hlsv 1.0.0 → 2.0.0

data/lib/hlsv/web_app.rb

@@ -12,173 +12,213 @@ require 'fast_excel'
 require 'zip'
 require 'nokogiri'
 
+require_relative 'config_manager'
+require_relative 'path_guard'
+require_relative 'url_helper'
+require_relative 'analysis_registry'
+
 module Hlsv
 class WebApp < Sinatra::Base
 
   set :root, Hlsv::INSTALL_ROOT
 
+  RESULTS_DIR = 'hlsv_results'
+
   # ---------------------------------------------------------------------------
-  # :section: ROUTES — Views
+  # :section: ROUTES - Views
   # ---------------------------------------------------------------------------
 
   # Homepage: loads config
   get '/' do
-    @config  = load_config
+    @config  = ConfigManager.load
     erb :index
   end
 
   # CSV viewer: displays a CSV file as an HTML table
   # Params:
-  #   :file           — path to the CSV file
-  #   :last_valid_key — comma-separated list of last tested keys (optional)
+  #   :file           - path to the CSV file
+  #   :last_valid_key - comma-separated list of last tested keys (optional)
+  #   :study          - study name, used to build the "Export to Excel" link (optional)
+  #   :dataset        - dataset name, used to build the "Export to Excel" link (optional,
+  #                      falls back to parsing the filename if not provided)
   get '/csv_view' do
-    file = params[:file]
-    halt 400, "Missing file parameter" unless file
-    halt 403, "Access denied"          if file.include?('..') || file.start_with?('/')
-    halt 404, "File not found"         unless File.exist?(file)
-
-    csv_name          = File.basename(file, '.csv')
-    type_dup, @ds_name = csv_name.split('_')
-    @type             = type_dup == 'data' ? 'dataset' : 'define.xml'
-    @last_valid_key   = params[:last_valid_key]&.split(',') || []
-    @rows             = CSV.read(file, headers: true)
+    file = safe_relative_path!(params[:file])
+    halt 404, "File not found" unless File.exist?(file)
+
+    @file = file
+    csv_name        = File.basename(file, '.csv')
+    type_dup        = csv_name.split('_').first
+    @type           = type_dup == 'data' ? 'dataset' : 'define.xml'
+    @ds_name        = params[:dataset] || csv_name.split('_').last
+    @study          = params[:study]
+    @last_valid_key = params[:last_valid_key]&.split(',') || []
+    @rows           = CSV.read(file, headers: true)
 
     erb :csv_view
   end
 
   # ---------------------------------------------------------------------------
-  # :section: ROUTES — Configuration (JSON API)
+  # :section: ROUTES - Configuration (JSON API)
   # ---------------------------------------------------------------------------
 
-  # GET /config — Returns the current configuration as JSON
+  # GET /config - Returns the current configuration as JSON
   get '/config' do
     content_type :json
-    load_config.to_json
+    ConfigManager.load.to_json
   end
 
-  # POST /config — Updates editable fields in config.yaml
+  # POST /config - Updates editable fields in config.yaml
   # Body: JSON object with field/value pairs
   post '/config' do
-    content_type :json
-    begin
+    json_action do
       config_params = JSON.parse(request.body.read)
-      save_config(config_params)
-      { success: true, message: "Configuration updated successfully" }.to_json
-    rescue => e
-      status 500
-      { success: false, erreur: e.message }.to_json
+      ConfigManager.save(config_params)
+      { message: "Configuration updated successfully" }
     end
   end
 
-  # POST /config/reset — Reloads config.yaml from config.default.yaml
+  # POST /config/reset - Reloads config.yaml from config.default.yaml
   post '/config/reset' do
-    content_type :json
-    begin
-      unless File.exist?(Hlsv.default_config_path)
-        return { success: false, erreur: "File config.default.yaml not found in project root" }.to_json
-      end
+    json_action do
+      ConfigManager.reset
+      { message: "Default configuration loaded from config.default.yaml" }
+    end
+  end
 
-      config_default = YAML.load_file(Hlsv.default_config_path)
-      File.write(Hlsv.config_path, config_default.to_yaml)
-      { success: true, message: "Default configuration loaded from config.default.yaml" }.to_json
-    rescue => e
-      status 500
-      { success: false, erreur: e.message }.to_json
+  # POST /config/load_existing - Loads config.yaml from an arbitrary file
+  # picked through the config page's file browser (GET /browse). Same
+  # trust boundary as /browse: the user explicitly chose this exact file
+  # via the picker, so no extra path restriction is applied here.
+  # Body: { "path": "/absolute/path/to/some_config.yaml" }
+  post '/config/load_existing' do
+    json_action do
+      payload = JSON.parse(request.body.read)
+      path    = payload['path'].to_s.strip
+
+      raise "Missing path parameter" if path.empty?
+
+      ConfigManager.load_from(path)
+      { message: "Configuration loaded from #{File.basename(path)}" }
     end
   end
 
-  # POST /config/clear — Resets all config fields to nil (keeps structure)
+  # POST /config/clear - Resets all config fields to nil (keeps structure)
   post '/config/clear' do
+    json_action do
+      ConfigManager.clear
+      { message: "Configuration cleared" }
+    end
+  end
+
+  # GET /browse - Lists directory entries for the config page's "Browse"
+  # buttons (Datasets Directory / Path to define.xml). This intentionally
+  # lets the user navigate anywhere on disk - the same trust boundary as
+  # typing an absolute path into the field by hand, since this is a
+  # local-only app. safe_relative_path!/resolve_within! don't apply here:
+  # they guard against escaping a *fixed* base dir (like RESULTS_DIR), not
+  # arbitrary filesystem browsing. This route only lists entries, never
+  # reads or serves file content.
+  #
+  # Params:
+  #   :path - directory to list (defaults to the server's launch directory,
+  #           Dir.pwd - same convention as Hlsv.config_path)
+  #   :mode - 'directory' (default) or 'file'; in 'file' mode, files
+  #           matching :ext are listed alongside subfolders
+  #   :ext  - extension filter for 'file' mode, e.g. '.xml'
+  get '/browse' do
     content_type :json
-    begin
-      empty_config = {
-        'study_name'           => nil,
-        'output_type'          => 'csv',
-        'output_directory'     => nil,
-        'data_directory'       => nil,
-        'define_path'          => nil,
-        'excluded_ds'          => nil,
-        'event_key'            => nil,
-        'intervention_key'     => nil,
-        'finding_key'          => nil,
-        'finding_about_key'    => nil,
-        'ds_key'               => nil,
-        'relrec_key'           => nil,
-        'CO_key'               => nil,
-        'TA_key'               => nil,
-        'TE_key'               => nil,
-        'TI_key'               => nil,
-        'TS_key'               => nil,
-        'TV_key'               => nil
-      }
-
-      File.write(Hlsv.config_path, empty_config.to_yaml)
-      { success: true, message: "Configuration cleared" }.to_json
-    rescue => e
-      status 500
-      { success: false, erreur: e.message }.to_json
+
+    requested = params['path'].to_s.strip
+    requested = Dir.pwd if requested.empty? # same convention as Hlsv.config_path in hlsv.rb
+
+    full_path = File.expand_path(requested)
+
+    halt 404, { error: 'Not found' }.to_json unless File.directory?(full_path)
+    halt 403, { error: 'Access denied' }.to_json unless File.readable?(full_path)
+
+    mode       = params['mode'] == 'file' ? 'file' : 'directory'
+    ext_filter = params['ext'].to_s.strip.downcase
+
+    folders = []
+    files   = []
+
+    Dir.children(full_path).sort_by(&:downcase).each do |name|
+      next if name.start_with?('.') # skip hidden files/folders
+
+      entry_path = File.join(full_path, name)
+
+      if File.directory?(entry_path)
+        folders << { name: name, path: entry_path }
+      else
+        # In 'directory' mode, files are listed unfiltered so the user can
+        # confirm they're in the right place; the ext filter only applies
+        # when actually selecting a file (mode == 'file').
+        next if mode == 'file' && !ext_filter.empty? && File.extname(name).downcase != ext_filter
+
+        files << { name: name, path: entry_path }
+      end
     end
+
+    parent = File.dirname(full_path)
+    parent = nil if parent == full_path # already at filesystem root
+
+    { path: full_path, parent: parent, folders: folders, files: files }.to_json
+  rescue Errno::EACCES
+    halt 403, { error: 'Access denied' }.to_json
   end
 
   # ---------------------------------------------------------------------------
-  # :section: ROUTES — Processing
+  # :section: ROUTES - Processing
   # ---------------------------------------------------------------------------
 
-  # POST /traiter — Validates config then runs the main processing script
-  post '/traiter' do
-    content_type :json
-    begin
-      config = load_config
-      errors = validate_config(config)
-
-      if errors.any?
-        return {
-          success: false,
-          erreur:  "Incomplete configuration",
-          details: errors
-        }.to_json
-      end
+  # POST /proceed - Validates config then runs the main processing script
+  post '/proceed' do
+    json_action do
+      config = ConfigManager.load
+      errors = ConfigManager.validate(config)
 
-      result = MonScript.executer(config)
-      { success: true, resultat: result }.to_json
-    rescue => e
-      status 500
-      { success: false, erreur: e.message }.to_json
+      halt 200, { success: false, error: "Incomplete configuration", details: errors }.to_json if errors.any?
+
+      { result: AnalysisRunner.run(config) }
     end
   end
 
   # ---------------------------------------------------------------------------
-  # :section: ROUTES — Results browsing
+  # :section: ROUTES - Results browsing
   # ---------------------------------------------------------------------------
+  # GET /ping — Lightweight health check used by report.html to detect
+  # whether the Sinatra server backing it is reachable (vs. the file being
+  # opened offline, or served by an unrelated static file server)
+  get '/ping' do
+    content_type :json
+    { success: true }.to_json
+  end
 
-  # GET /resultats — Returns the hlsv_results/ directory tree as JSON
-  get '/resultats' do
+  # GET /results - Returns the hlsv_results/ directory tree as JSON
+  get '/results' do
     content_type :json
-    results_dir = 'hlsv_results'
 
-    unless Dir.exist?(results_dir)
-      return { success: true, arborescence: {} }.to_json
+    unless Dir.exist?(RESULTS_DIR)
+      return { success: true, tree: {} }.to_json
     end
 
-    arborescence = build_tree(results_dir)
-    { success: true, arborescence: arborescence }.to_json
+    { success: true, tree: build_tree(RESULTS_DIR) }.to_json
   end
 
-  # GET /telecharger/* — Serves a result file (inline or as download)
-  # Inline for: .html, .htm, .pdf, .png, .jpg, .jpeg, .gif, .svg, .txt, .css, .js
-  # Download for: all other extensions
-  get '/telecharger/*' do
-    relative_file = params['splat'].first
-    halt 403, "Access denied" if relative_file.include?('..') || relative_file.start_with?('/')
+  # GET /download/* - Serves a result file (inline or as download)
+  # Inline by default for: .html, .htm, .pdf, .png, .jpg, .jpeg, .gif, .svg, .txt, .css, .js
+  # Download for: all other extensions, or any extension when ?download=1 is passed
+  # (used by the "⬇️ Download" button, as opposed to "👁️ Open" which omits it)
+  get '/download/*' do
+    file_path = resolve_within!(RESULTS_DIR, params['splat'].first)
+    halt 404, "File not found: #{params['splat'].first}" unless File.exist?(file_path)
 
-    file_path = File.join('hlsv_results', relative_file)
-    halt 404, "File not found: #{relative_file}" unless File.exist?(file_path)
+    extension       = File.extname(file_path).downcase
+    force_download  = params[:download] == '1'
 
-    extension = File.extname(file_path).downcase
-
-    if ['.html', '.htm', '.pdf', '.png', '.jpg', '.jpeg', '.gif', '.svg', '.txt'].include?(extension)
+    if !force_download && ['.html', '.htm', '.pdf', '.png', '.jpg', '.jpeg', '.gif', '.svg', '.txt'].include?(extension)
       send_file file_path, filename: File.basename(file_path), disposition: 'inline'
-    elsif ['.css', '.js'].include?(extension)
+    elsif !force_download && ['.css', '.js'].include?(extension)
       content_type extension == '.css' ? 'text/css' : 'application/javascript'
       send_file file_path, disposition: 'inline'
     else
@@ -186,12 +226,10 @@ class WebApp < Sinatra::Base
     end
   end
 
-  # GET /telecharger_zip_dossier/* — Packages a result folder as a ZIP archive
-  get '/telecharger_zip_dossier/*' do
+  # GET /download_zip_dir/* - Packages a result folder as a ZIP archive
+  get '/download_zip_dir/*' do
     relative_folder = params['splat'].first
-    halt 403, "Access denied"    if relative_folder.include?('..') || relative_folder.start_with?('/')
-
-    folder_path = File.join('hlsv_results', relative_folder)
+    folder_path     = resolve_within!(RESULTS_DIR, relative_folder)
     halt 404, "Folder not found" unless Dir.exist?(folder_path)
 
     # Build ZIP in memory, preserving relative paths inside the folder
@@ -201,254 +239,110 @@ class WebApp < Sinatra::Base
 
         relative_path = file_path.sub("#{folder_path}/", '')
         zip.put_next_entry(relative_path)
-        zip.write(File.read(file_path))
+        zip.write(File.binread(file_path)) # binread: preserves binary files (pdf, png, ...)
       end
     end
 
     zip_data.rewind
-    content_type  'application/zip'
-    folder_name = File.basename(relative_folder)
-    attachment    "#{Time.now.strftime('%Y-%m-%d')}-#{folder_name}.zip"
+    content_type 'application/zip'
+    attachment   "#{Time.now.strftime('%Y-%m-%d')}-#{File.basename(relative_folder)}.zip"
     zip_data.read
   end
 
   # ---------------------------------------------------------------------------
-  # :section: ROUTES — Excel exports
+  # :section: ROUTES - On-demand report generation (html / docx / excel)
   # ---------------------------------------------------------------------------
-
-  # GET /excel_export — Exports a single CSV file as a 2-sheet Excel workbook
-  # Sheet 1: README with metadata
-  # Sheet 2: Duplicate data with alternating row colors
-  # Params:
-  #   :file           — path to the CSV file
-  #   :last_valid_key — comma-separated list of last tested keys (optional)
-  get '/excel_export' do
-    file = params[:file]
-    halt 403, "Access denied"    if file.include?('..') || file.start_with?('/')
-    halt 404, "File not found"   unless File.exist?(file)
-
-    last_valid_key         = params[:last_valid_key]&.split(',') || []
-    type_dup, sheet_name   = File.basename(file, '.csv').split('_')
-    csv                    = CSV.read(file, headers: true)
-
-    workbook = FastExcel.open(constant_memory: true)
-
-    # --- Shared formats ---
-    title_format   = workbook.add_format(bold: true, font_size: 16, font_color: "#2c3e50", align: "left")
-    heading_format = workbook.add_format(bold: true, font_size: 12, font_color: "#2c3e50", bg_color: "#e8f4f8", pattern: 1, border: 1)
-    text_format    = workbook.add_format(font_size: 11, align: "left", text_wrap: true)
-    footer_format  = workbook.add_format(font_size: 9,  font_color: "#6c757d", align: "center")
-    header_format  = workbook.add_format(bold: true, bg_color: "#c0c0c0", pattern: 1, border: 1)
-    even_format    = workbook.add_format(pattern: 1, border: 1)
-    odd_format     = workbook.add_format(bg_color: "#E3F2FD", pattern: 1, border: 1)
-
-    # --- Sheet 1: README ---
-    readme_sheet = workbook.add_worksheet("README")
-    readme_sheet.set_column(0, 0, 80)
-    readme_sheet.set_column(1, 1, 20)
-
-    current_row = 0
-    readme_sheet.write_string(current_row, 0, "Duplicates Analysis Report - #{sheet_name}", title_format)
-    current_row += 2
-
-    readme_sheet.write_string(current_row, 0, "About This Report", heading_format)
-    current_row += 1
-
-    [
-      "This Excel file displays the detected duplicates, grouped according to the last key tested.",
-      "The duplicate groups are represented by a number in the 'No' column.",
-      "Alternating colors (white and light blue) are used to distinguish them visually.",
-      "All variables present in the dataset are displayed."
-    ].each { |line| readme_sheet.write_string(current_row, 0, line, text_format); current_row += 1 }
-    current_row += 1
-
-    readme_sheet.write_string(current_row, 0, "Sheet Information", heading_format)
-    current_row += 1
-
-    [
-      "• Dataset: #{sheet_name}",
-      "• Duplicate Type: #{type_dup == 'data' ? 'Duplicates in dataset' : 'Duplicates in define.xml'}",
-      "• Total Records: #{csv.size}",
-      "• Number of Variables: #{csv.headers.size}",
-      "• Generated: #{Time.now.strftime('%Y-%m-%d at %H:%M')}",
-      "• Last key tested: #{last_valid_key.join(' ')}"
-    ].each { |line| readme_sheet.write_string(current_row, 0, line, text_format); current_row += 1 }
-    current_row += 1
-
-    readme_sheet.write_string(current_row, 0, "Next Steps", heading_format)
-    current_row += 1
-
-    [
-      "→ Click on the '#{sheet_name}' tab at the bottom to view the duplicate records.",
-      "→ Identify variables to add in the configuration form to remove this duplicate.",
-      "→ Highlight issues with data cleaning."
-    ].each { |line| readme_sheet.write_string(current_row, 0, line, text_format); current_row += 1 }
-    current_row += 1
-
-    readme_sheet.write_string(current_row, 0,
-      "© #{Time.now.year} AdClin. All rights reserved. | Licensed under AGPL v3",
-      footer_format)
-
-    # --- Sheet 2: Duplicate data ---
-    data_sheet  = workbook.add_worksheet(sheet_name)
-    col_widths  = csv.headers.map { |h| h.to_s.length }
-
-    # Write frozen header row
-    csv.headers.each_with_index { |h, col| data_sheet.write_string(0, col, h, header_format) }
-    data_sheet.freeze_panes(1, 5)
-
-    # Write data rows with alternating colors based on the 'No' column (col 0)
-    csv.each_with_index do |row, row_index|
-      fmt = row[0].to_i.even? ? even_format : odd_format
-      row.fields.each_with_index do |value, col|
-        value_str = value.to_s
-        data_sheet.write_string(row_index + 1, col, value_str, fmt)
-        col_widths[col] = [col_widths[col], value_str.length].max
+  #
+  # These routes drive `sv.report`, the engine kept in memory by
+  # AnalysisRegistry after '/proceed' completed. Nothing is written to disk
+  # until one of these routes is actually hit - reports are generated once,
+  # on click, not automatically after the analysis.
+  #
+  # :study is the *display* study name (not the "hlsv_results/" prefixed
+  # internal one) - same value as the `study_name` field returned by
+  # POST /proceed.
+
+  # GET /report/:study/html - Serves the already-generated report if present
+  # on disk (works even without the analysis in memory, e.g. after a server
+  # restart); regenerates it on demand otherwise.
+  get '/report/:study/html' do
+    path = report_path_for(params[:study], 'html')
+
+    if File.exist?(path)
+      send_file path, disposition: 'inline'
+    else
+      with_analysis(params[:study]) do |sv|
+        sv.report.html
+        send_file "#{sv.report.report_name}.html", disposition: 'inline'
       end
     end
-
-    col_widths.each_with_index { |width, col| data_sheet.set_column(col, col, width + 2) }
-
-    # Send file
-    type      = type_dup == 'data' ? 'duplicate_in_dataset' : 'duplicate_in_define'
-    file_name = "#{Time.now.strftime('%Y-%m-%d')}-#{type}.xlsx"
-    content_type 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
-    attachment file_name
-    workbook.read_string
   end
 
-  # GET /telecharger_dossier_excel/* — Exports all CSV files in a folder as a multi-sheet Excel workbook
-  # Sheet 1: README with folder metadata
-  # One additional sheet per CSV file
-  get '/telecharger_dossier_excel/*' do
-    relative_folder = params['splat'].first
-    halt 403, "Access denied"              if relative_folder.include?('..') || relative_folder.start_with?('/')
-
-    folder_path = File.join('hlsv_results', relative_folder)
-    halt 404, "Folder not found"           unless Dir.exist?(folder_path)
-
-    csv_files = Dir.glob(File.join(folder_path, '*.csv')).sort
-    halt 404, "No CSV files found in this folder" if csv_files.empty?
-
-    workbook    = FastExcel.open(constant_memory: true)
-    folder_name = File.dirname(relative_folder)
-
-    # --- Shared formats ---
-    title_format   = workbook.add_format(bold: true, font_size: 16, font_color: "#2c3e50", align: "left")
-    heading_format = workbook.add_format(bold: true, font_size: 12, font_color: "#2c3e50", bg_color: "#e8f4f8", pattern: 1, border: 1)
-    text_format    = workbook.add_format(font_size: 11, align: "left", text_wrap: true)
-    footer_format  = workbook.add_format(font_size: 9,  font_color: "#6c757d", align: "center")
-    header_format  = workbook.add_format(bold: true, bg_color: "#c0c0c0", pattern: 1, border: 1)
-    even_format    = workbook.add_format(pattern: 1, border: 1)
-    odd_format     = workbook.add_format(bg_color: "#E3F2FD", pattern: 1, border: 1)
-
-    # --- Sheet 1: README ---
-    readme_sheet = workbook.add_worksheet("README")
-    readme_sheet.set_column(0, 0, 80)
-    readme_sheet.set_column(1, 1, 20)
-
-    current_row = 0
-    readme_sheet.write_string(current_row, 0, "Duplicates Analysis Report - #{folder_name}", title_format)
-    current_row += 2
-
-    readme_sheet.write_string(current_row, 0, "About This Report", heading_format)
-    current_row += 1
-
-    [
-      "This Excel file displays the detected duplicates, grouped according to the last key tested.",
-      "The duplicate groups are represented by a number in the 'No' column.",
-      "Alternating colors (white and light blue) are used to distinguish them visually.",
-      "All variables present in the dataset are displayed."
-    ].each { |line| readme_sheet.write_string(current_row, 0, line, text_format); current_row += 1 }
-    current_row += 1
-
-    readme_sheet.write_string(current_row, 0, "Workbook Information", heading_format)
-    current_row += 1
-
-    [
-      "• Folder: #{folder_name}",
-      "• Number of Datasets: #{csv_files.size}",
-      "• Generated: #{Time.now.strftime('%Y-%m-%d at %H:%M')}"
-    ].each { |line| readme_sheet.write_string(current_row, 0, line, text_format); current_row += 1 }
-    current_row += 1
-
-    readme_sheet.write_string(current_row, 0, "Next Steps", heading_format)
-    current_row += 1
-
-    [
-      "→ Each tab corresponds to one CSV file from the folder.",
-      "→ Review duplicate records and identify variables to add in the configuration.",
-      "→ Highlight issues with data cleaning."
-    ].each { |line| readme_sheet.write_string(current_row, 0, line, text_format); current_row += 1 }
-    current_row += 1
-
-    readme_sheet.write_string(current_row, 0,
-      "© #{Time.now.year} AdClin. All rights reserved. | Licensed under AGPL v3",
-      footer_format)
-
-    # --- Data sheets: one per CSV file ---
-    csv_files.each do |csv_file|
-      sheet_name = File.basename(csv_file, '.csv')
-      sheet_name = sheet_name[0..30] if sheet_name.length > 31  # Excel sheet name limit: 31 chars
-
-      csv_data = CSV.read(csv_file, headers: true)
-      next if csv_data.empty?
-
-      data_sheet = workbook.add_worksheet(sheet_name)
-      col_widths  = csv_data.headers.map { |h| h.to_s.length }
-
-      # Write frozen header row
-      csv_data.headers.each_with_index { |header, col| data_sheet.write_string(0, col, header.to_s, header_format) }
-      data_sheet.freeze_panes(1, 5)
-
-      # Write data rows with alternating colors based on the 'No' column (col 0)
-      csv_data.each_with_index do |row, row_index|
-        fmt = row[0].to_i.even? ? even_format : odd_format
-        row.fields.each_with_index do |value, col|
-          value_str = value.to_s
-          data_sheet.write_string(row_index + 1, col, value_str, fmt)
-          col_widths[col] = [col_widths[col], value_str.length].max
-        end
-      end
+  # GET /report/:study/docx
+  get '/report/:study/docx' do
+    path = report_path_for(params[:study], 'docx')
 
-      col_widths.each_with_index { |width, col| data_sheet.set_column(col, col, width + 2) }
+    if File.exist?(path)
+      send_file path, filename: "#{params[:study]}.docx"
+    else
+      with_analysis(params[:study]) do |sv|
+        sv.report.docx
+        send_file "#{sv.report.report_name}.docx", filename: "#{params[:study]}.docx"
+      end
     end
-
-    # Send file
-    content_type 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
-    attachment   "#{Time.now.strftime('%Y-%m-%d')}_#{folder_name}.xlsx"
-    workbook.read_string
   end
 
-  # ---------------------------------------------------------------------------
-  # :section: ROUTES — HTML to Word conversion
-  # ---------------------------------------------------------------------------
-
-  # GET /telecharger_html_word/* — Converts an HTML result file to a .docx Word document
-  # Returns JSON with success status and generated filename
-  get '/telecharger_html_word/*' do
-    content_type :json
-    chemin_relatif = params['splat'].first
+  # GET /report/:study/excel - whole-folder export
+  get '/report/:study/excel' do
+    path = report_path_for(params[:study], 'xlsx')
 
-    halt 403, { success: false, erreur: 'Accès refusé' }.to_json \
-      if chemin_relatif.include?('..') || chemin_relatif.start_with?('/')
+    if File.exist?(path)
+      send_file path, filename: "#{params[:study]}.xlsx"
+    else
+      with_analysis(params[:study]) do |sv|
+        sv.report.excel
+        halt 404, "No duplicates found - nothing to export" unless File.exist?("#{sv.report.report_name}.xlsx")
+        send_file "#{sv.report.report_name}.xlsx", filename: "#{params[:study]}.xlsx"
+      end
+    end
+  end
 
-    chemin_absolu = File.join('hlsv_results', chemin_relatif)
+  # GET /report/:study/excel/:dataset - per-dataset export
+  # obsolete keep in case of
+  get '/report/:study/excel/:dataset' do
+    path = "#{RESULTS_DIR}/#{params[:study]}/#{params[:dataset]}.xlsx"
 
-    halt 400, { success: false, erreur: 'Fichier HTML introuvable' }.to_json \
-      unless File.exist?(chemin_absolu) && chemin_absolu.end_with?('.html')
+    if File.exist?(path)
+      send_file path, filename: "#{params[:dataset]}.xlsx"
+    else
+      with_analysis(params[:study]) do |sv|
+        sv.report.excel(dataset: params[:dataset])
+        halt 404, "No duplicates found for #{params[:dataset]} - nothing to export" unless File.exist?(path)
+        send_file path, filename: "#{params[:dataset]}.xlsx"
+      end
+    end
+  end
 
-    output_docx = chemin_absolu.sub(/\.html$/, '.docx')
+  # GET /export_csv_excel - Exports a single duplicate CSV (the one shown on
+  # /csv_view) as a one-sheet Excel workbook. Works fully offline: no
+  # AnalysisRegistry lookup, since /csv_view's static HTML link already
+  # carries every parameter needed (file, dataset, tested key).
+  get '/export_csv_excel' do
+    study   = params[:study]
+    dataset = params[:dataset]
+    key     = params[:last_valid_key]
+    file    = safe_relative_path!(params[:file])
 
-    puts "Parsing #{chemin_absolu}..."
-    blocks = RiReportParser.new(chemin_absolu).parse
-    puts "  -> #{blocks.size} blocks extracted"
+    halt 400, "Missing required parameters" unless study && dataset
+    halt 404, "File not found" unless File.exist?(file)
 
-    puts "Building #{output_docx}..."
-    DocxWriter.new(output_docx).write(blocks)
-    puts "  -> Done: #{output_docx}"
+    workbook = Hlsv::SdtmValidation::Report.build_single_csv_workbook(
+      study_name: study, ds_name: dataset, csv_path: file, key: key
+    )
 
-    { success: true, message: "Word généré : #{File.basename(output_docx)}" }.to_json
+    content_type 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+    attachment "#{dataset}.xlsx"
+    workbook.read_string
   end
 
   # ---------------------------------------------------------------------------
@@ -456,11 +350,39 @@ class WebApp < Sinatra::Base
   # ---------------------------------------------------------------------------
 
   helpers do
+    include Hlsv::PathGuard
+    include Hlsv::UrlHelper
+
+    # Runs the block, wraps its return hash into {success: true, **hash}.to_json,
+    # and turns any raised error into {success: false, error: message} with a 500.
+    def json_action
+      content_type :json
+      { success: true, **yield }.to_json
+    rescue => e
+      status 500
+      { success: false, error: e.message }.to_json
+    end
+
+    # Fetches the in-memory analysis for `study` and yields it to the block.
+    # Turns a missing/unknown study into a clean 404 instead of a stack trace,
+    # since it's a legitimate case (server restarted, or study never analyzed).
+    def with_analysis(study)
+      sv = AnalysisRegistry.fetch!(study)
+      yield sv
+    rescue Hlsv::Error => e
+      halt 404, e.message
+    end
+
+    # Path of a report file for a given (display) study name, independent
+    # of whether the analysis is currently in memory
+    def report_path_for(study, ext)
+      "#{Hlsv::SdtmValidation::Report.report_name_for("#{RESULTS_DIR}/#{study}")}.#{ext}"
+    end
 
     # Recursively builds a directory tree hash for a given base path.
-    # Returns: { fichiers: [...], dossiers: { name => subtree, ... } }
+    # Returns: { files: [...], folders: { name => subtree, ... } }
     def build_tree(base_path, relative_path = '')
-      tree      = { fichiers: [], dossiers: {} }
+      tree      = { files: [], folders: {} }
       full_path = relative_path.empty? ? base_path : File.join(base_path, relative_path)
 
       return tree unless Dir.exist?(full_path)
@@ -472,97 +394,21 @@ class WebApp < Sinatra::Base
         relative_entry_path = relative_path.empty? ? entry : File.join(relative_path, entry)
 
         if File.directory?(entry_path)
-          tree[:dossiers][entry] = build_tree(base_path, relative_entry_path)
+          tree[:folders][entry] = build_tree(base_path, relative_entry_path)
         else
-          tree[:fichiers] << {
-            nom:       entry,
-            chemin:    relative_entry_path,
-            taille:    File.size(entry_path),
+          tree[:files] << {
+            name:       entry,
+            path:    relative_entry_path,
+            size:    File.size(entry_path),
             date:      File.mtime(entry_path).strftime('%Y-%m-%d %H:%M:%S'),
             extension: File.extname(entry)
           }
         end
       end
 
-      tree[:fichiers].sort_by! { |f| f[:nom] }
+      tree[:files].sort_by! { |f| f[:name] }
       tree
     end
-
-    # Loads and returns config.yaml as a Hash. Halts with 500 if file is missing.
-    def load_config
-      if File.exist?(Hlsv.config_path)
-        YAML.load_file(Hlsv.config_path) || {}
-      else
-        halt 500, "File config.yaml not found"
-      end
-    end
-
-    # Merges config_params into the existing config.yaml, for editable fields only.
-    # output_type is always forced to 'csv'.
-    def save_config(config_params)
-      current_config = File.exist?(Hlsv.config_path) ? (YAML.load_file(Hlsv.config_path) || {}) : {}
-
-      editable_fields = %w(
-        study_name output_directory data_directory define_path excluded_ds
-        event_key intervention_key finding_key finding_about_key
-        ds_key relrec_key CO_key TA_key TE_key TI_key TS_key TV_key
-      )
-
-      editable_fields.each do |field|
-        current_config[field] = config_params[field] if config_params.key?(field)
-      end
-
-      current_config['output_type'] = 'csv'
-      File.write(Hlsv.config_path, current_config.to_yaml)
-    end
-
-    # Validates the configuration hash.
-    # Checks all required fields are present and validates filesystem paths.
-    # Returns an array of error messages (empty if config is valid).
-    def validate_config(config)
-      errors = []
-
-      required_fields = {
-        'study_name'        => 'Study name',
-        'output_directory'  => 'Output directory',
-        'data_directory'    => 'Data directory',
-        'define_path'       => 'Define.xml path',
-        'event_key'         => 'Event key',
-        'intervention_key'  => 'Intervention key',
-        'finding_key'       => 'Finding key',
-        'finding_about_key' => 'Finding about key',
-        'ds_key'            => 'DS key',
-        'relrec_key'        => 'RELREC key',
-        'CO_key'            => 'CO key',
-        'TA_key'            => 'TA key',
-        'TE_key'            => 'TE key',
-        'TI_key'            => 'TI key',
-        'TS_key'            => 'TS key',
-        'TV_key'            => 'TV key'
-      }
-
-      # Check all required fields are filled
-      required_fields.each do |key, name|
-        value = config[key]
-        errors << "#{name} is empty" if value.nil? || value.to_s.strip.empty?
-      end
-
-      # Check data_directory exists and contains at least one .xpt file
-      if config['data_directory'] && !config['data_directory'].to_s.strip.empty?
-        dir = config['data_directory'].gsub('\\', '/')
-        errors << "Data directory does not exist: #{dir}"       unless Dir.exist?(dir)
-        errors << "Directory is empty, no .xpt files detected"  if Dir["#{dir}/*"].none? { |f| File.extname(f) == '.xpt' }
-      end
-
-      # Check define_path exists (skip if value is '-', meaning no define file)
-      if config['define_path'] && config['define_path'] != '-'
-        errors << "Invalid path: #{config['define_path']}" unless File.exist?(config['define_path'])
-      end
-
-      config['output_type'] = 'csv'
-      errors
-    end
-
   end # helpers
 
 end # class WebApp