Commit Graph

244 Commits

Author SHA1 Message Date
Pontoporeia
13d26ded66 Replace HTMX+PHP file upload queues with client-side JS
Drops the session-backed HTMX incremental upload system in favour of a
single JS module that manages `File` objects client-side and injects
them into `FormData` on submit.

Key changes:

* `file-upload-queue.js`: client-side queues with validation, reorder
  (SortableJS), removal, dirty-state tracking, and fetch-based submit
  with manual redirect handling
* `fichiers-fragment.php`: empty queue containers for JS-managed queues;
  HTMX format switching still works with queue rehydration after swap;
  annexe uploads now support multiple files
* Form UI cleanup: moved existing files and cover preview into the
  `Fichiers` fieldset (edit mode); removed redundant queue labels while
  keeping labels for single-file inputs (`couverture`,
  `note d'intention`); added delete buttons for existing files
* `ThesisFileHandler.php`: added
  `handleTfeQueueFiles()`/`handleAnnexeQueueFiles()` reading from
  `$_FILES['queue_file']`; introduced `extractFilesSubArray()` for
  nested upload arrays; removed session-based queue handling
* `ThesisCreateController.php` &
  `ThesisEditController.php`: switched to extracted
  `['queue_file']` uploads
* `beforeunload-guard.js`: now also watches
  `window.__xamxamDirty`
* Deleted obsolete PHP upload/remove/reorder queue endpoints for
  `partage` and `admin`
* Cleaned up route dispatch in `partage/index.php`
* Misc form and styling updates in templates/CSS
* Added `docs/cms-migration-plan.html`
2026-05-19 00:08:05 +02:00
Pontoporeia
98ed83fac2 fix: scoped HTMX file validation, add validation to TFE/PeerTube inputs
- Wrap file-field.php validation in <form> to scope hx-include (fixes
  cross-field contamination where cover change triggered note_intention
  validation)
- Add inline MIME/size validation to upload-tfe-file.php
- Add inline validation to PeerTube video/audio and direct video/audio
  file inputs in format-extras-block
- Fallback in validate-file-fragment-shared.php: if field_name doesn't
  match any $_FILES key, try the first uploaded file (handles
  PeerTube inputs where name differs from field_name)
- Fix file-field.php admin_mode using $adminMode variable instead of
  undefined ADMIN_MODE constant
2026-05-19 00:08:05 +02:00
Pontoporeia
ca7707cd47 refactor: session-based incremental TFE upload via HTMX, drop SortableJS
Replace the client-side FileArray + Sortable drag-to-reorder with a
server-side session-based upload flow:

- New endpoints: /partage/upload-tfe-file, /partage/remove-tfe-file
  (and /admin/ variants) — single-file incremental upload via HTMX
  multipart/form-data with progress bar support
- Session storage: uploaded files go to STORAGE_ROOT/uploads/{session_id}/
  with metadata in $_SESSION['tfe_uploads']
- file-upload-queue.js reduced to single-file previews only (couverture,
  note_intention, annexes thumbnails)
- ThesisFileHandler gains handleTfeFilesFromSession + writeTfeFileFromSrc
  + cleanupSessionUploads for final commit from session temp
- Sortable.min.js removed from all script tags; drag handles and ghost
  CSS removed
- No file_orders[]/file_labels[] hidden field injection needed
- Upload queue survives page refresh (server-owned list)

This eliminates the SortableJS dependency entirely while keeping the
same UX: pick files, see them in a queue, remove individual files.
2026-05-19 00:08:05 +02:00
Pontoporeia
e06a317499 fix: req annexes, add HTMX inline file validation (MIME/size)
- Annexes file input now required when 'has_annexes' checkbox is checked
- PHP-side validation: if has_annexes but no files, throw error
- HTMX inline file validation: POSTs to validate-file-fragment on file change
  - Validates MIME type against per-field whitelists (couverture, note_intention,
    tfe, annexes)
  - Validates file size with PDF-specific 100MB limit
  - Supports both single-file and multi-file inputs
  - Returns green ✓ or red ✕ inline validation messages
- Shared validation logic in src/Controllers/validate-file-fragment-shared.php
- Admin wrapper: admin/validate-file-fragment.php (with AdminAuth guard)
- Partage route: /partage/validate-file-fragment (dispatched via index.php)
- CSS: .file-validation-msg, .fv-ok (green), .fv-error (red)
- file-field.php: accepts $fieldName for per-input validation type,
  auto-detects admin/partage validate URL
2026-05-19 00:08:05 +02:00
Pontoporeia
a1a5d4609f fix: TFE and annexes files not saved, plus keyword validation and file preview CSS
- ThesisCreateController::submit() was missing call to handleAnnexeFiles
- ThesisEditController::save() was missing annexe upload handling
- handleAnnexeFiles now applies ALLOWED_MIME_TYPES/ALLOWED_EXTENSIONS validation
  (same restrictions as TFE files, formerly only size was checked)
- Use correct $_FILES key 'annexes' (matching the form input name)
- Relax keyword minimum: admin create/edit require 1+, student (partage) requires 3
- Add CSS styles for file preview items (.fp-item, .fp-thumb, .fp-icon,
  .fp-meta, .fp-name, .fp-size) so multi-file previews (annexes, etc.) wrap correctly
- Fix TFE file input accept attribute in fichiers-fragment.php to include
  video/audio/archive extensions
2026-05-19 00:08:05 +02:00
Pontoporeia
38dc8de9d8 feat: obfuscate all email addresses and mailto links as HTML entities
Added EmailObfuscator class (src/EmailObfuscator.php) that converts
email addresses to HTML decimal entities (e.g. &#102;&#111;&#111;@...)
so browsers render them correctly but bots and scrapers see gibberish.

Methods:
- email($addr): obfuscate for display in HTML content
- mailto($addr): return obfuscated mailto: href
- obfuscateHtml($html): post-process rendered HTML to obfuscate all
  mailto: links (used after Parsedown/Markdown rendering)

Applied to:
- partage/index.php: mailto link at top + error scenarios via _flash_contact
  flag rendered in form.php (outside htmlspecialchars to avoid double-escape)
- admin/acces.php: request email mailto links
- admin/file-access.php: request email mailto links
- public/about.php: contact email mailto links
- public/tfe.php: author contact mailto links
- AboutController: Parsedown output post-processing
- LicenceController: Parsedown output post-processing
- Dispatcher::render(): require_once EmailObfuscator for all public views

Also fixed _flash_contact session flag in form.php partial to show
contact email line on share link validation errors (separate from
flash_error/warning to bypass htmlspecialchars double-escaping).
2026-05-19 00:08:05 +02:00
Pontoporeia
ab6e266807 fix: add help email, preserve file names on validation error, license fix
The share link (partage) form does not expose a license field and does
not send access_type_id (defaults to 2/Interne). Server-side validation
was unconditionally requiring a license for non-admin submissions,
causing all share link submissions to fail.

Now the license check is gated on adminMode=false AND accessTypeId=1
(Libre), matching the client-side HTMX fragment behaviour in
licence-fragment.php. Also fixed a use-before-definition where
accessTypeId was referenced before being assigned.

Student form improvements:
- Add xamxam@erg.be mailto link at top of form
- On validation error, append "Si le problème persiste, envoyez un
  e-mail à xamxam@erg.be" to the flash message
- Preserve uploaded file names across validation redirects: store in
  session (share_primed_files_<slug>), display as warning on form
  re-render so the student knows which files to re-select

- License: only required for non-admin when access_type_id=1 (Libre),
  not for Interne (2) or Interdit (3). Fixes share link submissions
  failing with "Veuillez sélectionner une licence". Also fixed
  use-before-definition of accessTypeId.
2026-05-19 00:08:05 +02:00
Pontoporeia
6224e3ede0 Fix language-search fragment
- mots-clé and language where sharing the same q variable for the input value; they now have unique variables.

The admin language-search-fragment was missing App::boot() which the tag-search
fragment had. This caused the language suggestion dropdown to not return results
in Firefox. Both fragments now follow the same bootstrap pattern.

Rewrote language-search-fragment.php to use the same clean pattern as
tag-search-fragment.php: ->searchLanguages(), simple exact match check,
no predefined exclusion list. Both fragments now share identical structure.

fix: exclude main languages (français, anglais, néerlandais) from language-search suggestions
2026-05-19 00:08:05 +02:00
Pontoporeia
a3ded16915 Add sidebar TOC, simplify Données Secondaires section
- Rename 'Éditer Données Secondaires' → 'Données Secondaires', remove fieldset wrapper on Mots-clés link
- Create admin-toc.php partial: IntersectionObserver-based sidebar nav
- Include TOC on contenus.php, acces.php, parametres.php
- Add .admin-with-toc flex layout (sidebar + main) and .admin-toc CSS
- Fonts (Ductus, BBB DM Sans): verified loaded via variables.css → common.css import chain
- TOC: move inside <main> as <aside>, content in <article>, fix scrolling
- Lazy load: hx-trigger='load delay:100ms' with spinner (htmx-indicator) for tags/langues
- Inline rename: edit button in Nom cell, HTMX post for rename, validate+ cancel buttons
- Checkbox column: width:1% / fit-content
- Remove per-row merge forms/selects, only bulk merge when ≥2 checkboxes selected
- Remove per-row merge dialogs, keep only bulk merge and delete dialogs
- Add htmx-settling CSS transition for lazy-load fade-in
- Update acces.php/parametres.php: article layout, TOC inside main
- TOC: DOMContentLoaded guard, use <nav>+<a> directly instead of <ul>/<li>
- Section spacing: margin-bottom on sections and fieldsets in admin-main--toc
- Language dedup: GROUP BY LOWER(name) in getAllLanguagesWithCount and searchLanguages
- deduplicateLanguages() merges duplicate names and reassigns thesis_languages
- Sticky bulk-actions: position:sticky;top:0;z-index:10
- Tags toolbar: title left, stat count right (margin-left:auto), search bar under
- Tags count stat updated via hx-swap-oob from fragment
- Remove margin/max-width from .admin-main--toc
- Gap between TOC and article: --space-xs, sticky top: --space-xs
- Main padding: --space-s / --space-m / --space-xl (was --space-l/--space-l/--space-2xl)
- Article padding-top: --space-m
2026-05-19 00:08:05 +02:00
Pontoporeia
396cf19e9f Add Mots-clés and Langues management to contenus page
- Add searchLanguages, getAllLanguagesWithCount, renameLanguage, mergeLanguage, deleteLanguage to Database
- Create actions/language.php handler with rename/merge/merge_bulk/delete actions
- Add merge_bulk action to actions/tag.php
- Add Mots-clés section to contenus template with HTMX search, select checkboxes, rename/delete/merge buttons, and multi-select merge toolbar
- Add Langues section to contenus template with same pattern
- Create contenus-tags-fragment.php and contenus-languages-fragment.php HTMX fragments
- Remove form-settings- from flat-fieldset CSS selector so fieldsets in contenus retain border/padding
- contenus.php: add 'Gérer les mots-clés' link to /admin/tags.php
- contenus.php: add Langues fieldset with HTMX search + table (rename/merge/delete/bulk)
- tags.php: add HTMX search bar, checkbox column, bulk merge toolbar
- Create tags-fragment.php and contenus-langues-fragment.php for HTMX
- Remove tab component and associated CSS
- Simplify JS: separate tags/langues-prefixed functions
- Fix redirects: tag.php defaults to /admin/tags.php, supports return override
- Keep tags.php standalone page and Mots-clés button unchanged
2026-05-19 00:08:05 +02:00
Pontoporeia
494675d78c Move Formulaire settings to contenus, remove delete-all TFE
- Removed 'Supprimer tous les TFE' danger zone from parametres (template, dialog,
  backend handler, Database::deleteAllTheses(), AdminLogger method)
- Moved Formulaire section (access type toggles, restricted files) from parametres
  to contenus under new h2 'Paramètres du Formulaire'
- Moved Types de travaux from parametres to contenus as sub-section under
  Paramètres du Formulaire
- Existing 'Structure du formulaire' section now a sub-heading (h3) under
  Paramètres du Formulaire in contenus
- Sub-sections: Restrictions d'accès aux fichiers, Degré d'ouverture,
  Types de travaux, Structure du Formulaire
- Added siteSettings query to contenus controller
2026-05-19 00:08:05 +02:00
Pontoporeia
048a14bc2e Add language-search component for Autre Langue input + active search in lists
Mirrors the mots-clé tag-search system: dropdown suggestions from
existing languages via HTMX, pill display with bin-icon remove buttons,
'Créer' option for new languages. Replaces the plain text input.

- New partial: templates/partials/form/language-search.php
- New fragment: public/partage/language-search-fragment.php
- Admin wrapper: public/admin/language-search-fragment.php
- Updated language-autre-fragment to return just the required asterisk indicator
- Updated both controllers to handle language_autre as array (pill-based)
  with backward-compatible string path
- Updated edit form to compute selectedOtherLanguages from DB
- Registered new route in partage/index.php
- Fix CSV importer: split comma-separated language column into individual entries
- Add htmx active search to admin index, title line-clamp, predefined languages only in checkboxes
- Admin index: filter form now uses htmx triggers (input delay:300ms on search,
  change on selects) to actively search without page reload
- Sort links include hx-push-url for back-button support
- Added loading indicator bar (.admin-search-indicator)
- Title column: line-clamp at 2 lines with overflow hidden, native title attr
  tooltip for full text
- Language checkboxes now show only 3 predefined languages (Français, Anglais,
  Néerlandais); all others go via the Autre langue search component
- Added Database::getPredefinedLanguages() and excluded predefined from
  language-search-fragment suggestions
- Included hidden sort/dir inputs in table-wrap so sort state preserved across
  filter changes
- Fix language-search: block 'Créer' for predefined languages in dropdown
  The 'Créer' option in the language-search dropdown now also checks against the
  predefined set (français, anglais, néerlandais) to avoid offering creation of
  languages that already exist as checkboxes.
2026-05-19 00:08:05 +02:00
Pontoporeia
96fa8ee266 CSV importer: boolean and ap variants/typos
- add AP aliases for:
  - Design & politique du multiple → DPM,
  - Pratiques artistiques & complexité scientifique → PACS,
  - Narraion Speculative typo → NS
- Fix: OUI/NON CSV artefacts in contact_interne — clean DB, guard in findOrCreateAuthor and CSV import
- Cleaned 141 authors.email = 'NON' rows → NULL in dev DB
- findOrCreateAuthor: treat OUI/NON as null (CSV boolean artefact in email column)
- CSV import: sanitize contact column — OUI/NON → empty string before passing to findOrCreateAuthor
2026-05-19 00:08:05 +02:00
Pontoporeia
fa30aab368 Rename author_email→contact_interne, author_show_contact→contact_public across view/controllers/templates
- v_theses_full: author_email→contact_interne, author_show_contact→contact_public
- Updated schema.sql and live DB view
- Renamed all PHP variables: currentAuthorEmail→contactInterne, currentAuthorShowContact→contactPublic
- Restored contact_interne backoffice field with proper wiring (takes precedence over mail field)
- Updated admin/add.php, admin/edit.php, partage/index.php, public/tfe.php templates
2026-05-19 00:08:05 +02:00
Pontoporeia
8a4b2541fb Fix: email clearing in findOrCreateAuthor, htmlspecialchars(null) crash in old(), dead contact_interne field, access_type_id radio clearing
- findOrCreateAuthor: always update email column (pass null when empty/falsy) so clearing an email actually persists
- admin/add.php & admin/edit.php old(): add null guard before htmlspecialchars, cast to string
- jury-fieldset.php: guard against old() returning array for scalar-checked jury_lecteur keys
- formulaire.php: only suppress display_errors in production (not cli-server dev mode)
- Removed dead contact_interne field from backoffice form (no DB column, never saved)
- Removed dead contactInterne validation from ThesisCreateController
- Added "— Non défini" radio option for access_type_id in admin mode for clearing
- Fixed strict int-vs-string comparison breaking radio button checked detection
2026-05-19 00:08:05 +02:00
Pontoporeia
6cc0e407f3 Error tests, FK violations fix
- ErrorHandler tests: 77 assertions covering FK extraction, normalization, dedup, edge cases. Fix FK table map for child tables.
- Fix FK violation: (int)null → 0 in createThesis for orientation/ap/finality/license FK columns. Add FK value logging to updateThesis.
- Add CURRENT_ISSUES.md with summary of FK violation, dev debugging, and tag dedup status for next conversation
2026-05-19 00:08:05 +02:00
Pontoporeia
a80b2c08bf Admin mobile block: fix inline style beating media query 2026-05-19 00:08:05 +02:00
Pontoporeia
6614b04dbd Fix bulk form nesting, remove count bar, stopPropagation on actions
- Remove admin-bulk-meta__default (TFE count bar) — only bulk actions on selection
- Move #bulk-form out of table wrapper to avoid nested forms (was breaking
  per-row publish/unpublish which submitted to bulk form instead)
- execBulk() now populates #bulk-checkboxes with hidden inputs from checked boxes
- Add event.stopPropagation() to edit link and delete+publish forms so
  clicking actions doesn't navigate the row to recapitulatif
- Delete button: only opens confirm modal, no row nav
2026-05-19 00:08:05 +02:00
Pontoporeia
b6908f7453 Rename Liens étudiant·e, add link name + edit dialog
- Rename 'Accès étudiant·e' → 'Liens étudiant·e' in acces.php
- Add 'name' column to share_links (schema.sql + ALTER TABLE migration)
- ShareLink::create() now accepts optional  parameter
- Add ShareLink::update() method for name/password/expiration
- Add 'update' action to acces-etudiante.php controller
- Remove Visiter (play) button; row click opens link in new tab
- Add edit dialog with name, password, expiration fields
- Add pen icon button to open edit dialog per row
- Add Nom column to table (also in archived links section)
2026-05-19 00:08:05 +02:00
Pontoporeia
7711557d08 refactor: Admin index — replace emoji buttons with Phosphor SVG icons, add back buttons + row click navigation, minimal JS, move export DB to Exporter modal, color stats, bulk bar anti-shift, credits reorder, tags icons 2026-05-19 00:08:05 +02:00
Pontoporeia
dc3191f458 add explanation hint to is_published checkbox in Backoffice fieldset 2026-05-19 00:08:05 +02:00
Pontoporeia
bcf683c5c1 Merge Publication fieldset's is_published checkbox into Backoffice fieldset
Move the is_published checkbox from its own separate Publication fieldset
into the Backoffice fieldset (as item #8). This means the publish control
is now present in both add and edit admin forms (previously it was only
shown in edit mode via $showPublish).
2026-05-19 00:08:05 +02:00
Pontoporeia
c4a23d5c2d Remove duration_pages/duration_minutes/file_size_info; rename cc4r → cc2r in DB and code 2026-05-19 00:08:05 +02:00
Pontoporeia
cc0ae32df0 fix: resolve partage form submission issues
- Replace mb_strlen/mb_substr/mb_strtolower with strlen/substr/strtolower
  (mbstring extension missing on server, causing fatal error)
- Scope annexes checkbox HTMX swap to #annexes-input-block with hx-select
  (prevents duplicating entire page inside Fichiers fieldset)
- Split format+fichiers response: #format-fichiers-block (stable) and
  #format-extras-block (swappable, inside Fichiers fieldset). Format
  checkboxes use hx-select to extract only the extras, preserving file queue.
- Keep format extras inline in Fichiers fieldset (no sub-fieldsets). Remove
  website legend input (URL only).
- When PeerTube upload disabled, show direct file upload inputs for
  video/audio (name=files[]).
- Add "Glissez-déposez" sort hint below TFE file queue.
- Fix .fq-name overflow with width:0;min-width:100% chain.
- Remove legend placeholder from .fq-item.
- Merge "Récits et expérimentation" AP into "Narration Spéculative".
  Rename PACS to "Pratique de lart - outils critiques, arts et contexte
  simultanés".
- Remove président·e field from jury fieldset, form templates, and
  controller validation. Keep DB column and display logic for existing data.
2026-05-19 00:08:05 +02:00
Pontoporeia
59bbcf4642 css: moved + tweaked styles to common.css
- Add baseline input[type="checkbox"] and input[type="radio"] styling
  in common.css (accent-color, size, cursor, flex-shrink)
- Give select a solid background (var(--bg-primary)) and its own focus rule
- Remove now-redundant checkbox accent-color/size from
  .admin-checkbox-label (form.css) and .param-checkbox (admin.css)
- Simplify .search-filter-select (repertoire.css) to inherit common
  select defaults (border, background, arrow icon)
- Keep all layout-specific classes in form.css and admin.css intact
- Add baseline input[type="checkbox"] and input[type="radio"] styling
  in common.css (accent-color, size, cursor, flex-shrink)
- Give select its own rule block with same shape as text inputs
  (transparent background, same padding/border/radius/focus)
- Remove now-redundant checkbox accent-color/size from
  .admin-checkbox-label (form.css) and .param-checkbox (admin.css)
- Simplify .search-filter-select (repertoire.css) to inherit common
  select defaults
- Keep all layout-specific classes in form.css and admin.css intact
- Remove bottom-border/border-radius:0 overrides from .admin-form,
  .admin-inline-form, .param-form, and .param-grid inputs/selects
- Change required-field indicator from border-bottom-style to
  border-style: dashed to work with full-border approach
- Update param-grid aria-invalid from border-bottom-color to border-color
- All text inputs, selects, and textareas now inherit the full-border
  style from common.css (border, border-radius, padding, focus ring)
- .password-gate input[password]: remove redundant padding override
- .retry-email-form input[email]: remove redundant border/border-radius/
  padding/box-sizing, keep only font-size (larger) and width
- .tfe-access-request-form input/textarea: remove broken references to
  undefined vars (--border, --background, --accent), now inherit from
  common.css. Remove redundant focus rule.
- .fhb-name-input: strip redundant padding/border/radius/font-size/font
- .admin-inline-form input/select: strip redundant font-size
- .param-checkbox: remove font-size (inherits from body)
- .param-checkbox small: remove redundant color + font-size (common.css small already sets both)
- .param-note: remove font-size
- .param-account-status: remove font-size
- .param-smtp-test-row label: remove display:block + font-size (common.css label)
- .param-smtp-status: remove font-size
- .param-grid label: remove font-size
- Remove .param-form legend padding override (now inherits common.css legend)
- Remove .param-danger-zone legend padding override
- Remove .param-export-zone legend padding override
- Remove .param-fieldset-inline legend entirely (only rule was padding)
- Remove .licence-explanation legend entirely (all properties identical to common.css legend)
- All fieldsets now consistently use common.css fieldset padding
  (0 var(--space-m) var(--space-m) var(--space-m))
- The common.css fieldset has padding-top: 0, which leaves checkboxes
  and other content tight against the legend. Add var(--space-s) top
  padding so the first content row has proper spacing from the legend.
2026-05-19 00:08:05 +02:00
Pontoporeia
013317c97f link creation: fieldset with checkboxes for objet restriction, TFE checked by default
link creation: fieldset with checkboxes for objet restriction, TFE checked by default; password/expiration in second fieldset 'Accès'
2026-05-19 00:08:05 +02:00
Pontoporeia
21c2b55bfb style: normalize headers, overtype editor rounded corners, remove duplicate cover preview, thesis-add-header grid layout, subtitle below header with top gradient 2026-05-19 00:08:05 +02:00
Pontoporeia
7ccadbb224 refactor public search bar
- one big input with positioned magnifying glass icon
- fix search input left padding to prevent placeholder overlapping magnifying glass
- add !important to search input styles to override base form element rules
- reduce search input vertical padding
- bump search input vertical padding to space-2xs
2026-05-19 00:08:05 +02:00
Pontoporeia
862ed02136 style: unify form element styles in common.css, redesign focus rings, refactor public search bar, tweak admin section 2026-05-19 00:08:05 +02:00
Pontoporeia
77fd282e29 refactor: unify edit mode Format+Fichiers with add/partage HTMX fragment
- Edit mode now uses the same fichiers-fragment.php as add and partage,
  instead of duplicating the format checkboxes + new-file upload + website
  URL fieldsets.
- Edit-only elements (existing files list, cover replace) stay in
  a separate #edit-existing-files-block below the shared fragment.
- Removed .zip/.tar/.gz from the main TFE upload accept in both
  fichiers-fragment.php and fieldset-files.php. Archives go only
  in the Annexes file input.
- Removed admin/format-website-fragment.php dependency from edit
  (no longer needed — the shared fragment handles website too).

fix: jury repop crash + hx-preserve on file inputs, remove zip/tar from tfe accept

- Jury fieldset add-mode repopulation now handles both scalar (legacy)
  and array (new dynamic multi-row) values for jury_promoteur and
  jury_promoteur_ulb_name. htmlspecialchars() was choking on array value.
- All file inputs in fichiers-fragment.php wrapped in hx-preserve
  containers so HTMX swaps don't wipe user-selected files when toggling
  formats or the annexes checkbox.
- Removed .zip/.tar/.gz from main TFE file accept — archives only via
  annexes input (which already had multiple + correct accept).
- Edit mode now reuses the same fichiers-fragment.php fragment.

fix: file inputs re-initialize after HTMX swap via inline script

- Exposed window.XamxamInitFileUploads from file-upload-queue.js IIFE
  so HTMX fragments can trigger re-binding without a global listener.
- fichiers-fragment.php emits <script>XamxamInitFileUploads()</script>
  at the end of the #format-fichiers-block fragment.
- Removed hx-preserve wrappers — they prevented re-render after
  format/annexes toggles changed visible inputs.
- This also fixes .zip removal from TFE accept and jury repopulation
  array crash from the previous commit.

refactor: simplify file-upload-queue.js, remove file-preview.js

- file-upload-queue.js rewritten from ~250 lines to ~120 lines:
  no more DataTransfer machinery, no IIFE wrapper, uses .onchange
  instead of addEventListener for simpler HTMX re-init.
- window.XamxamInitFileUploads is the function itself (not an IIFE export).
- Merged file-preview.js functionality into file-upload-queue.js
  (single-file .data-preview handling). Deleted file-preview.js.
- fichiers-fragment.php inline script calls XamxamInitFileUploads()
  after every HTMX swap (same as before).

debug: add console.log to file-upload-queue.js for file input behavior

Adds logging at key points to diagnose why only one file is displayed:
- XamxamInitFileUploads called
- TFE queue picker init (id, multiple attribute state)
- onchange event (files count, names)
- fileArray post-concat length
- Single-file preview bindings (id, multiple attribute)

Remove after debug session.
2026-05-13 18:03:33 +02:00
Pontoporeia
8f4f9d00b4 Refactor: Form improvements and cleanup: note contextuel, annexes, fichiers
1. fix: form improvements — multiple promoteurices, asterisks, contact dedup, bentopdf

- Multiple promoteurice (interne + ULB): both fieldsets now support dynamic
  add/remove rows (same pattern as lecteurs). field names changed to arrays
  (jury_promoteur[], jury_promoteur_ulb_name[]). Controllers accept both
  scalar and array forms for backwards compat.
- ULB promoteurice: when finality=Approfondi, asterisk appears on legend
  and first ULB input is marked required (JS toggle). Non-Approfondi hides
  the fieldset and clears values.
- Contact visibility duplication: removed redundant contact_public checkbox
  from admin add/edit forms (showContact=false). The 'mail' field in
  fieldset-tfe-info already serves this purpose.
- Asterisk fixes: website URL field now has asterisk+required when Site web
  format selected. Video/audio already had correct required handling.
- bentopdf link: clearer full URL 'https://bentopdf.com/' in both
  fichiers-fragment.php and form.php (edit mode)

2. refactor: merge Note contextuelle into Backoffice, add Lien BAIU, reorder fields

Backoffice fieldset now contains in order:
1. Note contextuelle (was standalone fieldset)
2. Points du jury
3. Remarques
4. Lien BAIU (moved from Métadonnées complémentaires)
5. Exemplaire physique BAIU
6. Exemplaire physique ERG
7. Contact interne


Métadonnées complémentaires now only has: pages, minutes, annexes checkbox.
Removed dead showContextNote variable from form.php, add.php, edit.php.
Controller baiu_link still mapped to input name "lien" (no migration needed).

3. refactor: move annexes checkbox from Métadonnées into Fichiers fieldset

- Removed 'Ce TFE comporte des annexes' checkbox from
  fieldset-metadata.php.
- Added annexes checkbox + conditional file input to
  fichiers-fragment.php. When checked, an HTMX swap reveals
  the 'annexes' file input (multiple, PDF or ZIP/TAR, max 500 MB).
- form.php seeds ['has_annexes'] for initial fragment render.
- Métadonnées complémentaires now only contains pages + minutes.
2026-05-13 17:59:13 +02:00
Pontoporeia
03c5fd217e feat: dual upload system — direct file storage + PeerTube API integration
Adds a parallel PeerTube upload system behind a feature flag (disabled by default
until upload quota is granted). When disabled, the existing direct file upload
path works unchanged.

Files:
- src/PeerTubeService.php — credential storage (encrypted), OAuth2 token
  retrieval, multipart upload to /api/v1/videos/upload
- migrations/021_peertube_settings.sql — peertube_settings singleton table
  + peertube_upload_enabled site_setting (default 0)
- admin/actions/settings.php — peertube section handler
- admin/parametres.php / templates/admin/parametres.php — PeerTube UI section
- partage/fichiers-fragment.php — shows file inputs when enabled, TODO notice otherwise
- ThesisCreateController / ThesisEditController — handlePeerTubeUpload()
- tfe.php — PeerTube iframe embed detection
- AdminLogger — logPeerTubeUpdate()
2026-05-13 17:59:13 +02:00
Pontoporeia
e6829994b6 Refactor + feat: unify format/fichiers HTMX fragment, reorder format types, add file constraints, fix admin auth
* **Unified Format + Fichiers into a single HTMX fragment**

  * Introduced `app/public/partage/fichiers-fragment.php` as shared dynamic block returning both format checkboxes and adaptive “Fichiers” fieldset
  * Logic adapts inputs based on selected formats:

    * no selection / upload formats → standard file inputs
    * “Site web” → URL fields only
    * “Site web + upload” → file inputs + URL sub-fieldset
  * Added admin wrapper: `app/public/admin/fichiers-fragment.php` (gated via `admin_mode=1`)
  * Added `app/public/admin/format-website-fragment.php` for edit-mode website URL toggling
  * Wired route `/partage/fichiers-fragment` in `app/public/partage/index.php`
  * Refactored `form.php` (add/edit partage) to use single `#format-fichiers-block` instead of separate fragments
  * Edit mode format checkboxes now target `format-website-fragment.php` → `#edit-website-url-fieldset`
  * Added `$hxInclude` support in `checkbox-list.php` for configurable HTMX includes

* **Format system migration + ordering**

  * Migration `020_format_types_sort_and_rename.sql`:

    * added `sort_order` column to `format_types`
    * inserted new format **Image**
    * defined ordering: Écriture · Image · Audio · Vidéo · Site web · Performance · Objet éditorial · Installation · Autre
  * `Database.php`: format queries now use `ORDER BY sort_order, id`
  * `fichiers-fragment.php`:

    * uses ordered format list
    * resolves Image/Vidéo/Audio by name
    * introduces `$hasImage` flag
    * preserves `admin_mode` across HTMX requests

* **File constraints and UX updates**

  * Enforced **100 MB PDF limit**

    * `ThesisCreateController`: `MAX_PDF_SIZE = 100MB` for PDFs only
    * `ThesisEditController`: same PDF-specific constraint applied
    * Other file types remain capped at 500 MB
  * Updated UI hints in `fichiers-fragment.php` and edit form:

    * explicitly mention 100 MB PDF limit
    * added reference to `bentopdf.com` for compression guidance
  * `file-field.php`: added `$hintRaw` to allow HTML rendering in hints

* **Admin authentication fix**

  * Fixed missing auth in admin fragments
  * Added `require_once AdminAuth.php`
  * Replaced direct usage with `AdminAuth::requireLogin()`
  * Applied consistent pattern with existing fragment authentication approach

* **Migrations included**

  * `019_add_ecriture_format.sql`
  * `020_format_types_sort_and_rename.sql`

* **Files affected**

  * Controllers: `ThesisCreateController`, `ThesisEditController`
  * DB layer: `Database.php`
  * Public fragments: `partage/fichiers-fragment.php`, `admin/fichiers-fragment.php`, `admin/format-website-fragment.php`
  * Templates: `form.php`, `checkbox-list.php`, `file-field.php`
  * Routing: `partage/index.php`
  * Misc: `TODO.md`

This consolidates format normalization, HTMX UI simplification, file validation rules, and admin stability fixes into a single coherent system update.
2026-05-13 17:59:13 +02:00
Pontoporeia
7e35bba530 Encrypt SMTP password at rest with AES-256-GCM 2026-05-13 17:59:13 +02:00
Pontoporeia
95fcbc919a Remove required from all admin add/edit form inputs
- Skip required-field validation for orientation/ap/finality/licence/jury in admin add+edit
2026-05-13 17:59:13 +02:00
Pontoporeia
5735ccbc38 Fix issues with nginx access to pages
- fix: 403 on /language-autre-fragment.php — add explicit nginx location block

  The nginx catch-all  blocked direct access
  to all PHP files except /index.php and files inside /admin/.

  language-autre-fragment.php lives at the public root and is POSTed to by
  HTMX from both the admin edit form and the partage form. Added an explicit
   fastcgi block so it is executed
  rather than denied.

- fix: replace .php-suffixed public URLs blocked by nginx catch-all

  Audit of all client-facing PHP URL references against nginx routing:

  - fetch('/request-access.php') in tfe.php -> '/request-access'
    (clean URL already routed by Dispatcher)
  - /media.php?path= in form.php (x2) and admin/recapitulatif.php -> /media?path=
    (nginx only has location = /media, no location for /media.php)

  All these .php-suffixed URLs hit the nginx catch-all
    location ~ \.php$ { deny all; }
  which takes precedence over location / { try_files ... } for regex matches.
2026-05-13 17:58:29 +02:00
Pontoporeia
6ba13e00ea test: add ShareLinkTest + PureLogicTest (TDD), fix coverMap undefined in SearchController 2026-05-08 22:58:25 +02:00
Pontoporeia
15d54fa19e add Néerlandais language option and make language_autre conditionally required 2026-05-08 22:58:25 +02:00
Pontoporeia
f3d9615562 merge banners into covers: remove banner field, migrate files, add covers to search/home/repertoire cards 2026-05-08 22:58:25 +02:00
Pontoporeia
e3896811c4 Fix migrations and deploy issues + errors + linting
- scan both pending/ and applied/ dirs so remote catch-up works
- fix remote 500s: run.php handles per-statement errors so VIEW rebuilds run after duplicate columns; replace mb_strimwidth with substr (no mbstring extension on server)
- add missing migration: 015_license_custom.sql (column existed in schema.sql but was never migrated)
- remote: fgetcsv enclosure single-char + AdminLogger permission-denied
guard + deploy always migrates
- fix admin-filters wrapping: restore flex-wrap, flex-basis on
inputs/selects, shrink-protect buttons
- fix phpstan: remove redundant ?? [] after isset guard in
ThesisEditController
- biome: exclude vendored min.js via includes patterns;
lint whole js dir; modernise beforeunload-guard.js
2026-05-08 22:58:05 +02:00
Pontoporeia
bdd95341b0 Extract shared TFE form partial — single source of truth for add/edit/partage
Created templates/partials/form/form.php as the unified form template driven by
$mode ('add'|'edit'|'partage') and boolean flags for optional sections.

The three calling templates (templates/admin/add.php, templates/admin/edit.php,
partage/index.php renderShareLinkForm) now only set variables then include the
shared partial. ~200 lines of duplicated fieldset HTML eliminated.
2026-05-07 23:39:41 +02:00
Pontoporeia
ac0008df6c Add website-type TFE support: URLs stored as thesis_files rows, HTMX-toggle on Site web format 2026-05-07 23:39:41 +02:00
Pontoporeia
9dc7ea98f2 fix: password-protected share links never load form after password entry
The main GET handler in partage/index.php always showed the password gate
for links with password_hash set, even after successful verification. The
session flag share_verified_<slug> was being set by requirePasswordGate()
but never checked when deciding whether to re-show the gate.

Added a check: if the session flag is already set, skip the gate and
render the form directly.

Also added error_log() calls throughout the password flow to help
diagnose future issues.
2026-05-07 23:39:41 +02:00
Pontoporeia
03121d6b7e form: add spacing between elements inside fieldsets
- common.css: fieldset > *:not(:last-child) gets margin-bottom: var(--space-xs)
- admin.css: .param-form fieldset > * zeroes margin to avoid double-spacing with flex gap
2026-05-07 23:39:41 +02:00
Pontoporeia
d9dd4bdbc7 Edit Email confirmation styling 2026-05-07 23:39:41 +02:00
Pontoporeia
696259afae Fix form field required states & missing fields per spec
- Admin add: add contact_public checkbox (matching edit form)
- All forms: formats checkbox-list now required
- All forms: jury promoteur·ice interne required, lecteur·ice interne/externe required
- All forms: licence select now required
- Admin edit: add E-mail de confirmation fieldset
- Partage: contact always visible when provided (no contact_public field)
- Partage: filter PACS from AP programs dropdown
- Server-side validation: formats, jury, licence required (create + edit controllers)
- Autofocus mappings for new validation errors
- No duplicate asterisks — verified across all rendered fields
- fix: add missing old() function in admin edit controller
- refactor: move admin email field to Backoffice as Contact interne, never send email
- Untrack admin.log (covered by .gitignore)
2026-05-07 23:39:41 +02:00
Pontoporeia
51f9f56e09 Replace span with a link + href in about.php for credits 2026-05-07 23:39:41 +02:00
Pontoporeia
e0c748d8e7 Refactor about.php
- Hardcode source code URL and credits in about template, remove from DB/admin interface; only contacts remains editable
- Merge apropos editables into one À propos section, remove charte, add editable source code URL
2026-05-07 19:44:18 +02:00
Pontoporeia
24d68dda59 refactor form structure per new spec + fix
- split jury into interne/externe/ULB,
- remove president from student form,
- add language_autre,
- split duration into pages+minutes+annexes,
- move licence to degrés d'ouverture with CC2r,
- add license_custom,
- filter PACS from student AP list,
- editable généralités help block,
- Libre toggle per settings

Fix:
- missing comma after cc4r column in schema.sql
- remove duplicate form footer from partage template
- remove couverture from student files fieldset; add promoteur ULB conditional disable via JS on Approfondi
- promoteur ULB: remove 'si applicable', make required when visible
2026-05-07 19:43:43 +02:00
Pontoporeia
dce0e0b301 schema: validate against new TFE field spec
- add exemplaire_baiu, exemplaire_erg, cc4r, remarks;
- add is_ulb to jury;
- split jury_lecteurs into interne/externe in view;
- refactor admin edit form with backoffice fields;
- update public fiche to show promoteur ULB and split lecteurs
2026-05-07 17:53:24 +02:00