a/TODO.md b/TODO.md
index e3f0ccb..3855d9c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,82 +1,10 @@
 # TODO
 
-## TFE Public Page — File Display
+## Admin area cleanup
 
-- [x] Replace `<embed>` with `<iframe>` for PDF display (better cross-browser support)
-- [x] Exclude `cover` file_type from public files loop (covers are banners, not content)
-- [x] Move `App::boot()` in Dispatcher to after direct-response matching (no session on media requests)
-
-## SMTP Relay — bad greeting fix
-
-- [x] Fix `$read()` loop: use `!== false` so empty lines don't terminate early; check `timed_out` meta
-- [x] Add SSL stream context (`verify_peer=false`) to `stream_socket_client` to avoid CA bundle failures
-- [x] Improve "bad greeting" error: distinguish timeout vs garbage response in log message
-
-## Bug Fixes
-
-- [x] Fix `RateLimit::check()` called statically in `request-access.php` — replaced with `(new RateLimit(3, 600))->checkKey($rateLimitKey)`
-
-## Dev / Debug Fixes
-
-- [x] Fix `serve` recipe: show all PHP output (errors, logs) except static assets/connection noise
-- [x] Fix `STORAGE_ROOT` — use local `app/storage/` in dev (cli-server), `/var/www/posterg/storage` in prod
-- [x] Create `app/storage/covers/` and `app/storage/theses/` with `.gitkeep`
-- [x] Add gitignore rules for uploaded files in dev storage dirs
-- [x] Fix `error_log` path in `formulaire.php` (was relative, now absolute)
-- [x] Fix CSRF debug: log both tokens on mismatch
-- [x] Fix undefined `$redirect` on success path in `formulaire.php`
-
-## Deploy — Preserve Remote Data
-
-- [x] Exclude `storage/posterg.db` from rsync (not sent locally, not deleted remotely)
-- [x] Exclude `storage/theses/` from rsync (not sent locally, not deleted remotely)
-- [x] Exclude `storage/covers/` from rsync (not sent locally, not deleted remotely)
-
-## Deploy — Rename deploy path to /var/www/xamxam
-
-- [x] Update rsync destination in `justfile` (`deploy`, `deploy-db` recipes)
-- [x] Update all `/var/www/posterg` paths in `scripts/deploy-server.sh`
-- [x] Update `root` directive in `nginx/posterg.conf`
-- [x] Update `STORAGE_ROOT` production path in `app/bootstrap.php`
-
-## Form Help Blocks (student-facing explanatory text)
-
-- [x] Migration `004_add_form_help_blocks.sql` — `form_help_blocks` table with 8 seeded keys
-- [x] `Database` methods: `getFormHelpBlock`, `setFormHelpBlock`, `getAllFormHelpBlocks`, `FORM_HELP_KEYS`, `FORM_HELP_LABELS`
-- [x] `actions/form-help.php` — CSRF-validated save handler
-- [x] `actions/page.php` — CSRF-validated save handler for static pages (was missing)
-- [x] `contenus.php` controller — load `$formHelpBlocks`, add CSRF token
-- [x] `contenus-edit.php` controller — handle `?form_block=<key>` route
-- [x] `templates/admin/contenus.php` — flash messages + form help blocks table with edit links
-- [x] `templates/admin/contenus-edit.php` — `form_help` edit branch with OverType Markdown editor
-- [x] `templates/partials/form/form-help-block.php` — renders Markdown block via Parsedown (safe mode), silent on empty
-- [x] `partage/index.php` — load all blocks once, inject at all 8 positions (replaced TODO comments)
-- [x] `form.css` — `.form-help-block` styled with accent left-border
-- [x] `admin.css` — `.muted` utility class
-
-## Centralise Form Templates
-
-- [x] Extract shared fieldset partials: `fieldset-tfe-info.php`, `fieldset-academic.php`, `fieldset-files.php`, `fieldset-metadata.php`, `fieldset-licence-explanation.php`
-- [x] Refactor `templates/admin/add.php` to use shared partials
-- [x] Refactor `templates/admin/edit.php` to use shared partials (with edit-mode callable adapters)
-- [x] Refactor `partage/index.php` `renderShareLinkForm()` to use shared partials
-- [x] Add TODO comments in `partage/index.php` for student-facing explanations (intro block, per-fieldset notes, email note)
-
-## File Display in Forms & Recaps
-
-- [x] Add live file preview to `file-field.php` partial (`data-preview` attribute + `.file-preview-list` container)
-- [x] Write `file-preview.js` — renders thumbnails for images, emoji icons for PDFs/videos/zips, filename + size
-- [x] Load `file-preview.js` in `admin/add.php` via `$extraJs`
-- [x] Load `file-preview.js` in `admin/edit.php` via `$extraJs`
-- [x] Load `file-preview.js` in `partage/index.php` (self-contained HTML, direct `<script>` tag)
-- [x] Support `$extraJs` in `head.php`
-- [x] Add `data-preview` + preview container to edit template's cover/banner/files inputs (not using partial)
-- [x] Enhance `admin/recapitulatif.php` template — image thumbnails, clickable filenames, type badges, file size, date
-- [x] Rewrite `partage/recapitulatif.php` — full recap with thesis metadata + uploaded files list (thumbnails for images, icons for others)
-- [x] Add CSS: `.file-preview-list`, `.fp-item`, `.fp-thumb`, `.fp-icon`, `.fp-meta`, `.fp-name`, `.fp-size`
-- [x] Add CSS: `.recap-file-list`, `.recap-file-item`, `.recap-file-thumb`, `.recap-file-icon`, `.recap-file-meta`, `.recap-file-type-badge`, `.recap-file-date`
-- [x] Add CSS: `.partage-recap`, `.recap-section`, `.recap-dl` for partage recap layout
-
-## Bug Fixes (2026-04-29)
-
-- [x] Fix parse error in `Database.php` line 2005 — escaped apostrophe in `d'introduction`
+- [x] Combine `acces-etudiante.php` + `file-access.php` into `acces.php` (two `<section>` blocks)
+- [x] Move `system.php` content into `parametres.php` (system section + logs section)
+- [x] Use `<section>` for sections, `<fieldset>` only where form fields are present
+- [x] Redirect legacy URLs (acces-etudiante.php, file-access.php, system.php) with 301
+- [x] Update action redirects to point to new pages
+- [x] Update admin nav header (merged 3 items → 2)
diff --git a/app/public/admin/acces-etudiante.php b/app/public/admin/acces-etudiante.php
index 69c3558..d44d97d 100644
--- a/app/public/admin/acces-etudiante.php
+++ b/app/public/admin/acces-etudiante.php
@@ -1,19 +1,4 @@
 <?php
-require_once __DIR__ . '/../../bootstrap.php';
-require_once __DIR__ . '/../../src/AdminAuth.php';
-require_once __DIR__ . '/../../src/ShareLink.php';
-
-App::adminGuard();
-
-$shareLink = ShareLink::make();
-$links = $shareLink->listAll();
-
-$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
-$baseUrl  = $protocol . '://' . ($_SERVER['HTTP_HOST'] ?? 'localhost');
-$pageTitle = 'Accès étudiant·e';
-$isAdmin   = true;
-$bodyClass = 'admin-body';
-require_once APP_ROOT . '/templates/head.php';
-include APP_ROOT . '/templates/header.php';
-include APP_ROOT . '/templates/admin/acces-etudiante.php';
-require_once APP_ROOT . '/templates/admin/footer.php';
+// Redirects legacy /admin/acces-etudiante.php → /admin/acces.php
+header('Location: /admin/acces.php', true, 301);
+exit;
diff --git a/app/public/admin/acces.php b/app/public/admin/acces.php
new file mode 100644
index 0000000..ecb32fd
--- /dev/null
+++ b/app/public/admin/acces.php
@@ -0,0 +1,31 @@
+<?php
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+require_once __DIR__ . '/../../src/ShareLink.php';
+
+App::adminGuard();
+
+// ── Liens d'accès étudiant·e ──────────────────────────────────────────────────
+$shareLink = ShareLink::make();
+$links     = $shareLink->listAll();
+
+$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
+$baseUrl  = $protocol . '://' . ($_SERVER['HTTP_HOST'] ?? 'localhost');
+
+// ── Demandes d'accès aux fichiers ─────────────────────────────────────────────
+require_once APP_ROOT . '/src/Controllers/FileAccessController.php';
+
+$controller = FileAccessController::create();
+$vars = $controller->handle();
+extract($vars);
+
+// ── Page setup ────────────────────────────────────────────────────────────────
+$pageTitle = 'Accès';
+$isAdmin   = true;
+$bodyClass = 'admin-body';
+
+require_once APP_ROOT . '/templates/head.php';
+echo '<link rel="stylesheet" href="/assets/css/file-access.css">';
+include APP_ROOT . '/templates/header.php';
+include APP_ROOT . '/templates/admin/acces.php';
+require_once APP_ROOT . '/templates/admin/footer.php';
diff --git a/app/public/admin/actions/acces-etudiante.php b/app/public/admin/actions/acces-etudiante.php
index 1938a01..69fc747 100644
--- a/app/public/admin/actions/acces-etudiante.php
+++ b/app/public/admin/actions/acces-etudiante.php
@@ -27,21 +27,21 @@ switch ($action) {
         if ($expiresRaw) {
             $expiresAt = date('Y-m-d H:i:s', strtotime($expiresRaw));
             if ($expiresAt <= date('Y-m-d H:i:s')) {
-                App::redirect('/admin/acces-etudiante.php', error: "La date d'expiration doit être dans le futur.");
+                App::redirect('/admin/acces.php', error: "La date d'expiration doit être dans le futur.");
             }
         }
         $objetRaw = $_POST['objet_restriction'] ?? '';
         $objetRestriction = in_array($objetRaw, ['tfe', 'thèse', 'frart'], true) ? $objetRaw : null;
         $shareLink->create(1, $password, $expiresAt, $objetRestriction);
-        App::redirect('/admin/acces-etudiante.php', success: 'Lien d\'accès créé.');
+        App::redirect('/admin/acces.php', success: 'Lien d\'accès créé.');
         break;
 
     case 'toggle':
         if ($id > 0) {
             $shareLink->toggleActive($id);
-            App::redirect('/admin/acces-etudiante.php', success: 'Statut du lien modifié.');
+            App::redirect('/admin/acces.php', success: 'Statut du lien modifié.');
         } else {
-            App::redirect('/admin/acces-etudiante.php', error: 'Lien introuvable.');
+            App::redirect('/admin/acces.php', error: 'Lien introuvable.');
         }
         break;
 
@@ -49,22 +49,22 @@ switch ($action) {
         if ($id > 0) {
             $password = isset($_POST['password']) && $_POST['password'] !== '' ? trim($_POST['password']) : null;
             $shareLink->setPassword($id, $password);
-            App::redirect('/admin/acces-etudiante.php', success: 'Mot de passe mis à jour.');
+            App::redirect('/admin/acces.php', success: 'Mot de passe mis à jour.');
         } else {
-            App::redirect('/admin/acces-etudiante.php', error: 'Lien introuvable.');
+            App::redirect('/admin/acces.php', error: 'Lien introuvable.');
         }
         break;
 
     case 'delete':
         if ($id > 0) {
             $shareLink->delete($id);
-            App::redirect('/admin/acces-etudiante.php', success: 'Lien supprimé.');
+            App::redirect('/admin/acces.php', success: 'Lien supprimé.');
         } else {
-            App::redirect('/admin/acces-etudiante.php', error: 'Lien introuvable.');
+            App::redirect('/admin/acces.php', error: 'Lien introuvable.');
         }
         break;
 
     default:
-        App::redirect('/admin/acces-etudiante.php', error: 'Action inconnue.');
+        App::redirect('/admin/acces.php', error: 'Action inconnue.');
         break;
 }
diff --git a/app/public/admin/actions/access-request.php b/app/public/admin/actions/access-request.php
index 806569a..c9f48f9 100644
--- a/app/public/admin/actions/access-request.php
+++ b/app/public/admin/actions/access-request.php
@@ -64,7 +64,7 @@ try {
         App::flash('success', "Demande rejetée.");
     }
 
-    header('Location: /admin/file-access.php');
+    header('Location: /admin/acces.php');
     exit;
 
 } catch (Exception $e) {
diff --git a/app/public/admin/file-access.php b/app/public/admin/file-access.php
index 951834e..6918448 100644
--- a/app/public/admin/file-access.php
+++ b/app/public/admin/file-access.php
@@ -1,20 +1,4 @@
 <?php
-require_once __DIR__ . '/../../bootstrap.php';
-require_once __DIR__ . '/../../src/AdminAuth.php';
-AdminAuth::requireLogin();
-
-require_once APP_ROOT . '/src/Controllers/FileAccessController.php';
-
-$controller = FileAccessController::create();
-$vars = $controller->handle();
-extract($vars);
-
-$pageTitle = 'Demandes d\'accès aux fichiers';
-$isAdmin   = true;
-$bodyClass = 'admin-body';
-
-require_once APP_ROOT . '/templates/head.php';
-include APP_ROOT . '/templates/header.php';
-echo '<link rel="stylesheet" href="/assets/css/file-access.css">';
-include APP_ROOT . '/templates/admin/file-access.php';
-require_once APP_ROOT . '/templates/admin/footer.php';
+// Redirects legacy /admin/file-access.php → /admin/acces.php
+header('Location: /admin/acces.php', true, 301);
+exit;
diff --git a/app/public/admin/parametres.php b/app/public/admin/parametres.php
index ae938c7..ff9e3dd 100644
--- a/app/public/admin/parametres.php
+++ b/app/public/admin/parametres.php
@@ -16,11 +16,77 @@ $stats         = $db->getThesesStats();
 $smtpSettings  = SmtpRelay::getSettings($db);
 $smtpConfigured = SmtpRelay::isConfigured($db);
 
+// ── System section ────────────────────────────────────────────────────────────
+require_once APP_ROOT . '/src/SystemCache.php';
+require_once APP_ROOT . '/src/Controllers/SystemController.php';
+
+$_db2        = new Database();
+$_cache      = new SystemCache($_db2->getPDO());
+$_controller = new SystemController($_db2, $_cache);
+
+if (isset($_GET['refresh']) && $_GET['refresh'] === '1') {
+    $_controller->invalidateAll();
+}
+
+$statusData     = $_controller->getStatusData();
+$checks         = $statusData['checks'];
+$statusCached   = $statusData['cached'];
+$statusCacheAge = $statusData['cacheAge'];
+
+$phpInfo  = $_controller->getPhpInfo();
+$diskInfo = $_controller->getDiskInfo();
+
+$diskTotal = $diskInfo['total'];
+$diskFree  = $diskInfo['free'];
+$diskUsed  = $diskInfo['used'];
+$diskPct   = $diskInfo['pct'];
+$diskColor = SystemController::diskColor($diskPct);
+
+// ── Logs section ──────────────────────────────────────────────────────────────
+$activeTab = $_GET['tab'] ?? 'nginx_access';
+if ($activeTab === 'status') {
+    $activeTab = 'nginx_access';
+} elseif ($activeTab !== 'nginx_config' && !array_key_exists($activeTab, SystemController::LOG_FILES)) {
+    $activeTab = 'nginx_access';
+}
+
+$selectedN = isset($_GET['n']) ? (int) $_GET['n'] : 100;
+if (!in_array($selectedN, SystemController::ALLOWED_LINES, true)) {
+    $selectedN = 100;
+}
+
+$logLines    = null;
+$logError    = null;
+$logFileMeta = null;
+
+$nginxConfigLines  = null;
+$nginxConfigSource = null;
+$nginxConfigError  = null;
+$nginxConfigMeta   = null;
+
+if ($activeTab === 'nginx_config') {
+    $nginxData         = $_controller->getNginxConfigData();
+    $nginxConfigLines  = $nginxData['lines'];
+    $nginxConfigSource = $nginxData['source'];
+    $nginxConfigMeta   = $nginxData['meta'];
+    $nginxConfigError  = $nginxData['error'];
+} else {
+    $logData     = $_controller->getLogData($activeTab, $selectedN);
+    $logLines    = $logData['lines'];
+    $logError    = $logData['error'];
+    $logFileMeta = $logData['meta'];
+}
+
+$collapsed = $_COOKIE['sys_collapsed'] ?? null;
+$statusInitiallyCollapsed = $collapsed === '1';
+
+// ── Page setup ────────────────────────────────────────────────────────────────
 if (empty($_SESSION['csrf_token'])) {
     $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
 }
 
 $isAdmin = true; $bodyClass = 'admin-body';
+$extraCss = ['/assets/css/system.css'];
 require_once APP_ROOT . '/templates/head.php';
 include APP_ROOT . '/templates/header.php';
 include APP_ROOT . '/templates/admin/parametres.php';
diff --git a/app/public/admin/system.php b/app/public/admin/system.php
index 2635a0a..9b069fe 100644
--- a/app/public/admin/system.php
+++ b/app/public/admin/system.php
@@ -1,79 +1,4 @@
 <?php
-require_once __DIR__ . "/../../bootstrap.php";
-require_once __DIR__ . '/../../src/AdminAuth.php';
-require_once APP_ROOT . '/src/Database.php';
-require_once APP_ROOT . '/src/SystemCache.php';
-require_once APP_ROOT . '/src/Controllers/SystemController.php';
-AdminAuth::requireLogin();
-
-$pageTitle = "Système";
-
-$_db         = new Database();
-$_cache      = new SystemCache($_db->getPDO());
-$_controller = new SystemController($_db, $_cache);
-
-if (isset($_GET['refresh']) && $_GET['refresh'] === '1') {
-    $_controller->invalidateAll();
-}
-
-// ── Status / PHP / Disk data ──────────────────────────────────────────────────
-$statusData     = $_controller->getStatusData();
-$checks         = $statusData['checks'];
-$statusCached   = $statusData['cached'];
-$statusCacheAge = $statusData['cacheAge'];
-
-$phpInfo  = $_controller->getPhpInfo();
-$diskInfo = $_controller->getDiskInfo();
-
-$diskTotal = $diskInfo['total'];
-$diskFree  = $diskInfo['free'];
-$diskUsed  = $diskInfo['used'];
-$diskPct   = $diskInfo['pct'];
-$diskColor = SystemController::diskColor($diskPct);
-
-// ── Active tab + line count ───────────────────────────────────────────────────
-$activeTab = $_GET['tab'] ?? 'nginx_access';
-if ($activeTab === 'status') {
-    $activeTab = 'nginx_access';
-} elseif ($activeTab !== 'nginx_config' && !array_key_exists($activeTab, SystemController::LOG_FILES)) {
-    $activeTab = 'nginx_access';
-}
-
-$selectedN = isset($_GET['n']) ? (int) $_GET['n'] : 100;
-if (!in_array($selectedN, SystemController::ALLOWED_LINES, true)) {
-    $selectedN = 100;
-}
-
-// ── Tab content data ──────────────────────────────────────────────────────────
-$logLines    = null;
-$logError    = null;
-$logFileMeta = null;
-
-$nginxConfigLines  = null;
-$nginxConfigSource = null;
-$nginxConfigError  = null;
-$nginxConfigMeta   = null;
-
-if ($activeTab === 'nginx_config') {
-    $nginxData         = $_controller->getNginxConfigData();
-    $nginxConfigLines  = $nginxData['lines'];
-    $nginxConfigSource = $nginxData['source'];
-    $nginxConfigMeta   = $nginxData['meta'];
-    $nginxConfigError  = $nginxData['error'];
-} else {
-    $logData     = $_controller->getLogData($activeTab, $selectedN);
-    $logLines    = $logData['lines'];
-    $logError    = $logData['error'];
-    $logFileMeta = $logData['meta'];
-}
-
-$isAdmin = true; $bodyClass = 'admin-body';
-$extraCss = ['/assets/css/system.css'];
-require_once APP_ROOT . '/templates/head.php';
-
-$collapsed = $_COOKIE['sys_collapsed'] ?? null;
-$statusInitiallyCollapsed = $collapsed === '1';
-
-include APP_ROOT . '/templates/header.php';
-include APP_ROOT . '/templates/admin/system.php';
-require_once APP_ROOT . '/templates/admin/footer.php';
+// Redirects legacy /admin/system.php → /admin/parametres.php
+header('Location: /admin/parametres.php', true, 301);
+exit;
diff --git a/app/templates/admin/acces.php b/app/templates/admin/acces.php
new file mode 100644
index 0000000..cf8de0a
--- /dev/null
+++ b/app/templates/admin/acces.php
@@ -0,0 +1,394 @@
+<main id="main-content">
+    <h1>Accès</h1>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         LIENS D'ACCÈS ÉTUDIANT·E
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="acces-liens-title">
+        <div class="admin-list-toolbar">
+            <h2 id="acces-liens-title">Accès étudiant·e</h2>
+            <div class="admin-list-toolbar__right">
+                <button type="button" class="admin-btn admin-btn--sm" id="open-create-dialog">
+                    ＋ Créer un lien
+                </button>
+            </div>
+        </div>
+
+        <?php if (empty($links)): ?>
+            <p class="admin-empty">Aucun lien d'accès créé. Cliquez sur « Créer un lien » pour générer un lien partageable.</p>
+        <?php else: ?>
+        <table>
+            <thead>
+                <tr>
+                    <th scope="col">Lien</th>
+                    <th scope="col">Objet</th>
+                    <th scope="col">Statut</th>
+                    <th scope="col">Mot de passe</th>
+                    <th scope="col">Utilisations</th>
+                    <th scope="col">Expiration</th>
+                    <th scope="col">Créé le</th>
+                    <th scope="col">Actions</th>
+                </tr>
+            </thead>
+            <tbody>
+                <?php foreach ($links as $link): ?>
+                    <?php
+                        $isExpired = $link['expires_at'] !== null && strtotime($link['expires_at']) < time();
+                        $isActive  = (bool)$link['is_active'] && !$isExpired;
+                        $statusLabel = $isExpired ? 'Expiré' : ($link['is_active'] ? 'Actif' : 'Désactivé');
+                        $fullUrl = $baseUrl . '/partage/' . htmlspecialchars($link['slug']);
+                        $created = date('d/m/Y H:i', strtotime($link['created_at']));
+                        $expires = $link['expires_at'] ? date('d/m/Y', strtotime($link['expires_at'])) : '—';
+                        $hasLinkPassword = !empty($link['password_hash']);
+                    ?>
+                    <tr>
+                        <td>
+                            <code style="font-size:var(--step--2);color:var(--text-secondary);"><?= htmlspecialchars($link['slug']) ?></code>
+                            <input type="hidden" id="url-<?= $link['id'] ?>" value="<?= $fullUrl ?>">
+                        </td>
+                        <td>
+                            <?php if ($link['objet_restriction']): ?>
+                                <span class="status-badge"><?= htmlspecialchars($link['objet_restriction']) ?></span>
+                            <?php else: ?>
+                                <span style="color:var(--text-secondary);font-size:var(--step--2);">Tous</span>
+                            <?php endif; ?>
+                        </td>
+                        <td>
+                            <?php if ($isExpired): ?>
+                                <span class="status-badge status-pending"><?= $statusLabel ?></span>
+                            <?php elseif ($link['is_active']): ?>
+                                <span class="status-badge status-published"><?= $statusLabel ?></span>
+                            <?php else: ?>
+                                <span style="display:inline-block;padding:var(--space-3xs) var(--space-2xs);border-radius:3px;font-size:var(--step--2);font-weight:500;letter-spacing:0.04em;background:var(--error-muted-bg);color:var(--error);"><?= $statusLabel ?></span>
+                            <?php endif; ?>
+                        </td>
+                        <td><?= $hasLinkPassword ? '🔒 Oui' : 'Non' ?></td>
+                        <td style="text-align:center;"><?= intval($link['usage_count']) ?></td>
+                        <td><?= $expires ?></td>
+                        <td><?= $created ?></td>
+                        <td>
+                            <div class="admin-actions">
+                                <a href="/partage/<?= urlencode($link['slug']) ?>" target="_blank" rel="noopener"
+                                   class="admin-btn-sm admin-btn-visit" title="Visiter le formulaire">
+                                    👁 Visiter
+                                </a>
+                                <button type="button" class="admin-btn-sm admin-btn-view"
+                                        onclick="copyUrl(<?= $link['id'] ?>)" title="Copier l'URL">
+                                    Copier
+                                </button>
+                                <form method="post" action="actions/acces-etudiante.php" class="publish-form">
+                                    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                                    <input type="hidden" name="action" value="toggle">
+                                    <input type="hidden" name="id" value="<?= $link['id'] ?>">
+                                    <button type="submit"
+                                            class="admin-btn-sm <?= $link['is_active'] ? 'admin-btn-unpublish' : 'admin-btn-publish' ?>"
+                                            title="<?= $link['is_active'] ? 'Désactiver' : 'Activer' ?>">
+                                        <?= $link['is_active'] ? '⏸' : '▶' ?>
+                                    </button>
+                                </form>
+                                <button type="button" class="admin-btn-sm admin-btn-edit"
+                                        onclick="openPasswordDialog(<?= $link['id'] ?>, <?= $hasLinkPassword ? 'true' : 'false' ?>)"
+                                        title="Modifier le mot de passe">
+                                    🔑
+                                </button>
+                                <form method="post" action="actions/acces-etudiante.php" class="publish-form"
+                                      onsubmit="return confirm('Supprimer ce lien ? Les soumissions via ce lien seront bloquées.')">
+                                    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+                                    <input type="hidden" name="action" value="delete">
+                                    <input type="hidden" name="id" value="<?= $link['id'] ?>">
+                                    <button type="submit" class="admin-btn-sm admin-btn-delete" title="Supprimer">
+                                        🗑
+                                    </button>
+                                </form>
+                            </div>
+                        </td>
+                    </tr>
+                <?php endforeach; ?>
+            </tbody>
+        </table>
+        <?php endif; ?>
+    </section>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         DEMANDES D'ACCÈS AUX FICHIERS
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="acces-fichiers-title">
+        <h2 id="acces-fichiers-title">Demandes d'accès aux fichiers</h2>
+
+        <div class="access-req-stats">
+            <div class="access-req-stat-card">
+                <span class="access-req-stat-number"><?= $pendingCount ?></span>
+                <span class="access-req-stat-label">En attente</span>
+            </div>
+            <div class="access-req-stat-card">
+                <span class="access-req-stat-number"><?= $approvedCount ?></span>
+                <span class="access-req-stat-label">Approuvées</span>
+            </div>
+            <div class="access-req-stat-card">
+                <span class="access-req-stat-number"><?= $rejectedCount ?></span>
+                <span class="access-req-stat-label">Rejetées</span>
+            </div>
+        </div>
+
+        <nav class="access-req-tabs">
+            <a href="?status=pending" class="access-req-tab <?= $status === 'pending' ? 'active' : '' ?>">
+                En attente <?= $pendingCount > 0 ? "({$pendingCount})" : '' ?>
+            </a>
+            <a href="?status=approved" class="access-req-tab <?= $status === 'approved' ? 'active' : '' ?>">
+                Approuvées
+            </a>
+            <a href="?status=rejected" class="access-req-tab <?= $status === 'rejected' ? 'active' : '' ?>">
+                Rejetées
+            </a>
+        </nav>
+
+        <?php if (empty($requests)): ?>
+            <div class="access-req-empty">
+                <p>Aucune demande <?= $status === 'pending' ? 'en attente' : ($status === 'approved' ? 'approuvée' : 'rejetée') ?>.</p>
+            </div>
+        <?php else: ?>
+            <div class="access-req-list">
+                <?php foreach ($requests as $req): ?>
+                    <div class="access-req-card">
+                        <div class="access-req-card__header">
+                            <div class="access-req-card__thesis">
+                                <h3><?= htmlspecialchars($req['title']) ?></h3>
+                                <p class="access-req-card__authors">
+                                    <?php if (!empty($req['authors'])): ?>
+                                        par <?= htmlspecialchars($req['authors']) ?>
+                                    <?php endif; ?>
+                                    <?php if (!empty($req['year'])): ?>
+                                        — <?= htmlspecialchars($req['year']) ?>
+                                    <?php endif; ?>
+                                </p>
+                            </div>
+                            <div class="access-req-card__meta">
+                                <span class="access-req-badge access-req-badge--<?= $status ?>">
+                                    <?= $status === 'pending' ? 'En attente' : ($status === 'approved' ? 'Approuvée' : 'Rejetée') ?>
+                                </span>
+                            </div>
+                        </div>
+
+                        <div class="access-req-card__body">
+                            <div class="access-req-card__info">
+                                <div>
+                                    <strong>Email :</strong>
+                                    <a href="mailto:<?= htmlspecialchars($req['email']) ?>">
+                                        <?= htmlspecialchars($req['email']) ?>
+                                    </a>
+                                </div>
+                                <div>
+                                    <strong>Date :</strong>
+                                    <?= date('d/m/Y à H:i', strtotime($req['created_at'])) ?>
+                                </div>
+                                <?php if ($status === 'approved' && !empty($req['approved_at'])): ?>
+                                    <div>
+                                        <strong>Approuvée le :</strong>
+                                        <?= date('d/m/Y à H:i', strtotime($req['approved_at'])) ?>
+                                    </div>
+                                <?php endif; ?>
+                                <?php if ($status === 'rejected' && !empty($req['approved_at'])): ?>
+                                    <div>
+                                        <strong>Rejetée le :</strong>
+                                        <?= date('d/m/Y à H:i', strtotime($req['approved_at'])) ?>
+                                    </div>
+                                <?php endif; ?>
+                            </div>
+
+                            <?php if (!empty($req['justification'])): ?>
+                                <div class="access-req-card__justification">
+                                    <strong>Justification :</strong>
+                                    <p><?= nl2br(htmlspecialchars($req['justification'])) ?></p>
+                                </div>
+                            <?php endif; ?>
+
+                            <?php if ($status === 'rejected' && !empty($req['admin_notes'])): ?>
+                                <div class="access-req-card__admin-notes">
+                                    <strong>Note de l'administrateur :</strong>
+                                    <p><?= nl2br(htmlspecialchars($req['admin_notes'])) ?></p>
+                                </div>
+                            <?php endif; ?>
+
+                            <?php if ($status === 'pending'): ?>
+                                <div class="access-req-card__actions">
+                                    <button type="button"
+                                            class="access-req-btn access-req-btn--approve"
+                                            onclick="openApproveDialog(<?= $req['id'] ?>)">
+                                        Approuver
+                                    </button>
+                                    <button type="button"
+                                            class="access-req-btn access-req-btn--reject"
+                                            onclick="openRejectDialog(<?= $req['id'] ?>)">
+                                        Rejeter
+                                    </button>
+                                </div>
+                            <?php endif; ?>
+                        </div>
+                    </div>
+                <?php endforeach; ?>
+            </div>
+
+            <?php if ($totalPages > 1): ?>
+                <nav class="access-req-pagination">
+                    <?php if ($page > 1): ?>
+                        <a href="?status=<?= $status ?>&page=<?= $page - 1 ?>" class="access-req-pagination__link">
+                            &larr; Précédent
+                        </a>
+                    <?php endif; ?>
+
+                    <span class="access-req-pagination__info">
+                        Page <?= $page ?> sur <?= $totalPages ?>
+                    </span>
+
+                    <?php if ($page < $totalPages): ?>
+                        <a href="?status=<?= $status ?>&page=<?= $page + 1 ?>" class="access-req-pagination__link">
+                            Suivant &rarr;
+                        </a>
+                    <?php endif; ?>
+                </nav>
+            <?php endif; ?>
+        <?php endif; ?>
+    </section>
+</main>
+
+<!-- ═══════════════════════ CREATE DIALOG ═══════════════════════ -->
+<dialog id="create-dialog" class="admin-dialog" aria-labelledby="create-dialog-title">
+    <div class="admin-dialog__header">
+        <h2 id="create-dialog-title">Créer un lien d'accès</h2>
+        <button type="button" class="admin-dialog__close" aria-label="Fermer"
+                onclick="document.getElementById('create-dialog').close()">&#x2715;</button>
+    </div>
+    <form method="post" action="actions/acces-etudiante.php" class="admin-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" name="action" value="create">
+        <div>
+            <label for="create-objet">Type d'objet (optionnel)</label>
+            <select id="create-objet" name="objet_restriction">
+                <option value="">— Tous les types —</option>
+                <option value="tfe">TFE</option>
+                <option value="thèse">Thèse</option>
+                <option value="frart">Frart</option>
+            </select>
+            <small>Restreint ce lien à un seul type de soumission.</small>
+        </div>
+        <div>
+            <label for="create-password">Mot de passe (optionnel)</label>
+            <input type="password" id="create-password" name="password" autocomplete="new-password">
+            <small>Laissez vide pour un lien sans mot de passe.</small>
+        </div>
+        <div>
+            <label for="create-expires">Expiration (optionnel)</label>
+            <input type="datetime-local" id="create-expires" name="expires_at">
+            <small>Laissez vide pour qu'il n'expire jamais.</small>
+        </div>
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Créer le lien</button>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('create-dialog').close()">Annuler</button>
+        </div>
+    </form>
+</dialog>
+
+<!-- ═══════════════════════ PASSWORD DIALOG ═══════════════════════ -->
+<dialog id="password-dialog" class="admin-dialog" aria-labelledby="password-dialog-title">
+    <div class="admin-dialog__header">
+        <h2 id="password-dialog-title">Mot de passe</h2>
+        <button type="button" class="admin-dialog__close" aria-label="Fermer"
+                onclick="document.getElementById('password-dialog').close()">&#x2715;</button>
+    </div>
+    <form method="post" action="actions/acces-etudiante.php" class="admin-form">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" name="action" value="set_password">
+        <input type="hidden" name="id" id="password-link-id" value="">
+        <div>
+            <label for="password-input">Nouveau mot de passe</label>
+            <input type="password" id="password-input" name="password" autocomplete="new-password">
+            <small>Laissez vide pour supprimer le mot de passe.</small>
+            <p id="password-current-info" style="font-size:var(--step--2);color:var(--text-secondary);margin-top:var(--space-2xs);"></p>
+        </div>
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Enregistrer</button>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('password-dialog').close()">Annuler</button>
+        </div>
+    </form>
+</dialog>
+
+<!-- ═══════════════════════ APPROVE DIALOG ═══════════════════════ -->
+<dialog id="approve-dialog" class="admin-dialog">
+    <div class="admin-dialog__header">
+        <h2>Approuver la demande</h2>
+        <button type="button" class="admin-dialog__close"
+                onclick="document.getElementById('approve-dialog').close()">&times;</button>
+    </div>
+    <form method="post" action="/admin/actions/access-request.php">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" name="request_id" id="approve-request-id">
+        <input type="hidden" name="action" value="approve">
+        <label for="approve-notes">Note optionnelle (inclus dans l'email) :</label>
+        <textarea name="admin_notes" id="approve-notes" rows="3"
+                  placeholder="Message personnalisé pour le demandeur..."></textarea>
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn">Approuver et envoyer email</button>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('approve-dialog').close()">Annuler</button>
+        </div>
+    </form>
+</dialog>
+
+<!-- ═══════════════════════ REJECT DIALOG ════════════════════════ -->
+<dialog id="reject-dialog" class="admin-dialog">
+    <div class="admin-dialog__header">
+        <h2>Rejeter la demande</h2>
+        <button type="button" class="admin-dialog__close"
+                onclick="document.getElementById('reject-dialog').close()">&times;</button>
+    </div>
+    <form method="post" action="/admin/actions/access-request.php">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+        <input type="hidden" name="request_id" id="reject-request-id">
+        <input type="hidden" name="action" value="reject">
+        <label for="reject-notes">Raison du rejet (optionnel) :</label>
+        <textarea name="admin_notes" id="reject-notes" rows="3"
+                  placeholder="Raison du rejet..."></textarea>
+        <div class="admin-form-footer">
+            <button type="submit" class="admin-btn admin-btn--danger">Rejeter</button>
+            <button type="button" class="admin-btn-secondary"
+                    onclick="document.getElementById('reject-dialog').close()">Annuler</button>
+        </div>
+    </form>
+</dialog>
+
+<script>
+document.getElementById('open-create-dialog').addEventListener('click', () => {
+    document.getElementById('create-dialog').showModal();
+});
+
+function copyUrl(id) {
+    const input = document.getElementById('url-' + id);
+    navigator.clipboard.writeText(input.value).then(() => {
+        const btn = event.target.closest('button');
+        const orig = btn.textContent;
+        btn.textContent = '✓ Copié';
+        setTimeout(() => { btn.textContent = orig; }, 1200);
+    });
+}
+
+function openPasswordDialog(id, hasPassword) {
+    document.getElementById('password-link-id').value = id;
+    const info = document.getElementById('password-current-info');
+    info.textContent = hasPassword
+        ? 'Un mot de passe est actuellement configuré. Entrez-en un nouveau ou laissez vide pour le supprimer.'
+        : 'Aucun mot de passe configuré.';
+    document.getElementById('password-dialog').showModal();
+}
+
+function openApproveDialog(requestId) {
+    document.getElementById('approve-request-id').value = requestId;
+    document.getElementById('approve-dialog').showModal();
+}
+
+function openRejectDialog(requestId) {
+    document.getElementById('reject-request-id').value = requestId;
+    document.getElementById('reject-dialog').showModal();
+}
+</script>
diff --git a/app/templates/admin/parametres.php b/app/templates/admin/parametres.php
index 780c5a1..98c75ec 100644
--- a/app/templates/admin/parametres.php
+++ b/app/templates/admin/parametres.php
@@ -346,6 +346,120 @@
         <?php endif; ?>
     </section>
 
+    <!-- ══════════════════════════════════════════════════════════════
+         SYSTÈME
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="settings-system-title">
+        <h2 id="settings-system-title">Système</h2>
+
+        <p class="sys-refresh-note">
+            Affiché le <?= date('d/m/Y à H:i:s') ?> —
+            <a href="?tab=<?= htmlspecialchars($activeTab) ?>&amp;n=<?= $selectedN ?>">Rafraîchir</a> —
+            <a href="?tab=<?= htmlspecialchars($activeTab) ?>&amp;n=<?= $selectedN ?>&amp;refresh=1">Forcer actualisation</a>
+        </p>
+
+        <div class="sys-status-header">
+            <h3 class="srv-section-title srv-section-title--compact">Statut
+                <?php if ($statusCached && $statusCacheAge !== null): ?>
+                <span class="sys-cache-badge sys-cache-badge--hit" title="Données en cache">
+                    ⚡ Cache — il y a <?= $statusCacheAge ?>s
+                </span>
+                <?php else: ?>
+                <span class="sys-cache-badge sys-cache-badge--miss" title="Données fraîches">
+                    ⟳ Actualisé
+                </span>
+                <?php endif; ?>
+            </h3>
+            <button id="sys-status-toggle" class="sys-status-toggle"
+                    aria-expanded="<?= $statusInitiallyCollapsed ? 'false' : 'true' ?>" aria-controls="sys-status-body"
+                    type="button"
+                    onclick="var b=document.getElementById('sys-status-body');var c=b.hidden;b.hidden=!c;this.setAttribute('aria-expanded',c);this.textContent=c?'▲ Réduire':'▼ Développer';document.cookie='sys_collapsed='+(!c)+';path=/;max-age=31536000';return false">
+              <?= $statusInitiallyCollapsed ? '▼ Développer' : '▲ Réduire' ?>
+            </button>
+        </div>
+
+        <div id="sys-status-body"<?= $statusInitiallyCollapsed ? ' hidden' : '' ?>>
+            <div class="srv-grid">
+                <?php foreach ($checks as $check): ?>
+                <?php $st = $check['status'] ?? 'unknown'; ?>
+                <div class="srv-card">
+                    <div class="srv-card__header">
+                        <span class="srv-card__name"><?= htmlspecialchars($check['label']) ?></span>
+                        <span class="<?= SystemController::statusClass($st) ?>"><?= SystemController::statusLabel($st) ?></span>
+                    </div>
+                    <?php if (!empty($check['detail'])): ?>
+                    <div class="srv-card__detail"><?= htmlspecialchars($check['detail']) ?></div>
+                    <?php endif; ?>
+                </div>
+                <?php endforeach; ?>
+            </div>
+
+            <div class="sys-status-meta">
+                <div>
+                    <h4 class="srv-section-title srv-section-title--sub">Environnement PHP</h4>
+                    <div class="php-grid php-grid--flush">
+                        <?php foreach ($phpInfo as $key => $val): ?>
+                        <div class="php-item">
+                            <div class="php-item__key"><?= htmlspecialchars($key) ?></div>
+                            <div class="php-item__val"><?= htmlspecialchars($val) ?></div>
+                        </div>
+                        <?php endforeach; ?>
+                    </div>
+                </div>
+                <div>
+                    <h4 class="srv-section-title srv-section-title--sub">Espace disque</h4>
+                    <div class="disk-bar-wrap">
+                        <div class="disk-bar" style="--disk-pct:<?= $diskPct ?>%;--disk-color:<?= $diskColor ?>"></div>
+                    </div>
+                    <div class="disk-stats">
+                        <span><?= SystemController::humanBytes($diskUsed) ?> utilisé (<?= $diskPct ?>%)</span>
+                        <span><?= SystemController::humanBytes($diskFree) ?> libre / <?= SystemController::humanBytes($diskTotal) ?></span>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </section>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         JOURNAUX
+    ══════════════════════════════════════════════════════════════ -->
+    <section aria-labelledby="settings-logs-title">
+        <h2 id="settings-logs-title">Journaux</h2>
+
+        <nav class="sys-tabs" aria-label="Journaux et configuration">
+            <?php foreach (SystemController::LOG_FILES as $key => $def): ?>
+            <a href="?tab=<?= htmlspecialchars($key) ?>&amp;n=<?= $selectedN ?>"
+               class="sys-tab <?= $activeTab === $key ? 'active' : '' ?>"
+               hx-get="/admin/system-fragment.php?tab=<?= htmlspecialchars($key) ?>&amp;n=<?= $selectedN ?>"
+               hx-target="#sys-tab-panel"
+               hx-push-url="?tab=<?= htmlspecialchars($key) ?>&amp;n=<?= $selectedN ?>"
+               hx-swap="innerHTML"
+               hx-indicator="#sys-tab-panel"
+               data-tab="<?= htmlspecialchars($key) ?>"
+               <?= $activeTab === $key ? 'aria-current="page"' : '' ?>>
+                <?= htmlspecialchars($def['label']) ?>
+            </a>
+            <?php endforeach; ?>
+            <a href="?tab=nginx_config"
+               class="sys-tab <?= $activeTab === 'nginx_config' ? 'active' : '' ?>"
+               hx-get="/admin/system-fragment.php?tab=nginx_config"
+               hx-target="#sys-tab-panel"
+               hx-push-url="?tab=nginx_config"
+               hx-swap="innerHTML"
+               hx-indicator="#sys-tab-panel"
+               data-tab="nginx_config"
+               <?= $activeTab === 'nginx_config' ? 'aria-current="page"' : '' ?>>nginx — config</a>
+        </nav>
+
+        <div id="sys-tab-panel">
+            <?php if ($activeTab === 'nginx_config'): ?>
+                <?php include APP_ROOT . '/templates/admin/partials/system-nginx-config-panel.php'; ?>
+            <?php else: ?>
+                <?php include APP_ROOT . '/templates/admin/partials/system-log-panel.php'; ?>
+            <?php endif; ?>
+        </div>
+    </section>
+
     <!-- ══════════════════════════════════════════════════════════════════
          EXPORT DATABASE DIALOG
     ═══════════════════════════════════════════════════════════════ -->
@@ -366,3 +480,53 @@
         </div>
     </dialog>
 </main>
+
+<script>
+function copyLogContent(btn) {
+    var logOut = document.querySelector('#log-output');
+    if (!logOut) return;
+    var text = Array.from(logOut.querySelectorAll('.log-line'))
+        .map(function(el){ return el.textContent; }).join('\n');
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+        navigator.clipboard.writeText(text).then(function(){
+            btn.textContent = '\u2713 Copi\u00e9';
+            btn.classList.add('copied');
+            setTimeout(function(){ btn.textContent = 'Copier'; btn.classList.remove('copied'); }, 2000);
+        });
+    } else {
+        fallbackCopy(text, btn);
+    }
+}
+function fallbackCopy(text, btn) {
+    var ta = document.createElement('textarea');
+    ta.value = text;
+    ta.style.cssText = 'position:fixed;opacity:0';
+    document.body.appendChild(ta); ta.select();
+    try { document.execCommand('copy'); btn.textContent = '\u2713 Copi\u00e9'; btn.classList.add('copied');
+        setTimeout(function(){ btn.textContent = 'Copier'; btn.classList.remove('copied'); }, 2000);
+    } catch(e) {}
+    document.body.removeChild(ta);
+}
+// Update active tab class after each HTMX swap on #sys-tab-panel
+document.body.addEventListener('htmx:afterSwap', function(evt) {
+    if (evt.detail.target && evt.detail.target.id === 'sys-tab-panel') {
+        var rc = evt.detail.requestConfig;
+        var tab = null;
+        var qIdx = rc.path.indexOf('?');
+        if (qIdx !== -1) {
+            tab = new URLSearchParams(rc.path.substring(qIdx + 1)).get('tab');
+        }
+        if (!tab && rc.parameters && rc.parameters.tab) {
+            tab = rc.parameters.tab;
+        }
+        if (tab) {
+            document.querySelectorAll('.sys-tabs .sys-tab').forEach(function(a) {
+                var isActive = a.getAttribute('data-tab') === tab;
+                a.classList.toggle('active', isActive);
+                if (isActive) a.setAttribute('aria-current', 'page');
+                else a.removeAttribute('aria-current');
+            });
+        }
+    }
+});
+</script>
diff --git a/app/templates/header.php b/app/templates/header.php
index cb6629b..36c6c03 100644
--- a/app/templates/header.php
+++ b/app/templates/header.php
@@ -19,15 +19,13 @@ $_thesisId     = $_GET['id'] ?? null;
             <li><a href="/admin/" <?= $_currentPage === 'index.php' ? 'aria-current="page"' : '' ?>>Liste des TFE</a></li>
             <li><a href="/admin/contenus.php" <?= in_array($_currentPage, ['contenus.php', 'contenus-edit.php']) ? 'aria-current="page"' : '' ?>>Contenus</a></li>
             <li><a href="/admin/tags.php" <?= $_currentPage === 'tags.php' ? 'aria-current="page"' : '' ?>>Mots-clés</a></li>
-            <li><a href="/admin/file-access.php" <?= $_currentPage === 'file-access.php' ? 'aria-current="page"' : '' ?>>
-                Demandes d'accès
+            <li><a href="/admin/acces.php" <?= in_array($_currentPage, ['acces.php', 'file-access.php', 'acces-etudiante.php']) ? 'aria-current="page"' : '' ?>>
+                Accès
                 <?php if (isset($pendingCount) && $pendingCount > 0): ?>
                     <span class="admin-nav-badge"><?= $pendingCount ?></span>
                 <?php endif; ?>
             </a></li>
-            <li><a href="/admin/system.php" <?= in_array($_currentPage, ['system.php', 'status.php', 'logs.php']) ? 'aria-current="page"' : '' ?>>Système</a></li>
-            <li><a href="/admin/acces-etudiante.php" <?= $_currentPage === 'acces-etudiante.php' ? 'aria-current="page"' : '' ?>>Accès étudiant·e</a></li>
-            <li><a href="/admin/parametres.php" <?= $_currentPage === 'parametres.php' ? 'aria-current="page"' : '' ?>>Paramètres</a></li>
+            <li><a href="/admin/parametres.php" <?= in_array($_currentPage, ['parametres.php', 'system.php', 'status.php', 'logs.php']) ? 'aria-current="page"' : '' ?>>Paramètres</a></li>
             <?php if ($_thesisId && in_array($_currentPage, ['edit.php', 'recapitulatif.php'])): ?>
             <li><a href="/admin/edit.php?id=<?= intval($_thesisId) ?>" <?= $_currentPage === 'edit.php' ? 'aria-current="page"' : '' ?>>Modifier</a></li>
             <?php endif; ?>