create-snapify-app 0.0.0-stage → 1.1.0

package/template/server/marketplace/signing.ts

@@ -0,0 +1,116 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/**
+ * Signature NOVALABS des versions approuvées : les sites n'installent que des paquets signés
+ * par une clé de confiance. La clé privée (SNAPIFY_SIGNING_KEY, chemin PEM) ne quitte jamais
+ * ce serveur et n'est jamais versionnée.
+ */
+import fs from 'fs/promises';
+import os from 'os';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { eq } from 'drizzle-orm';
+import { db } from '../db/client';
+import { mpProducts, mpVersions } from '../db/schema';
+import { HttpError } from '../http';
+import { decodePackage, encodePackage, sign, verify } from '../../sdk/package';
+import type { LicensePayload, SignedLicense } from '../../sdk/index';
+import { TRUSTED_KEYS } from '../modules/trust';
+import { validateMarketplacePackage, type PackageValidationResult } from './packageValidate';
+
+type Version = typeof mpVersions.$inferSelect;
+
+export const PACKAGES_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../data/marketplace-packages');
+
+async function signingKey(): Promise<{ pem: string; kid: string } | null> {
+  const raw = process.env.SNAPIFY_SIGNING_KEY;
+  const kid = process.env.SNAPIFY_SIGNING_KID || 'novalabs-2026';
+  if (!raw) return null;
+  if (!TRUSTED_KEYS[kid]) throw new HttpError(503, `Clé de signature « ${kid} » absente de la liste des clés de confiance`);
+  const file = raw.startsWith('~/') ? path.join(os.homedir(), raw.slice(2)) : raw;
+  return { pem: await fs.readFile(file, 'utf8'), kid };
+}
+
+function freeLicense(moduleId: string, key: { pem: string; kid: string }): SignedLicense {
+  const payload: LicensePayload = {
+    v: 1,
+    licenseId: `free-${moduleId}`,
+    moduleId,
+    licensee: 'Licence gratuite',
+    plan: 'free',
+    domains: ['*'],
+    issuedAt: new Date().toISOString(),
+    expiresAt: null,
+  };
+  return { payload, signature: sign(payload, key.pem, key.kid) };
+}
+
+/**
+ * Signe les versions non signées d'un produit au moment de l'approbation. Chaque paquet est
+ * revalidé avant signature ; une version gratuite reçoit la licence gratuite intégrée.
+ */
+export async function signProductVersions(versions: Version[], pkgDir: string, free: boolean): Promise<Version[]> {
+  const pending = versions.filter((v) => !v.signed);
+  if (!pending.length) return [];
+  const key = await signingKey();
+  if (!key) throw new HttpError(503, 'Signature impossible : SNAPIFY_SIGNING_KEY n’est pas configurée sur le serveur de la marketplace.');
+
+  const signed: Version[] = [];
+  for (const ver of pending) {
+    const abs = path.resolve(pkgDir, path.basename(ver.packagePath));
+    if (!abs.startsWith(pkgDir + path.sep)) throw new HttpError(400, 'Chemin de paquet invalide');
+    const buf = await fs.readFile(abs).catch(() => {
+      throw new HttpError(404, `Fichier de la version ${ver.version} introuvable`);
+    });
+
+    const before = await validateMarketplacePackage(buf);
+    if (!before.ok || !before.manifest) {
+      const errors = before.checks.filter((c) => c.status === 'fail').map((c) => c.detail);
+      throw new HttpError(422, `Version ${ver.version} non conforme : ${errors.join(' ; ') || 'paquet invalide'}`);
+    }
+    if (ver.moduleId && before.manifest.id !== ver.moduleId) throw new HttpError(422, `Version ${ver.version} : identifiant inattendu (${before.manifest.id})`);
+
+    const { pkg } = decodePackage(buf);
+    pkg.signature = sign(pkg.manifest, key.pem, key.kid);
+    if (free) pkg.license = freeLicense(pkg.manifest.id, key);
+    else delete pkg.license;
+    if (!verify(pkg.manifest, pkg.signature, TRUSTED_KEYS)) throw new HttpError(500, 'La signature produite ne correspond à aucune clé de confiance');
+
+    const out = encodePackage(pkg);
+    const report: PackageValidationResult = await validateMarketplacePackage(out);
+    if (!report.ok || !report.signed) throw new HttpError(500, `Version ${ver.version} : le paquet signé ne passe pas la validation`);
+
+    const tmp = `${abs}.signing`;
+    await fs.writeFile(tmp, out);
+    await fs.rename(tmp, abs);
+    const [row] = await db
+      .update(mpVersions)
+      .set({ signed: true, sha256: report.sha256, size: report.size, validationReport: report as unknown as Record<string, unknown> })
+      .where(eq(mpVersions.id, ver.id))
+      .returning();
+    signed.push(row);
+  }
+  return signed;
+}
+
+/**
+ * Approbation d'un produit (nouveau ou mise à jour d'un produit déjà publié) : signe toutes ses
+ * versions en attente puis le publie. Seul chemin de publication, pour l'admin marketplace comme pour le superadmin.
+ */
+export async function approveProduct(productId: string) {
+  const [p] = await db.select().from(mpProducts).where(eq(mpProducts.id, productId)).limit(1);
+  if (!p) throw new HttpError(404, 'Introuvable');
+  const versions = await db.select().from(mpVersions).where(eq(mpVersions.productId, p.id));
+  if (!versions.length) throw new HttpError(422, 'Aucune version à publier');
+  const signed = await signProductVersions(versions, PACKAGES_DIR, p.priceMillimes === 0);
+  const [updated] = await db
+    .update(mpProducts)
+    .set({ status: 'published', rejectionReason: null, updatedAt: new Date() })
+    .where(eq(mpProducts.id, p.id))
+    .returning();
+  return { product: updated, signed: signed.map((v) => v.version) };
+}

package/template/server/marketplace/syncOfficial.ts

@@ -0,0 +1,282 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/**
+ * Synchronise la marketplace (DB + paquets) depuis marketplace/catalog.json —
+ * modules et thèmes officiels Snapify/NOVALABS. Aucun produit mock.
+ */
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { and, eq, inArray, like, or } from 'drizzle-orm';
+import { db } from '../db/client';
+import { mpCarts, mpOrderItems, mpProducts, mpPublishers, mpReviews, mpVersions, platformUsers } from '../db/schema';
+import { hashPassword } from '../platform/passwords';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const MARKETPLACE_ROOT = path.resolve(__dirname, '../../marketplace');
+const PKG_DIR = path.resolve(__dirname, '../../data/marketplace-packages');
+const UPLOAD_DIR = path.resolve(__dirname, '../../public/uploads/marketplace');
+
+type CatalogEntry = {
+  id: string;
+  kind?: 'module' | 'theme';
+  name: string;
+  version: string;
+  description: string;
+  author?: { name?: string; email?: string; url?: string };
+  pricing?: 'free' | 'paid';
+  category?: string;
+  icon?: string;
+  permissions?: string[];
+  engines?: { snapify: string };
+  screenshot?: string;
+  gallery?: string[];
+  package: string;
+  sha256: string;
+  size: number;
+  signed?: boolean;
+};
+
+async function ensurePublisherFor(author?: CatalogEntry['author']): Promise<typeof mpPublishers.$inferSelect> {
+  const email = (author?.email || 'dev@snapify.tn').trim().toLowerCase();
+  const displayName = (author?.name || (email === 'dev@snapify.tn' ? 'NOVALABS WEB DESIGN' : email.split('@')[0])).trim();
+  const website = (author?.url || 'https://novalabs.tn').trim();
+
+  let [pubUser] = await db.select().from(platformUsers).where(eq(platformUsers.email, email)).limit(1);
+  if (!pubUser) {
+    const { hash, salt } = hashPassword(email === 'dev@snapify.tn' ? 'Developer1' : crypto.randomBytes(18).toString('base64url'));
+    const id = crypto.randomUUID();
+    [pubUser] = await db
+      .insert(platformUsers)
+      .values({
+        id,
+        email,
+        displayName,
+        passwordHash: hash,
+        salt,
+        role: 'publisher',
+      })
+      .returning();
+  } else if (pubUser.role === 'member') {
+    await db.update(platformUsers).set({ role: 'publisher', displayName: pubUser.displayName || displayName }).where(eq(platformUsers.id, pubUser.id));
+  }
+
+  let [publisher] = await db.select().from(mpPublishers).where(eq(mpPublishers.userId, pubUser.id)).limit(1);
+  if (!publisher) {
+    [publisher] = await db
+      .insert(mpPublishers)
+      .values({
+        id: crypto.randomUUID(),
+        userId: pubUser.id,
+        displayName,
+        website,
+        status: 'active',
+        paidAt: new Date(),
+      })
+      .returning();
+  } else if (publisher.status !== 'active' || publisher.displayName !== displayName) {
+    [publisher] = await db
+      .update(mpPublishers)
+      .set({
+        status: 'active',
+        paidAt: publisher.paidAt || new Date(),
+        displayName,
+        website: website || publisher.website,
+      })
+      .where(eq(mpPublishers.id, publisher.id))
+      .returning();
+  }
+  return publisher;
+}
+
+async function removeMockProducts() {
+  const mocks = await db
+    .select()
+    .from(mpProducts)
+    .where(
+      or(
+        like(mpProducts.slug, 'novalabs.demo-%'),
+        like(mpProducts.slug, 'demo.%'),
+        eq(mpProducts.slug, 'pack-seo-pro'),
+        eq(mpProducts.slug, 'novalabs.demo-seo'),
+        eq(mpProducts.slug, 'novalabs.demo-theme-lite')
+      )
+    );
+  if (!mocks.length) return;
+  const ids = mocks.map((p) => p.id);
+  await db.delete(mpVersions).where(inArray(mpVersions.productId, ids));
+  await db.delete(mpReviews).where(inArray(mpReviews.productId, ids));
+  await db.delete(mpOrderItems).where(inArray(mpOrderItems.productId, ids));
+  // paniers : retirer l’id mock de productIds
+  const carts = await db.select().from(mpCarts);
+  for (const c of carts) {
+    const next = (c.productIds || []).filter((id) => !ids.includes(id));
+    if (next.length !== (c.productIds || []).length) {
+      await db.update(mpCarts).set({ productIds: next, updatedAt: new Date() }).where(eq(mpCarts.userId, c.userId));
+    }
+  }
+  await db.delete(mpProducts).where(inArray(mpProducts.id, ids));
+  for (const p of mocks) console.log(`[marketplace] mock retiré : ${p.slug}`);
+}
+
+async function copyImage(rel: string, name: string): Promise<string | null> {
+  const src = path.resolve(MARKETPLACE_ROOT, rel);
+  if (!src.startsWith(MARKETPLACE_ROOT + path.sep)) return null;
+  try {
+    const buf = await fs.readFile(src);
+    await fs.mkdir(UPLOAD_DIR, { recursive: true });
+    const file = `${name}${path.extname(src).toLowerCase() || '.jpg'}`;
+    await fs.writeFile(path.join(UPLOAD_DIR, file), buf);
+    return `/uploads/marketplace/${file}`;
+  } catch {
+    return null;
+  }
+}
+
+/** Couverture (capture du paquet) puis galerie `marketplace/gallery/<id>/`. */
+async function copyScreenshots(entry: CatalogEntry): Promise<string[]> {
+  const base = entry.id.replace(/\./g, '-');
+  const urls: (string | null)[] = [];
+  if (entry.screenshot) urls.push(await copyImage(entry.screenshot, `${base}-shot`));
+  for (const [i, rel] of (Array.isArray(entry.gallery) ? entry.gallery.slice(0, 8) : []).entries()) {
+    if (typeof rel === 'string') urls.push(await copyImage(rel, `${base}-gallery-${i + 1}`));
+  }
+  return urls.filter((u): u is string => !!u);
+}
+
+export async function syncOfficialMarketplace(): Promise<{ synced: number }> {
+  await fs.mkdir(PKG_DIR, { recursive: true });
+  await fs.mkdir(UPLOAD_DIR, { recursive: true });
+  await removeMockProducts();
+
+  let catalog: { modules?: CatalogEntry[] };
+  try {
+    catalog = JSON.parse(await fs.readFile(path.join(MARKETPLACE_ROOT, 'catalog.json'), 'utf8'));
+  } catch (e) {
+    console.error('[marketplace] catalog.json introuvable — sync annulée', e);
+    return { synced: 0 };
+  }
+
+  const entries = Array.isArray(catalog.modules) ? catalog.modules : [];
+  if (!entries.length) {
+    console.warn('[marketplace] catalogue vide');
+    return { synced: 0 };
+  }
+
+  const publisherCache = new Map<string, typeof mpPublishers.$inferSelect>();
+  let synced = 0;
+
+  for (const entry of entries) {
+    if (!entry?.id || !entry.version || !entry.package) continue;
+    const kind = entry.kind === 'theme' ? 'theme' : 'module';
+    const pkgSrc = path.resolve(MARKETPLACE_ROOT, entry.package);
+    if (!pkgSrc.startsWith(MARKETPLACE_ROOT + path.sep)) continue;
+
+    let pkgBuf: Buffer;
+    try {
+      pkgBuf = await fs.readFile(pkgSrc);
+    } catch {
+      console.error(`[marketplace] paquet manquant : ${entry.package}`);
+      continue;
+    }
+
+    const filename = path.basename(pkgSrc);
+    await fs.writeFile(path.join(PKG_DIR, filename), pkgBuf);
+
+    const screenshots = await copyScreenshots(entry);
+    const shortDesc = (entry.description || '').slice(0, 280);
+    const longDesc = `<p>${entry.description || ''}</p><p>Éditeur : ${entry.author?.name || 'NOVALABS WEB DESIGN'}.</p>`;
+    const priceMillimes = entry.pricing === 'paid' ? 49_000 : 0;
+    const authorKey = (entry.author?.email || 'dev@snapify.tn').trim().toLowerCase();
+    let publisher = publisherCache.get(authorKey);
+    if (!publisher) {
+      publisher = await ensurePublisherFor(entry.author);
+      publisherCache.set(authorKey, publisher);
+    }
+
+    let [product] = await db.select().from(mpProducts).where(eq(mpProducts.slug, entry.id)).limit(1);
+    if (!product) {
+      const id = crypto.randomUUID();
+      [product] = await db
+        .insert(mpProducts)
+        .values({
+          id,
+          publisherId: publisher.id,
+          slug: entry.id,
+          name: entry.name,
+          kind,
+          shortDesc,
+          longDesc,
+          category: entry.category || (kind === 'theme' ? 'Apparence' : 'Autres'),
+          priceMillimes,
+          icon: entry.icon || (kind === 'theme' ? 'layout' : 'package'),
+          screenshots,
+          engines: entry.engines || { snapify: '^1.0.0' },
+          permissions: entry.permissions || [],
+          status: 'published',
+        })
+        .returning();
+    } else {
+      [product] = await db
+        .update(mpProducts)
+        .set({
+          publisherId: publisher.id,
+          name: entry.name,
+          kind,
+          shortDesc,
+          longDesc,
+          category: entry.category || product.category,
+          priceMillimes,
+          icon: screenshots[0] || entry.icon || product.icon,
+          screenshots: screenshots.length ? screenshots : product.screenshots,
+          engines: entry.engines || product.engines,
+          permissions: entry.permissions || product.permissions,
+          status: 'published',
+          updatedAt: new Date(),
+        })
+        .where(eq(mpProducts.id, product.id))
+        .returning();
+    }
+
+    const [existingVer] = await db
+      .select()
+      .from(mpVersions)
+      .where(and(eq(mpVersions.productId, product.id), eq(mpVersions.version, entry.version)))
+      .limit(1);
+
+    if (!existingVer) {
+      await db.insert(mpVersions).values({
+        id: crypto.randomUUID(),
+        productId: product.id,
+        version: entry.version,
+        changelog: `Version ${entry.version} (catalogue officiel Snapify)`,
+        packagePath: filename,
+        sha256: entry.sha256,
+        size: entry.size || pkgBuf.length,
+        signed: entry.signed !== false,
+        moduleId: entry.id,
+      });
+    } else {
+      await db
+        .update(mpVersions)
+        .set({
+          packagePath: filename,
+          sha256: entry.sha256,
+          size: entry.size || pkgBuf.length,
+          signed: entry.signed !== false,
+          moduleId: entry.id,
+        })
+        .where(eq(mpVersions.id, existingVer.id));
+    }
+
+    synced += 1;
+  }
+
+  console.log(`[marketplace] sync officiel : ${synced} produit(s) depuis catalog.json`);
+  return { synced };
+}

package/template/server/media/images.ts

@@ -0,0 +1,63 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/** Images envoyées en base64 (photos de profil…) : contrôle du format réel, enregistrement et suppression. */
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import path from 'path';
+import { getDataPaths } from '../cms/store';
+
+const FORMATS = {
+  'image/jpeg': { ext: 'jpg', magic: (b: Buffer) => b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff },
+  'image/png': { ext: 'png', magic: (b: Buffer) => b.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) },
+  'image/webp': { ext: 'webp', magic: (b: Buffer) => b.subarray(0, 4).toString('latin1') === 'RIFF' && b.subarray(8, 12).toString('latin1') === 'WEBP' },
+} as const;
+
+export type ImageMime = keyof typeof FORMATS;
+
+export class ImageError extends Error {
+  constructor(
+    public status: number,
+    message: string
+  ) {
+    super(message);
+  }
+}
+
+/** Décode et vérifie une image : le type annoncé doit correspondre à la signature du fichier. */
+export function decodeImage(input: { dataBase64?: unknown; mimeType?: unknown }, maxBytes: number): { buf: Buffer; ext: string } {
+  const mime = String(input.mimeType || '') as ImageMime;
+  const format = FORMATS[mime];
+  if (!format) throw new ImageError(415, 'Format non pris en charge : JPG, PNG ou WebP uniquement.');
+  const raw = String(input.dataBase64 || '').replace(/^data:[^;]+;base64,/, '');
+  if (!raw || !/^[A-Za-z0-9+/=\s]+$/.test(raw)) throw new ImageError(400, 'Image illisible.');
+  const buf = Buffer.from(raw, 'base64');
+  if (buf.length > maxBytes) throw new ImageError(413, `Image trop lourde (${Math.round(maxBytes / 1024)} Ko max.).`);
+  if (buf.length < 12 || !format.magic(buf)) throw new ImageError(415, 'Le fichier n’est pas une image valide.');
+  return { buf, ext: format.ext };
+}
+
+const SUBDIR_PATTERN = /^[a-z0-9][a-z0-9._-]*(\/[a-z0-9][a-z0-9._-]*)*$/;
+
+/** Enregistre l'image sous public/uploads/<subdir>/ avec un nom imprévisible ; renvoie son URL publique. */
+export async function saveImage(subdir: string, prefix: string, buf: Buffer, ext: string): Promise<string> {
+  if (!SUBDIR_PATTERN.test(subdir)) throw new Error(`Dossier d'images invalide : ${subdir}`);
+  const { UPLOADS_DIR } = getDataPaths();
+  const dir = path.join(UPLOADS_DIR, subdir);
+  await fs.mkdir(dir, { recursive: true });
+  const safePrefix = prefix.toLowerCase().replace(/[^a-z0-9-]/g, '').slice(0, 40) || 'image';
+  const name = `${safePrefix}-${crypto.randomBytes(8).toString('hex')}.${ext}`;
+  await fs.writeFile(path.join(dir, name), buf, { mode: 0o644 });
+  return `/uploads/${subdir}/${name}`;
+}
+
+/** Supprime une image précédemment enregistrée dans ce dossier ; ignore toute autre URL. */
+export async function removeImage(subdir: string, url: string | undefined | null): Promise<void> {
+  if (!url || !SUBDIR_PATTERN.test(subdir) || !url.startsWith(`/uploads/${subdir}/`)) return;
+  const name = url.slice(`/uploads/${subdir}/`.length);
+  if (!/^[a-z0-9-]+\.(jpg|png|webp)$/.test(name)) return;
+  await fs.rm(path.join(getDataPaths().UPLOADS_DIR, subdir, name), { force: true }).catch(() => undefined);
+}

package/template/server/middleware/adminAuth.ts

@@ -0,0 +1,134 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import type { Request, Response, NextFunction } from 'express';
+import { passwordExpired, tokenMatchesUser, verifyToken } from '../cms/auth';
+import { loadSnapshot } from '../cms/store';
+import type { AdminUser, CmsSnapshot } from '../cms/types';
+import { rolePermissions, SUPERADMIN_ROLE, type Permission } from '../cms/permissions';
+import { HttpError } from '../http';
+import { getSession, isSessionActive, touchSession } from '../security/sessions';
+import { clientIp, ipAllowed } from '../security/ip';
+import { hit, rateLimitError } from '../security/rateLimit';
+
+export interface AdminContext {
+  sub: string;
+  email: string;
+  name: string;
+  role: string;
+  sid: string;
+  isSuper: boolean;
+  permissions: Permission[];
+}
+
+export interface AuthedRequest extends Request {
+  admin?: AdminContext;
+}
+
+export function permissionsOf(s: CmsSnapshot, user: AdminUser): Permission[] {
+  return rolePermissions(s.roles, user.role);
+}
+
+/** Étapes obligatoires avant d'accéder à l'administration. */
+export function pendingRequirements(s: CmsSnapshot, user: AdminUser) {
+  const policy = s.system.security;
+  const twoFactorRequired = policy.twoFactor === 'all' || (policy.twoFactor === 'superadmins' && user.role === SUPERADMIN_ROLE);
+  return {
+    mustChangePassword: !!user.mustChangePassword || passwordExpired(user, policy.passwordExpiryDays),
+    mustSetup2fa: twoFactorRequired && !user.totpEnabled,
+    twoFactorRequired,
+  };
+}
+
+const unauthorized = (message = 'Session expirée') => new HttpError(401, message, 'SESSION_EXPIRED');
+
+async function authenticate(req: AuthedRequest, res: Response): Promise<{ user: AdminUser; snap: CmsSnapshot }> {
+  const header = req.headers.authorization;
+  const token = header?.startsWith('Bearer ') ? header.slice(7) : undefined;
+  if (!token) throw new HttpError(401, 'Non authentifié', 'SESSION_EXPIRED');
+
+  const payload = verifyToken(token);
+  if (!payload) throw unauthorized();
+
+  const snap = await loadSnapshot();
+  const user = snap.users.find((u) => u.id === payload.sub);
+  if (!user || !tokenMatchesUser(payload, user)) throw unauthorized();
+  if (user.status !== 'active') throw unauthorized(user.status === 'suspended' ? 'Compte suspendu' : 'Session expirée');
+
+  const session = await getSession(payload.sid);
+  if (!session || session.userId !== user.id || !isSessionActive(session, snap.system.security.idleMinutes)) {
+    throw unauthorized(session && !session.revokedAt && session.expiresAt.getTime() > Date.now() ? 'Session fermée après inactivité' : 'Session expirée');
+  }
+  touchSession(session.id, clientIp(req));
+
+  const quota = hit(`admin:${user.id}`, snap.system.limits.adminApiPerMinute, 60_000);
+  if (!quota.ok) throw rateLimitError(res, quota, 'Trop de requêtes');
+
+  req.admin = {
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    role: user.role,
+    sid: session.id,
+    isSuper: user.role === SUPERADMIN_ROLE,
+    permissions: permissionsOf(snap, user),
+  };
+  return { user, snap };
+}
+
+/**
+ * Toute personne connectée. Tant qu'un changement de mot de passe ou l'activation de la 2FA est exigé,
+ * seules les routes marquées `allowPending` (profil, déconnexion) répondent.
+ */
+export function requireAuth(opts: { allowPending?: boolean } = {}) {
+  return async (req: AuthedRequest, res: Response, next: NextFunction) => {
+    try {
+      const { user, snap } = await authenticate(req, res);
+      if (!opts.allowPending) {
+        const pending = pendingRequirements(snap, user);
+        if (pending.mustChangePassword) throw new HttpError(403, 'Vous devez changer votre mot de passe', 'PASSWORD_CHANGE_REQUIRED');
+        if (pending.mustSetup2fa) throw new HttpError(403, 'Activez la double authentification pour continuer', 'TWO_FACTOR_REQUIRED');
+      }
+      next();
+    } catch (e) {
+      next(e);
+    }
+  };
+}
+
+/** Au moins une des permissions demandées (le super administrateur les a toutes). */
+export function requirePerm(...perms: Permission[]) {
+  const auth = requireAuth();
+  return (req: AuthedRequest, res: Response, next: NextFunction) =>
+    auth(req, res, (err?: unknown) => {
+      if (err) return next(err);
+      if (!perms.some((p) => req.admin!.permissions.includes(p))) return next(new HttpError(403, 'Droits insuffisants', 'FORBIDDEN'));
+      next();
+    });
+}
+
+export const requireAdmin = () => requireAuth();
+
+export const hasPerm = (req: AuthedRequest, ...perms: Permission[]) => perms.some((p) => !!req.admin?.permissions.includes(p));
+
+export function assertPerm(req: AuthedRequest, perm: Permission, message = 'Droits insuffisants') {
+  if (!hasPerm(req, perm)) throw new HttpError(403, message, 'FORBIDDEN');
+}
+
+/** Restreint toute l'API d'administration aux adresses autorisées (contournement : SNAPIFY_ADMIN_IP_BYPASS=true). */
+export async function adminIpGuard(req: Request, _res: Response, next: NextFunction) {
+  try {
+    if (process.env.SNAPIFY_ADMIN_IP_BYPASS === 'true') return next();
+    const s = await loadSnapshot();
+    const ip = clientIp(req);
+    if (!ipAllowed(ip, s.system.security.adminIpAllowlist)) {
+      return next(new HttpError(403, `Administration inaccessible depuis votre adresse IP (${ip})`, 'IP_BLOCKED'));
+    }
+    next();
+  } catch (e) {
+    next(e);
+  }
+}

package/template/server/modules/legacy.ts

@@ -0,0 +1,44 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/**
+ * Modules installés d'office au premier démarrage, avec reprise des réglages de l'époque
+ * où WhatsApp et l'assistant IA faisaient partie du cœur du CMS (clés `whatsapp` et `ai`
+ * de site_settings, supprimées après migration).
+ */
+type Legacy = Record<string, unknown> | undefined;
+
+export interface OfficialModule {
+  id: string;
+  legacyKey: string;
+  settings: (legacy: Legacy) => Record<string, unknown>;
+  enabled: (legacy: Legacy) => boolean;
+}
+
+const pick = (src: Legacy, keys: string[]) => Object.fromEntries(keys.filter((k) => src && k in src).map((k) => [k, src![k]]));
+
+export const OFFICIAL_MODULES: OfficialModule[] = [
+  {
+    id: 'novalabs.whatsapp',
+    legacyKey: 'whatsapp',
+    settings: (l) => pick(l, ['number', 'defaultMessage', 'showOnMobile', 'showOnDesktop', 'position']),
+    enabled: (l) => l?.enabled !== false,
+  },
+  {
+    id: 'novalabs.ai-chat',
+    legacyKey: 'ai',
+    settings: (l) => {
+      const out: Record<string, unknown> = pick(l, ['model', 'temperature', 'maxMessagesPerSession', 'maxSessionsPerDayPerIp', 'maxTokensPerDayGlobal']);
+      const override = typeof l?.systemInstructionOverride === 'string' ? l.systemInstructionOverride.trim() : '';
+      if (override) out.systemInstruction = override;
+      if (Array.isArray(l?.showOnPages)) out.showOnPages = l.showOnPages;
+      return out;
+    },
+    enabled: (l) => l?.enabled !== false,
+  },
+];
+
+export const LEGACY_KEYS = OFFICIAL_MODULES.map((m) => m.legacyKey);