Refactor + feat: unify format/fichiers HTMX fragment, reorder format types, add file constraints, fix admin auth

* **Unified Format + Fichiers into a single HTMX fragment** * Introduced `app/public/partage/fichiers-fragment.php` as shared dynamic block returning both format checkboxes and adaptive “Fichiers” fieldset * Logic adapts inputs based on selected formats: * no selection / upload formats → standard file inputs * “Site web” → URL fields only * “Site web + upload” → file inputs + URL sub-fieldset * Added admin wrapper: `app/public/admin/fichiers-fragment.php` (gated via `admin_mode=1`) * Added `app/public/admin/format-website-fragment.php` for edit-mode website URL toggling * Wired route `/partage/fichiers-fragment` in `app/public/partage/index.php` * Refactored `form.php` (add/edit partage) to use single `#format-fichiers-block` instead of separate fragments * Edit mode format checkboxes now target `format-website-fragment.php` → `#edit-website-url-fieldset` * Added `$hxInclude` support in `checkbox-list.php` for configurable HTMX includes * **Format system migration + ordering** * Migration `020_format_types_sort_and_rename.sql`: * added `sort_order` column to `format_types` * inserted new format **Image** * defined ordering: Écriture · Image · Audio · Vidéo · Site web · Performance · Objet éditorial · Installation · Autre * `Database.php`: format queries now use `ORDER BY sort_order, id` * `fichiers-fragment.php`: * uses ordered format list * resolves Image/Vidéo/Audio by name * introduces `$hasImage` flag * preserves `admin_mode` across HTMX requests * **File constraints and UX updates** * Enforced **100 MB PDF limit** * `ThesisCreateController`: `MAX_PDF_SIZE = 100MB` for PDFs only * `ThesisEditController`: same PDF-specific constraint applied * Other file types remain capped at 500 MB * Updated UI hints in `fichiers-fragment.php` and edit form: * explicitly mention 100 MB PDF limit * added reference to `bentopdf.com` for compression guidance * `file-field.php`: added `$hintRaw` to allow HTML rendering in hints * **Admin authentication fix** * Fixed missing auth in admin fragments * Added `require_once AdminAuth.php` * Replaced direct usage with `AdminAuth::requireLogin()` * Applied consistent pattern with existing fragment authentication approach * **Migrations included** * `019_add_ecriture_format.sql` * `020_format_types_sort_and_rename.sql` * **Files affected** * Controllers: `ThesisCreateController`, `ThesisEditController` * DB layer: `Database.php` * Public fragments: `partage/fichiers-fragment.php`, `admin/fichiers-fragment.php`, `admin/format-website-fragment.php` * Templates: `form.php`, `checkbox-list.php`, `file-field.php` * Routing: `partage/index.php` * Misc: `TODO.md` This consolidates format normalization, HTMX UI simplification, file validation rules, and admin stability fixes into a single coherent system update.
2026-06-25 16:19:19 +02:00 · 2026-05-08 13:03:18 +02:00
parent 7e35bba530
commit e6829994b6
13 changed files with 390 additions and 49 deletions
--- a/TODO.md
+++ b/TODO.md
@@ -2,6 +2,29 @@

 ## Completed

+- [x] PDF 100 MB limit + bentopdf mention
+  - [x] `ThesisCreateController`: `MAX_PDF_SIZE = 100 MB`; PDFs checked against it, other files still 500 MB
+  - [x] `ThesisEditController`: same per-PDF limit applied
+  - [x] `fichiers-fragment.php`: note d'intention and TFE hints mention 100 MB PDF limit + bentopdf.com link
+  - [x] `form.php` edit-mode new-files hint updated
+  - [x] `file-field.php`: added `$hintRaw` flag to allow HTML in hints
+
+- [x] Format types: reorder, rename, add Image/Écriture
+  - [x] Migration 019: add Écriture
+  - [x] Migration 020: add `sort_order` column, rename Autre → Etc. / Autre, add Image, set display order (Écriture · Image · Audio · Vidéo · Site web · Performance · Objet éditorial · Installation · Etc. / Autre)
+  - [x] `Database.php` format_types query uses `ORDER BY sort_order, id`
+  - [x] `fichiers-fragment.php` uses `ORDER BY sort_order, id`; Image/Vidéo/Audio IDs resolved via name map
+  - [ ] TODO: Vidéo + Audio — PeerTube API upload (notice shown in form for now)
+
+- [x] Combined Format + Fichiers into HTMX-swappable block
+  - [x] `partage/fichiers-fragment.php` — new combined fragment: format checkboxes + fichiers fieldset that adapts based on selected formats (upload inputs / URL fields / both)
+  - [x] Route `/partage/fichiers-fragment` added to `partage/index.php`
+  - [x] `admin/fichiers-fragment.php` — admin-gated wrapper for the same fragment (sets `admin_mode=1`)
+  - [x] `admin/format-website-fragment.php` — admin-gated fragment for edit-mode website URL fieldset toggle
+  - [x] `form.php` — add/partage mode: replaced separate Format + Fichiers + website-url-fieldset with single `#format-fichiers-block` server-rendered via shared fragment
+  - [x] `form.php` — edit mode: Format checkboxes wire to `admin/format-website-fragment.php` → `#edit-website-url-fieldset` (existing-file management untouched)
+  - [x] `checkbox-list.php` — added `$hxInclude` variable (defaults to `'this, #website-url-fieldset'`) so callers can customise included fields
+
 - [x] TDD analysis + new test suites
  - [x] **Bug fixed**: `SearchController::handleSearch()` — `$coverMap` undefined variable + never populated for search results
  - [x] `ShareLinkTest` (13 tests) — `generateSlug`, all `validateLink` branches, `verifyPassword`, `incrementUsage`, `objet_restriction`
--- a/app/migrations/applied/019_add_ecriture_format.sql
+++ b/app/migrations/applied/019_add_ecriture_format.sql
@@ -0,0 +1,2 @@
+-- Migration 019: Add "Écriture" format type
+INSERT INTO format_types (name) VALUES ('Écriture');
--- a/app/migrations/applied/020_format_types_sort_and_rename.sql
+++ b/app/migrations/applied/020_format_types_sort_and_rename.sql
@@ -0,0 +1,13 @@
+-- Migration 020: Add sort_order to format_types, rename/reorder entries, add Image
+ALTER TABLE format_types ADD COLUMN sort_order INTEGER NOT NULL DEFAULT 99;
+
+UPDATE format_types SET sort_order = 1 WHERE name = 'Écriture';
+UPDATE format_types SET sort_order = 3 WHERE name = 'Audio';
+UPDATE format_types SET sort_order = 4 WHERE name = 'Vidéo';
+UPDATE format_types SET sort_order = 5 WHERE name = 'Site web';
+UPDATE format_types SET sort_order = 6 WHERE name = 'Performance';
+UPDATE format_types SET sort_order = 7 WHERE name = 'Objet éditorial';
+UPDATE format_types SET sort_order = 8 WHERE name = 'Installation';
+UPDATE format_types SET sort_order = 9 WHERE name = 'Autre';
+
+INSERT OR IGNORE INTO format_types (name, sort_order) VALUES ('Image', 2);
--- a/app/public/admin/fichiers-fragment.php
+++ b/app/public/admin/fichiers-fragment.php
@@ -0,0 +1,17 @@
+<?php
+/**
+ * fichiers-fragment.php (admin)
+ *
+ * Admin-gated HTMX fragment: returns the combined Format(s) + Fichiers block
+ * for the admin add/edit forms.  Wraps the shared logic in fichiers-fragment.php
+ * after enforcing authentication.
+ */
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+App::boot();
+
+AdminAuth::requireLogin();
+
+$_POST['admin_mode'] = '1';
+
+require_once __DIR__ . '/../partage/fichiers-fragment.php';
--- a/app/public/admin/format-website-fragment.php
+++ b/app/public/admin/format-website-fragment.php
@@ -0,0 +1,57 @@
+<?php
+/**
+ * format-website-fragment.php (admin)
+ *
+ * Admin-gated HTMX fragment: returns the Site web URL fieldset for the
+ * admin edit form when "Site web" is among the selected format checkboxes.
+ * Uses id="edit-website-url-fieldset" to avoid collision with the partage form.
+ */
+require_once __DIR__ . '/../../bootstrap.php';
+require_once __DIR__ . '/../../src/AdminAuth.php';
+App::boot();
+
+AdminAuth::requireLogin();
+
+$db = Database::getInstance()->getConnection();
+
+$stmt = $db->prepare('SELECT id FROM format_types WHERE name = ? LIMIT 1');
+$stmt->execute(['Site web']);
+$websiteFormatId = $stmt->fetchColumn();
+
+if (!$websiteFormatId) {
+    echo '<fieldset id="edit-website-url-fieldset" style="display:none"></fieldset>';
+    exit;
+}
+
+$selectedFormats = isset($_POST['formats']) && is_array($_POST['formats'])
+    ? array_map('intval', $_POST['formats'])
+    : [];
+
+if (!in_array((int)$websiteFormatId, $selectedFormats, true)) {
+    echo '<fieldset id="edit-website-url-fieldset" style="display:none"></fieldset>';
+    exit;
+}
+
+$websiteUrl   = htmlspecialchars($_POST['website_url']   ?? '');
+$websiteLabel = htmlspecialchars($_POST['website_label'] ?? '');
+?>
+<fieldset id="edit-website-url-fieldset">
+    <legend>Site web</legend>
+    <div class="admin-form-group">
+        <label for="website_url">URL du site :</label>
+        <div class="admin-file-input">
+            <input type="url" id="website_url" name="website_url"
+                   value="<?= $websiteUrl ?>"
+                   placeholder="https://mon-tfe.erg.be">
+            <small>Si le TFE est un site web, entrez son URL ici. Il sera affiché comme un site embarqué sur la page du TFE.</small>
+        </div>
+    </div>
+    <div class="admin-form-group">
+        <label for="website_label">Légende :</label>
+        <input type="text" id="website_label" name="website_label"
+               value="<?= $websiteLabel ?>"
+               placeholder="Description du site (optionnel)"
+               class="admin-file-label-input"
+               style="max-width:400px;">
+    </div>
+</fieldset>
--- a/app/public/partage/fichiers-fragment.php
+++ b/app/public/partage/fichiers-fragment.php
@@ -0,0 +1,205 @@
+<?php
+/**
+ * fichiers-fragment.php (partage & admin)
+ *
+ * HTMX fragment: returns the combined Format(s) + Fichiers block.
+ * Called on every format checkbox change so the Fichiers fieldset adapts.
+ *
+ * Fixed inputs (always present):
+ *   1. Image de couverture (optional)
+ *   2. Note d'intention (PDF, required unless adminMode)
+ *   3. TFE — multi-file upload (required unless adminMode)
+ *
+ * Format-specific extra inputs (appended after the fixed three):
+ *   - Site web   → URL + label fields
+ *   - Vidéo      → TODO: PeerTube upload (notice shown)
+ *   - Audio      → TODO: PeerTube upload (notice shown)
+ *   - (all others: Écriture, Performance, Objet éditorial, Installation, Autre)
+ *     → no extra input needed beyond the standard TFE file upload
+ *
+ * Expected POST:
+ *   formats[]       — array of selected format_type IDs
+ *   website_url     — current value (repopulation)
+ *   website_label   — current value (repopulation)
+ *   admin_mode      — '1' for admin context (removes required attrs)
+ */
+
+$db = Database::getInstance()->getConnection();
+
+// Load all format types in display order
+$allFormats = $db->query('SELECT id, name FROM format_types ORDER BY sort_order, id')
+                 ->fetchAll(PDO::FETCH_ASSOC);
+
+// Build name→id map for format logic
+$formatIdByName = [];
+foreach ($allFormats as $f) {
+    $formatIdByName[$f['name']] = (int)$f['id'];
+}
+
+$siteWebId = $formatIdByName['Site web'] ?? null;
+$videoId   = $formatIdByName['Vidéo']    ?? null;
+$audioId   = $formatIdByName['Audio']    ?? null;
+$imageId   = $formatIdByName['Image']    ?? null;
+
+$selectedFormats = isset($_POST['formats']) && is_array($_POST['formats'])
+    ? array_map('intval', $_POST['formats'])
+    : [];
+
+$adminMode = ($_POST['admin_mode'] ?? '0') === '1';
+
+$hasSiteWeb = $siteWebId && in_array($siteWebId, $selectedFormats, true);
+$hasVideo   = $videoId   && in_array($videoId,   $selectedFormats, true);
+$hasAudio   = $audioId   && in_array($audioId,   $selectedFormats, true);
+$hasImage   = $imageId   && in_array($imageId,   $selectedFormats, true);
+
+// Show standard file inputs unless *only* Site web is selected
+$hasNonWebFormat = !empty(array_filter(
+    $selectedFormats,
+    fn($id) => $id !== $siteWebId
+));
+$showUploadBlock = $hasNonWebFormat || !$hasSiteWeb;
+
+$websiteUrl   = htmlspecialchars($_POST['website_url']   ?? '');
+$websiteLabel = htmlspecialchars($_POST['website_label'] ?? '');
+
+$hxPost = $adminMode ? '/admin/fichiers-fragment.php' : '/partage/fichiers-fragment';
+?>
+<div id="format-fichiers-block">
+<input type="hidden" name="admin_mode" value="<?= $adminMode ? '1' : '0' ?>">
+
+<!-- ═══════════════════ Format(s) ═══════════════════ -->
+<fieldset>
+    <legend>Format(s)</legend>
+    <div>
+        <span class="admin-row-label">Format(s) du TFE :<?= !$adminMode ? ' <span class="asterisk">*</span>' : '' ?></span>
+        <fieldset class="admin-checkbox-group"
+                  <?= !$adminMode ? 'required aria-required="true"' : '' ?>
+                  hx-post="<?= htmlspecialchars($hxPost) ?>"
+                  hx-target="#format-fichiers-block"
+                  hx-trigger="change"
+                  hx-include="this, [name='website_url'], [name='website_label'], [name='admin_mode']"
+                  hx-swap="outerHTML">
+            <legend class="sr-only">Format(s) du TFE</legend>
+            <ul>
+                <?php foreach ($allFormats as $opt): ?>
+                <li>
+                    <label class="admin-checkbox-label">
+                        <input type="checkbox"
+                               name="formats[]"
+                               value="<?= htmlspecialchars((string)$opt['id']) ?>"
+                               <?= in_array((int)$opt['id'], $selectedFormats, true) ? 'checked' : '' ?>>
+                        <?= htmlspecialchars($opt['name']) ?>
+                    </label>
+                </li>
+                <?php endforeach; ?>
+            </ul>
+        </fieldset>
+    </div>
+</fieldset>
+
+<!-- ═══════════════════ Fichiers ═══════════════════ -->
+<fieldset>
+    <legend>Fichiers</legend>
+
+    <!-- ── 1. Couverture (always) ── -->
+    <?php
+    $name     = 'couverture';
+    $label    = 'Image de couverture (optionnel) :';
+    $accept   = 'image/jpeg,image/png,image/webp';
+    $hint     = 'JPG, PNG ou WEBP. Format 4:3 recommandé. Max 20 MB.';
+    $required = false;
+    include APP_ROOT . '/templates/partials/form/file-field.php';
+    ?>
+
+    <!-- ── 2. Note d'intention (always) ── -->
+    <?php
+    $name     = 'note_intention';
+    $label    = 'Note d\'intention :';
+    $accept   = '.pdf';
+    $hint     = 'PDF uniquement. Max 100 MB. Si votre fichier est trop lourd, compressez-le avec <a href="https://www.bentopdf.com" target="_blank" rel="noopener">bentopdf.com</a>.';
+    $hintRaw  = true; // allow the <a> tag through
+    $required = !$adminMode;
+    include APP_ROOT . '/templates/partials/form/file-field.php';
+    ?>
+
+    <!-- ── 3. TFE (always) ── -->
+    <div class="admin-form-group admin-files-fieldgroup">
+        <label>TFE<?= !$adminMode ? ' <span class="asterisk">*</span>' : '' ?> :</label>
+        <div class="admin-file-input">
+            <input type="file" id="tfe-files-input"
+                   name="files[]" multiple
+                   accept=".pdf,.jpg,.jpeg,.png,.gif,.webp,.zip,.tar,.gz"
+                   class="tfe-file-picker">
+            <small class="admin-file-hint">
+                PDF (max 100 MB) · Images (JPG/PNG/GIF/WEBP) · Archives ZIP/TAR (max 500 MB).
+                PDFs trop lourds ? <a href="https://www.bentopdf.com" target="_blank" rel="noopener">bentopdf.com</a>
+            </small>
+            <ul id="tfe-file-queue" class="tfe-file-queue sortable-list"
+                aria-label="Fichiers sélectionnés (réordonnable)"></ul>
+            <p id="tfe-file-queue-empty" class="tfe-queue-empty">Aucun fichier sélectionné.</p>
+        </div>
+    </div>
+
+    <!-- ── Format-specific extras ── -->
+
+    <?php if ($hasSiteWeb): ?>
+    <!-- Site web -->
+    <fieldset class="fichiers-format-extra" id="fichiers-website">
+        <legend>Site web</legend>
+        <div class="admin-form-group">
+            <label for="website_url">URL du site :</label>
+            <div class="admin-file-input">
+                <input type="url" id="website_url" name="website_url"
+                       value="<?= $websiteUrl ?>"
+                       placeholder="https://mon-tfe.erg.be">
+                <small>Le TFE sera affiché comme un site embarqué sur sa page publique.</small>
+            </div>
+        </div>
+        <div class="admin-form-group">
+            <label for="website_label">Légende :</label>
+            <input type="text" id="website_label" name="website_label"
+                   value="<?= $websiteLabel ?>"
+                   placeholder="Description du site (optionnel)"
+                   class="admin-file-label-input"
+                   style="max-width:400px;">
+        </div>
+    </fieldset>
+    <?php endif; ?>
+
+    <?php if ($hasVideo): ?>
+    <!-- Vidéo — TODO: PeerTube -->
+    <fieldset class="fichiers-format-extra" id="fichiers-video">
+        <legend>Vidéo</legend>
+        <div class="admin-form-group fichiers-todo-notice">
+            <p>
+                🚧 <strong>À venir :</strong> l'upload vidéo sera géré directement via l'API PeerTube.
+                La vidéo sera hébergée sur l'instance PeerTube de l'école et intégrée
+                comme lecteur embarqué sur la page du TFE.
+            </p>
+            <p class="fichiers-todo-workaround">
+                En attendant, déposez votre vidéo dans le champ TFE ci-dessus (ZIP si besoin).
+            </p>
+        </div>
+    </fieldset>
+    <?php endif; ?>
+
+    <?php if ($hasAudio): ?>
+    <!-- Audio — TODO: PeerTube -->
+    <fieldset class="fichiers-format-extra" id="fichiers-audio">
+        <legend>Audio</legend>
+        <div class="admin-form-group fichiers-todo-notice">
+            <p>
+                🚧 <strong>À venir :</strong> l'upload audio sera géré via l'API PeerTube.
+                Le fichier audio sera hébergé sur l'instance PeerTube de l'école et
+                intégré comme lecteur embarqué sur la page du TFE.
+            </p>
+            <p class="fichiers-todo-workaround">
+                En attendant, déposez votre fichier audio dans le champ TFE ci-dessus (ZIP si besoin).
+            </p>
+        </div>
+    </fieldset>
+    <?php endif; ?>
+
+</fieldset><!-- /Fichiers -->
+
+</div><!-- #format-fichiers-block -->
--- a/app/public/partage/index.php
+++ b/app/public/partage/index.php
@@ -28,13 +28,20 @@ if ($slug === 'language-autre-fragment' && $_SERVER['REQUEST_METHOD'] === 'POST'
    exit;
 }

-// Special route: /partage/format-website-fragment (HTMX fragment, no auth needed)
+// Special route: /partage/format-website-fragment (HTMX fragment, legacy — kept for safety)
 if ($slug === 'format-website-fragment' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    App::boot();
    require_once __DIR__ . '/format-website-fragment.php';
    exit;
 }

+// Special route: /partage/fichiers-fragment (HTMX fragment — format-aware fichiers block)
+if ($slug === 'fichiers-fragment' && $_SERVER['REQUEST_METHOD'] === 'POST') {
+    App::boot();
+    require_once __DIR__ . '/fichiers-fragment.php';
+    exit;
+}
+
 // Special route: /partage/recapitulatif?id=N
 if ($slug === 'recapitulatif' || $slug === 'recapitulatif.php') {
    App::boot();
--- a/app/src/Controllers/ThesisCreateController.php
+++ b/app/src/Controllers/ThesisCreateController.php
@@ -23,6 +23,9 @@ class ThesisCreateController
    /** Maximum allowed file size for thesis files (bytes). */
    private const MAX_FILE_SIZE = 500 * 1024 * 1024; // 500 MB

+    /** Maximum allowed file size for PDF files specifically (bytes). */
+    private const MAX_PDF_SIZE = 100 * 1024 * 1024; // 100 MB
+
    /** MIME types accepted for thesis files. */
    private const ALLOWED_MIME_TYPES = [
        // Images
@@ -640,8 +643,10 @@ class ThesisCreateController
                continue;
            }

-            if ($uploads['size'][$i] > self::MAX_FILE_SIZE) {
-                error_log("ThesisCreateController: file too large {$uploads['name'][$i]}, skipping");
+            $isPdf = ($mimeType === 'application/pdf' || $ext === 'pdf');
+            $sizeLimit = $isPdf ? self::MAX_PDF_SIZE : self::MAX_FILE_SIZE;
+            if ($uploads['size'][$i] > $sizeLimit) {
+                error_log("ThesisCreateController: file too large {$uploads['name'][$i]} (" . round($uploads['size'][$i] / 1024 / 1024) . ' MB), skipping');
                continue;
            }

--- a/app/src/Controllers/ThesisEditController.php
+++ b/app/src/Controllers/ThesisEditController.php
@@ -369,6 +369,7 @@ class ThesisEditController
            'zip', 'tar', 'gz', 'tgz',
        ];
        $maxBytes    = 500 * 1024 * 1024; // 500 MB
+        $maxPdfBytes = 100 * 1024 * 1024; // 100 MB for PDFs

        $year       = (int)($post['année'] ?? date('Y'));
        $authorName = trim($post['auteurice'] ?? 'unknown');
@@ -429,8 +430,10 @@ class ThesisEditController
                continue;
            }

-            if ($uploads['size'][$i] > $maxBytes) {
-                error_log("ThesisEditController: file too large {$uploads['name'][$i]}, skipping");
+            $isPdf     = ($mimeType === 'application/pdf' || $ext === 'pdf');
+            $sizeLimit = $isPdf ? $maxPdfBytes : $maxBytes;
+            if ($uploads['size'][$i] > $sizeLimit) {
+                error_log("ThesisEditController: file too large {$uploads['name'][$i]} (" . round($uploads['size'][$i] / 1024 / 1024) . ' MB), skipping');
                continue;
            }

--- a/app/src/Database.php
+++ b/app/src/Database.php
@@ -725,7 +725,7 @@ class Database
     */
    public function getAllFormatTypes(): array
    {
-        $stmt = $this->pdo->query('SELECT * FROM format_types ORDER BY name');
+        $stmt = $this->pdo->query('SELECT * FROM format_types ORDER BY sort_order, id');
        return $stmt->fetchAll();
    }

--- a/app/templates/partials/form/checkbox-list.php
+++ b/app/templates/partials/form/checkbox-list.php
@@ -16,6 +16,7 @@
 *   string  $hxPost    — optional hx-post URL for HTMX live update
 *   string  $hxTarget  — optional hx-target CSS selector for HTMX swap
 *   string  $hxSwap    — optional hx-swap value; default 'outerHTML'
+ *   string  $hxInclude — optional hx-include selector; default 'this, #website-url-fieldset'
 */

 $checked    = $checked    ?? [];
@@ -23,6 +24,7 @@ $required  = $required  ?? false;
 $hxPost     = $hxPost     ?? '';
 $hxTarget   = $hxTarget   ?? '';
 $hxSwap     = $hxSwap     ?? 'outerHTML';
+$hxInclude  = $hxInclude  ?? 'this, #website-url-fieldset';
 ?>
 <div>
    <span class="admin-row-label"><?= htmlspecialchars($label) ?><?= $required ? ' <span class="asterisk">*</span>' : '' ?></span>
@@ -32,7 +34,7 @@ $hxSwap    = $hxSwap    ?? 'outerHTML';
              hx-post="<?= htmlspecialchars($hxPost) ?>"
              hx-target="<?= htmlspecialchars($hxTarget) ?>"
              hx-trigger="change"
-              hx-include="this, #website-url-fieldset"
+              hx-include="<?= htmlspecialchars($hxInclude) ?>"
              hx-swap="<?= htmlspecialchars($hxSwap) ?>"
              <?php endif; ?>>
        <legend class="sr-only"><?= htmlspecialchars($label) ?></legend>
@@ -52,4 +54,4 @@ $hxSwap    = $hxSwap    ?? 'outerHTML';
    </fieldset>
 </div>
 <?php
-unset($checked, $hxPost, $hxTarget, $hxSwap);
+unset($checked, $hxPost, $hxTarget, $hxSwap, $hxInclude);
--- a/app/templates/partials/form/file-field.php
+++ b/app/templates/partials/form/file-field.php
@@ -14,6 +14,7 @@

 $accept   = $accept   ?? '';
 $hint     = $hint     ?? null;
+$hintRaw  = $hintRaw  ?? false; // when true, $hint is emitted as raw HTML
 $required = $required ?? false;
 $multiple = $multiple ?? false;
 $id       = $id       ?? $name;
@@ -31,9 +32,9 @@ $previewId = 'fp-' . htmlspecialchars($id);
               data-preview="<?= $previewId ?>">
        <div id="<?= $previewId ?>" class="file-preview-list" aria-live="polite"></div>
        <?php if ($hint): ?>
-        <small><?= htmlspecialchars($hint) ?></small>
+        <small><?= $hintRaw ? $hint : htmlspecialchars($hint) ?></small>
        <?php endif; ?>
    </div>
 </div>
 <?php
-unset($accept, $hint, $required, $multiple, $id, $previewId);
+unset($accept, $hint, $hintRaw, $required, $multiple, $id, $previewId);
--- a/app/templates/partials/form/form.php
+++ b/app/templates/partials/form/form.php
@@ -230,7 +230,27 @@ $checkedFormatsForSiteWeb = $checkedFormatsForSiteWeb ?? [];
        require APP_ROOT . "/templates/partials/form/jury-fieldset.php";
        ?>

-        <!-- ═══════════════════ Format(s) ═══════════════════ -->
+        <!-- ═══════════════════ Format(s) + Fichiers ═══════════════════ -->
+<?php if ($filesMode === 'add'): ?>
+        <?php
+        // Add / partage mode: Format + Fichiers rendered as one HTMX-swappable block.
+        // Synthesise POST-like data so fichiers-fragment.php can render the initial state.
+        if ($mode === "partage" && isset($helpFn)) {
+            $helpContent = $helpFn("fieldset_files");
+            include APP_ROOT . "/templates/partials/form/form-help-block.php";
+        }
+        // Temporarily populate $_POST so the fragment can read formats/website values.
+        $_savedPost = $_POST;
+        $_POST['formats']       = $checkedFormatsForSiteWeb;
+        $_POST['website_url']   = $existingWebsiteUrl;
+        $_POST['website_label'] = $existingWebsiteLabel;
+        $_POST['admin_mode']    = $adminMode ? '1' : '0';
+        include APP_ROOT . '/public/partage/fichiers-fragment.php';
+        $_POST = $_savedPost;
+        unset($_savedPost);
+        ?>
+<?php else: ?>
+        <!-- Edit mode: Format checkboxes (old website fragment) + existing files management -->
        <fieldset>
            <legend>Format(s)</legend>
            <?php
@@ -239,14 +259,15 @@ $checkedFormatsForSiteWeb = $checkedFormatsForSiteWeb ?? [];
            $options  = $formatTypes;
            $checked  = $formData["formats"] ?? [];
            $required = !$adminMode;
-            $hxPost = "/partage/format-website-fragment";
-            $hxTarget = "#website-url-fieldset";
+            $hxPost     = "/admin/format-website-fragment.php";
+            $hxTarget   = "#edit-website-url-fieldset";
+            $hxSwap     = "outerHTML";
+            $hxInclude  = "this, #edit-website-url-fieldset";
            include APP_ROOT . "/templates/partials/form/checkbox-list.php";
            ?>
        </fieldset>

-        <!-- ═══════════════════ Fichiers ═══════════════════ -->
-<?php if ($filesMode === "edit"): ?>
+        <!-- ═══════════════════ Fichiers (edit mode) ═══════════════════ -->
        <fieldset>
            <legend>Fichiers</legend>

@@ -386,46 +407,30 @@ $checkedFormatsForSiteWeb = $checkedFormatsForSiteWeb ?? [];
                           accept=".pdf,.jpg,.jpeg,.png,.gif,.webp,.mp4,.webm,.mov,.ogv,.mp3,.ogg,.oga,.wav,.flac,.aac,.m4a,.zip,.tar,.gz,.vtt"
                           class="tfe-file-picker">
                    <small class="admin-file-hint">
-                        Types acceptés : PDF · JPG/PNG/GIF/WEBP · MP4/WebM/MOV (vidéo) · MP3/OGG/WAV/FLAC (audio) · ZIP/TAR (archives) · autres fichiers (téléchargement uniquement). Max 500 MB par fichier.
+                        PDF (max 100 MB) · Images (JPG/PNG/GIF/WEBP) · ZIP/TAR (max 500 MB) · autres fichiers.
+                        PDFs trop lourds ? <a href="https://www.bentopdf.com" target="_blank" rel="noopener">bentopdf.com</a>
                    </small>
                    <ul id="tfe-file-queue" class="tfe-file-queue sortable-list" aria-label="Nouveaux fichiers (réordonnable)"></ul>
                    <p id="tfe-file-queue-empty" class="tfe-queue-empty">Aucun nouveau fichier sélectionné.</p>
                </div>
            </div>
-
-
        </fieldset>
-<?php else: ?>
-        <?php
-        if ($mode === "partage" && isset($helpFn)) {
-            $helpContent = $helpFn("fieldset_files");
-            include APP_ROOT . "/templates/partials/form/form-help-block.php";
-        }
-        include APP_ROOT . "/templates/partials/form/fieldset-files.php";
-        ?>
-<?php endif; ?>

-        <!-- Website URL fieldset — shown/hidden via HTMX when "Site web" checked -->
-        <fieldset id="website-url-fieldset" style="display:none">
+        <!-- Website URL fieldset for edit mode — shown/hidden via HTMX -->
+        <fieldset id="edit-website-url-fieldset" style="display:none">
            <legend>Site web</legend>
-
            <div class="admin-form-group">
                <label for="website_url">URL du site :</label>
                <div class="admin-file-input">
-                    <input type="url"
-                           id="website_url"
-                           name="website_url"
+                    <input type="url" id="website_url" name="website_url"
                           value="<?= htmlspecialchars($existingWebsiteUrl) ?>"
                           placeholder="https://mon-tfe.erg.be">
                    <small>Si le TFE est un site web, entrez son URL ici. Il sera affiché comme un site embarqué sur la page du TFE.</small>
                </div>
            </div>
-
            <div class="admin-form-group">
                <label for="website_label">Légende :</label>
-                <input type="text"
-                       id="website_label"
-                       name="website_label"
+                <input type="text" id="website_label" name="website_label"
                       value="<?= htmlspecialchars($existingWebsiteLabel) ?>"
                       placeholder="Description du site (optionnel)"
                       class="admin-file-label-input"
@@ -433,7 +438,7 @@ $checkedFormatsForSiteWeb = $checkedFormatsForSiteWeb ?? [];
            </div>
        </fieldset>
        <?php
-        // Server-side: show if Site web already checked (e.g. on error redirect)
+        // Server-side: show website fieldset if Site web already checked
        $_stmt = Database::getInstance()
            ->getConnection()
            ->prepare("SELECT id FROM format_types WHERE name = ? LIMIT 1");
@@ -447,9 +452,10 @@ $checkedFormatsForSiteWeb = $checkedFormatsForSiteWeb ?? [];
                true,
            )
        ) {
-            echo '<script>document.getElementById("website-url-fieldset").style.display=""</script>';
+            echo '<script>document.getElementById("edit-website-url-fieldset").style.display=""</script>';
        }
        ?>
+<?php endif; ?>

        <!-- ═══════════════════ Métadonnées complémentaires ═══════════════════ -->
        <?php include APP_ROOT .