create-snapify-app 0.0.0-stage → 1.1.1

package/template/server/routes/googleOAuth.ts

@@ -0,0 +1,327 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import crypto from 'crypto';
+import type { Request } from 'express';
+import { loadSnapshot, updateSnapshot } from '../cms/store';
+import type { CmsSnapshot } from '../cms/types';
+import { requirePerm, type AuthedRequest } from '../middleware/adminAuth';
+import { asyncRouter, HttpError } from '../http';
+import { audit } from '../security/audit';
+import { decryptSecret, encryptSecret } from '../security/secrets';
+
+const canSeo = requirePerm('seo.edit');
+const canManage = requirePerm('settings.manage');
+
+const SCOPES = ['openid', 'email', 'https://www.googleapis.com/auth/webmasters.readonly'].join(' ');
+const CALLBACK_PATH = '/api/admin/google/callback';
+const CLIENT_ID_RE = /^[0-9]+-[a-z0-9]+\.apps\.googleusercontent\.com$/;
+
+const pendingStates = new Map<string, { exp: number; redirectUri: string; userId?: string; userEmail?: string }>();
+
+type CredentialSource = 'settings' | 'env' | 'none';
+
+function credentials(s: CmsSnapshot): { clientId: string; clientSecret: string; source: CredentialSource } {
+  const secret = decryptSecret(s.google.oauthClientSecretEnc);
+  if (s.google.oauthClientId && secret) return { clientId: s.google.oauthClientId, clientSecret: secret, source: 'settings' };
+  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+    return { clientId: process.env.GOOGLE_CLIENT_ID, clientSecret: process.env.GOOGLE_CLIENT_SECRET, source: 'env' };
+  }
+  return { clientId: '', clientSecret: '', source: 'none' };
+}
+
+export const googleOAuthConfigured = (s: CmsSnapshot) => credentials(s).source !== 'none';
+
+/**
+ * Origine déclarée chez Google : celle de l'URL publique, ou l'hôte courant s'il s'agit d'un poste local.
+ * Un en-tête Host arbitraire n'est jamais repris (empoisonnement de l'URI de retour).
+ */
+function siteOrigin(req: Request, s: CmsSnapshot): string {
+  const publicUrl = new URL(s.settings.publicUrl);
+  const host = String(req.headers.host || '');
+  const hostname = host.replace(/:\d+$/, '');
+  if (hostname === 'localhost' || hostname === '127.0.0.1') return `${req.protocol}://${host}`;
+  return publicUrl.origin;
+}
+
+/** GOOGLE_REDIRECT_URI ne s'applique qu'avec les identifiants du .env, déclarés ensemble chez Google. */
+function redirectUriFor(req: Request, s: CmsSnapshot): string {
+  if (credentials(s).source === 'env' && process.env.GOOGLE_REDIRECT_URI) return process.env.GOOGLE_REDIRECT_URI;
+  return `${siteOrigin(req, s)}${CALLBACK_PATH}`;
+}
+
+const refreshToken = (s: CmsSnapshot) => (s.google.oauthRefreshToken ? (decryptSecret(s.google.oauthRefreshToken) ?? s.google.oauthRefreshToken) : null);
+
+type TokenResponse = { access_token?: string; refresh_token?: string; id_token?: string; expires_in?: number; error?: string; error_description?: string };
+
+async function tokenRequest(params: Record<string, string>): Promise<TokenResponse> {
+  const r = await fetch('https://oauth2.googleapis.com/token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(params),
+    signal: AbortSignal.timeout(15_000),
+  });
+  return (await r.json()) as TokenResponse;
+}
+
+let accessCache: { token: string; exp: number } | null = null;
+
+async function getAccessToken(): Promise<string> {
+  if (accessCache && accessCache.exp > Date.now() + 30_000) return accessCache.token;
+  const s = await loadSnapshot();
+  const refresh = refreshToken(s);
+  if (!refresh) throw new HttpError(400, 'Compte Google non connecté');
+  const { clientId, clientSecret } = credentials(s);
+  if (!clientId) throw new HttpError(400, 'Identifiants OAuth Google non configurés');
+  const json = await tokenRequest({ client_id: clientId, client_secret: clientSecret, refresh_token: refresh, grant_type: 'refresh_token' });
+  if (!json.access_token) {
+    if (json.error === 'invalid_grant') {
+      throw new HttpError(
+        401,
+        'Google a révoqué l’accès (application en mode « Test » : l’autorisation expire après 7 jours, ou accès retiré depuis votre compte Google). Publiez l’application puis reconnectez le compte.',
+        'GOOGLE_REAUTH'
+      );
+    }
+    throw new HttpError(502, json.error_description || 'Jeton Google refusé, reconnectez le compte', 'GOOGLE_REAUTH');
+  }
+  accessCache = { token: json.access_token, exp: Date.now() + (json.expires_in || 3600) * 1000 };
+  return json.access_token;
+}
+
+async function googleFetch<T>(url: string, init?: RequestInit): Promise<T> {
+  const token = await getAccessToken();
+  const r = await fetch(url, {
+    ...init,
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...(init?.headers || {}) },
+    signal: AbortSignal.timeout(20_000),
+  });
+  const json = (await r.json()) as T & { error?: { message?: string; status?: string; details?: { reason?: string }[] } };
+  if (!r.ok) {
+    const msg = json.error?.message || '';
+    if (/has not been used|is disabled|SERVICE_DISABLED|accessNotConfigured/i.test(msg) || json.error?.details?.some((d) => d.reason === 'SERVICE_DISABLED')) {
+      throw new HttpError(
+        502,
+        'L’API « Google Search Console » n’est pas activée dans votre projet Google Cloud. Activez-la puis réessayez dans une minute.',
+        'GOOGLE_API_DISABLED'
+      );
+    }
+    throw new HttpError(502, msg || `Erreur API Google (${r.status})`);
+  }
+  return json;
+}
+
+/** Vérifie un couple ID client / code secret auprès de Google sans connexion : un code bidon renvoie invalid_grant si le client est valide. */
+async function probeCredentials(clientId: string, clientSecret: string, redirectUri: string): Promise<{ ok: boolean; error?: string }> {
+  try {
+    const json = await tokenRequest({ client_id: clientId, client_secret: clientSecret, code: 'snapify-credential-check', grant_type: 'authorization_code', redirect_uri: redirectUri });
+    if (json.error === 'invalid_grant') return { ok: true };
+    if (json.error === 'invalid_client') {
+      return {
+        ok: false,
+        error: /not found/i.test(json.error_description || '') ? 'ID client introuvable chez Google : vérifiez qu’il est copié en entier.' : 'Code secret refusé par Google : copiez-le à nouveau depuis la console.',
+      };
+    }
+    if (json.error === 'redirect_uri_mismatch') return { ok: false, error: 'L’URI de redirection n’est pas déclarée dans l’ID client.' };
+    return { ok: false, error: json.error_description || json.error || 'Réponse inattendue de Google' };
+  } catch {
+    return { ok: false, error: 'Impossible de joindre Google depuis le serveur (connexion Internet ou pare-feu).' };
+  }
+}
+
+function emailFromIdToken(idToken?: string): string | undefined {
+  try {
+    const payload = JSON.parse(Buffer.from(String(idToken).split('.')[1], 'base64url').toString('utf8')) as { email?: string };
+    return payload.email;
+  } catch {
+    return undefined;
+  }
+}
+
+export function createGoogleOAuthRouter() {
+  const router = asyncRouter();
+
+  router.get('/status', canSeo, async (req, res) => {
+    const s = await loadSnapshot();
+    const creds = credentials(s);
+    const redirectUri = redirectUriFor(req, s);
+    res.json({
+      configured: creds.source !== 'none',
+      source: creds.source,
+      clientId: creds.source === 'settings' ? creds.clientId : creds.source === 'env' ? creds.clientId.replace(/^(\d{4})\d+/, '$1…') : '',
+      connected: s.google.connected && !!refreshToken(s),
+      accountEmail: s.google.accountEmail,
+      property: s.google.searchConsoleProperty,
+      lastSyncAt: s.google.lastSyncAt,
+      redirectUri,
+      javascriptOrigin: new URL(redirectUri).origin,
+      publicUrl: s.settings.publicUrl,
+      verificationTag: !!s.settings.seo.googleVerification,
+    });
+  });
+
+  router.post('/credentials/test', canManage, async (req, res) => {
+    const s = await loadSnapshot();
+    const clientId = String(req.body?.clientId || '').trim();
+    const secret = String(req.body?.clientSecret || '').trim() || decryptSecret(s.google.oauthClientSecretEnc) || '';
+    if (!CLIENT_ID_RE.test(clientId)) throw new HttpError(400, 'L’ID client doit se terminer par « .apps.googleusercontent.com »');
+    if (!secret) throw new HttpError(400, 'Code secret requis');
+    res.locals.audit = false;
+    res.json(await probeCredentials(clientId, secret, redirectUriFor(req, s)));
+  });
+
+  router.put('/credentials', canManage, async (req: AuthedRequest, res) => {
+    const s = await loadSnapshot();
+    const clientId = String(req.body?.clientId || '').trim();
+    const typed = String(req.body?.clientSecret || '').trim();
+    const secret = typed || (clientId === s.google.oauthClientId ? decryptSecret(s.google.oauthClientSecretEnc) : '') || '';
+    if (!CLIENT_ID_RE.test(clientId)) throw new HttpError(400, 'L’ID client doit se terminer par « .apps.googleusercontent.com »');
+    if (!secret) throw new HttpError(400, 'Code secret requis');
+    const probe = await probeCredentials(clientId, secret, redirectUriFor(req, s));
+    if (!probe.ok) throw new HttpError(400, probe.error || 'Identifiants refusés par Google');
+    const changedClient = clientId !== s.google.oauthClientId;
+    accessCache = null;
+    await updateSnapshot((snap) => {
+      snap.google.oauthClientId = clientId;
+      snap.google.oauthClientSecretEnc = encryptSecret(secret);
+      // Un jeton n'est valable que pour le client qui l'a émis.
+      if (changedClient) {
+        snap.google.connected = false;
+        delete snap.google.oauthRefreshToken;
+        delete snap.google.accountEmail;
+      }
+    });
+    res.locals.audit = { action: 'seo.google_credentials', detail: { clientId: clientId.split('-')[0] } };
+    res.json({ ok: true });
+  });
+
+  router.delete('/credentials', canManage, async (_req, res) => {
+    accessCache = null;
+    await updateSnapshot((snap) => {
+      delete snap.google.oauthClientId;
+      delete snap.google.oauthClientSecretEnc;
+      delete snap.google.oauthRefreshToken;
+      delete snap.google.accountEmail;
+      snap.google.connected = false;
+    });
+    res.locals.audit = { action: 'seo.google_credentials_delete' };
+    res.json({ ok: true });
+  });
+
+  router.get('/connect', canSeo, async (req: AuthedRequest, res) => {
+    const s = await loadSnapshot();
+    const { clientId } = credentials(s);
+    if (!clientId) throw new HttpError(400, 'Identifiants OAuth Google non configurés');
+    const redirectUri = redirectUriFor(req, s);
+    const now = Date.now();
+    for (const [k, v] of pendingStates) if (v.exp < now) pendingStates.delete(k);
+    const state = crypto.randomBytes(24).toString('hex');
+    pendingStates.set(state, { exp: now + 10 * 60_000, redirectUri, userId: req.admin?.sub, userEmail: req.admin?.email });
+    const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
+    url.search = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: 'code',
+      scope: SCOPES,
+      access_type: 'offline',
+      prompt: 'consent',
+      include_granted_scopes: 'true',
+      state,
+    }).toString();
+    res.json({ authUrl: url.toString() });
+  });
+
+  router.get('/callback', async (req, res) => {
+    const back = (status: string, reason?: string) =>
+      res.redirect(`/administrator/seo?tab=google&google=${status}${reason ? `&reason=${encodeURIComponent(reason)}` : ''}`);
+    const state = String(req.query.state || '');
+    const pending = pendingStates.get(state);
+    pendingStates.delete(state);
+    if (!pending || pending.exp < Date.now()) return back('error', 'state');
+    if (req.query.error) return back('error', String(req.query.error).slice(0, 40));
+    const code = String(req.query.code || '');
+    if (!code) return back('error', 'no_code');
+
+    const s = await loadSnapshot();
+    const { clientId, clientSecret } = credentials(s);
+    const tokens = await tokenRequest({ code, client_id: clientId, client_secret: clientSecret, redirect_uri: pending.redirectUri, grant_type: 'authorization_code' }).catch(
+      () => ({ error: 'network' }) as TokenResponse
+    );
+    if (tokens.error) return back('error', tokens.error);
+    if (!tokens.refresh_token) return back('error', 'no_refresh_token');
+    const granted = String((tokens as { scope?: string }).scope || '');
+    if (granted && !granted.includes('webmasters')) return back('error', 'scope_denied');
+
+    const accountEmail = emailFromIdToken(tokens.id_token);
+    accessCache = null;
+    await updateSnapshot((snap) => {
+      snap.google.connected = true;
+      snap.google.oauthRefreshToken = encryptSecret(tokens.refresh_token!);
+      snap.google.accountEmail = accountEmail;
+      snap.google.lastSyncAt = new Date().toISOString();
+    });
+    void audit(req, { action: 'seo.google_connect', target: accountEmail, userId: pending.userId, userEmail: pending.userEmail });
+    back('connected');
+  });
+
+  router.get('/sites', canSeo, async (_req, res) => {
+    const data = await googleFetch<{ siteEntry?: { siteUrl: string; permissionLevel: string }[] }>('https://www.googleapis.com/webmasters/v3/sites');
+    res.json((data.siteEntry || []).filter((e) => e.permissionLevel !== 'siteUnverifiedUser'));
+  });
+
+  router.get('/performance', canSeo, async (req, res) => {
+    const s = await loadSnapshot();
+    const site = s.google.searchConsoleProperty;
+    if (!site) throw new HttpError(400, 'Sélectionnez une propriété Search Console');
+    const days = Math.min(Number(req.query.days) || 28, 480);
+    const end = new Date(Date.now() - 2 * 86400000);
+    const start = new Date(end.getTime() - days * 86400000);
+    const fmt = (d: Date) => d.toISOString().slice(0, 10);
+    const endpoint = `https://www.googleapis.com/webmasters/v3/sites/${encodeURIComponent(site)}/searchAnalytics/query`;
+    type Row = { keys?: string[]; clicks: number; impressions: number; ctr: number; position: number };
+    const query = (dimensions: string[], rowLimit: number) =>
+      googleFetch<{ rows?: Row[] }>(endpoint, {
+        method: 'POST',
+        body: JSON.stringify({ startDate: fmt(start), endDate: fmt(end), dimensions, rowLimit }),
+      });
+    const [byDate, byQuery, byPage] = await Promise.all([query(['date'], 500), query(['query'], 250), query(['page'], 250)]);
+    const rows = byDate.rows || [];
+    const totals = rows.reduce(
+      (a, r) => ({ clicks: a.clicks + r.clicks, impressions: a.impressions + r.impressions }),
+      { clicks: 0, impressions: 0 }
+    );
+    await updateSnapshot((snap) => {
+      snap.google.lastSyncAt = new Date().toISOString();
+    });
+    res.json({
+      range: { start: fmt(start), end: fmt(end) },
+      totals: {
+        ...totals,
+        ctr: totals.impressions ? totals.clicks / totals.impressions : 0,
+        position: rows.length ? rows.reduce((a, r) => a + r.position, 0) / rows.length : 0,
+      },
+      timeseries: rows.map((r) => ({ date: r.keys![0], clicks: r.clicks, impressions: r.impressions })),
+      queries: (byQuery.rows || []).map((r) => ({ query: r.keys![0], clicks: r.clicks, impressions: r.impressions, ctr: r.ctr, position: r.position })),
+      pages: (byPage.rows || []).map((r) => ({ page: r.keys![0], clicks: r.clicks, impressions: r.impressions, ctr: r.ctr, position: r.position })),
+    });
+  });
+
+  router.post('/disconnect', canManage, async (_req, res) => {
+    accessCache = null;
+    const s = await loadSnapshot();
+    const refresh = refreshToken(s);
+    if (refresh) {
+      await fetch(`https://oauth2.googleapis.com/revoke?token=${encodeURIComponent(refresh)}`, { method: 'POST', signal: AbortSignal.timeout(8_000) }).catch(() => undefined);
+    }
+    await updateSnapshot((snap) => {
+      snap.google.connected = false;
+      delete snap.google.oauthRefreshToken;
+      delete snap.google.accountEmail;
+    });
+    res.json({ ok: true });
+  });
+
+  return router;
+}

package/template/server/routes/modules.ts

@@ -0,0 +1,323 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import { Router, type NextFunction, type Request, type Response } from 'express';
+import { MODULE_ID_PATTERN, SNAPIFY_MODULE_API_VERSION, type ModuleCookie } from '../../sdk/index';
+import { clientIp } from '../security/ip';
+import { maintenanceFor } from './publicCms';
+import { compareVersions, PACKAGE_EXTENSIONS, PackageError, satisfies } from '../../sdk/package';
+import { asyncRouter, HttpError } from '../http';
+import { assertPerm, requireAuth, requirePerm, type AuthedRequest } from '../middleware/adminAuth';
+
+const canManageModules = requirePerm('modules.manage');
+const canManageThemes = requirePerm('appearance.themes');
+import {
+  activateTheme,
+  dispatchModuleAdminRequest,
+  dispatchModuleRequest,
+  installedVersions,
+  installStaged,
+  isDevMode,
+  listModules,
+  listThemes,
+  moduleAsset,
+  moduleDetail,
+  ModuleError,
+  setModuleEnabled,
+  setModuleLicense,
+  stagedKind,
+  stagePackage,
+  themeDetail,
+  uninstallModule,
+  updateModuleSettings,
+} from '../modules/manager';
+import { downloadPackage, galleryUrls, getCatalog, localGalleryImage, localScreenshot, screenshotUrl } from '../modules/marketplace';
+import { getModulePurchase, latestPaidLicenseForModule, markModulePurchasePaid, startModuleCheckout, catalogPriceMillimes } from '../modules/purchases';
+import type { MarketplaceListing } from '../modules/types';
+import { formatDt } from '../platform/settings';
+
+function moduleId(req: Request): string {
+  const id = String(req.params.id || '');
+  if (!MODULE_ID_PATTERN.test(id)) throw new HttpError(400, 'Identifiant de module invalide');
+  return id;
+}
+
+function moduleErrors(err: unknown, _req: Request, res: Response, next: NextFunction) {
+  if (err instanceof ModuleError) return res.status(err.status).json({ error: err.message });
+  if (err instanceof PackageError) return res.status(400).json({ error: err.message });
+  next(err);
+}
+
+/** Administration : /api/admin/modules, /api/admin/themes et /api/admin/marketplace. */
+export function createModulesAdminRouter(): Router {
+  const router = asyncRouter();
+
+  router.get('/modules', requireAuth(), async (_req, res) => {
+    res.json({ modules: await listModules(), devMode: isDevMode() });
+  });
+
+  router.post('/modules/upload', requirePerm('modules.manage', 'appearance.themes'), async (req, res) => {
+    const { filename, dataBase64 } = req.body || {};
+    if (typeof filename !== 'string' || !PACKAGE_EXTENSIONS.some((ext) => filename.toLowerCase().endsWith(ext))) {
+      throw new HttpError(400, `Fichier ${PACKAGE_EXTENSIONS.join(' ou ')} attendu`);
+    }
+    if (typeof dataBase64 !== 'string' || !dataBase64) throw new HttpError(400, 'Fichier vide');
+    res.json(stagePackage(Buffer.from(dataBase64, 'base64'), 'upload'));
+  });
+
+  router.post('/modules/install', requirePerm('modules.manage', 'appearance.themes'), async (req: AuthedRequest, res) => {
+    const token = String(req.body?.token || '');
+    if (!token) throw new HttpError(400, 'Jeton d’installation manquant');
+    const kind = stagedKind(token);
+    if (kind) {
+      assertPerm(req, kind === 'theme' ? 'appearance.themes' : 'modules.manage', kind === 'theme' ? 'Vous n’êtes pas autorisé à installer des thèmes' : 'Vous n’êtes pas autorisé à installer des modules');
+      res.locals.audit = { action: kind === 'theme' ? 'theme.install' : 'module.install' };
+    }
+    let installed = await installStaged(token);
+    // Licence déjà achetée depuis le backoffice (Flouci) → application automatique
+    if (installed.kind === 'module' && installed.pricing === 'paid') {
+      const paid = await latestPaidLicenseForModule(installed.id);
+      if (paid?.licenseKey && installed.license.state !== 'valid') {
+        try {
+          installed = await setModuleLicense(installed.id, paid.licenseKey);
+        } catch {
+          /* licence appliquée manuellement plus tard */
+        }
+      }
+    }
+    res.json(installed);
+  });
+
+  router.get('/modules/:id', requireAuth(), async (req, res) => {
+    res.json(await moduleDetail(moduleId(req)));
+  });
+
+  router.put('/modules/:id/settings', requirePerm('modules.settings'), async (req, res) => {
+    const result = await updateModuleSettings(moduleId(req), req.body?.settings);
+    if (result.errors) return res.status(400).json({ error: 'Certains réglages sont invalides', fields: result.errors });
+    res.json(result);
+  });
+
+  router.post('/modules/:id/enabled', canManageModules, async (req, res) => {
+    if (typeof req.body?.enabled !== 'boolean') throw new HttpError(400, 'Valeur attendue : enabled');
+    res.json(await setModuleEnabled(moduleId(req), req.body.enabled));
+  });
+
+  router.post('/modules/:id/license', canManageModules, async (req, res) => {
+    const key = String(req.body?.key || '').trim();
+    if (!key) throw new HttpError(400, 'Clé de licence manquante');
+    res.json(await setModuleLicense(moduleId(req), key));
+  });
+
+  router.delete('/modules/:id', canManageModules, async (req, res) => {
+    await uninstallModule(moduleId(req));
+    res.status(204).end();
+  });
+
+  router.get('/marketplace', requirePerm('modules.manage', 'appearance.themes'), async (req, res) => {
+    const catalog = await getCatalog(req.query.refresh === '1');
+    const installed = installedVersions();
+    const listing: MarketplaceListing = {
+      source: catalog.source,
+      url: catalog.url,
+      error: catalog.error,
+      devMode: isDevMode(),
+      modules: await Promise.all(
+        catalog.modules.map(async (m) => {
+          const installedVersion = installed.get(m.id) ?? null;
+          const paid = m.pricing === 'paid' ? await latestPaidLicenseForModule(m.id) : null;
+          const priceMillimes = catalogPriceMillimes(m);
+          return {
+            ...m,
+            kind: m.kind ?? 'module',
+            screenshot: screenshotUrl(catalog, m),
+            gallery: galleryUrls(catalog, m),
+            priceMillimes,
+            priceLabel: m.pricing === 'paid' ? formatDt(priceMillimes) : 'Gratuit',
+            purchased: !!paid,
+            installedVersion,
+            updateAvailable: !!installedVersion && compareVersions(m.version, installedVersion) > 0,
+            compatible: satisfies(SNAPIFY_MODULE_API_VERSION, m.engines.snapify),
+          };
+        })
+      ),
+    };
+    res.json(listing);
+  });
+
+  router.get('/marketplace/purchases/:purchaseId', requirePerm('modules.manage'), async (req, res) => {
+    const p = await getModulePurchase(String(req.params.purchaseId || ''));
+    if (!p) throw new HttpError(404, 'Achat introuvable');
+    // Si paiement mock / retour navigateur avant webhook
+    if (p.status === 'pending' && p.paymentId?.startsWith('mock_')) {
+      const paid = await markModulePurchasePaid(p.paymentId);
+      if (paid) return res.json({ purchase: paid });
+    }
+    res.json({ purchase: p });
+  });
+
+  router.post('/marketplace/:id/stage', requirePerm('modules.manage', 'appearance.themes'), async (req, res) => {
+    res.json(stagePackage(await downloadPackage(moduleId(req)), 'marketplace'));
+  });
+
+  /** Achat Flouci d’un module payant du catalogue officiel — depuis le backoffice. */
+  router.post('/marketplace/:id/checkout', requirePerm('modules.manage'), async (req: AuthedRequest, res) => {
+    const host = String(req.headers['x-forwarded-host'] || req.headers.host || 'localhost');
+    const proto = String(req.headers['x-forwarded-proto'] || (req.secure ? 'https' : 'http'));
+    const publicBase = process.env.PUBLIC_URL || `${proto}://${host}`;
+    const result = await startModuleCheckout({
+      moduleId: moduleId(req),
+      publicBase,
+      buyerEmail: req.admin?.email,
+    });
+    res.json({
+      purchaseId: result.purchase.id,
+      paymentLink: result.paymentLink,
+      paymentId: result.paymentId,
+      amountMillimes: result.purchase.amountMillimes,
+      amountLabel: formatDt(result.purchase.amountMillimes),
+      moduleId: result.purchase.moduleId,
+      moduleName: result.purchase.moduleName,
+    });
+  });
+
+  router.get('/themes', requireAuth(), async (_req, res) => {
+    res.json({ themes: await listThemes(), devMode: isDevMode() });
+  });
+
+  router.get('/themes/:id', requireAuth(), async (req, res) => {
+    res.json(await themeDetail(moduleId(req)));
+  });
+
+  router.post('/themes/:id/activate', canManageThemes, async (req, res) => {
+    res.json(await activateTheme(moduleId(req)));
+  });
+
+  router.put('/themes/:id/settings', requirePerm('appearance.customize'), async (req, res) => {
+    const id = moduleId(req);
+    await themeDetail(id);
+    const result = await updateModuleSettings(id, req.body?.settings);
+    if (result.errors) return res.status(400).json({ error: 'Certaines options sont invalides', fields: result.errors });
+    res.json(result);
+  });
+
+  router.delete('/themes/:id', canManageThemes, async (req, res) => {
+    const id = moduleId(req);
+    await themeDetail(id);
+    await uninstallModule(id);
+    res.status(204).end();
+  });
+
+  router.all('/modules/:id/api/*', requirePerm('modules.use'), async (req: AuthedRequest, res) => {
+    const id = moduleId(req);
+    const routePath = `/${req.params[0] ?? ''}`;
+    const { status, body } = await dispatchModuleAdminRequest(id, req.method, routePath, {
+      query: queryOf(req),
+      body: req.body ?? null,
+      ip: clientIp(req),
+      userAgent: String(req.headers['user-agent'] || '').slice(0, 300),
+      admin: { id: req.admin!.sub, email: req.admin!.email, name: req.admin!.name },
+    });
+    if (req.method !== 'GET') res.locals.audit = { action: 'module.data', target: id, detail: { method: req.method, path: routePath } };
+    res.setHeader('Cache-Control', 'no-store');
+    res.status(status).json(body);
+  });
+
+  router.use(moduleErrors);
+  return router;
+}
+
+const queryOf = (req: Request) =>
+  Object.fromEntries(Object.entries(req.query).filter(([, v]) => typeof v === 'string')) as Record<string, string>;
+
+function parseCookies(header: string | undefined): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const part of (header || '').split(';')) {
+    const i = part.indexOf('=');
+    if (i < 1) continue;
+    const name = part.slice(0, i).trim();
+    if (!name.startsWith('sm_')) continue;
+    try {
+      out[name] = decodeURIComponent(part.slice(i + 1).trim());
+    } catch {
+      /* cookie illisible ignoré */
+    }
+  }
+  return out;
+}
+
+function setModuleCookies(req: Request, res: Response, cookies: ModuleCookie[] | undefined) {
+  if (!cookies?.length) return;
+  const secure = req.secure;
+  res.append(
+    'Set-Cookie',
+    cookies.map((c) => {
+      const parts = [`${c.name}=${encodeURIComponent(c.value)}`, 'Path=/', 'HttpOnly', 'SameSite=Lax'];
+      if (c.maxAgeSec !== undefined) parts.push(`Max-Age=${Math.max(0, Math.floor(c.maxAgeSec))}`);
+      if (secure) parts.push('Secure');
+      return parts.join('; ');
+    })
+  );
+}
+
+/** Fichiers publics des modules (/_modules/<id>/<version>/<fichier>) et leur API (/api/modules/<id>/…). */
+export function createModulesPublicRouter(): Router {
+  const router = Router();
+
+  router.get('/_marketplace/screenshots/:file', async (req, res) => {
+    const data = await localScreenshot(req.params.file);
+    if (!data) return res.status(404).type('text/plain').send('Not found');
+    res.type(req.params.file.split('.').pop()!);
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.send(data);
+  });
+
+  router.get('/_marketplace/gallery/:moduleId/:file', async (req, res) => {
+    const data = await localGalleryImage(req.params.moduleId, req.params.file);
+    if (!data) return res.status(404).type('text/plain').send('Not found');
+    res.type(req.params.file.split('.').pop()!);
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.send(data);
+  });
+
+  router.use('/_modules', (req, res, next) => {
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+    const [id, version, file, ...rest] = req.path.split('/').slice(1);
+    const data = !rest.length && id && version && file ? moduleAsset(id, version, file) : null;
+    if (!data) return res.status(404).type('text/plain').send('Not found');
+    res.type(file.split('.').pop()!);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+    res.send(data);
+  });
+
+  router.use('/api/modules/:id', async (req, res, next) => {
+    try {
+      if (!MODULE_ID_PATTERN.test(req.params.id)) return res.status(404).json({ error: 'Module inconnu' });
+      if (await maintenanceFor(req)) {
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Retry-After', '600');
+        return res.status(503).json({ error: 'Le site est en maintenance : réessayez dans quelques instants.' });
+      }
+      const { status, body, cookies } = await dispatchModuleRequest(req.params.id, req.method, req.path || '/', {
+        query: queryOf(req),
+        body: req.body ?? null,
+        ip: clientIp(req),
+        userAgent: String(req.headers['user-agent'] || '').slice(0, 300),
+        cookies: parseCookies(req.headers.cookie),
+      });
+      setModuleCookies(req, res, cookies);
+      res.setHeader('Cache-Control', 'no-store');
+      res.status(status).json(body);
+    } catch (e) {
+      next(e);
+    }
+  });
+
+  return router;
+}