create-snapify-app 0.0.0-stage → 1.1.1

package/template/server/client/routes.ts

@@ -0,0 +1,252 @@
+/**
+ * Snapify — API espace client
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ */
+import crypto from 'crypto';
+import type { Request } from 'express';
+import { and, desc, eq, inArray, or } from 'drizzle-orm';
+import { asyncRouter, HttpError } from '../http';
+import { db } from '../db/client';
+import { clientProfiles, platformUsers, saInvoices, saPaymentEvents, saTickets } from '../db/schema';
+import { requirePlatformUser, toPublicUser } from '../platform/auth';
+import { formatMoney } from '../platform/money';
+import { getClientByEmail, getClientByUserId, linkClientProfileToUser, updateClientProfile } from '../platform/clients';
+import { listLicenseOrders } from '../platform/licenseOrders';
+import { clientIp } from '../security/ip';
+import { resolveGeoFromIp } from '../geoip';
+
+function escapeHtml(s: string) {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+
+async function requireClient(req: Request) {
+  const user = req.platformUser!;
+  let profile = await getClientByUserId(user.id);
+  if (!profile) {
+    const byEmail = await getClientByEmail(user.email);
+    if (byEmail) {
+      profile = (await linkClientProfileToUser(user.email, user.id)) || byEmail;
+    } else {
+      const [created] = await db
+        .insert(clientProfiles)
+        .values({
+          id: crypto.randomUUID(),
+          platformUserId: user.id,
+          email: user.email,
+          name: user.displayName,
+          status: 'lead',
+        })
+        .returning();
+      profile = created;
+    }
+  }
+  if (!profile) throw new HttpError(404, 'Fiche client introuvable.');
+  return { user, profile };
+}
+
+export function createClientPortalRouter() {
+  const r = asyncRouter();
+
+  r.get('/me', requirePlatformUser, async (req, res) => {
+    const { user, profile } = await requireClient(req);
+    const country = resolveGeoFromIp(clientIp(req)).country || profile.country;
+    res.json({
+      user: toPublicUser(user),
+      profile: {
+        ...profile,
+        currency: profile.market === 'tn' ? 'TND' : 'EUR',
+      },
+      country,
+    });
+  });
+
+  r.patch('/profile', requirePlatformUser, async (req, res) => {
+    const { user, profile } = await requireClient(req);
+    const b = req.body || {};
+    const patch: Record<string, string> = {};
+    if (typeof b.name === 'string' && b.name.trim().length >= 2) patch.name = b.name.trim().slice(0, 120);
+    if (typeof b.phone === 'string') patch.phone = b.phone.trim().slice(0, 40);
+    if (typeof b.company === 'string') patch.company = b.company.trim().slice(0, 120);
+    if (typeof b.domain === 'string') {
+      patch.domain = b.domain
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, '')
+        .replace(/\/.*$/, '')
+        .slice(0, 120);
+    }
+    const updated = await updateClientProfile(profile.id, patch);
+    if (typeof b.displayName === 'string' && b.displayName.trim().length >= 2) {
+      await db
+        .update(platformUsers)
+        .set({ displayName: b.displayName.trim().slice(0, 80), updatedAt: new Date() })
+        .where(eq(platformUsers.id, user.id));
+    }
+    const [freshUser] = await db.select().from(platformUsers).where(eq(platformUsers.id, user.id)).limit(1);
+    res.json({ profile: updated, user: freshUser ? toPublicUser(freshUser) : toPublicUser(user) });
+  });
+
+  r.get('/requests', requirePlatformUser, async (req, res) => {
+    const { profile } = await requireClient(req);
+    const country = profile.market === 'fr' ? 'FR' : 'TN';
+    const all = await listLicenseOrders();
+    const items = all
+      .filter((o) => o.email.toLowerCase() === profile.email || profile.licenseOrderIds.includes(o.id))
+      .map((o) => ({
+        ...o,
+        amountLabel: formatMoney(o.amountMillimes, country),
+      }));
+    res.json({ items });
+  });
+
+  r.get('/payments', requirePlatformUser, async (req, res) => {
+    const { profile } = await requireClient(req);
+    const country = profile.market === 'fr' ? 'FR' : 'TN';
+    const orders = (await listLicenseOrders()).filter(
+      (o) => o.email.toLowerCase() === profile.email || profile.licenseOrderIds.includes(o.id)
+    );
+    let events: (typeof saPaymentEvents.$inferSelect)[] = [];
+    if (orders.length) {
+      events = await db
+        .select()
+        .from(saPaymentEvents)
+        .where(and(eq(saPaymentEvents.refType, 'license'), inArray(saPaymentEvents.refId, orders.map((o) => o.id))))
+        .orderBy(desc(saPaymentEvents.createdAt))
+        .limit(100);
+    }
+
+    const synth = orders.map((o) => ({
+      id: `ord_${o.id}`,
+      provider: 'flouci',
+      kind: 'charge',
+      amountMillimes: o.amountMillimes,
+      amountLabel: formatMoney(o.amountMillimes, country),
+      status: o.status,
+      paymentId: o.paymentId || null,
+      refType: 'license',
+      refId: o.id,
+      domain: o.domain,
+      createdAt: o.paidAt || o.createdAt,
+    }));
+
+    const fromEvents = events.map((e) => ({
+      ...e,
+      amountLabel: formatMoney(e.amountMillimes, country),
+      domain: orders.find((o) => o.id === e.refId)?.domain || '',
+    }));
+
+    res.json({ items: fromEvents.length ? fromEvents : synth });
+  });
+
+  r.get('/invoices', requirePlatformUser, async (req, res) => {
+    const { profile } = await requireClient(req);
+    const country = profile.market === 'fr' ? 'FR' : 'TN';
+    const rows = await db
+      .select()
+      .from(saInvoices)
+      .where(eq(saInvoices.customerEmail, profile.email))
+      .orderBy(desc(saInvoices.createdAt))
+      .limit(100);
+    res.json({
+      items: rows.map((inv) => ({
+        ...inv,
+        amountLabel: formatMoney(inv.amountMillimes, country),
+        downloadUrl: `/api/client/invoices/${inv.id}/download`,
+      })),
+    });
+  });
+
+  r.get('/invoices/:id/download', requirePlatformUser, async (req, res) => {
+    const { profile } = await requireClient(req);
+    const country = profile.market === 'fr' ? 'FR' : 'TN';
+    const [inv] = await db.select().from(saInvoices).where(eq(saInvoices.id, req.params.id)).limit(1);
+    if (!inv || inv.customerEmail.toLowerCase() !== profile.email.toLowerCase()) {
+      throw new HttpError(404, 'Facture introuvable');
+    }
+    const lines = inv.lines
+      .map(
+        (l) =>
+          `<tr><td style="padding:8px;border-bottom:1px solid #e2e8f0">${escapeHtml(l.label)}</td><td style="padding:8px;border-bottom:1px solid #e2e8f0;text-align:right">${escapeHtml(formatMoney(l.amountMillimes, country))}</td></tr>`
+      )
+      .join('');
+    const html = `<!doctype html><html lang="fr"><head><meta charset="utf-8"/><title>Facture ${escapeHtml(inv.number)}</title>
+<style>body{font-family:Inter,system-ui,sans-serif;color:#0f172a;max-width:720px;margin:40px auto;padding:0 16px}h1{font-size:22px;margin:0 0 4px}.muted{color:#64748b;font-size:13px}table{width:100%;border-collapse:collapse;margin-top:24px}.total{font-weight:700;font-size:16px}</style></head>
+<body>
+  <div style="display:flex;justify-content:space-between;align-items:flex-start">
+    <div><h1>Facture ${escapeHtml(inv.number)}</h1><div class="muted">Snapify · NOVALABS WEB DESIGN</div></div>
+    <div class="muted" style="text-align:right">Statut : ${escapeHtml(inv.status)}<br/>${new Date(inv.createdAt).toLocaleDateString('fr-FR')}</div>
+  </div>
+  <p style="margin-top:24px"><strong>${escapeHtml(inv.customerName)}</strong><br/><span class="muted">${escapeHtml(inv.customerEmail)}</span></p>
+  <table><thead><tr><th style="text-align:left;padding:8px;border-bottom:2px solid #0f172a">Désignation</th><th style="text-align:right;padding:8px;border-bottom:2px solid #0f172a">Montant</th></tr></thead>
+  <tbody>${lines}<tr><td class="total" style="padding:12px 8px">Total</td><td class="total" style="padding:12px 8px;text-align:right">${escapeHtml(formatMoney(inv.amountMillimes, country))}</td></tr></tbody></table>
+  ${inv.notes ? `<p class="muted" style="margin-top:24px">${escapeHtml(inv.notes)}</p>` : ''}
+  <p class="muted" style="margin-top:40px;font-size:12px">Document généré depuis l’espace client Snapify. ${profile.market === 'fr' ? 'NOVALABS — offre France.' : 'NOVALABS WEB DESIGN — Tunisie.'}</p>
+  <script>window.print()</script>
+</body></html>`;
+    res.type('html').send(html);
+  });
+
+  r.get('/tickets', requirePlatformUser, async (req, res) => {
+    const { user, profile } = await requireClient(req);
+    const rows = await db
+      .select()
+      .from(saTickets)
+      .where(or(eq(saTickets.userId, user.id), eq(saTickets.email, profile.email)))
+      .orderBy(desc(saTickets.updatedAt))
+      .limit(100);
+    res.json({ items: rows });
+  });
+
+  r.post('/tickets', requirePlatformUser, async (req, res) => {
+    const { user, profile } = await requireClient(req);
+    const subject = String(req.body?.subject || '').trim().slice(0, 200);
+    if (subject.length < 3) throw new HttpError(422, 'Sujet requis');
+    const kindRaw = String(req.body?.kind || 'support');
+    const kind = ['support', 'payment', 'license', 'bug'].includes(kindRaw) ? kindRaw : 'support';
+    const priority = ['low', 'normal', 'high', 'urgent'].includes(req.body?.priority) ? req.body.priority : 'normal';
+    const [row] = await db
+      .insert(saTickets)
+      .values({
+        id: crypto.randomUUID(),
+        kind: kind as 'support' | 'payment' | 'license' | 'bug',
+        priority,
+        subject,
+        body: String(req.body?.body || '').slice(0, 8000),
+        email: profile.email,
+        name: profile.name,
+        userId: user.id,
+        refType: kind === 'bug' ? 'bug' : 'client',
+        refId: profile.id,
+      })
+      .returning();
+    res.status(201).json({ ticket: row });
+  });
+
+  r.get('/overview', requirePlatformUser, async (req, res) => {
+    const { profile } = await requireClient(req);
+    const country = profile.market === 'fr' ? 'FR' : 'TN';
+    const orders = (await listLicenseOrders()).filter(
+      (o) => o.email.toLowerCase() === profile.email || profile.licenseOrderIds.includes(o.id)
+    );
+    const tickets = await db
+      .select()
+      .from(saTickets)
+      .where(or(eq(saTickets.userId, req.platformUser!.id), eq(saTickets.email, profile.email)))
+      .limit(50);
+    const invoices = await db.select().from(saInvoices).where(eq(saInvoices.customerEmail, profile.email)).limit(50);
+    const openTickets = tickets.filter((t) => t.status === 'open' || t.status === 'in_progress' || t.status === 'waiting').length;
+    res.json({
+      profile,
+      stats: {
+        requests: orders.length,
+        paid: orders.filter((o) => o.status === 'paid').length,
+        openTickets,
+        invoices: invoices.length,
+      },
+      recentRequests: orders.slice(0, 5).map((o) => ({ ...o, amountLabel: formatMoney(o.amountMillimes, country) })),
+      recentTickets: tickets.slice(0, 5),
+    });
+  });
+
+  return r;
+}

package/template/server/cms/analyticsStore.ts

@@ -0,0 +1,180 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import fs from 'fs/promises';
+import crypto from 'crypto';
+import { createReadStream } from 'fs';
+import readline from 'readline';
+import { sql } from 'drizzle-orm';
+import type { AnalyticsEvent, AnalyticsSummary } from './types';
+import { db, type Tx } from '../db/client';
+import { analyticsEvents } from '../db/schema';
+
+export type { AnalyticsSummary } from './types';
+
+const RETENTION_DAYS = 400;
+const MAX_DURATION_SEC = 1800;
+
+const toRow = (e: AnalyticsEvent): typeof analyticsEvents.$inferInsert => ({
+  id: /^[0-9a-f-]{36}$/i.test(e.id) ? e.id : crypto.randomUUID(),
+  kind: e.kind ?? (e.durationSec ? 'leave' : 'view'),
+  sessionId: e.sessionId,
+  path: e.path,
+  referrer: e.referrer ?? null,
+  country: e.country ?? null,
+  city: e.city ?? null,
+  device: e.device ?? 'unknown',
+  durationSec: typeof e.durationSec === 'number' ? Math.round(e.durationSec) : null,
+  ts: new Date(e.ts),
+});
+
+export async function appendAnalyticsEvent(event: AnalyticsEvent): Promise<void> {
+  try {
+    await db.insert(analyticsEvents).values(toRow(event)).onConflictDoNothing();
+  } catch (e) {
+    console.error('[analytics] écriture impossible', e);
+  }
+}
+
+export async function pruneAnalytics(days = RETENTION_DAYS): Promise<number> {
+  if (days <= 0) return 0;
+  const res = await db.execute(sql`delete from analytics_events where ts < now() - make_interval(days => ${days})`);
+  return res.rowCount ?? 0;
+}
+
+/** Import unique de l'ancien journal JSONL (et des événements hérités du snapshot). */
+export async function importLegacyAnalytics(tx: Tx, file: string, legacy?: AnalyticsEvent[]): Promise<void> {
+  const rows: (typeof analyticsEvents.$inferInsert)[] = (legacy ?? []).map(toRow);
+  try {
+    const rl = readline.createInterface({ input: createReadStream(file, 'utf-8'), crlfDelay: Infinity });
+    for await (const line of rl) {
+      if (!line.trim()) continue;
+      try {
+        rows.push(toRow(JSON.parse(line) as AnalyticsEvent));
+      } catch {
+        /* ligne corrompue ignorée */
+      }
+    }
+  } catch {
+    /* pas d'ancien journal */
+  }
+  for (let i = 0; i < rows.length; i += 1000) {
+    await tx.insert(analyticsEvents).values(rows.slice(i, i + 1000)).onConflictDoNothing();
+  }
+  if (rows.length) {
+    await fs.rename(file, `${file}.imported`).catch(() => undefined);
+  }
+}
+
+function referrerSource(ref?: string | null): string {
+  if (!ref) return 'Accès direct';
+  try {
+    const host = new URL(ref).hostname.replace(/^www\./, '');
+    if (/google\./.test(host)) return 'Google';
+    if (/bing\./.test(host)) return 'Bing';
+    if (/linkedin\./.test(host)) return 'LinkedIn';
+    if (/facebook\.|fb\./.test(host)) return 'Facebook';
+    return host;
+  } catch {
+    return 'Autre';
+  }
+}
+
+const n = (v: unknown) => Number(v ?? 0);
+
+/** Agrégats calculés par PostgreSQL : le volume d'événements n'est jamais chargé en mémoire. */
+export async function summarizeAnalytics(days: number, ownHost?: string): Promise<AnalyticsSummary> {
+  const since = new Date(Date.now() - days * 86400000);
+  const views = sql`kind = 'view' and ts >= ${since}`;
+
+  const [totals, timeseries, topPages, countries, devices, referrers, recent] = await Promise.all([
+    db.execute(sql`
+      with s as (
+        select session_id, count(*) as n from analytics_events where ${views} group by session_id
+      )
+      select
+        (select count(*) from analytics_events where ${views}) as page_views,
+        (select count(*) from s) as sessions,
+        (select count(*) from s where n = 1) as bounced,
+        (select avg(least(duration_sec, ${MAX_DURATION_SEC})) from analytics_events
+           where kind = 'leave' and duration_sec is not null and ts >= ${since}) as avg_time,
+        (select count(distinct session_id) from analytics_events where ts >= now() - interval '5 minutes') as active_now
+    `),
+    db.execute(sql`
+      select to_char(ts at time zone 'UTC', 'YYYY-MM-DD') as day, count(*) as views, count(distinct session_id) as sessions
+      from analytics_events where ${views} group by 1
+    `),
+    db.execute(sql`
+      with v as (
+        select path, count(*) as views from analytics_events where ${views} group by path order by views desc limit 15
+      ),
+      t as (
+        select path, avg(least(duration_sec, ${MAX_DURATION_SEC})) as avg_time from analytics_events
+        where kind = 'leave' and duration_sec is not null and ts >= ${since} group by path
+      )
+      select v.path, v.views, coalesce(t.avg_time, 0) as avg_time from v left join t using (path) order by v.views desc
+    `),
+    db.execute(sql`
+      select coalesce(country, '??') as country, count(*) as views from analytics_events
+      where ${views} group by 1 order by views desc
+    `),
+    db.execute(sql`
+      select device, count(*) as views from analytics_events where ${views} group by 1 order by views desc
+    `),
+    db.execute(sql`
+      select referrer, count(*) as views from analytics_events
+      where ${views} ${ownHost ? sql`and (referrer is null or position(${ownHost} in referrer) = 0)` : sql``}
+      group by referrer
+    `),
+    db.select().from(analyticsEvents).orderBy(sql`ts desc`).limit(500),
+  ]);
+
+  const tot = totals.rows[0] as Record<string, unknown>;
+  const sessions = n(tot.sessions);
+
+  const byDay = new Map(timeseries.rows.map((r) => [String(r.day), r]));
+  const series: AnalyticsSummary['timeseries'] = [];
+  for (let i = days - 1; i >= 0; i--) {
+    const date = new Date(Date.now() - i * 86400000).toISOString().slice(0, 10);
+    const row = byDay.get(date);
+    series.push({ date, views: n(row?.views), sessions: n(row?.sessions) });
+  }
+
+  const sources = new Map<string, number>();
+  for (const r of referrers.rows) {
+    const key = referrerSource(r.referrer as string | null);
+    sources.set(key, (sources.get(key) || 0) + n(r.views));
+  }
+
+  return {
+    days,
+    pageViews: n(tot.page_views),
+    uniqueSessions: sessions,
+    avgTimeOnPageSec: Math.round(n(tot.avg_time)),
+    bounceRate: sessions ? Math.round((n(tot.bounced) / sessions) * 100) : 0,
+    activeNow: n(tot.active_now),
+    timeseries: series,
+    topPages: topPages.rows.map((r) => ({ path: String(r.path), views: n(r.views), avgTimeSec: Math.round(n(r.avg_time)) })),
+    countries: countries.rows.map((r) => ({ country: String(r.country), views: n(r.views) })),
+    devices: devices.rows.map((r) => ({ device: String(r.device), views: n(r.views) })),
+    referrers: [...sources.entries()]
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, 10)
+      .map(([source, views]) => ({ source, views })),
+    recent: recent.map((r) => ({
+      id: r.id,
+      kind: r.kind,
+      sessionId: r.sessionId,
+      path: r.path,
+      ...(r.referrer ? { referrer: r.referrer } : {}),
+      ...(r.country ? { country: r.country } : {}),
+      ...(r.city ? { city: r.city } : {}),
+      device: r.device,
+      ...(r.durationSec != null ? { durationSec: r.durationSec } : {}),
+      ts: r.ts.toISOString(),
+    })),
+  };
+}

package/template/server/cms/auth.ts

@@ -0,0 +1,155 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import crypto from 'crypto';
+import type { AdminUser, SystemSettings } from './types';
+
+function jwtSecret(): string {
+  const secret = process.env.ADMIN_JWT_SECRET;
+  if (!secret && process.env.NODE_ENV === 'production') {
+    throw new Error('ADMIN_JWT_SECRET doit être défini en production');
+  }
+  return secret || 'dev-only-secret-snapify-cms';
+}
+
+export function hashPassword(password: string, salt?: string): { hash: string; salt: string } {
+  const s = salt || crypto.randomBytes(16).toString('hex');
+  const hash = crypto.scryptSync(password, s, 64).toString('hex');
+  return { hash, salt: s };
+}
+
+function safeEqual(a: Buffer, b: Buffer): boolean {
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+export function verifyPassword(password: string, user: AdminUser): boolean {
+  const { hash } = hashPassword(password, user.salt);
+  return safeEqual(Buffer.from(hash, 'hex'), Buffer.from(user.passwordHash, 'hex'));
+}
+
+/** Empreinte factice : même coût de calcul quand le compte n'existe pas (pas d'énumération par le temps de réponse). */
+let dummy: AdminUser | null = null;
+export function burnPasswordCheck(password: string) {
+  if (!dummy) {
+    const { hash, salt } = hashPassword(crypto.randomUUID());
+    dummy = { id: '', email: '', name: '', role: '', passwordHash: hash, salt };
+  }
+  verifyPassword(password, dummy);
+}
+
+/** Mot de passe inutilisable (comptes invités, réinitialisés). */
+export function unusablePassword(): { hash: string; salt: string } {
+  return hashPassword(crypto.randomBytes(32).toString('hex'));
+}
+
+type PasswordPolicy = Pick<SystemSettings['security'], 'passwordMinLength' | 'requireUppercase' | 'requireNumber' | 'requireSymbol'>;
+
+export function validatePassword(password: string, policy: PasswordPolicy, user?: { email?: string; name?: string }): string | null {
+  if (password.length < policy.passwordMinLength) return `Le mot de passe doit contenir au moins ${policy.passwordMinLength} caractères.`;
+  if (password.length > 200) return 'Le mot de passe est trop long (200 caractères max).';
+  if (!/[a-zA-Z]/.test(password)) return 'Le mot de passe doit contenir au moins une lettre.';
+  if (policy.requireUppercase && (!/[A-Z]/.test(password) || !/[a-z]/.test(password))) return 'Le mot de passe doit mêler majuscules et minuscules.';
+  if (policy.requireNumber && !/\d/.test(password)) return 'Le mot de passe doit contenir au moins un chiffre.';
+  if (policy.requireSymbol && !/[^a-zA-Z0-9]/.test(password)) return 'Le mot de passe doit contenir au moins un caractère spécial.';
+  const lower = password.toLowerCase();
+  const local = user?.email?.split('@')[0]?.toLowerCase();
+  if (local && local.length >= 4 && lower.includes(local)) return 'Le mot de passe ne doit pas contenir votre adresse e-mail.';
+  if (/^(.)\1+$/.test(password) || /^(?:0123456789|1234567890|azertyuiop|qwertyuiop|password|motdepasse)/i.test(password)) {
+    return 'Ce mot de passe est trop facile à deviner.';
+  }
+  return null;
+}
+
+/** Le mot de passe a-t-il dépassé la durée de validité de la politique ? */
+export function passwordExpired(user: AdminUser, expiryDays: number): boolean {
+  if (expiryDays <= 0) return false;
+  const since = user.passwordChangedAt || user.createdAt;
+  return !!since && Date.now() - new Date(since).getTime() > expiryDays * 86400_000;
+}
+
+/* ---------- Jetons signés ---------- */
+
+function sign(payload: object): string {
+  const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+  const sig = crypto.createHmac('sha256', jwtSecret()).update(body).digest('base64url');
+  return `${body}.${sig}`;
+}
+
+function unsign<T extends { exp: number }>(token: string): T | null {
+  const parts = token.split('.');
+  if (parts.length !== 2) return null;
+  const [body, sig] = parts;
+  const expected = crypto.createHmac('sha256', jwtSecret()).update(body).digest('base64url');
+  if (!safeEqual(Buffer.from(sig), Buffer.from(expected))) return null;
+  try {
+    const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf-8')) as T;
+    if (typeof payload.exp !== 'number' || payload.exp < Date.now()) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export interface TokenPayload {
+  typ: 'session';
+  sub: string;
+  /** Identifiant de session (table admin_sessions), révocable. */
+  sid: string;
+  exp: number;
+  /** Empreinte du hash : un changement de mot de passe invalide les jetons existants. */
+  pv: string;
+}
+
+const passwordVersion = (user: AdminUser) => user.passwordHash.slice(0, 12);
+
+export function createToken(user: AdminUser, sid: string, expiresAt: Date): string {
+  return sign({ typ: 'session', sub: user.id, sid, exp: expiresAt.getTime(), pv: passwordVersion(user) } satisfies TokenPayload);
+}
+
+export function verifyToken(token: string): TokenPayload | null {
+  const p = unsign<TokenPayload>(token);
+  return p?.typ === 'session' && p.sid ? p : null;
+}
+
+export const tokenMatchesUser = (payload: { pv: string }, user: AdminUser) => payload.pv === passwordVersion(user);
+
+/** Étape intermédiaire de connexion : mot de passe validé, code 2FA attendu (5 min). */
+export interface ChallengePayload {
+  typ: '2fa';
+  sub: string;
+  remember: boolean;
+  exp: number;
+  pv: string;
+}
+
+export const createChallenge = (user: AdminUser, remember: boolean) =>
+  sign({ typ: '2fa', sub: user.id, remember, exp: Date.now() + 5 * 60_000, pv: passwordVersion(user) } satisfies ChallengePayload);
+
+export function verifyChallenge(token: string): ChallengePayload | null {
+  const p = unsign<ChallengePayload>(token);
+  return p?.typ === '2fa' ? p : null;
+}
+
+export async function ensureDefaultAdmin(users: AdminUser[]): Promise<AdminUser[]> {
+  if (users.length > 0) return users;
+  const password = process.env.ADMIN_PASSWORD;
+  if (!password) throw new Error('ADMIN_PASSWORD requis pour créer le premier compte administrateur');
+  const { hash, salt } = hashPassword(password);
+  const now = new Date().toISOString();
+  return [
+    {
+      id: 'admin-1',
+      email: process.env.ADMIN_EMAIL || 'admin@snapify.fr',
+      passwordHash: hash,
+      salt,
+      role: 'superadmin',
+      name: 'Administrateur Snapify',
+      status: 'active',
+      passwordChangedAt: now,
+      createdAt: now,
+    },
+  ];
+}