create-snapify-app 0.0.0-stage → 1.1.0

package/template/server/marketplace/routes.ts

@@ -0,0 +1,850 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { and, asc, count, desc, eq, ilike, inArray, or, sql } from 'drizzle-orm';
+import { asyncRouter, HttpError, paging } from '../http';
+import { db } from '../db/client';
+import {
+  mpCarts,
+  mpDownloads,
+  mpOrderItems,
+  mpOrders,
+  mpPayouts,
+  mpProducts,
+  mpPublishers,
+  mpReviews,
+  mpVersions,
+  platformUsers,
+} from '../db/schema';
+import { platformAuthOptional, requirePlatformUser, requireRole, toPublicUser } from '../platform/auth';
+import { slugify } from '../platform/passwords';
+import { getMpSettings, setMpSettings } from '../platform/settings';
+import { formatMoney, moneyCurrency } from '../platform/money';
+import { clientIp } from '../security/ip';
+import { resolveGeoFromIp } from '../geoip';
+import { buildCmsCatalog } from './catalog';
+import { addMarketplaceChecks, validateMarketplacePackage, type PackageValidationResult } from './packageValidate';
+import { compareVersions } from '../../sdk/package';
+import { createOrderFromProducts, startOrderCheckout, startPublisherFeeCheckout } from './payments';
+import { approveProduct, PACKAGES_DIR } from './signing';
+import type { Request } from 'express';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PKG_DIR = PACKAGES_DIR;
+
+async function ensurePkgDir() {
+  await fs.mkdir(PKG_DIR, { recursive: true });
+}
+
+function reqCountry(req: Request): string {
+  const fromIp = (resolveGeoFromIp(clientIp(req)).country || '').toUpperCase();
+  if (fromIp) return fromIp;
+  // Fallback hôte : .tn / localhost → DT ; sinon € (ex. marketplace.snapify.fr)
+  const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').toLowerCase();
+  if (/\.tn\b|localhost|127\.0\.0\.1/.test(host)) return 'TN';
+  return '';
+}
+
+/** Prix affiché : DT en Tunisie, € ailleurs (millimes restent la source de vérité). */
+function publicProduct(p: typeof mpProducts.$inferSelect, country: string, extras: Record<string, unknown> = {}) {
+  return {
+    id: p.id,
+    slug: p.slug,
+    name: p.name,
+    kind: p.kind,
+    shortDesc: p.shortDesc,
+    longDesc: p.longDesc,
+    category: p.category,
+    priceMillimes: p.priceMillimes,
+    priceLabel: formatMoney(p.priceMillimes, country),
+    currency: moneyCurrency(country),
+    status: p.status,
+    icon: p.icon,
+    screenshots: p.screenshots,
+    engines: p.engines,
+    permissions: p.permissions,
+    salesCount: p.salesCount,
+    publisherId: p.publisherId,
+    createdAt: p.createdAt,
+    updatedAt: p.updatedAt,
+    ...extras,
+  };
+}
+
+function pub(req: Request, p: typeof mpProducts.$inferSelect, extras: Record<string, unknown> = {}) {
+  return publicProduct(p, reqCountry(req), extras);
+}
+
+export function createMarketplaceRouter() {
+  const r = asyncRouter();
+
+  r.get('/catalog.json', async (_req, res) => {
+    res.setHeader('Cache-Control', 'public, max-age=60');
+    res.json(await buildCmsCatalog());
+  });
+
+  /** Téléchargement public pour le CMS Snapify (catalogue distant). */
+  r.get('/packages/:versionId/download-public', async (req, res) => {
+    const [ver] = await db.select().from(mpVersions).where(eq(mpVersions.id, req.params.versionId)).limit(1);
+    if (!ver || !ver.signed) throw new HttpError(404, 'Paquet introuvable');
+    const [p] = await db.select().from(mpProducts).where(and(eq(mpProducts.id, ver.productId), eq(mpProducts.status, 'published'))).limit(1);
+    if (!p) throw new HttpError(404, 'Produit introuvable');
+    const abs = path.resolve(PKG_DIR, path.basename(ver.packagePath));
+    if (!abs.startsWith(PKG_DIR)) throw new HttpError(400, 'Chemin invalide');
+    try {
+      await fs.access(abs);
+    } catch {
+      throw new HttpError(404, 'Fichier manquant');
+    }
+    res.download(abs, path.basename(abs));
+  });
+
+  r.get('/settings/public', async (req, res) => {
+    const s = await getMpSettings();
+    const country = reqCountry(req);
+    res.json({
+      commissionBps: s.commissionBps,
+      developerFeeMillimes: s.developerFeeMillimes,
+      developerFeeLabel: formatMoney(s.developerFeeMillimes, country),
+      currency: moneyCurrency(country),
+      country: country || null,
+    });
+  });
+
+  r.get('/products', platformAuthOptional, async (req, res) => {
+    const { page, pageSize } = paging(req.query as Record<string, unknown>, 24);
+    const q = String(req.query.q || '').trim();
+    const kind = String(req.query.kind || '');
+    const category = String(req.query.category || '');
+    const sort = String(req.query.sort || 'popular');
+    const pricing = String(req.query.pricing || '');
+
+    const conditions = [eq(mpProducts.status, 'published')];
+    if (kind === 'module' || kind === 'theme') conditions.push(eq(mpProducts.kind, kind));
+    if (category) conditions.push(eq(mpProducts.category, category));
+    if (pricing === 'free') conditions.push(eq(mpProducts.priceMillimes, 0));
+    if (pricing === 'paid') conditions.push(sql`${mpProducts.priceMillimes} > 0`);
+    if (q) conditions.push(or(ilike(mpProducts.name, `%${q}%`), ilike(mpProducts.shortDesc, `%${q}%`))!);
+
+    const where = and(...conditions);
+    const orderBy =
+      sort === 'newest'
+        ? desc(mpProducts.createdAt)
+        : sort === 'price_asc'
+          ? asc(mpProducts.priceMillimes)
+          : sort === 'price_desc'
+            ? desc(mpProducts.priceMillimes)
+            : desc(mpProducts.salesCount);
+
+    const [totalRow] = await db.select({ n: count() }).from(mpProducts).where(where);
+    const rows = await db
+      .select()
+      .from(mpProducts)
+      .where(where)
+      .orderBy(orderBy)
+      .limit(pageSize)
+      .offset((page - 1) * pageSize);
+
+    const pubIds = [...new Set(rows.map((p) => p.publisherId))];
+    const pubs = pubIds.length ? await db.select().from(mpPublishers).where(inArray(mpPublishers.id, pubIds)) : [];
+    const pubMap = Object.fromEntries(pubs.map((p) => [p.id, p]));
+    const productIds = rows.map((p) => p.id);
+    const reviewRows = productIds.length
+      ? await db
+          .select({ productId: mpReviews.productId, avg: sql<number>`avg(${mpReviews.rating})`, n: count() })
+          .from(mpReviews)
+          .where(inArray(mpReviews.productId, productIds))
+          .groupBy(mpReviews.productId)
+      : [];
+    const reviewMap = Object.fromEntries(reviewRows.map((r) => [r.productId, { avg: Math.round(Number(r.avg) * 10) / 10, n: r.n }]));
+
+    res.json({
+      items: rows.map((p) =>
+        pub(req, p, {
+          publisher: pubMap[p.publisherId] ? { displayName: pubMap[p.publisherId].displayName, website: pubMap[p.publisherId].website } : null,
+          avgRating: reviewMap[p.id]?.avg ?? null,
+          reviewCount: reviewMap[p.id]?.n ?? 0,
+        })
+      ),
+      page,
+      pageSize,
+      total: totalRow?.n || 0,
+    });
+  });
+
+  r.get('/products/:slug', platformAuthOptional, async (req, res) => {
+    const [p] = await db.select().from(mpProducts).where(eq(mpProducts.slug, req.params.slug)).limit(1);
+    if (!p || (p.status !== 'published' && req.platformUser?.role !== 'admin')) throw new HttpError(404, 'Produit introuvable');
+
+    const versions = await db.select().from(mpVersions).where(eq(mpVersions.productId, p.id)).orderBy(desc(mpVersions.createdAt));
+    const reviews = await db.select().from(mpReviews).where(eq(mpReviews.productId, p.id)).orderBy(desc(mpReviews.createdAt)).limit(50);
+    // Ne pas nommer « pub » : masque la fonction pub() (TypeError: pub is not a function → 500)
+    const [publisher] = await db.select().from(mpPublishers).where(eq(mpPublishers.id, p.publisherId)).limit(1);
+    const author = publisher
+      ? (await db.select().from(platformUsers).where(eq(platformUsers.id, publisher.userId)).limit(1))[0]
+      : null;
+    const avg =
+      reviews.length === 0 ? null : Math.round((reviews.reduce((s, x) => s + x.rating, 0) / reviews.length) * 10) / 10;
+
+    const reviewAuthors = await db
+      .select()
+      .from(platformUsers)
+      .where(inArray(platformUsers.id, reviews.map((x) => x.userId).concat(author ? [author.id] : [])));
+    const byId = Object.fromEntries(reviewAuthors.map((u) => [u.id, toPublicUser(u)]));
+
+    res.json({
+      product: pub(req, p, {
+        versions: versions.map((v) => ({
+          id: v.id,
+          version: v.version,
+          changelog: v.changelog,
+          size: v.size,
+          signed: v.signed,
+          createdAt: v.createdAt,
+        })),
+        reviews: reviews.map((rv) => ({
+          id: rv.id,
+          rating: rv.rating,
+          body: rv.body,
+          createdAt: rv.createdAt,
+          author: byId[rv.userId] || null,
+        })),
+        avgRating: avg,
+        publisher: publisher
+          ? {
+              id: publisher.id,
+              displayName: publisher.displayName,
+              website: publisher.website,
+              user: author ? toPublicUser(author) : null,
+            }
+          : null,
+      }),
+    });
+  });
+
+  r.get('/categories', async (_req, res) => {
+    const rows = await db
+      .select({ category: mpProducts.category, n: count() })
+      .from(mpProducts)
+      .where(eq(mpProducts.status, 'published'))
+      .groupBy(mpProducts.category);
+    res.json({ items: rows });
+  });
+
+  /* ---- Cart ---- */
+  r.get('/cart', requirePlatformUser, async (req, res) => {
+    const [cart] = await db.select().from(mpCarts).where(eq(mpCarts.userId, req.platformUser!.id)).limit(1);
+    const ids = cart?.productIds || [];
+    const products = ids.length
+      ? await db.select().from(mpProducts).where(and(eq(mpProducts.status, 'published'), inArray(mpProducts.id, ids)))
+      : [];
+    res.json({ items: products.map((p) => pub(req, p)), totalMillimes: products.reduce((s, p) => s + p.priceMillimes, 0) });
+  });
+
+  r.put('/cart', requirePlatformUser, async (req, res) => {
+    const productIds = Array.isArray(req.body?.productIds) ? req.body.productIds.filter((x: unknown) => typeof x === 'string') : [];
+    await db
+      .insert(mpCarts)
+      .values({ userId: req.platformUser!.id, productIds, updatedAt: new Date() })
+      .onConflictDoUpdate({ target: mpCarts.userId, set: { productIds, updatedAt: new Date() } });
+    res.json({ ok: true });
+  });
+
+  r.post('/cart/add', requirePlatformUser, async (req, res) => {
+    const productId = String(req.body?.productId || '');
+    const [p] = await db.select().from(mpProducts).where(and(eq(mpProducts.id, productId), eq(mpProducts.status, 'published'))).limit(1);
+    if (!p) throw new HttpError(404, 'Produit introuvable');
+    const [cart] = await db.select().from(mpCarts).where(eq(mpCarts.userId, req.platformUser!.id)).limit(1);
+    const productIds = [...new Set([...(cart?.productIds || []), productId])];
+    await db
+      .insert(mpCarts)
+      .values({ userId: req.platformUser!.id, productIds, updatedAt: new Date() })
+      .onConflictDoUpdate({ target: mpCarts.userId, set: { productIds, updatedAt: new Date() } });
+    res.json({ ok: true, count: productIds.length });
+  });
+
+  /* ---- Checkout ---- */
+  r.post('/checkout', requirePlatformUser, async (req, res) => {
+    const [cart] = await db.select().from(mpCarts).where(eq(mpCarts.userId, req.platformUser!.id)).limit(1);
+    const ids = cart?.productIds || [];
+    const orderId = await createOrderFromProducts(req.platformUser!.id, ids);
+    await db
+      .insert(mpCarts)
+      .values({ userId: req.platformUser!.id, productIds: [], updatedAt: new Date() })
+      .onConflictDoUpdate({ target: mpCarts.userId, set: { productIds: [], updatedAt: new Date() } });
+
+    const [order] = await db.select().from(mpOrders).where(eq(mpOrders.id, orderId)).limit(1);
+    if (order!.totalMillimes === 0) {
+      return res.json({ orderId, status: 'paid', link: null });
+    }
+    const payment = await startOrderCheckout(orderId, req.platformUser!.id);
+    res.json({ orderId, status: 'pending', link: payment.link, paymentId: payment.paymentId });
+  });
+
+  r.get('/orders/mine', requirePlatformUser, async (req, res) => {
+    const orders = await db
+      .select()
+      .from(mpOrders)
+      .where(eq(mpOrders.buyerId, req.platformUser!.id))
+      .orderBy(desc(mpOrders.createdAt))
+      .limit(50);
+    const items = await db.select().from(mpOrderItems).where(inArray(mpOrderItems.orderId, orders.map((o) => o.id).concat(['__none__'])));
+    const products = await db
+      .select()
+      .from(mpProducts)
+      .where(inArray(mpProducts.id, items.map((i) => i.productId).concat(['__none__'])));
+    const downloads = await db
+      .select()
+      .from(mpDownloads)
+      .where(inArray(mpDownloads.orderItemId, items.map((i) => i.id).concat(['__none__'])));
+    const pMap = Object.fromEntries(products.map((p) => [p.id, p]));
+    const dMap = Object.fromEntries(downloads.map((d) => [d.orderItemId, d]));
+
+    res.json({
+      items: orders.map((o) => ({
+        ...o,
+        totalLabel: formatMoney(o.totalMillimes, reqCountry(req)),
+        items: items
+          .filter((i) => i.orderId === o.id)
+          .map((i) => ({
+            ...i,
+            product: pMap[i.productId] ? pub(req, pMap[i.productId]) : null,
+            downloadToken: o.status === 'paid' ? dMap[i.id]?.token : null,
+          })),
+      })),
+    });
+  });
+
+  r.get('/downloads/:token', requirePlatformUser, async (req, res) => {
+    const [dl] = await db.select().from(mpDownloads).where(eq(mpDownloads.token, req.params.token)).limit(1);
+    if (!dl || dl.expiresAt < new Date()) throw new HttpError(404, 'Lien expiré');
+    const [item] = await db.select().from(mpOrderItems).where(eq(mpOrderItems.id, dl.orderItemId)).limit(1);
+    if (!item) throw new HttpError(404, 'Introuvable');
+    const [order] = await db.select().from(mpOrders).where(eq(mpOrders.id, item.orderId)).limit(1);
+    if (!order || order.buyerId !== req.platformUser!.id || order.status !== 'paid') throw new HttpError(403, 'Accès refusé');
+    const [ver] = await db.select().from(mpVersions).where(eq(mpVersions.id, item.versionId)).limit(1);
+    if (!ver) throw new HttpError(404, 'Version introuvable');
+
+    await db.update(mpDownloads).set({ count: dl.count + 1 }).where(eq(mpDownloads.id, dl.id));
+    const abs = path.resolve(PKG_DIR, path.basename(ver.packagePath));
+    if (!abs.startsWith(PKG_DIR)) throw new HttpError(400, 'Chemin invalide');
+    res.download(abs, path.basename(abs));
+  });
+
+  r.post('/products/:id/reviews', requirePlatformUser, async (req, res) => {
+    const rating = Number(req.body?.rating);
+    const body = String(req.body?.body || '').slice(0, 2000);
+    if (!Number.isInteger(rating) || rating < 1 || rating > 5) throw new HttpError(422, 'Note invalide');
+    const [p] = await db.select().from(mpProducts).where(and(eq(mpProducts.id, req.params.id), eq(mpProducts.status, 'published'))).limit(1);
+    if (!p) throw new HttpError(404, 'Produit introuvable');
+    const owned = await db
+      .select()
+      .from(mpOrderItems)
+      .innerJoin(mpOrders, eq(mpOrders.id, mpOrderItems.orderId))
+      .where(and(eq(mpOrderItems.productId, p.id), eq(mpOrders.buyerId, req.platformUser!.id), eq(mpOrders.status, 'paid')))
+      .limit(1);
+    if (!owned.length) throw new HttpError(403, 'Achetez le produit pour laisser un avis.');
+    const id = crypto.randomUUID();
+    await db
+      .insert(mpReviews)
+      .values({ id, productId: p.id, userId: req.platformUser!.id, rating, body })
+      .onConflictDoUpdate({
+        target: [mpReviews.productId, mpReviews.userId],
+        set: { rating, body },
+      });
+    res.status(201).json({ ok: true });
+  });
+
+  /* ---- Publisher ---- */
+  r.post('/developer/register', requirePlatformUser, async (req, res) => {
+    const displayName = String(req.body?.displayName || req.platformUser!.displayName).trim().slice(0, 80);
+    const website = req.body?.website ? String(req.body.website).slice(0, 200) : null;
+    const existing = await db.select().from(mpPublishers).where(eq(mpPublishers.userId, req.platformUser!.id)).limit(1);
+    let publisher = existing[0];
+    if (!publisher) {
+      const id = crypto.randomUUID();
+      [publisher] = await db
+        .insert(mpPublishers)
+        .values({ id, userId: req.platformUser!.id, displayName, website, status: 'pending_payment' })
+        .returning();
+    } else if (publisher.status === 'active') {
+      throw new HttpError(400, 'Vous êtes déjà développeur.');
+    } else {
+      [publisher] = await db
+        .update(mpPublishers)
+        .set({ displayName, website })
+        .where(eq(mpPublishers.id, publisher.id))
+        .returning();
+    }
+    const payment = await startPublisherFeeCheckout(publisher.id, req.platformUser!.id);
+    res.json({ publisherId: publisher.id, link: payment.link, paymentId: payment.paymentId });
+  });
+
+  r.get('/developer/me', requirePlatformUser, async (req, res) => {
+    let [pub] = await db.select().from(mpPublishers).where(eq(mpPublishers.userId, req.platformUser!.id)).limit(1);
+    // Admin plateforme : provisionner un profil éditeur actif si absent
+    if (!pub && req.platformUser!.role === 'admin') {
+      const id = crypto.randomUUID();
+      [pub] = await db
+        .insert(mpPublishers)
+        .values({
+          id,
+          userId: req.platformUser!.id,
+          displayName: req.platformUser!.displayName || 'Snapify Admin',
+          status: 'active',
+          paidAt: new Date(),
+        })
+        .returning();
+    }
+    if (!pub) return res.json({ publisher: null });
+    const products = await db.select().from(mpProducts).where(eq(mpProducts.publisherId, pub.id)).orderBy(desc(mpProducts.updatedAt));
+    const settings = await getMpSettings();
+    const soldItems = await db
+      .select({
+        unit: mpOrderItems.unitPriceMillimes,
+        orderId: mpOrders.id,
+        paidAt: mpOrders.paidAt,
+        productId: mpOrderItems.productId,
+        licenseKey: mpOrderItems.licenseKey,
+      })
+      .from(mpOrderItems)
+      .innerJoin(mpOrders, eq(mpOrders.id, mpOrderItems.orderId))
+      .innerJoin(mpProducts, eq(mpProducts.id, mpOrderItems.productId))
+      .where(and(eq(mpProducts.publisherId, pub.id), eq(mpOrders.status, 'paid')))
+      .orderBy(desc(mpOrders.paidAt))
+      .limit(50);
+    const gross = soldItems.reduce((s, x) => s + x.unit, 0);
+    const net = Math.round(gross * (1 - settings.commissionBps / 10_000));
+    const payouts = await db.select().from(mpPayouts).where(eq(mpPayouts.publisherId, pub.id)).orderBy(desc(mpPayouts.createdAt));
+    const byStatus = {
+      draft: products.filter((p) => p.status === 'draft').length,
+      pending: products.filter((p) => p.status === 'pending').length,
+      published: products.filter((p) => p.status === 'published').length,
+      rejected: products.filter((p) => p.status === 'rejected').length,
+    };
+    const productMap = Object.fromEntries(products.map((p) => [p.id, p]));
+    res.json({
+      publisher: pub,
+      products: products.map((p) => pub(req, p)),
+      earnings: { grossMillimes: gross, netMillimes: net, commissionBps: settings.commissionBps, salesCount: soldItems.length },
+      stats: { ...byStatus, productCount: products.length },
+      recentSales: soldItems.map((s) => ({
+        orderId: s.orderId,
+        productId: s.productId,
+        productName: productMap[s.productId]?.name || s.productId,
+        unitPriceMillimes: s.unit,
+        netMillimes: Math.round(s.unit * (1 - settings.commissionBps / 10_000)),
+        paidAt: s.paidAt,
+        licenseKey: s.licenseKey,
+      })),
+      payouts,
+    });
+  });
+
+  r.get('/developer/products/:id', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    const [p] = await db.select().from(mpProducts).where(eq(mpProducts.id, req.params.id)).limit(1);
+    if (!p) throw new HttpError(404, 'Produit introuvable');
+    const [pub] = await db.select().from(mpPublishers).where(eq(mpPublishers.id, p.publisherId)).limit(1);
+    if (pub?.userId !== req.platformUser!.id && req.platformUser!.role !== 'admin') throw new HttpError(403, 'Accès refusé');
+    const versions = await db.select().from(mpVersions).where(eq(mpVersions.productId, p.id)).orderBy(desc(mpVersions.createdAt));
+    const reviews = await db.select().from(mpReviews).where(eq(mpReviews.productId, p.id));
+    const avg = reviews.length ? Math.round((reviews.reduce((s, r) => s + r.rating, 0) / reviews.length) * 10) / 10 : null;
+    res.json({
+      product: pub(req, p, { avgRating: avg, reviewCount: reviews.length }),
+      versions,
+      publisher: pub,
+    });
+  });
+
+  /** Produit ciblé par une nouvelle version : contrôle d’accès, identifiant et dernière version publiée. */
+  async function ownedProduct(productId: string, user: { id: string; role: string }) {
+    const [p] = await db.select().from(mpProducts).where(eq(mpProducts.id, productId)).limit(1);
+    if (!p) throw new HttpError(404, 'Produit introuvable');
+    const [pub] = await db.select().from(mpPublishers).where(eq(mpPublishers.id, p.publisherId)).limit(1);
+    if (pub?.userId !== user.id && user.role !== 'admin') throw new HttpError(403, 'Accès refusé');
+    const versions = await db.select({ version: mpVersions.version, moduleId: mpVersions.moduleId }).from(mpVersions).where(eq(mpVersions.productId, p.id));
+    const latestVersion = versions.map((v) => v.version).sort(compareVersions).pop() || null;
+    const moduleId = versions.find((v) => v.moduleId)?.moduleId || (p.slug.includes('.') ? p.slug : null);
+    return { product: p, moduleId, latestVersion };
+  }
+
+  /** Ajoute au rapport les règles propres à la marketplace (identifiant réservé ou déjà pris, version suivante). */
+  async function withMarketplaceChecks(report: PackageValidationResult, user: { id: string; role: string }, target?: Awaited<ReturnType<typeof ownedProduct>>) {
+    const m = report.manifest;
+    if (!m) return report;
+    if (target) {
+      return addMarketplaceChecks(report, { product: { moduleId: target.moduleId || m.id, latestVersion: target.latestVersion } });
+    }
+    const owners = await db
+      .select({ userId: mpPublishers.userId })
+      .from(mpVersions)
+      .innerJoin(mpProducts, eq(mpProducts.id, mpVersions.productId))
+      .innerJoin(mpPublishers, eq(mpPublishers.id, mpProducts.publisherId))
+      .where(and(or(eq(mpVersions.moduleId, m.id), eq(mpProducts.slug, m.id)), sql`${mpProducts.status} <> 'rejected'`));
+    const takenBy = !owners.length ? null : owners.some((o) => o.userId !== user.id) ? 'other' : 'self';
+    const reservedPrefix = user.role !== 'admin' && /^(novalabs|snapify)\./.test(m.id);
+    return addMarketplaceChecks(report, { takenBy, reservedPrefix });
+  }
+
+  /** Pré-validation sans enregistrer (drag & drop). */
+  r.post('/developer/validate-package', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    const b64 = String(req.body?.packageBase64 || '');
+    if (!b64) throw new HttpError(422, 'Paquet manquant');
+    const buf = Buffer.from(b64, 'base64');
+    const target = req.body?.productId ? await ownedProduct(String(req.body.productId), req.platformUser!) : undefined;
+    const report = await validateMarketplacePackage(buf, {
+      expectedKind: target?.product.kind || (req.body?.kind === 'theme' ? 'theme' : req.body?.kind === 'module' ? 'module' : undefined),
+      expectedVersion: req.body?.expectedVersion ? String(req.body.expectedVersion) : undefined,
+    });
+    res.json({ validation: await withMarketplaceChecks(report, req.platformUser!, target) });
+  });
+
+  /** Créer un produit + 1re version depuis un paquet validé. */
+  r.post('/developer/products/from-package', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    await ensurePkgDir();
+    const [pub] = await db
+      .select()
+      .from(mpPublishers)
+      .where(and(eq(mpPublishers.userId, req.platformUser!.id), eq(mpPublishers.status, 'active')))
+      .limit(1);
+    if (!pub && req.platformUser!.role !== 'admin') throw new HttpError(403, 'Inscription développeur requise.');
+    const publisherId = pub?.id || String(req.body.publisherId || '');
+    if (!publisherId) throw new HttpError(422, 'Publisher manquant');
+
+    const b64 = String(req.body?.packageBase64 || '');
+    if (!b64) throw new HttpError(422, 'Paquet manquant');
+    const buf = Buffer.from(b64, 'base64');
+    const report = await withMarketplaceChecks(await validateMarketplacePackage(buf), req.platformUser!);
+    if (!report.ok || !report.manifest) throw new HttpError(422, `Validation échouée : ${report.errors.join(' · ') || 'paquet invalide'}`);
+
+    const m = report.manifest;
+    const kind = m.kind === 'theme' ? 'theme' : 'module';
+    let slug = slugify(m.id.replace(/\./g, '-'));
+    const clash = await db.select({ id: mpProducts.id }).from(mpProducts).where(eq(mpProducts.slug, slug)).limit(1);
+    if (clash.length) slug = `${slug}-${crypto.randomBytes(2).toString('hex')}`;
+
+    const priceMillimes =
+      req.body?.priceMillimes !== undefined
+        ? Math.max(0, Math.floor(Number(req.body.priceMillimes) || 0))
+        : m.pricing === 'free'
+          ? 0
+          : 49_000;
+
+    const productId = crypto.randomUUID();
+    const [p] = await db
+      .insert(mpProducts)
+      .values({
+        id: productId,
+        publisherId,
+        kind,
+        slug,
+        name: m.name,
+        shortDesc: m.description.slice(0, 300),
+        longDesc: `<p>${m.description}</p>`,
+        category: String(req.body?.category || (m as { category?: string }).category || 'Autres').slice(0, 80),
+        priceMillimes,
+        icon: m.icon || 'package',
+        screenshots: [],
+        engines: m.engines || { snapify: '^1.0.0' },
+        permissions: m.permissions || [],
+        status: 'draft',
+      })
+      .returning();
+
+    const ext = kind === 'theme' ? '.snaptheme' : '.snapmod';
+    const filename = `${slug}-${m.version}${ext}`;
+    await fs.writeFile(path.join(PKG_DIR, filename), buf);
+    const [ver] = await db
+      .insert(mpVersions)
+      .values({
+        id: crypto.randomUUID(),
+        productId,
+        version: m.version,
+        changelog: String(req.body?.changelog || 'Version initiale').slice(0, 5000),
+        packagePath: filename,
+        sha256: report.sha256,
+        size: report.size,
+        signed: report.signed,
+        validationReport: report as unknown as Record<string, unknown>,
+        moduleId: m.id,
+      })
+      .returning();
+
+    res.status(201).json({ product: pub(req, p), version: ver, validation: report });
+  });
+
+  r.post('/developer/products', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    const [pub] = await db
+      .select()
+      .from(mpPublishers)
+      .where(and(eq(mpPublishers.userId, req.platformUser!.id), eq(mpPublishers.status, 'active')))
+      .limit(1);
+    if (!pub && req.platformUser!.role !== 'admin') throw new HttpError(403, 'Inscription développeur requise.');
+
+    const publisherId = pub?.id || String(req.body.publisherId || '');
+    if (!publisherId) throw new HttpError(422, 'Publisher manquant');
+
+    const kind = req.body?.kind === 'theme' ? 'theme' : 'module';
+    const name = String(req.body?.name || '').trim().slice(0, 120);
+    if (name.length < 2) throw new HttpError(422, 'Nom invalide');
+    let slug = slugify(String(req.body?.slug || name));
+    const clash = await db.select({ id: mpProducts.id }).from(mpProducts).where(eq(mpProducts.slug, slug)).limit(1);
+    if (clash.length) slug = `${slug}-${crypto.randomBytes(2).toString('hex')}`;
+
+    const id = crypto.randomUUID();
+    const [p] = await db
+      .insert(mpProducts)
+      .values({
+        id,
+        publisherId,
+        kind,
+        slug,
+        name,
+        shortDesc: String(req.body?.shortDesc || '').slice(0, 300),
+        longDesc: String(req.body?.longDesc || '').slice(0, 20_000),
+        category: String(req.body?.category || 'Autres').slice(0, 80),
+        priceMillimes: Math.max(0, Math.floor(Number(req.body?.priceMillimes) || 0)),
+        icon: String(req.body?.icon || 'package').slice(0, 500),
+        screenshots: Array.isArray(req.body?.screenshots) ? req.body.screenshots.slice(0, 8) : [],
+        engines: req.body?.engines || { snapify: '^1.0.0' },
+        permissions: Array.isArray(req.body?.permissions) ? req.body.permissions : [],
+        status: 'draft',
+      })
+      .returning();
+    res.status(201).json({ product: pub(req, p) });
+  });
+
+  /** Upload image (icône / capture) → URL publique /uploads/marketplace/… */
+  r.post('/developer/media', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    const b64 = String(req.body?.imageBase64 || '');
+    const mime = String(req.body?.mime || 'image/png');
+    if (!b64) throw new HttpError(422, 'Image manquante');
+    if (!/^image\/(png|jpeg|jpg|webp|gif)$/.test(mime)) throw new HttpError(422, 'Format image non supporté');
+    const raw = b64.includes(',') ? b64.split(',')[1] : b64;
+    const buf = Buffer.from(raw, 'base64');
+    if (buf.length < 32 || buf.length > 5 * 1024 * 1024) throw new HttpError(422, 'Image trop petite ou > 5 Mo');
+    const ext = mime.includes('webp') ? 'webp' : mime.includes('gif') ? 'gif' : mime.includes('png') ? 'png' : 'jpg';
+    const dir = path.resolve(__dirname, '../../public/uploads/marketplace');
+    await fs.mkdir(dir, { recursive: true });
+    const name = `${crypto.randomUUID()}.${ext}`;
+    await fs.writeFile(path.join(dir, name), buf);
+    res.status(201).json({ url: `/uploads/marketplace/${name}` });
+  });
+
+  r.patch('/developer/products/:id', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    const [p] = await db.select().from(mpProducts).where(eq(mpProducts.id, req.params.id)).limit(1);
+    if (!p) throw new HttpError(404, 'Introuvable');
+    const [pub] = await db.select().from(mpPublishers).where(eq(mpPublishers.id, p.publisherId)).limit(1);
+    if (pub?.userId !== req.platformUser!.id && req.platformUser!.role !== 'admin') throw new HttpError(403, 'Accès refusé');
+
+    const patch: Partial<typeof mpProducts.$inferInsert> = { updatedAt: new Date() };
+    for (const key of ['name', 'shortDesc', 'longDesc', 'category', 'icon'] as const) {
+      if (typeof req.body?.[key] === 'string') {
+        const val = key === 'icon' ? req.body[key].slice(0, 500) : req.body[key];
+        (patch as Record<string, string>)[key] = val;
+      }
+    }
+    if (req.body?.priceMillimes !== undefined) patch.priceMillimes = Math.max(0, Math.floor(Number(req.body.priceMillimes) || 0));
+    if (Array.isArray(req.body?.screenshots)) {
+      patch.screenshots = req.body.screenshots.filter((u: unknown) => typeof u === 'string').slice(0, 8);
+    }
+    if (req.body?.submit === true) patch.status = 'pending';
+    if (req.body?.status === 'draft' && (p.status === 'rejected' || p.status === 'pending')) patch.status = 'draft';
+    const [updated] = await db.update(mpProducts).set(patch).where(eq(mpProducts.id, p.id)).returning();
+    res.json({ product: pub(req, updated) });
+  });
+
+  r.post('/developer/products/:id/versions', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    await ensurePkgDir();
+    const target = await ownedProduct(req.params.id, req.platformUser!);
+    const p = target.product;
+
+    const changelog = String(req.body?.changelog || '').slice(0, 5000);
+    const b64 = String(req.body?.packageBase64 || '');
+    if (!b64 || b64.length > 30 * 1024 * 1024) throw new HttpError(422, 'Paquet manquant ou trop volumineux');
+    const buf = Buffer.from(b64, 'base64');
+    if (buf.length < 16) throw new HttpError(422, 'Paquet invalide');
+
+    const report = await withMarketplaceChecks(
+      await validateMarketplacePackage(buf, { expectedKind: p.kind, expectedVersion: req.body?.version ? String(req.body.version) : undefined }),
+      req.platformUser!,
+      target
+    );
+    if (!report.ok || !report.manifest) {
+      throw new HttpError(422, `Validation échouée : ${report.errors.join(' · ')}`);
+    }
+
+    const version = report.manifest.version;
+    const existing = await db
+      .select({ id: mpVersions.id })
+      .from(mpVersions)
+      .where(and(eq(mpVersions.productId, p.id), eq(mpVersions.version, version)))
+      .limit(1);
+    if (existing.length) throw new HttpError(409, `La version ${version} existe déjà pour ce produit`);
+
+    const ext = p.kind === 'theme' ? '.snaptheme' : '.snapmod';
+    const filename = `${p.slug}-${version}${ext}`;
+    await fs.writeFile(path.join(PKG_DIR, filename), buf);
+
+    // Sync product metadata from manifest (permissions / engines / icon)
+    await db
+      .update(mpProducts)
+      .set({
+        permissions: report.manifest.permissions || p.permissions,
+        engines: report.manifest.engines || p.engines,
+        icon: report.manifest.icon || p.icon,
+        updatedAt: new Date(),
+      })
+      .where(eq(mpProducts.id, p.id));
+
+    const id = crypto.randomUUID();
+    const [ver] = await db
+      .insert(mpVersions)
+      .values({
+        id,
+        productId: p.id,
+        version,
+        changelog: changelog || `Version ${version}`,
+        packagePath: filename,
+        sha256: report.sha256,
+        size: report.size,
+        signed: report.signed,
+        validationReport: report as unknown as Record<string, unknown>,
+        moduleId: report.manifest.id,
+      })
+      .returning();
+    res.status(201).json({ version: ver, validation: report });
+  });
+
+  r.post('/developer/payouts', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    const [pub] = await db
+      .select()
+      .from(mpPublishers)
+      .where(and(eq(mpPublishers.userId, req.platformUser!.id), eq(mpPublishers.status, 'active')))
+      .limit(1);
+    if (!pub) throw new HttpError(403, 'Publisher requis');
+    const amountMillimes = Math.floor(Number(req.body?.amountMillimes) || 0);
+    if (amountMillimes < 10_000) throw new HttpError(422, 'Minimum 10 DT');
+    const period = String(req.body?.period || new Date().toISOString().slice(0, 7));
+    const id = crypto.randomUUID();
+    const [row] = await db
+      .insert(mpPayouts)
+      .values({ id, publisherId: pub.id, amountMillimes, period, status: 'requested' })
+      .returning();
+    res.status(201).json({ payout: row });
+  });
+
+  r.patch('/developer/profile', requirePlatformUser, requireRole('publisher', 'admin'), async (req, res) => {
+    const [pub] = await db.select().from(mpPublishers).where(eq(mpPublishers.userId, req.platformUser!.id)).limit(1);
+    if (!pub) throw new HttpError(404, 'Publisher introuvable');
+    const patch: Partial<typeof mpPublishers.$inferInsert> = {};
+    if (typeof req.body?.displayName === 'string') patch.displayName = req.body.displayName.slice(0, 80);
+    if (typeof req.body?.website === 'string' || req.body?.website === null) patch.website = req.body.website;
+    if (typeof req.body?.payoutIban === 'string' || req.body?.payoutIban === null) patch.payoutIban = req.body.payoutIban;
+    const [updated] = await db.update(mpPublishers).set(patch).where(eq(mpPublishers.id, pub.id)).returning();
+    res.json({ publisher: updated });
+  });
+
+  /* ---- Admin ---- */
+  r.post('/admin/sync-official', requirePlatformUser, requireRole('admin'), async (_req, res) => {
+    const { syncOfficialMarketplace } = await import('./syncOfficial');
+    const result = await syncOfficialMarketplace();
+    res.json(result);
+  });
+
+  r.get('/admin/products', requirePlatformUser, requireRole('admin'), async (req, res) => {
+    const status = String(req.query.status || 'pending');
+    const rows = await db
+      .select()
+      .from(mpProducts)
+      .where(status === 'all' ? undefined : eq(mpProducts.status, status as 'pending'))
+      .orderBy(desc(mpProducts.updatedAt))
+      .limit(100);
+    res.json({ items: rows.map((p) => pub(req, p)) });
+  });
+
+  r.post('/admin/products/:id/review', requirePlatformUser, requireRole('admin'), async (req, res) => {
+    const action = req.body?.action;
+    const [p] = await db.select().from(mpProducts).where(eq(mpProducts.id, req.params.id)).limit(1);
+    if (!p) throw new HttpError(404, 'Introuvable');
+    if (action === 'approve') {
+      const { product, signed } = await approveProduct(p.id);
+      return res.json({ product: pub(req, product), signed });
+    }
+    if (action === 'reject') {
+      const [updated] = await db
+        .update(mpProducts)
+        .set({
+          status: 'rejected',
+          rejectionReason: String(req.body?.reason || 'Non conforme').slice(0, 500),
+          updatedAt: new Date(),
+        })
+        .where(eq(mpProducts.id, p.id))
+        .returning();
+      return res.json({ product: pub(req, updated) });
+    }
+    throw new HttpError(422, 'action = approve | reject');
+  });
+
+  r.get('/admin/orders', requirePlatformUser, requireRole('admin'), async (_req, res) => {
+    const orders = await db.select().from(mpOrders).orderBy(desc(mpOrders.createdAt)).limit(100);
+    res.json({ items: orders });
+  });
+
+  r.get('/admin/publishers', requirePlatformUser, requireRole('admin'), async (_req, res) => {
+    const pubs = await db.select().from(mpPublishers).orderBy(desc(mpPublishers.createdAt)).limit(100);
+    res.json({ items: pubs });
+  });
+
+  r.get('/admin/payouts', requirePlatformUser, requireRole('admin'), async (_req, res) => {
+    const rows = await db.select().from(mpPayouts).orderBy(desc(mpPayouts.createdAt)).limit(100);
+    res.json({ items: rows });
+  });
+
+  r.post('/admin/payouts/:id', requirePlatformUser, requireRole('admin'), async (req, res) => {
+    const status = req.body?.status === 'paid' ? 'paid' : req.body?.status === 'rejected' ? 'rejected' : null;
+    if (!status) throw new HttpError(422, 'status invalide');
+    const [row] = await db
+      .update(mpPayouts)
+      .set({ status, paidAt: status === 'paid' ? new Date() : null, note: req.body?.note ? String(req.body.note) : undefined })
+      .where(eq(mpPayouts.id, req.params.id))
+      .returning();
+    res.json({ payout: row });
+  });
+
+  r.get('/admin/settings', requirePlatformUser, requireRole('admin'), async (_req, res) => {
+    const s = await getMpSettings();
+    res.json({
+      commissionBps: s.commissionBps,
+      developerFeeMillimes: s.developerFeeMillimes,
+      bankFallback: s.bankFallback,
+      flouciPublicKey: s.flouciPublicKey || '',
+      hasFlouciPrivateKey: Boolean(s.flouciPrivateKeyEnc || process.env.FLOUCI_PRIVATE_KEY),
+    });
+  });
+
+  r.put('/admin/settings', requirePlatformUser, requireRole('admin'), async (req, res) => {
+    const next = await setMpSettings({
+      commissionBps: req.body?.commissionBps !== undefined ? Number(req.body.commissionBps) : undefined,
+      developerFeeMillimes: req.body?.developerFeeMillimes !== undefined ? Number(req.body.developerFeeMillimes) : undefined,
+      bankFallback: req.body?.bankFallback,
+      flouciPublicKey: req.body?.flouciPublicKey,
+      flouciPrivateKey: req.body?.flouciPrivateKey,
+    });
+    res.json({
+      commissionBps: next.commissionBps,
+      developerFeeMillimes: next.developerFeeMillimes,
+      bankFallback: next.bankFallback,
+      flouciPublicKey: next.flouciPublicKey || '',
+    });
+  });
+
+  return r;
+}