[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_182":183,"_184":185},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":53,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",13,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","b50ac696-a153-11f1-85e9-1607ee4eb77e","name","fileType","http","content","/**\n * E-Ticket v2 — HTTP val Val Town\n * -----------------------------------------------------------------------------\n * Comptes individuels (email + mot de passe) et **espaces partagés** rejoints\n * par code. Les métadonnées et les fichiers vivent dans **Neon Postgres**.\n *\n * Fichiers du val :\n * main.ts (ce fichier) — routes HTTP\n * db.ts — accès Postgres (postgres.js) + schéma auto\n *\n * Variables d'environnement (Val Town → Settings → Environment variables) :\n * DATABASE_URL — chaîne de connexion Neon (endpoint -pooler conseillé)\n * JWT_SECRET — secret HMAC (32+ caractères)\n * CRON_SECRET — optionnel, pour le val cron de purge\n * CORS_ORIGIN — origines autorisées, `*` par défaut\n *\n * Authentification :\n * - Compte : POST /auth/signup puis POST /oauth/token (grant password, email)\n * - Espace : POST /vaults (créer) ou POST /vaults/join (rejoindre avec code)\n * - Chaque requête d'espace envoie l'en-tête `X-Vault-Id` ; le serveur\n * vérifie l'appartenance avant tout accès aux données.\n */\n\nimport postgres from \"npm:postgres\";\nimport * as store from \"./db.ts\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nconst ITERATIONS = 120_000;\nconst TOKEN_TTL_SEC = 60 * 60 * 24 * 7; // 7 jours\n\n/** Domaines email autorisés à l'inscription. */\nconst ALLOWED_EMAIL_DOMAINS = [\"gmail.com\", \"yahoo.fr\", \"hotmail.fr\"];\n\ntype TicketKind = \"pdf\" | \"image\" | \"other\";\n\nclass HttpError extends Error {\n status: number;\n constructor(status: number, message: string) {\n super(message);\n this.status = status;\n }\n}\n\nfunction env(name: string, fallback = \"\"): string {\n return (Deno.env.get(name) ?? fallback).trim();\n}\n\nfunction json(data: unknown, status = 200, extra: HeadersInit = {}): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...extra },\n });\n}\n\nfunction corsHeaders(req: Request): Record {\n const allowed = env(\"CORS_ORIGIN\", \"*\");\n const origin = req.headers.get(\"origin\") ?? \"\";\n const list = allowed.split(\",\").map((s) => s.trim()).filter(Boolean);\n const allow = allowed === \"*\" || list.includes(\"*\")\n ? \"*\"\n : list.includes(origin)\n ? origin\n : list[0] ?? \"*\";\n return {\n \"access-control-allow-origin\": allow,\n \"access-control-allow-headers\": \"Authorization, Content-Type, X-Vault-Id\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n vary: \"Origin\",\n };\n}\n\nfunction withCors(req: Request, res: Response): Response {\n const headers = new Headers(res.headers);\n for (const [k, v] of Object.entries(corsHeaders(req))) headers.set(k, v);\n return new Response(res.body, { status: res.status, headers });\n}\n\n/* ------------------------------ crypto helpers ---------------------------- */\n\nfunction b64url(bytes: Uint8Array): string {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\n \"=\",\n \"\",\n );\n}\n\nfunction b64urlDecode(s: string): Uint8Array {\n const pad = s.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (s.length % 4));\n const b64 = s.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + pad;\n const bin = atob(b64);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt: salt as unknown as BufferSource,\n iterations,\n },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\n\nasync function sha256Hex(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(input));\n return b64url(new Uint8Array(digest));\n}\n\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** Format stocké : pbkdf2$iterations$saltB64url$hashB64url */\nasync function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await pbkdf2(password, salt, ITERATIONS);\n return `pbkdf2$${ITERATIONS}$${b64url(salt)}$${b64url(hash)}`;\n}\n\nasync function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n const [algo, iters, saltB64, hashB64] = stored.split(\"$\");\n if (algo !== \"pbkdf2\") return false;\n const got = await pbkdf2(\n password,\n b64urlDecode(saltB64),\n Number(iters) || ITERATIONS,\n );\n return timingSafeEqual(got, b64urlDecode(hashB64));\n}\n\nasync function hmac(secret: string, data: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\n \"sign\",\n ],\n );\n return new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data)),\n );\n}\n\nasync function signJwt(payload: Record): Promise {\n const header = b64url(\n encoder.encode(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" })),\n );\n const body = b64url(encoder.encode(JSON.stringify(payload)));\n const sig = b64url(await hmac(requiredJwtSecret(), `${header}.${body}`));\n return `${header}.${body}.${sig}`;\n}\n\nfunction requiredJwtSecret(): string {\n const s = env(\"JWT_SECRET\");\n if (!s) throw new HttpError(500, \"Variable manquante : JWT_SECRET\");\n return s;\n}\n\nasync function verifyJwt(token: string): Promise<{ sub: string; exp: number }> {\n const parts = token.split(\".\");\n if (parts.length !== 3) throw new HttpError(401, \"Jeton invalide\");\n const sig = b64url(\n await hmac(requiredJwtSecret(), `${parts[0]}.${parts[1]}`),\n );\n if (sig !== parts[2]) throw new HttpError(401, \"Jeton invalide\");\n let payload: Record;\n try {\n payload = JSON.parse(decoder.decode(b64urlDecode(parts[1])));\n } catch {\n throw new HttpError(401, \"Jeton invalide\");\n }\n if (typeof payload.exp !== \"number\" || payload.exp * 1000 < Date.now()) {\n throw new HttpError(401, \"Session expirée\");\n }\n return payload as { sub: string; exp: number };\n}\n\nasync function issueToken(\n user: store.UserRow,\n): Promise<\n {\n access_token: string;\n token_type: string;\n expires_in: number;\n user: PublicUser;\n }\n> {\n const now = Math.floor(Date.now() / 1000);\n const access_token = await signJwt({\n sub: user.id,\n iat: now,\n exp: now + TOKEN_TTL_SEC,\n });\n return {\n access_token,\n token_type: \"Bearer\",\n expires_in: TOKEN_TTL_SEC,\n user: publicUser(user),\n };\n}\n\n/* ------------------------------ auth & guards ----------------------------- */\n\nexport interface PublicUser {\n id: string;\n email: string;\n displayName: string;\n createdAt: string;\n}\n\nfunction publicUser(u: store.UserRow): PublicUser {\n return {\n id: u.id,\n email: u.email,\n displayName: u.display_name,\n createdAt: new Date(u.created_at).toISOString(),\n };\n}\n\nasync function requireUser(req: Request): Promise {\n const header = req.headers.get(\"authorization\") ?? \"\";\n const m = header.match(/^Bearer\\s+(.+)$/i);\n if (!m) throw new HttpError(401, \"Authentification requise\");\n const payload = await verifyJwt(m[1].trim());\n const user = await store.getUserById(payload.sub);\n if (!user) throw new HttpError(401, \"Compte introuvable\");\n return user;\n}\n\n/** Vérifie l'appartenance à l'espace indiqué par X-Vault-Id. */\nasync function requireVault(\n req: Request,\n user: store.UserRow,\n): Promise<{ vault: store.VaultRow; role: string }> {\n const vaultId = req.headers.get(\"x-vault-id\")?.trim() ?? \"\";\n if (!vaultId) {\n throw new HttpError(400, \"Espace non sélectionné (X-Vault-Id manquant)\");\n }\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n const vault = await store.getVault(vaultId);\n if (!vault) throw new HttpError(404, \"Espace introuvable\");\n return { vault, role: membership.role };\n}\n\nasync function readBody(req: Request): Promise> {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n const params = new URLSearchParams(await req.text());\n const out: Record = {};\n for (const [k, v] of params) out[k] = v;\n return out;\n }\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const out: Record = {};\n for (const [k, v] of form.entries()) out[k] = v;\n return out;\n }\n if (!ct || ct.includes(\"application/json\")) {\n const text = await req.text();\n if (!text) return {};\n return JSON.parse(text);\n }\n return {};\n}\n\n/** Montant d'une dépense : nombre ≥ 0, arrondi à 2 décimales (0 = non renseigné). */\nexport function parseAmount(input: unknown): number {\n const n = Number(String(input ?? \"\").replace(\",\", \".\"));\n if (!Number.isFinite(n) || n < 0) return 0;\n return Math.round(n * 100) / 100;\n}\n\nfunction parseTags(input: unknown): string[] {\n if (Array.isArray(input)) {\n return [\n ...new Set(\n input.map((t) => String(t).trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n if (typeof input === \"string\") {\n return [\n ...new Set(\n input.split(/[,;#]/).map((t) => t.trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n return [];\n}\n\nfunction kindFromMime(mime: string, fileName: string): TicketKind {\n if (mime === \"application/pdf\" || fileName.toLowerCase().endsWith(\".pdf\")) {\n return \"pdf\";\n }\n if (mime.startsWith(\"image/\")) return \"image\";\n return \"other\";\n}\n\nfunction ticketPublic(t: store.TicketRow) {\n return {\n id: t.id,\n name: t.name,\n brandId: t.brand_id,\n tags: t.tags,\n color: t.color,\n kind: t.kind,\n fileName: t.file_name,\n mimeType: t.mime_type,\n size: Number(t.size),\n notes: t.notes,\n amount: Number(t.amount ?? 0),\n expiresAt: t.expires_at ? new Date(t.expires_at).toISOString() : null,\n createdAt: new Date(t.created_at).toISOString(),\n updatedAt: new Date(t.updated_at).toISOString(),\n createdBy: t.created_by_name ?? \"Famille\",\n hasFile: Number(t.size) > 0 && Boolean(t.file_name),\n pinned: t.pinned,\n };\n}\n\nfunction brandPublic(b: store.BrandRow) {\n return {\n id: b.id,\n name: b.name,\n color: b.color,\n createdAt: new Date(b.created_at).toISOString(),\n };\n}\n\nfunction vaultPublic(v: store.VaultSummary) {\n return {\n id: v.id,\n name: v.name,\n role: v.role,\n members: v.members,\n tickets: v.tickets,\n createdAt: v.createdAt,\n };\n}\n\n/* --------------------------------- handlers -------------------------------- */\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nexport function emailDomainAllowed(email: string): boolean {\n const domain = email.trim().toLowerCase().split(\"@\")[1] ?? \"\";\n return ALLOWED_EMAIL_DOMAINS.includes(domain);\n}\n\nasync function handleSignup(req: Request): Promise {\n const body = await readBody(req);\n const email = String(body.email ?? \"\").trim();\n const password = String(body.password ?? \"\");\n const displayName = String(body.displayName ?? \"\").trim();\n if (!EMAIL_RE.test(email) || !emailDomainAllowed(email)) {\n throw new HttpError(\n 400,\n \"Email non autorisé : seuls les domaines @gmail.com, @yahoo.fr et @hotmail.fr sont acceptés\",\n );\n }\n if (password.length < 8) {\n throw new HttpError(400, \"Mot de passe trop court (8 caractères minimum)\");\n }\n if (!displayName) throw new HttpError(400, \"Le prénom est obligatoire\");\n if (await store.getUserByEmail(email)) {\n throw new HttpError(409, \"Un compte existe déjà avec cet email\");\n }\n const user = await store.insertUser(\n email,\n await hashPassword(password),\n displayName,\n );\n return json({ ...(await issueToken(user)) }, 201);\n}\n\nasync function handleLogin(req: Request): Promise {\n const body = await readBody(req);\n const grant = String(body.grant_type ?? \"password\");\n if (grant !== \"password\") {\n throw new HttpError(400, \"grant_type non supporté (utiliser password)\");\n }\n const email = String(body.username ?? body.email ?? \"\").trim();\n const password = String(body.password ?? \"\");\n const user = await store.getUserByEmail(email);\n if (!user || !(await verifyPassword(password, user.password_hash))) {\n throw new HttpError(401, \"Email ou mot de passe incorrect\");\n }\n return json(await issueToken(user));\n}\n\nasync function handleMe(req: Request, user: store.UserRow): Promise {\n return json({\n user: publicUser(user),\n vaults: (await store.listUserVaults(user.id)).map(vaultPublic),\n });\n}\n\nasync function handlePasswordChange(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const current = String(body.current ?? body.oldPassword ?? \"\");\n const next = String(body.next ?? body.newPassword ?? \"\");\n if (next.length < 8) {\n throw new HttpError(\n 400,\n \"Nouveau mot de passe trop court (8 caractères min.)\",\n );\n }\n if (!(await verifyPassword(current, user.password_hash))) {\n throw new HttpError(401, \"Mot de passe actuel incorrect\");\n }\n await store.updateUserPassword(user.id, await hashPassword(next));\n return json({ ok: true, message: \"Mot de passe du compte mis à jour.\" });\n}\n\nasync function handleNameChange(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const displayName = String(body.displayName ?? \"\").trim();\n if (!displayName) throw new HttpError(400, \"Le prénom est obligatoire\");\n await store.updateUserDisplayName(user.id, displayName);\n return json({ user: publicUser({ ...user, display_name: displayName }) });\n}\n\nasync function handleCreateVault(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim();\n const code = String(body.code ?? \"\").trim();\n if (!name) throw new HttpError(400, \"Le nom de l'espace est obligatoire\");\n if (code.length < 6) {\n throw new HttpError(\n 400,\n \"Le code de l'espace doit faire au moins 6 caractères\",\n );\n }\n const vault = await store.insertVault(\n name,\n await sha256Hex(code),\n await hashPassword(code),\n user.id,\n );\n const summary = (await store.listUserVaults(user.id)).find((v) =>\n v.id === vault.id\n )!;\n return json({ vault: vaultPublic(summary) }, 201);\n}\n\nasync function handleJoinVault(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const code = String(body.code ?? \"\").trim();\n if (!code) throw new HttpError(400, \"Saisis le code de l'espace\");\n const vault = await store.getVaultByCodeLookup(await sha256Hex(code));\n if (!vault || !(await verifyPassword(code, vault.join_code_hash))) {\n throw new HttpError(401, \"Code d'espace incorrect\");\n }\n await store.insertMembership(user.id, vault.id);\n const summary = (await store.listUserVaults(user.id)).find((v) =>\n v.id === vault.id\n )!;\n return json({ vault: vaultPublic(summary) });\n}\n\nasync function handleMembers(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n return json({ members: await store.listMembers(vaultId) });\n}\n\nasync function handleLeaveVault(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(404, \"Tu n'es pas membre de cet espace\");\n if (membership.role === \"owner\") {\n throw new HttpError(\n 400,\n \"Le propriétaire ne peut pas quitter l'espace : supprime-le depuis les réglages.\",\n );\n }\n await store.deleteMembership(user.id, vaultId);\n return json({ ok: true });\n}\n\nasync function handleDeleteVault(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n void req;\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n if (membership.role !== \"owner\") {\n throw new HttpError(403, \"Seul le propriétaire peut supprimer l'espace\");\n }\n await store.deleteVault(vaultId); // tickets, fichiers, marques, membres : cascade\n return json({ ok: true });\n}\n\nasync function handleTicketsList(\n req: Request,\n vaultId: string,\n): Promise {\n const url = new URL(req.url);\n const q = url.searchParams.get(\"q\") ?? \"\";\n await store.purgeExpired(vaultId);\n const [tickets, brands] = await Promise.all([\n store.listTickets(vaultId, q),\n store.listBrands(vaultId),\n ]);\n return json({\n tickets: tickets.map(ticketPublic),\n brands: brands.map(brandPublic),\n });\n}\n\nasync function handleCreateTicket(\n req: Request,\n vaultId: string,\n user: store.UserRow,\n): Promise {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let meta: Record = {};\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n for (const [k, v] of form.entries()) {\n if (k === \"file\" && typeof v !== \"string\") file = v;\n else meta[k] = v;\n }\n } else {\n meta = await readBody(req);\n }\n\n const name = String(meta.name ?? file?.name ?? \"Ticket\").trim();\n if (!name) throw new HttpError(400, \"Le nom est obligatoire\");\n\n const fileName = file?.name || String(meta.fileName ?? \"\");\n const mimeType = file?.type ||\n String(meta.mimeType ?? \"application/octet-stream\");\n let data: Uint8Array | null = null;\n if (file) {\n data = new Uint8Array(await file.arrayBuffer()); // pas de limite de taille\n }\n\n const ticket = await store.insertTicket({\n vaultId,\n name,\n brandId: meta.brandId ? String(meta.brandId) : null,\n tags: parseTags(meta.tags),\n color: String(meta.color ?? \"#c45c26\"),\n kind: data ? kindFromMime(mimeType, fileName) : \"other\",\n fileName: data ? fileName : \"\",\n mimeType,\n size: data ? data.byteLength : 0,\n notes: String(meta.notes ?? \"\"),\n amount: parseAmount(meta.amount),\n expiresAt: meta.expiresAt ? String(meta.expiresAt) : null,\n createdBy: user.id,\n });\n if (data && fileName) {\n await store.upsertFile(ticket.id, data, mimeType, fileName);\n }\n\n const full = await store.getTicket(vaultId, ticket.id);\n return json({ ticket: ticketPublic(full ?? ticket) }, 201);\n}\n\nasync function handlePatchTicket(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const body = await readBody(req);\n const patch: store.TicketPatch = {};\n if (body.name != null) patch.name = String(body.name).trim();\n if (body.brandId !== undefined) {\n patch.brandId = body.brandId\n ? String(body.brandId)\n : null;\n }\n if (body.tags != null) patch.tags = parseTags(body.tags);\n if (body.color != null) patch.color = String(body.color);\n if (body.notes != null) patch.notes = String(body.notes);\n if (body.amount !== undefined) patch.amount = parseAmount(body.amount);\n if (body.expiresAt !== undefined) {\n patch.expiresAt = body.expiresAt\n ? String(body.expiresAt)\n : null;\n }\n if (body.pinned != null) patch.pinned = Boolean(body.pinned);\n const updated = await store.updateTicket(id, patch);\n if (!updated) throw new HttpError(404, \"Ticket introuvable\");\n const full = await store.getTicket(vaultId, id);\n return json({ ticket: ticketPublic(full ?? updated) });\n}\n\nasync function handleDeleteTicket(\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n await store.deleteTicket(id); // le fichier est supprimé par cascade\n return json({ ok: true, id });\n}\n\nasync function handleFile(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n const row = await store.getFile(id);\n if (!row) throw new HttpError(404, \"Fichier absent\");\n const disposition = new URL(req.url).searchParams.get(\"download\") === \"1\"\n ? \"attachment\"\n : \"inline\";\n return new Response(row.data as unknown as BodyInit, {\n status: 200,\n headers: {\n \"content-type\": row.mime_type || ticket.mime_type ||\n \"application/octet-stream\",\n \"content-length\": String(row.data.byteLength),\n \"content-disposition\": `${disposition}; filename=\"${\n row.file_name.replaceAll('\"', \"\")\n }\"`,\n \"cache-control\": \"private, max-age=120\",\n },\n });\n}\n\nasync function handleUpload(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const v = form.get(\"file\");\n if (v && typeof v !== \"string\") file = v;\n }\n if (!file) throw new HttpError(400, \"Fichier manquant (champ file)\");\n const data = new Uint8Array(await file.arrayBuffer()); // pas de limite de taille\n await store.upsertFile(\n id,\n data,\n file.type || \"application/octet-stream\",\n file.name,\n );\n await store.updateTicketFileMeta(id, {\n fileName: file.name,\n mimeType: file.type || ticket.mime_type || \"application/octet-stream\",\n size: data.byteLength,\n kind: kindFromMime(file.type || \"\", file.name),\n });\n const patched = await store.getTicket(vaultId, id);\n return json({ ticket: ticketPublic(patched ?? ticket) });\n}\n\nasync function handleBrands(req: Request, vaultId: string): Promise {\n if (req.method === \"GET\") {\n return json({ brands: (await store.listBrands(vaultId)).map(brandPublic) });\n }\n if (req.method === \"POST\") {\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim();\n if (!name) throw new HttpError(400, \"Nom de marque obligatoire\");\n try {\n const brand = await store.insertBrand(\n vaultId,\n name,\n String(body.color ?? \"#c45c26\"),\n );\n return json({ brand: brandPublic(brand) }, 201);\n } catch (e) {\n if (store.isUniqueViolation(e)) {\n throw new HttpError(\n 409,\n \"Une marque porte déjà ce nom dans cet espace\",\n );\n }\n throw e;\n }\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleBrandItem(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const brand = (await store.listBrands(vaultId)).find((b) => b.id === id);\n if (!brand) throw new HttpError(404, \"Marque introuvable\");\n if (req.method === \"PATCH\") {\n const body = await readBody(req);\n const updated = await store.updateBrand(id, {\n name: body.name != null ? String(body.name).trim() : undefined,\n color: body.color != null ? String(body.color) : undefined,\n });\n return json({ brand: brandPublic(updated ?? brand) });\n }\n if (req.method === \"DELETE\") {\n await store.deleteBrand(id);\n return json({ ok: true });\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleStats(vaultId: string): Promise {\n await store.purgeExpired(vaultId);\n return json({ stats: await store.computeStats(vaultId) });\n}\n\nasync function handlePurge(req: Request): Promise {\n const secret = env(\"CRON_SECRET\");\n const header = req.headers.get(\"authorization\") ?? \"\";\n const q = new URL(req.url).searchParams.get(\"secret\") ?? \"\";\n const bearer = header.replace(/^Bearer\\s+/i, \"\");\n let authed = Boolean(secret) && (bearer === secret || q === secret);\n if (!authed) {\n try {\n const user = await requireUser(req);\n void user; // un membre connecté peut aussi forcer la purge\n authed = true;\n } catch {\n throw new HttpError(401, \"CRON_SECRET ou session requis\");\n }\n }\n const purged = await store.purgeExpired(null);\n return json({ ok: true, purged });\n}\n\nasync function handleGetPreferences(\n req: Request,\n user: store.UserRow,\n): Promise {\n void req;\n return json({ preferences: await store.getPreferences(user.id) });\n}\n\nasync function handleSavePreferences(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const data = (body.preferences ?? body) as Record;\n if (typeof data !== \"object\" || data === null || Array.isArray(data)) {\n throw new HttpError(400, \"Préférences invalides\");\n }\n return json({ preferences: await store.savePreferences(user.id, data) });\n}\n\nconst RECURRENCES = [\"none\", \"daily\", \"weekly\", \"monthly\", \"yearly\"];\n\nfunction reminderPublic(r: store.ReminderRow) {\n return {\n id: r.id,\n title: r.title,\n notes: r.notes,\n kind: r.kind,\n dueAt: r.due_at ? new Date(r.due_at).toISOString() : null,\n done: r.done,\n ticketId: r.ticket_id,\n ticketName: r.ticket_name ?? null,\n brandId: r.brand_id,\n brandName: r.brand_name ?? null,\n tags: r.tags ?? [],\n recurrence: r.recurrence ?? \"none\",\n createdBy: r.created_by_name ?? \"Famille\",\n createdAt: new Date(r.created_at).toISOString(),\n completedAt: r.completed_at ? new Date(r.completed_at).toISOString() : null,\n lastCompletedAt: r.last_completed_at\n ? new Date(r.last_completed_at).toISOString()\n : null,\n };\n}\n\nasync function handleCreateReminder(\n req: Request,\n vaultId: string,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const title = String(body.title ?? \"\").trim();\n if (!title) throw new HttpError(400, \"Le titre du rappel est obligatoire\");\n const recurrence = RECURRENCES.includes(String(body.recurrence))\n ? String(body.recurrence)\n : \"none\";\n const reminder = await store.insertReminder({\n vaultId,\n createdBy: user.id,\n title,\n notes: String(body.notes ?? \"\"),\n kind: [\"create_ticket\", \"import\", \"custom\"].includes(String(body.kind))\n ? String(body.kind)\n : \"custom\",\n dueAt: body.dueAt ? String(body.dueAt) : null,\n ticketId: body.ticketId ? String(body.ticketId) : null,\n brandId: body.brandId ? String(body.brandId) : null,\n tags: parseTags(body.tags),\n recurrence,\n });\n const full = await store.getReminder(vaultId, reminder.id);\n return json({ reminder: reminderPublic(full ?? reminder) }, 201);\n}\n\nasync function handlePatchReminder(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const body = await readBody(req);\n const doneRequested = body.done != null ? Boolean(body.done) : undefined;\n\n // Rappel récurrent terminé : on reprogramme l'occurrence suivante au lieu de le clore.\n let reprogrammed: string | null = null;\n if (doneRequested === true) {\n const current = await store.getReminder(vaultId, id);\n if (current && current.recurrence && current.recurrence !== \"none\") {\n const base = current.due_at ? new Date(current.due_at) : new Date();\n const next = store.nextRecurrenceDate(\n base > new Date() ? base : new Date(),\n current.recurrence,\n );\n if (next) reprogrammed = next.toISOString();\n }\n }\n\n const updated = await store.updateReminder(id, {\n title: body.title != null ? String(body.title).trim() : undefined,\n notes: body.notes != null ? String(body.notes) : undefined,\n dueAt: reprogrammed\n ? reprogrammed\n : body.dueAt !== undefined\n ? (body.dueAt ? String(body.dueAt) : null)\n : undefined,\n done: reprogrammed ? undefined : doneRequested,\n completedNow: Boolean(reprogrammed),\n brandId: body.brandId !== undefined\n ? (body.brandId ? String(body.brandId) : null)\n : undefined,\n tags: body.tags != null ? parseTags(body.tags) : undefined,\n recurrence:\n body.recurrence != null && RECURRENCES.includes(String(body.recurrence))\n ? String(body.recurrence)\n : undefined,\n });\n if (!updated) throw new HttpError(404, \"Rappel introuvable\");\n const full = await store.getReminder(vaultId, id);\n return json({\n reminder: reminderPublic(full ?? updated),\n rescheduledTo: reprogrammed,\n });\n}\n\nasync function handleDeleteReminder(\n vaultId: string,\n id: string,\n): Promise {\n const reminder = await store.getReminder(vaultId, id);\n if (!reminder) throw new HttpError(404, \"Rappel introuvable\");\n await store.deleteReminder(id);\n return json({ ok: true, id });\n}\n\nasync function handleNotifyLog(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const type = String(body.type ?? \"\").trim();\n if (!type) throw new HttpError(400, \"Type de notification manquant\");\n const first = await store.logNotification(\n user.id,\n type,\n String(body.refId ?? \"\"),\n );\n return json({ first });\n}\n\n/* --------------------------------- routing -------------------------------- */\n\nfunction match(\n pathname: string,\n pattern: string,\n): Record | null {\n const a = pathname.split(\"/\").filter(Boolean);\n const b = pattern.split(\"/\").filter(Boolean);\n if (a.length !== b.length) return null;\n const params: Record = {};\n for (let i = 0; i < a.length; i++) {\n if (b[i].startsWith(\":\")) params[b[i].slice(1)] = decodeURIComponent(a[i]);\n else if (a[i] !== b[i]) return null;\n }\n return params;\n}\n\nasync function route(req: Request): Promise {\n await store.ensureSchema();\n const url = new URL(req.url);\n let path = url.pathname.replace(/^\\/v\\d+/, \"\");\n if (path.length > 1 && path.endsWith(\"/\")) path = path.slice(0, -1);\n\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204 });\n\n if (req.method === \"GET\" && (path === \"/\" || path === \"/health\")) {\n return json({\n name: \"E-Ticket API\",\n version: 2,\n ok: true,\n storage: \"postgres\",\n auth: \"accounts+vaults\",\n time: new Date().toISOString(),\n });\n }\n\n if (req.method === \"POST\" && path === \"/auth/signup\") {\n return await handleSignup(req);\n }\n\n if (\n req.method === \"POST\" &&\n (path === \"/oauth/token\" || path === \"/auth/login\" ||\n path === \"/auth/token\")\n ) {\n return await handleLogin(req);\n }\n\n if (\n path === \"/internal/purge\" &&\n (req.method === \"POST\" || req.method === \"GET\")\n ) {\n return await handlePurge(req);\n }\n\n const user = await requireUser(req);\n\n if (req.method === \"GET\" && path === \"/auth/me\") {\n return await handleMe(req, user);\n }\n if (req.method === \"POST\" && path === \"/auth/password\") {\n return await handlePasswordChange(req, user);\n }\n if (req.method === \"PATCH\" && path === \"/auth/me\") {\n return await handleNameChange(req, user);\n }\n if (req.method === \"GET\" && path === \"/auth/preferences\") {\n return await handleGetPreferences(req, user);\n }\n if (req.method === \"PUT\" && path === \"/auth/preferences\") {\n return await handleSavePreferences(req, user);\n }\n if (req.method === \"POST\" && path === \"/notify/log\") {\n return await handleNotifyLog(req, user);\n }\n\n if (req.method === \"POST\" && path === \"/vaults\") {\n return await handleCreateVault(req, user);\n }\n if (req.method === \"GET\" && path === \"/vaults\") {\n return json({\n vaults: (await store.listUserVaults(user.id)).map(vaultPublic),\n });\n }\n if (req.method === \"POST\" && path === \"/vaults/join\") {\n return await handleJoinVault(req, user);\n }\n\n let m = match(path, \"/vaults/:id/members\");\n if (m && req.method === \"GET\") return await handleMembers(req, user, m.id);\n\n m = match(path, \"/vaults/:id/members/me\");\n if (m && req.method === \"DELETE\") {\n return await handleLeaveVault(req, user, m.id);\n }\n\n m = match(path, \"/vaults/:id\");\n if (m && req.method === \"DELETE\") {\n return await handleDeleteVault(req, user, m.id);\n }\n\n // À partir d'ici, tout est relatif à un espace partagé.\n const { vault } = await requireVault(req, user);\n\n if (req.method === \"GET\" && path === \"/tickets\") {\n return await handleTicketsList(req, vault.id);\n }\n if (req.method === \"POST\" && path === \"/tickets\") {\n return await handleCreateTicket(req, vault.id, user);\n }\n\n if (req.method === \"GET\" && path === \"/stats\") {\n return await handleStats(vault.id);\n }\n\n if (req.method === \"GET\" && path === \"/reminders\") {\n const url = new URL(req.url);\n const includeDone = url.searchParams.get(\"done\") !== \"0\";\n return json({\n reminders: (await store.listReminders(vault.id, includeDone)).map(\n reminderPublic,\n ),\n });\n }\n if (req.method === \"POST\" && path === \"/reminders\") {\n return await handleCreateReminder(req, vault.id, user);\n }\n\n m = match(path, \"/reminders/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const reminder = await store.getReminder(vault.id, m.id);\n if (!reminder) throw new HttpError(404, \"Rappel introuvable\");\n return json({ reminder: reminderPublic(reminder) });\n }\n if (req.method === \"PATCH\") {\n return await handlePatchReminder(req, vault.id, m.id);\n }\n if (req.method === \"DELETE\") {\n return await handleDeleteReminder(vault.id, m.id);\n }\n }\n\n if (path === \"/brands\") return await handleBrands(req, vault.id);\n\n m = match(path, \"/tickets/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const ticket = await store.getTicket(vault.id, m.id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n return json({ ticket: ticketPublic(ticket) });\n }\n if (req.method === \"PATCH\") {\n return await handlePatchTicket(req, vault.id, m.id);\n }\n if (req.method === \"DELETE\") {\n return await handleDeleteTicket(vault.id, m.id);\n }\n }\n\n m = match(path, \"/tickets/:id/file\");\n if (m && req.method === \"GET\") return await handleFile(req, vault.id, m.id);\n if (m && (req.method === \"POST\" || req.method === \"PUT\")) {\n return await handleUpload(req, vault.id, m.id);\n }\n\n m = match(path, \"/brands/:id\");\n if (m) return await handleBrandItem(req, vault.id, m.id);\n\n if (req.method === \"GET\" && path === \"/tags\") {\n return json({ tags: await store.listTags(vault.id) });\n }\n\n throw new HttpError(404, `Route inconnue : ${req.method} ${path}`);\n}\n\nexport default async function handler(req: Request): Promise {\n try {\n return withCors(req, await route(req));\n } catch (err) {\n if (err instanceof store.DbError) {\n return withCors(\n req,\n json({ error: err.message, status: err.status }, err.status),\n );\n }\n if (err instanceof postgres.PostgresError) {\n console.error(\"E-Ticket API [postgres]\", err.code, err.message);\n const status = err.code === \"23505\" ? 409 : 500;\n const message = err.code === \"23505\"\n ? \"Cette valeur existe déjà\"\n : \"Erreur de base de données\";\n return withCors(req, json({ error: message, status }, status));\n }\n const status = err instanceof HttpError ? err.status : 500;\n const message = err instanceof Error ? err.message : \"Erreur interne\";\n console.error(\"E-Ticket API\", status, message);\n return withCors(req, json({ error: message, status }, status));\n }\n}","/**\n * E-Ticket v2 — HTTP val Val Town\n * -----------------------------------------------------------------------------\n * Comptes individuels (email + mot de passe) et **espaces partagés** rejoints\n * par code. Les métadonnées et les fichiers vivent dans **Neon Postgres**.\n *\n * Fichiers du val :\n * main.ts (ce fichier) — routes HTTP\n * db.ts — accès Postgres (postgres.js) + schéma auto\n *\n * Variables d'environnement (Val Town → Settings → Environment variables) :\n * DATABASE_URL — chaîne de connexion Neon (endpoint -pooler conseillé)\n * JWT_SECRET — secret HMAC (32+ caractères)\n * CRON_SECRET — optionnel, pour le val cron de purge\n * CORS_ORIGIN — origines autorisées, `*` par défaut\n *\n * Authentification :\n * - Compte : POST /auth/signup puis POST /oauth/token (grant password, email)\n * - Espace : POST /vaults (créer) ou POST /vaults/join (rejoindre avec code)\n * - Chaque requête d'espace envoie l'en-tête `X-Vault-Id` ; le serveur\n * vérifie l'appartenance avant tout accès aux données.\n */\n\nimport postgres from \"npm:postgres\";\nimport * as store from \"./db.ts\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nconst ITERATIONS = 120_000;\nconst TOKEN_TTL_SEC = 60 * 60 * 24 * 7; // 7 jours\nconst MAX_STORAGE_BYTES = 1073741824;\n\n/** Domaines email autorisés à l'inscription. */\nconst ALLOWED_EMAIL_DOMAINS = [\"gmail.com\", \"yahoo.fr\", \"hotmail.fr\"];\n\ntype TicketKind = \"pdf\" | \"image\" | \"other\";\n\nclass HttpError extends Error {\n status: number;\n constructor(status: number, message: string) {\n super(message);\n this.status = status;\n }\n}\n\nfunction env(name: string, fallback = \"\"): string {\n return (Deno.env.get(name) ?? fallback).trim();\n}\n\nfunction json(data: unknown, status = 200, extra: HeadersInit = {}): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...extra },\n });\n}\n\nfunction corsHeaders(req: Request): Record {\n const allowed = env(\"CORS_ORIGIN\", \"*\");\n const origin = req.headers.get(\"origin\") ?? \"\";\n const list = allowed.split(\",\").map((s) => s.trim()).filter(Boolean);\n const allow = allowed === \"*\" || list.includes(\"*\")\n ? \"*\"\n : list.includes(origin)\n ? origin\n : list[0] ?? \"*\";\n return {\n \"access-control-allow-origin\": allow,\n \"access-control-allow-headers\": \"Authorization, Content-Type, X-Vault-Id\",\n \"access-control-allow-methods\": \"GET, POST, PATCH, PUT, DELETE, OPTIONS\",\n \"access-control-max-age\": \"86400\",\n vary: \"Origin\",\n };\n}\n\nfunction withCors(req: Request, res: Response): Response {\n const headers = new Headers(res.headers);\n for (const [k, v] of Object.entries(corsHeaders(req))) headers.set(k, v);\n return new Response(res.body, { status: res.status, headers });\n}\n\n/* ------------------------------ crypto helpers ---------------------------- */\n\nfunction b64url(bytes: Uint8Array): string {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\n \"=\",\n \"\",\n );\n}\n\nfunction b64urlDecode(s: string): Uint8Array {\n const pad = s.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (s.length % 4));\n const b64 = s.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + pad;\n const bin = atob(b64);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt: salt as unknown as BufferSource,\n iterations,\n },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\n\nasync function sha256Hex(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(input));\n return b64url(new Uint8Array(digest));\n}\n\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** Format stocké : pbkdf2$iterations$saltB64url$hashB64url */\nasync function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await pbkdf2(password, salt, ITERATIONS);\n return `pbkdf2$${ITERATIONS}$${b64url(salt)}$${b64url(hash)}`;\n}\n\nasync function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n const [algo, iters, saltB64, hashB64] = stored.split(\"$\");\n if (algo !== \"pbkdf2\") return false;\n const got = await pbkdf2(\n password,\n b64urlDecode(saltB64),\n Number(iters) || ITERATIONS,\n );\n return timingSafeEqual(got, b64urlDecode(hashB64));\n}\n\nasync function hmac(secret: string, data: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\n \"sign\",\n ],\n );\n return new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data)),\n );\n}\n\nasync function signJwt(payload: Record): Promise {\n const header = b64url(\n encoder.encode(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" })),\n );\n const body = b64url(encoder.encode(JSON.stringify(payload)));\n const sig = b64url(await hmac(requiredJwtSecret(), `${header}.${body}`));\n return `${header}.${body}.${sig}`;\n}\n\nfunction requiredJwtSecret(): string {\n const s = env(\"JWT_SECRET\");\n if (!s) throw new HttpError(500, \"Variable manquante : JWT_SECRET\");\n return s;\n}\n\nasync function verifyJwt(token: string): Promise<{ sub: string; exp: number }> {\n const parts = token.split(\".\");\n if (parts.length !== 3) throw new HttpError(401, \"Jeton invalide\");\n const sig = b64url(\n await hmac(requiredJwtSecret(), `${parts[0]}.${parts[1]}`),\n );\n if (sig !== parts[2]) throw new HttpError(401, \"Jeton invalide\");\n let payload: Record;\n try {\n payload = JSON.parse(decoder.decode(b64urlDecode(parts[1])));\n } catch {\n throw new HttpError(401, \"Jeton invalide\");\n }\n if (typeof payload.exp !== \"number\" || payload.exp * 1000 < Date.now()) {\n throw new HttpError(401, \"Session expirée\");\n }\n return payload as { sub: string; exp: number };\n}\n\nasync function issueToken(\n user: store.UserRow,\n): Promise<\n {\n access_token: string;\n token_type: string;\n expires_in: number;\n user: PublicUser;\n }\n> {\n const now = Math.floor(Date.now() / 1000);\n const access_token = await signJwt({\n sub: user.id,\n iat: now,\n exp: now + TOKEN_TTL_SEC,\n });\n return {\n access_token,\n token_type: \"Bearer\",\n expires_in: TOKEN_TTL_SEC,\n user: publicUser(user),\n };\n}\n\n/* ------------------------------ auth & guards ----------------------------- */\n\nexport interface PublicUser {\n id: string;\n email: string;\n displayName: string;\n createdAt: string;\n}\n\nfunction publicUser(u: store.UserRow): PublicUser {\n return {\n id: u.id,\n email: u.email,\n displayName: u.display_name,\n createdAt: new Date(u.created_at).toISOString(),\n };\n}\n\nasync function requireUser(req: Request): Promise {\n const header = req.headers.get(\"authorization\") ?? \"\";\n const m = header.match(/^Bearer\\s+(.+)$/i);\n if (!m) throw new HttpError(401, \"Authentification requise\");\n const payload = await verifyJwt(m[1].trim());\n const user = await store.getUserById(payload.sub);\n if (!user) throw new HttpError(401, \"Compte introuvable\");\n return user;\n}\n\n/** Vérifie l'appartenance à l'espace indiqué par X-Vault-Id. */\nasync function requireVault(\n req: Request,\n user: store.UserRow,\n): Promise<{ vault: store.VaultRow; role: string }> {\n const vaultId = req.headers.get(\"x-vault-id\")?.trim() ?? \"\";\n if (!vaultId) {\n throw new HttpError(400, \"Espace non sélectionné (X-Vault-Id manquant)\");\n }\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n const vault = await store.getVault(vaultId);\n if (!vault) throw new HttpError(404, \"Espace introuvable\");\n return { vault, role: membership.role };\n}\n\nasync function readBody(req: Request): Promise> {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n const params = new URLSearchParams(await req.text());\n const out: Record = {};\n for (const [k, v] of params) out[k] = v;\n return out;\n }\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const out: Record = {};\n for (const [k, v] of form.entries()) out[k] = v;\n return out;\n }\n if (!ct || ct.includes(\"application/json\")) {\n const text = await req.text();\n if (!text) return {};\n return JSON.parse(text);\n }\n return {};\n}\n\n/** Montant d'une dépense : nombre ≥ 0, arrondi à 2 décimales (0 = non renseigné). */\nexport function parseAmount(input: unknown): number {\n const n = Number(String(input ?? \"\").replace(\",\", \".\"));\n if (!Number.isFinite(n) || n < 0) return 0;\n return Math.round(n * 100) / 100;\n}\n\nfunction parseTags(input: unknown): string[] {\n if (Array.isArray(input)) {\n return [\n ...new Set(\n input.map((t) => String(t).trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n if (typeof input === \"string\") {\n return [\n ...new Set(\n input.split(/[,;#]/).map((t) => t.trim().toLowerCase()).filter(Boolean),\n ),\n ].slice(0, 24);\n }\n return [];\n}\n\nfunction kindFromMime(mime: string, fileName: string): TicketKind {\n if (mime === \"application/pdf\" || fileName.toLowerCase().endsWith(\".pdf\")) {\n return \"pdf\";\n }\n if (mime.startsWith(\"image/\")) return \"image\";\n return \"other\";\n}\n\nfunction ticketPublic(t: store.TicketRow) {\n return {\n id: t.id,\n name: t.name,\n brandId: t.brand_id,\n tags: t.tags,\n color: t.color,\n kind: t.kind,\n fileName: t.file_name,\n mimeType: t.mime_type,\n size: Number(t.size),\n notes: t.notes,\n amount: Number(t.amount ?? 0),\n expiresAt: t.expires_at ? new Date(t.expires_at).toISOString() : null,\n createdAt: new Date(t.created_at).toISOString(),\n updatedAt: new Date(t.updated_at).toISOString(),\n createdBy: t.created_by_name ?? \"Famille\",\n hasFile: Number(t.size) > 0 && Boolean(t.file_name),\n pinned: t.pinned,\n };\n}\n\nfunction brandPublic(b: store.BrandRow) {\n return {\n id: b.id,\n name: b.name,\n color: b.color,\n createdAt: new Date(b.created_at).toISOString(),\n };\n}\n\nfunction vaultPublic(v: store.VaultSummary) {\n return {\n id: v.id,\n name: v.name,\n role: v.role,\n members: v.members,\n tickets: v.tickets,\n createdAt: v.createdAt,\n };\n}\n\n/* --------------------------------- handlers -------------------------------- */\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nexport function emailDomainAllowed(email: string): boolean {\n const domain = email.trim().toLowerCase().split(\"@\")[1] ?? \"\";\n return ALLOWED_EMAIL_DOMAINS.includes(domain);\n}\n\nasync function handleSignup(req: Request): Promise {\n const body = await readBody(req);\n const email = String(body.email ?? \"\").trim();\n const password = String(body.password ?? \"\");\n const displayName = String(body.displayName ?? \"\").trim();\n if (!EMAIL_RE.test(email) || !emailDomainAllowed(email)) {\n throw new HttpError(\n 400,\n \"Email non autorisé : seuls les domaines @gmail.com, @yahoo.fr et @hotmail.fr sont acceptés\",\n );\n }\n if (password.length < 8) {\n throw new HttpError(400, \"Mot de passe trop court (8 caractères minimum)\");\n }\n if (!displayName) throw new HttpError(400, \"Le prénom est obligatoire\");\n if (await store.getUserByEmail(email)) {\n throw new HttpError(409, \"Un compte existe déjà avec cet email\");\n }\n const user = await store.insertUser(\n email,\n await hashPassword(password),\n displayName,\n );\n return json({ ...(await issueToken(user)) }, 201);\n}\n\nasync function handleLogin(req: Request): Promise {\n const body = await readBody(req);\n const grant = String(body.grant_type ?? \"password\");\n if (grant !== \"password\") {\n throw new HttpError(400, \"grant_type non supporté (utiliser password)\");\n }\n const email = String(body.username ?? body.email ?? \"\").trim();\n const password = String(body.password ?? \"\");\n const user = await store.getUserByEmail(email);\n if (!user || !(await verifyPassword(password, user.password_hash))) {\n throw new HttpError(401, \"Email ou mot de passe incorrect\");\n }\n return json(await issueToken(user));\n}\n\nasync function handleMe(req: Request, user: store.UserRow): Promise {\n return json({\n user: publicUser(user),\n vaults: (await store.listUserVaults(user.id)).map(vaultPublic),\n });\n}\n\nasync function handlePasswordChange(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const current = String(body.current ?? body.oldPassword ?? \"\");\n const next = String(body.next ?? body.newPassword ?? \"\");\n if (next.length < 8) {\n throw new HttpError(\n 400,\n \"Nouveau mot de passe trop court (8 caractères min.)\",\n );\n }\n if (!(await verifyPassword(current, user.password_hash))) {\n throw new HttpError(401, \"Mot de passe actuel incorrect\");\n }\n await store.updateUserPassword(user.id, await hashPassword(next));\n return json({ ok: true, message: \"Mot de passe du compte mis à jour.\" });\n}\n\nasync function handleNameChange(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const displayName = String(body.displayName ?? \"\").trim();\n if (!displayName) throw new HttpError(400, \"Le prénom est obligatoire\");\n await store.updateUserDisplayName(user.id, displayName);\n return json({ user: publicUser({ ...user, display_name: displayName }) });\n}\n\nasync function handleCreateVault(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim();\n const code = String(body.code ?? \"\").trim();\n if (!name) throw new HttpError(400, \"Le nom de l'espace est obligatoire\");\n if (code.length < 6) {\n throw new HttpError(\n 400,\n \"Le code de l'espace doit faire au moins 6 caractères\",\n );\n }\n const vault = await store.insertVault(\n name,\n await sha256Hex(code),\n await hashPassword(code),\n user.id,\n );\n const summary = (await store.listUserVaults(user.id)).find((v) =>\n v.id === vault.id\n )!;\n return json({ vault: vaultPublic(summary) }, 201);\n}\n\nasync function handleJoinVault(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const code = String(body.code ?? \"\").trim();\n if (!code) throw new HttpError(400, \"Saisis le code de l'espace\");\n const vault = await store.getVaultByCodeLookup(await sha256Hex(code));\n if (!vault || !(await verifyPassword(code, vault.join_code_hash))) {\n throw new HttpError(401, \"Code d'espace incorrect\");\n }\n await store.insertMembership(user.id, vault.id);\n const summary = (await store.listUserVaults(user.id)).find((v) =>\n v.id === vault.id\n )!;\n return json({ vault: vaultPublic(summary) });\n}\n\nasync function handleMembers(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n return json({ members: await store.listMembers(vaultId) });\n}\n\nasync function handleLeaveVault(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(404, \"Tu n'es pas membre de cet espace\");\n if (membership.role === \"owner\") {\n throw new HttpError(\n 400,\n \"Le propriétaire ne peut pas quitter l'espace : supprime-le depuis les réglages.\",\n );\n }\n await store.deleteMembership(user.id, vaultId);\n return json({ ok: true });\n}\n\nasync function handleDeleteVault(\n req: Request,\n user: store.UserRow,\n vaultId: string,\n): Promise {\n void req;\n const membership = await store.getMembership(user.id, vaultId);\n if (!membership) throw new HttpError(403, \"Tu n'es pas membre de cet espace\");\n if (membership.role !== \"owner\") {\n throw new HttpError(403, \"Seul le propriétaire peut supprimer l'espace\");\n }\n await store.deleteVault(vaultId); // tickets, fichiers, marques, membres : cascade\n return json({ ok: true });\n}\n\nasync function handleTicketsList(\n req: Request,\n vaultId: string,\n): Promise {\n const url = new URL(req.url);\n const q = url.searchParams.get(\"q\") ?? \"\";\n await store.purgeExpired(vaultId);\n const [tickets, brands] = await Promise.all([\n store.listTickets(vaultId, q),\n store.listBrands(vaultId),\n ]);\n return json({\n tickets: tickets.map(ticketPublic),\n brands: brands.map(brandPublic),\n });\n}\n\nasync function handleCreateTicket(\n req: Request,\n vaultId: string,\n user: store.UserRow,\n): Promise {\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let meta: Record = {};\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n for (const [k, v] of form.entries()) {\n if (k === \"file\" && typeof v !== \"string\") file = v;\n else meta[k] = v;\n }\n } else {\n meta = await readBody(req);\n }\n\n const name = String(meta.name ?? file?.name ?? \"Ticket\").trim();\n if (!name) throw new HttpError(400, \"Le nom est obligatoire\");\n\n const fileName = file?.name || String(meta.fileName ?? \"\");\n const mimeType = file?.type ||\n String(meta.mimeType ?? \"application/octet-stream\");\n let data: Uint8Array | null = null;\n if (file) {\n if (file.size > MAX_STORAGE_BYTES) {\n throw new HttpError(\n 413,\n \"Fichier trop volumineux : quota de 1 Gio dépassé\",\n );\n }\n data = new Uint8Array(await file.arrayBuffer());\n }\n\n const ticket = await store.insertTicket({\n vaultId,\n name,\n brandId: meta.brandId ? String(meta.brandId) : null,\n tags: parseTags(meta.tags),\n color: String(meta.color ?? \"#c45c26\"),\n kind: data ? kindFromMime(mimeType, fileName) : \"other\",\n fileName: data ? fileName : \"\",\n mimeType,\n size: data ? data.byteLength : 0,\n notes: String(meta.notes ?? \"\"),\n amount: parseAmount(meta.amount),\n expiresAt: meta.expiresAt ? String(meta.expiresAt) : null,\n createdBy: user.id,\n });\n if (data && fileName) {\n await store.upsertFile(ticket.id, data, mimeType, fileName);\n }\n\n const full = await store.getTicket(vaultId, ticket.id);\n return json({ ticket: ticketPublic(full ?? ticket) }, 201);\n}\n\nasync function handlePatchTicket(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const body = await readBody(req);\n const patch: store.TicketPatch = {};\n if (body.name != null) patch.name = String(body.name).trim();\n if (body.brandId !== undefined) {\n patch.brandId = body.brandId\n ? String(body.brandId)\n : null;\n }\n if (body.tags != null) patch.tags = parseTags(body.tags);\n if (body.color != null) patch.color = String(body.color);\n if (body.notes != null) patch.notes = String(body.notes);\n if (body.amount !== undefined) patch.amount = parseAmount(body.amount);\n if (body.expiresAt !== undefined) {\n patch.expiresAt = body.expiresAt\n ? String(body.expiresAt)\n : null;\n }\n if (body.pinned != null) patch.pinned = Boolean(body.pinned);\n const updated = await store.updateTicket(id, patch);\n if (!updated) throw new HttpError(404, \"Ticket introuvable\");\n const full = await store.getTicket(vaultId, id);\n return json({ ticket: ticketPublic(full ?? updated) });\n}\n\nasync function handleDeleteTicket(\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n await store.deleteTicket(id); // le fichier est supprimé par cascade\n return json({ ok: true, id });\n}\n\nasync function handleFile(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n const row = await store.getFile(id);\n if (!row) throw new HttpError(404, \"Fichier absent\");\n const disposition = new URL(req.url).searchParams.get(\"download\") === \"1\"\n ? \"attachment\"\n : \"inline\";\n return new Response(row.data as unknown as BodyInit, {\n status: 200,\n headers: {\n \"content-type\": row.mime_type || ticket.mime_type ||\n \"application/octet-stream\",\n \"content-length\": String(row.data.byteLength),\n \"content-disposition\": `${disposition}; filename=\"${\n row.file_name.replaceAll('\"', \"\")\n }\"`,\n \"cache-control\": \"private, max-age=120\",\n },\n });\n}\n\nasync function handleUpload(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const ticket = await store.getTicket(vaultId, id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n const ct = req.headers.get(\"content-type\") ?? \"\";\n let file: File | null = null;\n if (ct.includes(\"multipart/form-data\")) {\n const form = await req.formData();\n const v = form.get(\"file\");\n if (v && typeof v !== \"string\") file = v;\n }\n if (!file) throw new HttpError(400, \"Fichier manquant (champ file)\");\n if (file.size > MAX_STORAGE_BYTES) {\n throw new HttpError(\n 413,\n \"Fichier trop volumineux : quota de 1 Gio dépassé\",\n );\n }\n const data = new Uint8Array(await file.arrayBuffer());\n await store.upsertFile(\n id,\n data,\n file.type || \"application/octet-stream\",\n file.name,\n );\n await store.updateTicketFileMeta(id, {\n fileName: file.name,\n mimeType: file.type || ticket.mime_type || \"application/octet-stream\",\n size: data.byteLength,\n kind: kindFromMime(file.type || \"\", file.name),\n });\n const patched = await store.getTicket(vaultId, id);\n return json({ ticket: ticketPublic(patched ?? ticket) });\n}\n\nasync function handleBrands(req: Request, vaultId: string): Promise {\n if (req.method === \"GET\") {\n return json({ brands: (await store.listBrands(vaultId)).map(brandPublic) });\n }\n if (req.method === \"POST\") {\n const body = await readBody(req);\n const name = String(body.name ?? \"\").trim();\n if (!name) throw new HttpError(400, \"Nom de marque obligatoire\");\n try {\n const brand = await store.insertBrand(\n vaultId,\n name,\n String(body.color ?? \"#c45c26\"),\n );\n return json({ brand: brandPublic(brand) }, 201);\n } catch (e) {\n if (store.isUniqueViolation(e)) {\n throw new HttpError(\n 409,\n \"Une marque porte déjà ce nom dans cet espace\",\n );\n }\n throw e;\n }\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleBrandItem(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const brand = (await store.listBrands(vaultId)).find((b) => b.id === id);\n if (!brand) throw new HttpError(404, \"Marque introuvable\");\n if (req.method === \"PATCH\") {\n const body = await readBody(req);\n const updated = await store.updateBrand(id, {\n name: body.name != null ? String(body.name).trim() : undefined,\n color: body.color != null ? String(body.color) : undefined,\n });\n return json({ brand: brandPublic(updated ?? brand) });\n }\n if (req.method === \"DELETE\") {\n await store.deleteBrand(id);\n return json({ ok: true });\n }\n throw new HttpError(405, \"Méthode non autorisée\");\n}\n\nasync function handleStats(vaultId: string): Promise {\n await store.purgeExpired(vaultId);\n return json({ stats: await store.computeStats(vaultId) });\n}\n\nasync function handlePurge(req: Request): Promise {\n const secret = env(\"CRON_SECRET\");\n const header = req.headers.get(\"authorization\") ?? \"\";\n const q = new URL(req.url).searchParams.get(\"secret\") ?? \"\";\n const bearer = header.replace(/^Bearer\\s+/i, \"\");\n let authed = Boolean(secret) && (bearer === secret || q === secret);\n if (!authed) {\n try {\n const user = await requireUser(req);\n void user; // un membre connecté peut aussi forcer la purge\n authed = true;\n } catch {\n throw new HttpError(401, \"CRON_SECRET ou session requis\");\n }\n }\n const purged = await store.purgeExpired(null);\n return json({ ok: true, purged });\n}\n\nasync function handleGetPreferences(\n req: Request,\n user: store.UserRow,\n): Promise {\n void req;\n return json({ preferences: await store.getPreferences(user.id) });\n}\n\nasync function handleSavePreferences(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const data = (body.preferences ?? body) as Record;\n if (typeof data !== \"object\" || data === null || Array.isArray(data)) {\n throw new HttpError(400, \"Préférences invalides\");\n }\n return json({ preferences: await store.savePreferences(user.id, data) });\n}\n\nconst RECURRENCES = [\"none\", \"daily\", \"weekly\", \"monthly\", \"yearly\"];\n\nfunction reminderPublic(r: store.ReminderRow) {\n return {\n id: r.id,\n title: r.title,\n notes: r.notes,\n kind: r.kind,\n dueAt: r.due_at ? new Date(r.due_at).toISOString() : null,\n done: r.done,\n ticketId: r.ticket_id,\n ticketName: r.ticket_name ?? null,\n brandId: r.brand_id,\n brandName: r.brand_name ?? null,\n tags: r.tags ?? [],\n recurrence: r.recurrence ?? \"none\",\n createdBy: r.created_by_name ?? \"Famille\",\n createdAt: new Date(r.created_at).toISOString(),\n completedAt: r.completed_at ? new Date(r.completed_at).toISOString() : null,\n lastCompletedAt: r.last_completed_at\n ? new Date(r.last_completed_at).toISOString()\n : null,\n };\n}\n\nasync function handleCreateReminder(\n req: Request,\n vaultId: string,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const title = String(body.title ?? \"\").trim();\n if (!title) throw new HttpError(400, \"Le titre du rappel est obligatoire\");\n const recurrence = RECURRENCES.includes(String(body.recurrence))\n ? String(body.recurrence)\n : \"none\";\n const reminder = await store.insertReminder({\n vaultId,\n createdBy: user.id,\n title,\n notes: String(body.notes ?? \"\"),\n kind: [\"create_ticket\", \"import\", \"custom\"].includes(String(body.kind))\n ? String(body.kind)\n : \"custom\",\n dueAt: body.dueAt ? String(body.dueAt) : null,\n ticketId: body.ticketId ? String(body.ticketId) : null,\n brandId: body.brandId ? String(body.brandId) : null,\n tags: parseTags(body.tags),\n recurrence,\n });\n const full = await store.getReminder(vaultId, reminder.id);\n return json({ reminder: reminderPublic(full ?? reminder) }, 201);\n}\n\nasync function handlePatchReminder(\n req: Request,\n vaultId: string,\n id: string,\n): Promise {\n const body = await readBody(req);\n const doneRequested = body.done != null ? Boolean(body.done) : undefined;\n\n // Rappel récurrent terminé : on reprogramme l'occurrence suivante au lieu de le clore.\n let reprogrammed: string | null = null;\n if (doneRequested === true) {\n const current = await store.getReminder(vaultId, id);\n if (current && current.recurrence && current.recurrence !== \"none\") {\n const base = current.due_at ? new Date(current.due_at) : new Date();\n const next = store.nextRecurrenceDate(\n base > new Date() ? base : new Date(),\n current.recurrence,\n );\n if (next) reprogrammed = next.toISOString();\n }\n }\n\n const updated = await store.updateReminder(id, {\n title: body.title != null ? String(body.title).trim() : undefined,\n notes: body.notes != null ? String(body.notes) : undefined,\n dueAt: reprogrammed\n ? reprogrammed\n : body.dueAt !== undefined\n ? (body.dueAt ? String(body.dueAt) : null)\n : undefined,\n done: reprogrammed ? undefined : doneRequested,\n completedNow: Boolean(reprogrammed),\n brandId: body.brandId !== undefined\n ? (body.brandId ? String(body.brandId) : null)\n : undefined,\n tags: body.tags != null ? parseTags(body.tags) : undefined,\n recurrence:\n body.recurrence != null && RECURRENCES.includes(String(body.recurrence))\n ? String(body.recurrence)\n : undefined,\n });\n if (!updated) throw new HttpError(404, \"Rappel introuvable\");\n const full = await store.getReminder(vaultId, id);\n return json({\n reminder: reminderPublic(full ?? updated),\n rescheduledTo: reprogrammed,\n });\n}\n\nasync function handleDeleteReminder(\n vaultId: string,\n id: string,\n): Promise {\n const reminder = await store.getReminder(vaultId, id);\n if (!reminder) throw new HttpError(404, \"Rappel introuvable\");\n await store.deleteReminder(id);\n return json({ ok: true, id });\n}\n\nasync function handleNotifyLog(\n req: Request,\n user: store.UserRow,\n): Promise {\n const body = await readBody(req);\n const type = String(body.type ?? \"\").trim();\n if (!type) throw new HttpError(400, \"Type de notification manquant\");\n const first = await store.logNotification(\n user.id,\n type,\n String(body.refId ?? \"\"),\n );\n return json({ first });\n}\n\n/* --------------------------------- routing -------------------------------- */\n\nfunction match(\n pathname: string,\n pattern: string,\n): Record | null {\n const a = pathname.split(\"/\").filter(Boolean);\n const b = pattern.split(\"/\").filter(Boolean);\n if (a.length !== b.length) return null;\n const params: Record = {};\n for (let i = 0; i < a.length; i++) {\n if (b[i].startsWith(\":\")) params[b[i].slice(1)] = decodeURIComponent(a[i]);\n else if (a[i] !== b[i]) return null;\n }\n return params;\n}\n\nasync function route(req: Request): Promise {\n await store.ensureSchema();\n const url = new URL(req.url);\n let path = url.pathname.replace(/^\\/v\\d+/, \"\");\n if (path.length > 1 && path.endsWith(\"/\")) path = path.slice(0, -1);\n\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204 });\n\n if (req.method === \"GET\" && (path === \"/\" || path === \"/health\")) {\n return json({\n name: \"E-Ticket API\",\n version: 2,\n ok: true,\n storage: \"postgres\",\n auth: \"accounts+vaults\",\n time: new Date().toISOString(),\n });\n }\n\n if (req.method === \"POST\" && path === \"/auth/signup\") {\n return await handleSignup(req);\n }\n\n if (\n req.method === \"POST\" &&\n (path === \"/oauth/token\" || path === \"/auth/login\" ||\n path === \"/auth/token\")\n ) {\n return await handleLogin(req);\n }\n\n if (\n path === \"/internal/purge\" &&\n (req.method === \"POST\" || req.method === \"GET\")\n ) {\n return await handlePurge(req);\n }\n\n const user = await requireUser(req);\n\n if (req.method === \"GET\" && path === \"/auth/me\") {\n return await handleMe(req, user);\n }\n if (req.method === \"POST\" && path === \"/auth/password\") {\n return await handlePasswordChange(req, user);\n }\n if (req.method === \"PATCH\" && path === \"/auth/me\") {\n return await handleNameChange(req, user);\n }\n if (req.method === \"GET\" && path === \"/auth/preferences\") {\n return await handleGetPreferences(req, user);\n }\n if (req.method === \"PUT\" && path === \"/auth/preferences\") {\n return await handleSavePreferences(req, user);\n }\n if (req.method === \"POST\" && path === \"/notify/log\") {\n return await handleNotifyLog(req, user);\n }\n\n if (req.method === \"POST\" && path === \"/vaults\") {\n return await handleCreateVault(req, user);\n }\n if (req.method === \"GET\" && path === \"/vaults\") {\n return json({\n vaults: (await store.listUserVaults(user.id)).map(vaultPublic),\n });\n }\n if (req.method === \"POST\" && path === \"/vaults/join\") {\n return await handleJoinVault(req, user);\n }\n\n let m = match(path, \"/vaults/:id/members\");\n if (m && req.method === \"GET\") return await handleMembers(req, user, m.id);\n\n m = match(path, \"/vaults/:id/members/me\");\n if (m && req.method === \"DELETE\") {\n return await handleLeaveVault(req, user, m.id);\n }\n\n m = match(path, \"/vaults/:id\");\n if (m && req.method === \"DELETE\") {\n return await handleDeleteVault(req, user, m.id);\n }\n\n // À partir d'ici, tout est relatif à un espace partagé.\n const { vault } = await requireVault(req, user);\n\n if (req.method === \"GET\" && path === \"/tickets\") {\n return await handleTicketsList(req, vault.id);\n }\n if (req.method === \"POST\" && path === \"/tickets\") {\n return await handleCreateTicket(req, vault.id, user);\n }\n\n if (req.method === \"GET\" && path === \"/stats\") {\n return await handleStats(vault.id);\n }\n\n if (req.method === \"GET\" && path === \"/reminders\") {\n const url = new URL(req.url);\n const includeDone = url.searchParams.get(\"done\") !== \"0\";\n return json({\n reminders: (await store.listReminders(vault.id, includeDone)).map(\n reminderPublic,\n ),\n });\n }\n if (req.method === \"POST\" && path === \"/reminders\") {\n return await handleCreateReminder(req, vault.id, user);\n }\n\n m = match(path, \"/reminders/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const reminder = await store.getReminder(vault.id, m.id);\n if (!reminder) throw new HttpError(404, \"Rappel introuvable\");\n return json({ reminder: reminderPublic(reminder) });\n }\n if (req.method === \"PATCH\") {\n return await handlePatchReminder(req, vault.id, m.id);\n }\n if (req.method === \"DELETE\") {\n return await handleDeleteReminder(vault.id, m.id);\n }\n }\n\n if (path === \"/brands\") return await handleBrands(req, vault.id);\n\n m = match(path, \"/tickets/:id\");\n if (m) {\n if (req.method === \"GET\") {\n const ticket = await store.getTicket(vault.id, m.id);\n if (!ticket) throw new HttpError(404, \"Ticket introuvable\");\n return json({ ticket: ticketPublic(ticket) });\n }\n if (req.method === \"PATCH\") {\n return await handlePatchTicket(req, vault.id, m.id);\n }\n if (req.method === \"DELETE\") {\n return await handleDeleteTicket(vault.id, m.id);\n }\n }\n\n m = match(path, \"/tickets/:id/file\");\n if (m && req.method === \"GET\") return await handleFile(req, vault.id, m.id);\n if (m && (req.method === \"POST\" || req.method === \"PUT\")) {\n return await handleUpload(req, vault.id, m.id);\n }\n\n m = match(path, \"/brands/:id\");\n if (m) return await handleBrandItem(req, vault.id, m.id);\n\n if (req.method === \"GET\" && path === \"/tags\") {\n return json({ tags: await store.listTags(vault.id) });\n }\n\n throw new HttpError(404, `Route inconnue : ${req.method} ${path}`);\n}\n\nexport default async function handler(req: Request): Promise {\n try {\n return withCors(req, await route(req));\n } catch (err) {\n if (err instanceof store.DbError) {\n return withCors(\n req,\n json({ error: err.message, status: err.status }, err.status),\n );\n }\n if (err instanceof postgres.PostgresError) {\n console.error(\"E-Ticket API [postgres]\", err.code, err.message);\n const status = err.code === \"23505\" ? 409 : 500;\n const message = err.code === \"23505\"\n ? \"Cette valeur existe déjà\"\n : \"Erreur de base de données\";\n return withCors(req, json({ error: message, status }, status));\n }\n const status = err instanceof HttpError ? err.status : 500;\n const message = err instanceof Error ? err.message : \"Erreur interne\";\n console.error(\"E-Ticket API\", status, message);\n return withCors(req, json({ error: message, status }, status));\n }\n}","createdAt",["D",1788018201883],"branchVersion","branchId","f409cc80-4dfe-4648-826c-5f94984b93a7","id","67d3ebca-0208-40ef-9e43-526d7a9d01a3","eticket",["D",1787751631620],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","7ed13655-83c2-4934-a981-01578302df33","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f99eb-d944-7332-99f8-2fbb8b1e7011","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",17,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mdevslabs","handle","displayName","mProjects","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/ec72623f-c02d-461a-9b1c-c2f416214400/square512?exp=1789531199&sig=25a96be94e4470f003a44a77c79fbb32c949df13a787265c2020603d023b67d8","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":178,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":179,"_80":180,"_82":181,"_84":25},"tree",[165,166,167],"files",[165,166,167],"counts",{"_153":62,"_154":155,"_156":62,"_157":158,"_159":160},"contents",[126,127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":144,"_32":145,"_30":146,"_132":-5,"_41":42,"_40":147,"_134":25,"_38":148,"_13":149,"_33":150,"_35":151,"_24":25,"_139":-5,"_27":152},{"_43":141,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_134":25,"_38":142,"_13":136,"_33":34,"_35":37,"_24":25,"_139":45,"_27":143},{"_43":129,"_32":130,"_30":131,"_132":-5,"_41":42,"_40":133,"_134":58,"_38":135,"_13":136,"_33":137,"_35":138,"_24":25,"_139":-5,"_27":140},"3f2cc61b-8cdd-4025-bd4e-9fb44ea489e1","purge.ts","60942de0-a154-11f1-94ff-1607ee4eb77e","parentId",8,"latest",["D",1787751953719],4,"interval","/**\n * E-Ticket — Cron val Val Town (optionnel)\n * -----------------------------------------------------------------------------\n * Crée un Val « Scheduled » qui tourne 1× / jour et colle ce fichier.\n * Il appelle le HTTP val pour supprimer les tickets dont la date d'expiration\n * est dépassée — même si personne n'ouvre l'application.\n *\n * Variables : API_BASE_URL (https://xxx.web.val.run) et CRON_SECRET.\n */\n\nexport default async function purgeExpiredTickets() {\n const base = (Deno.env.get(\"API_BASE_URL\") ?? \"\").replace(/\\/$/, \"\");\n const secret = Deno.env.get(\"CRON_SECRET\") ?? \"\";\n if (!base || !secret) {\n console.error(\"API_BASE_URL ou CRON_SECRET manquant\");\n return;\n }\n const res = await fetch(`${base}/internal/purge`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${secret}` },\n });\n const body = await res.text();\n console.log(\"purge\", res.status, body);\n}","label",[130],"e46368bd-eae3-4db0-90bf-73496cdc5e70",["D",1788018201883],[28],"9f28dac9-2ab6-4c22-9a6a-2c4b29b2c44b","db.ts","8705b56c-a16c-11f1-a39c-1607ee4eb77e",12,["D",1787762297021],2,"script","/**\n * E-Ticket v2 — accès Neon Postgres (driver postgres.js).\n * -----------------------------------------------------------------------------\n * Fonctionne sur Val Town (Deno) : `import postgres from \"npm:postgres\"`.\n * La chaîne de connexion vient de DATABASE_URL (Neon → Connection string,\n * de préférence l'endpoint « -pooler »).\n *\n * Le schéma est créé automatiquement au premier appel (DDL idempotent).\n * Il est aussi disponible sous forme SQL pure dans ./schema.sql.\n */\n\nimport postgres from \"npm:postgres\";\n\nlet client: postgres.Sql | null = null;\nlet schemaPromise: Promise | null = null;\n\n/** Erreur porteuse de statut HTTP, relancée en HttpError par main.ts. */\nexport class DbError extends Error {\n status: number;\n constructor(status: number, message: string) {\n super(message);\n this.status = status;\n }\n}\n\nfunction requiredEnv(name: string): string {\n const v = (Deno.env.get(name) ?? \"\").trim();\n if (!v) throw new DbError(500, `Variable manquante : ${name}`);\n return v;\n}\n\nexport function db(): postgres.Sql {\n if (client) return client;\n let url = requiredEnv(\"DATABASE_URL\");\n // Neon exige TLS : on force sslmode si absent de la chaîne.\n if (!/sslmode=/.test(url)) {\n url += (url.includes(\"?\") ? \"&\" : \"?\") + \"sslmode=require\";\n }\n client = postgres(url, {\n max: 5,\n idle_timeout: 20,\n connect_timeout: 10,\n prepare: false, // compatibilité poolers (Neon PgBouncer)\n onnotice: () => {},\n });\n return client;\n}\n\nexport async function ensureSchema(): Promise {\n schemaPromise ??= (async () => {\n const sql = db();\n await sql`\n create table if not exists users (\n id uuid primary key default gen_random_uuid(),\n email text not null unique,\n password_hash text not null,\n display_name text not null,\n created_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists vaults (\n id uuid primary key default gen_random_uuid(),\n name text not null,\n join_code_lookup text not null unique, -- sha256 du code (recherche rapide)\n join_code_hash text not null, -- pbkdf2 (vérification lente)\n created_by uuid not null references users(id) on delete cascade,\n created_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists memberships (\n user_id uuid not null references users(id) on delete cascade,\n vault_id uuid not null references vaults(id) on delete cascade,\n role text not null default 'member',\n joined_at timestamptz not null default now(),\n primary key (user_id, vault_id)\n )`;\n await sql`\n create table if not exists brands (\n id uuid primary key default gen_random_uuid(),\n vault_id uuid not null references vaults(id) on delete cascade,\n name text not null,\n color text not null default '#c45c26',\n created_at timestamptz not null default now(),\n unique (vault_id, name)\n )`;\n await sql`\n create table if not exists tickets (\n id uuid primary key default gen_random_uuid(),\n vault_id uuid not null references vaults(id) on delete cascade,\n name text not null,\n brand_id uuid references brands(id) on delete set null,\n tags text[] not null default '{}',\n color text not null default '#c45c26',\n kind text not null default 'other',\n file_name text not null default '',\n mime_type text not null default 'application/octet-stream',\n size bigint not null default 0,\n notes text not null default '',\n expires_at timestamptz,\n pinned boolean not null default false,\n created_by uuid references users(id) on delete set null,\n created_at timestamptz not null default now(),\n updated_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists files (\n ticket_id uuid primary key references tickets(id) on delete cascade,\n data bytea not null,\n mime_type text not null,\n file_name text not null,\n size bigint not null,\n uploaded_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists preferences (\n user_id uuid primary key references users(id) on delete cascade,\n data jsonb not null default '{}', -- theme, vue, tri, notifications, hors ligne par défaut…\n updated_at timestamptz not null default now()\n )`;\n await sql`\n create table if not exists reminders (\n id uuid primary key default gen_random_uuid(),\n vault_id uuid not null references vaults(id) on delete cascade,\n created_by uuid references users(id) on delete set null,\n title text not null,\n notes text not null default '',\n kind text not null default 'custom', -- 'create_ticket' | 'import' | 'custom'\n due_at timestamptz,\n done boolean not null default false,\n ticket_id uuid references tickets(id) on delete set null,\n created_at timestamptz not null default now(),\n completed_at timestamptz\n )`;\n await sql`\n create table if not exists notification_log (\n id uuid primary key default gen_random_uuid(),\n user_id uuid not null references users(id) on delete cascade,\n type text not null, -- 'offline' | 'reminder' | 'expiry' | 'custom'\n ref_id text not null default '', -- ticket / rappel concerné\n day date not null default current_date,\n created_at timestamptz not null default now(),\n unique (user_id, type, ref_id, day)\n )`;\n // v3 : montant dépensé par ticket (historique des dépenses)\n await sql`alter table tickets add column if not exists amount numeric not null default 0`;\n // v2.2 : récurrence, marque et tags sur les rappels (migration idempotente)\n await sql`alter table reminders add column if not exists brand_id uuid references brands(id) on delete set null`;\n await sql`alter table reminders add column if not exists tags text[] not null default '{}'`;\n await sql`alter table reminders add column if not exists recurrence text not null default 'none'`;\n await sql`alter table reminders add column if not exists last_completed_at timestamptz`;\n await sql`create index if not exists idx_tickets_vault on tickets (vault_id, created_at desc)`;\n await sql`create index if not exists idx_tickets_expiry on tickets (expires_at) where expires_at is not null`;\n await sql`create index if not exists idx_brands_vault on brands (vault_id)`;\n await sql`create index if not exists idx_memberships_vault on memberships (vault_id)`;\n await sql`create index if not exists idx_reminders_vault on reminders (vault_id, due_at)`;\n await sql`create index if not exists idx_reminders_due on reminders (due_at) where done = false`;\n })();\n try {\n await schemaPromise;\n } catch (e) {\n schemaPromise = null; // permettre un nouvel essai au prochain appel\n throw e;\n }\n}\n\n/** Numéro d'erreur PostgreSQL : 23505 = violation d'unicité. */\nexport function isUniqueViolation(e: unknown): boolean {\n return typeof e === \"object\" && e !== null && \"code\" in e &&\n (e as { code?: string }).code === \"23505\";\n}\n\n/* ---------------------------------- users --------------------------------- */\n\nexport interface UserRow {\n id: string;\n email: string;\n password_hash: string;\n display_name: string;\n created_at: Date;\n}\n\nexport async function getUserByEmail(email: string): Promise {\n const rows =\n (await db()`select * from users where email = ${email.trim().toLowerCase()} limit 1`) as UserRow[];\n return rows[0] ?? null;\n}\n\nexport async function getUserById(id: string): Promise {\n const rows =\n (await db()`select * from users where id = ${id} limit 1`) as UserRow[];\n return rows[0] ?? null;\n}\n\nexport async function insertUser(\n email: string,\n passwordHash: string,\n displayName: string,\n): Promise {\n const rows = (await db()`\n insert into users (email, password_hash, display_name)\n values (${email.trim().toLowerCase()}, ${passwordHash}, ${displayName})\n returning *`) as UserRow[];\n return rows[0];\n}\n\nexport async function updateUserPassword(\n id: string,\n passwordHash: string,\n): Promise {\n await db()`update users set password_hash = ${passwordHash} where id = ${id}`;\n}\n\nexport async function updateUserDisplayName(\n id: string,\n displayName: string,\n): Promise {\n await db()`update users set display_name = ${displayName} where id = ${id}`;\n}\n\n/* ---------------------------------- vaults -------------------------------- */\n\nexport interface VaultRow {\n id: string;\n name: string;\n join_code_lookup: string;\n join_code_hash: string;\n created_by: string;\n created_at: Date;\n}\n\nexport async function insertVault(\n name: string,\n codeLookup: string,\n codeHash: string,\n createdBy: string,\n): Promise {\n return (await db().begin(async (tx) => {\n const v = (await tx`\n insert into vaults (name, join_code_lookup, join_code_hash, created_by)\n values (${name}, ${codeLookup}, ${codeHash}, ${createdBy})\n returning *`) as VaultRow[];\n await tx`insert into memberships (user_id, vault_id, role) values (${createdBy}, ${\n v[0].id\n }, 'owner')`;\n return v[0];\n })) as VaultRow;\n}\n\nexport async function getVault(id: string): Promise {\n const rows =\n (await db()`select * from vaults where id = ${id} limit 1`) as VaultRow[];\n return rows[0] ?? null;\n}\n\nexport async function getVaultByCodeLookup(\n lookup: string,\n): Promise {\n const rows =\n (await db()`select * from vaults where join_code_lookup = ${lookup} limit 1`) as VaultRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteVault(id: string): Promise {\n await db()`delete from vaults where id = ${id}`;\n}\n\nexport interface VaultSummary {\n id: string;\n name: string;\n role: \"owner\" | \"member\";\n members: number;\n tickets: number;\n createdAt: string;\n}\n\ninterface VaultListRow {\n id: string;\n name: string;\n role: string;\n members: number;\n tickets: number;\n created_at: Date;\n}\n\ninterface MemberRow {\n id: string;\n email: string;\n display_name: string;\n role: string;\n joined_at: Date;\n}\n\nexport async function listUserVaults(userId: string): Promise {\n const rows = await db()`\n select v.id, v.name, v.created_at, m.role,\n (select count(*) from memberships m2 where m2.vault_id = v.id)::int as members,\n (select count(*) from tickets t where t.vault_id = v.id)::int as tickets\n from vaults v\n join memberships m on m.vault_id = v.id and m.user_id = ${userId}\n order by v.created_at asc`;\n return (rows as unknown as VaultListRow[]).map((r) => ({\n id: r.id,\n name: r.name,\n role: r.role === \"owner\" ? \"owner\" : \"member\",\n members: Number(r.members),\n tickets: Number(r.tickets),\n createdAt: new Date(r.created_at).toISOString(),\n }));\n}\n\nexport interface MemberSummary {\n id: string;\n email: string;\n displayName: string;\n role: \"owner\" | \"member\";\n joinedAt: string;\n}\n\nexport async function listMembers(vaultId: string): Promise {\n const rows = await db()`\n select u.id, u.email, u.display_name, m.role, m.joined_at\n from memberships m\n join users u on u.id = m.user_id\n where m.vault_id = ${vaultId}\n order by m.joined_at asc`;\n return (rows as unknown as MemberRow[]).map((r) => ({\n id: r.id,\n email: r.email,\n displayName: r.display_name,\n role: r.role === \"owner\" ? \"owner\" : \"member\",\n joinedAt: new Date(r.joined_at).toISOString(),\n }));\n}\n\nexport async function getMembership(\n userId: string,\n vaultId: string,\n): Promise<{ role: string } | null> {\n const rows =\n (await db()`select role from memberships where user_id = ${userId} and vault_id = ${vaultId} limit 1`) as {\n role: string;\n }[];\n return rows[0] ?? null;\n}\n\nexport async function insertMembership(\n userId: string,\n vaultId: string,\n): Promise {\n await db()`insert into memberships (user_id, vault_id) values (${userId}, ${vaultId}) on conflict do nothing`;\n}\n\nexport async function deleteMembership(\n userId: string,\n vaultId: string,\n): Promise {\n await db()`delete from memberships where user_id = ${userId} and vault_id = ${vaultId}`;\n}\n\n/* ---------------------------------- brands -------------------------------- */\n\nexport interface BrandRow {\n id: string;\n vault_id: string;\n name: string;\n color: string;\n created_at: Date;\n}\n\nexport async function listBrands(vaultId: string): Promise {\n return (await db()`select * from brands where vault_id = ${vaultId} order by name asc`) as BrandRow[];\n}\n\nexport async function insertBrand(\n vaultId: string,\n name: string,\n color: string,\n): Promise {\n const rows = (await db()`\n insert into brands (vault_id, name, color) values (${vaultId}, ${name}, ${color}) returning *`) as BrandRow[];\n return rows[0];\n}\n\nexport async function updateBrand(\n id: string,\n body: { name?: string; color?: string },\n): Promise {\n const sets: string[] = [];\n const params: unknown[] = [];\n if (body.name !== undefined) {\n params.push(body.name);\n sets.push(`name = $${params.length}`);\n }\n if (body.color !== undefined) {\n params.push(body.color);\n sets.push(`color = $${params.length}`);\n }\n if (!sets.length) return null;\n params.push(id);\n const rows = (await db().unsafe(\n `update brands set ${\n sets.join(\", \")\n } where id = $${params.length} returning *`,\n params as never[],\n )) as BrandRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteBrand(id: string): Promise {\n await db()`delete from brands where id = ${id}`;\n}\n\n/* ---------------------------------- tickets ------------------------------- */\n\nexport interface TicketRow {\n id: string;\n vault_id: string;\n name: string;\n brand_id: string | null;\n tags: string[];\n color: string;\n kind: string;\n file_name: string;\n mime_type: string;\n size: string | number;\n notes: string;\n amount: string | number;\n expires_at: Date | null;\n pinned: boolean;\n created_by: string | null;\n created_at: Date;\n updated_at: Date;\n brand_name?: string | null;\n created_by_name?: string | null;\n}\n\nexport async function listTickets(\n vaultId: string,\n q = \"\",\n): Promise {\n const sql = db();\n const needle = `%${q.trim()}%`;\n const search = q.trim()\n ? sql` and (\n t.name ilike ${needle}\n or t.notes ilike ${needle}\n or t.file_name ilike ${needle}\n or b.name ilike ${needle}\n or u.display_name ilike ${needle}\n or exists (select 1 from unnest(t.tags) tag where tag ilike ${needle})\n )`\n : sql``;\n return (await sql`\n select t.*, b.name as brand_name, u.display_name as created_by_name\n from tickets t\n left join brands b on b.id = t.brand_id\n left join users u on u.id = t.created_by\n where t.vault_id = ${vaultId} ${search}\n order by t.pinned desc, t.created_at desc`) as TicketRow[];\n}\n\nexport async function getTicket(\n vaultId: string,\n id: string,\n): Promise {\n const rows = (await db()`\n select t.*, b.name as brand_name, u.display_name as created_by_name\n from tickets t\n left join brands b on b.id = t.brand_id\n left join users u on u.id = t.created_by\n where t.vault_id = ${vaultId} and t.id = ${id}\n limit 1`) as TicketRow[];\n return rows[0] ?? null;\n}\n\nexport interface NewTicket {\n vaultId: string;\n name: string;\n brandId: string | null;\n tags: string[];\n color: string;\n kind: string;\n fileName: string;\n mimeType: string;\n size: number;\n notes: string;\n amount: number;\n expiresAt: string | null;\n createdBy: string;\n}\n\nexport async function insertTicket(t: NewTicket): Promise {\n const rows = (await db()`\n insert into tickets (vault_id, name, brand_id, tags, color, kind, file_name, mime_type, size, notes, amount, expires_at, created_by)\n values (${t.vaultId}, ${t.name}, ${t.brandId}, ${t.tags}, ${t.color}, ${t.kind}, ${t.fileName}, ${t.mimeType},\n ${t.size}, ${t.notes}, ${t.amount}, ${t.expiresAt}, ${t.createdBy})\n returning *`) as TicketRow[];\n return rows[0];\n}\n\nexport interface TicketPatch {\n name?: string;\n brandId?: string | null;\n tags?: string[];\n color?: string;\n notes?: string;\n amount?: number;\n expiresAt?: string | null;\n pinned?: boolean;\n}\n\nexport async function updateTicket(\n id: string,\n body: TicketPatch,\n): Promise {\n const sets: string[] = [];\n const params: unknown[] = [];\n if (body.name !== undefined) {\n params.push(body.name);\n sets.push(`name = $${params.length}`);\n }\n if (body.brandId !== undefined) {\n params.push(body.brandId);\n sets.push(`brand_id = $${params.length}::uuid`);\n }\n if (body.tags !== undefined) {\n params.push(body.tags);\n sets.push(`tags = $${params.length}::text[]`);\n }\n if (body.color !== undefined) {\n params.push(body.color);\n sets.push(`color = $${params.length}`);\n }\n if (body.notes !== undefined) {\n params.push(body.notes);\n sets.push(`notes = $${params.length}`);\n }\n if (body.amount !== undefined) {\n params.push(body.amount);\n sets.push(`amount = $${params.length}::numeric`);\n }\n if (body.expiresAt !== undefined) {\n params.push(body.expiresAt);\n sets.push(`expires_at = $${params.length}::timestamptz`);\n }\n if (body.pinned !== undefined) {\n params.push(body.pinned);\n sets.push(`pinned = $${params.length}::boolean`);\n }\n sets.push(\"updated_at = now()\");\n params.push(id);\n const rows = (await db().unsafe(\n `update tickets set ${\n sets.join(\", \")\n } where id = $${params.length}::uuid returning *`,\n params as never[],\n )) as TicketRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteTicket(id: string): Promise {\n await db()`delete from tickets where id = ${id}`;\n}\n\n/** Métadonnées à mettre à jour quand le fichier d'un ticket est remplacé. */\nexport async function updateTicketFileMeta(\n id: string,\n meta: { fileName: string; mimeType: string; size: number; kind: string },\n): Promise {\n await db()`\n update tickets\n set file_name = ${meta.fileName}, mime_type = ${meta.mimeType}, size = ${meta.size},\n kind = ${meta.kind}, updated_at = now()\n where id = ${id}`.then(() => undefined);\n}\n\n/** Supprime les tickets expirés (d'un espace ou de tous) — les fichiers suivent par cascade. */\nexport async function purgeExpired(\n vaultId: string | null = null,\n): Promise {\n const rows = vaultId\n ? await db()`delete from tickets where vault_id = ${vaultId} and expires_at is not null and expires_at < now() returning id`\n : await db()`delete from tickets where expires_at is not null and expires_at < now() returning id`;\n return rows.length;\n}\n\n/* ---------------------------------- files --------------------------------- */\n\nexport interface FileRow {\n ticket_id: string;\n data: Uint8Array;\n mime_type: string;\n file_name: string;\n size: string | number;\n}\n\nexport async function upsertFile(\n ticketId: string,\n data: Uint8Array,\n mimeType: string,\n fileName: string,\n): Promise {\n await db()`\n insert into files (ticket_id, data, mime_type, file_name, size)\n values (${ticketId}, ${data}, ${mimeType}, ${fileName}, ${data.byteLength})\n on conflict (ticket_id) do update\n set data = excluded.data, mime_type = excluded.mime_type, file_name = excluded.file_name,\n size = excluded.size, uploaded_at = now()`;\n}\n\nexport async function getFile(ticketId: string): Promise {\n const rows =\n (await db()`select * from files where ticket_id = ${ticketId} limit 1`) as FileRow[];\n return rows[0] ?? null;\n}\n\n/* ------------------------------ préférences ------------------------------- */\n\nfunction parseJsonb(value: unknown): Record {\n if (typeof value === \"string\") {\n try {\n return JSON.parse(value) as Record;\n } catch {\n return {};\n }\n }\n return (value as Record) ?? {};\n}\n\nexport async function getPreferences(\n userId: string,\n): Promise> {\n const rows =\n (await db()`select data from preferences where user_id = ${userId} limit 1`) as unknown as {\n data: unknown;\n }[];\n return rows[0] ? parseJsonb(rows[0].data) : {};\n}\n\nexport async function savePreferences(\n userId: string,\n data: Record,\n): Promise> {\n const rows = (await db()`\n insert into preferences (user_id, data, updated_at)\n values (${userId}, ${JSON.stringify(data)}, now())\n on conflict (user_id) do update\n set data = ${JSON.stringify(data)}, updated_at = now()\n returning data`) as unknown as { data: unknown }[];\n return rows[0] ? parseJsonb(rows[0].data) : data;\n}\n\n/* -------------------------------- rappels --------------------------------- */\n\nexport interface ReminderRow {\n id: string;\n vault_id: string;\n created_by: string | null;\n title: string;\n notes: string;\n kind: string;\n due_at: Date | null;\n done: boolean;\n ticket_id: string | null;\n brand_id: string | null;\n tags: string[];\n recurrence: string; // 'none' | 'daily' | 'weekly' | 'monthly' | 'yearly'\n created_at: Date;\n completed_at: Date | null;\n last_completed_at: Date | null;\n created_by_name?: string | null;\n ticket_name?: string | null;\n brand_name?: string | null;\n}\n\nexport async function listReminders(\n vaultId: string,\n includeDone = true,\n): Promise {\n const sql = db();\n const filter = includeDone ? sql`` : sql` where r.done = false`;\n return (await sql`\n select r.*, u.display_name as created_by_name, t.name as ticket_name, b.name as brand_name\n from reminders r\n left join users u on u.id = r.created_by\n left join tickets t on t.id = r.ticket_id\n left join brands b on b.id = r.brand_id\n ${filter}\n order by r.done asc, r.due_at asc nulls last, r.created_at desc`) as unknown as ReminderRow[];\n}\n\nexport async function getReminder(\n vaultId: string,\n id: string,\n): Promise {\n const rows = (await db()`\n select r.*, u.display_name as created_by_name, t.name as ticket_name, b.name as brand_name\n from reminders r\n left join users u on u.id = r.created_by\n left join tickets t on t.id = r.ticket_id\n left join brands b on b.id = r.brand_id\n where r.vault_id = ${vaultId} and r.id = ${id}\n limit 1`) as unknown as ReminderRow[];\n return rows[0] ?? null;\n}\n\n/** Date de la prochaine occurrence pour un rappel récurrent. */\nexport function nextRecurrenceDate(\n from: Date,\n recurrence: string,\n): Date | null {\n const d = new Date(from);\n switch (recurrence) {\n case \"daily\":\n d.setDate(d.getDate() + 1);\n return d;\n case \"weekly\":\n d.setDate(d.getDate() + 7);\n return d;\n case \"monthly\":\n d.setMonth(d.getMonth() + 1);\n return d;\n case \"yearly\":\n d.setFullYear(d.getFullYear() + 1);\n return d;\n default:\n return null;\n }\n}\n\nexport interface NewReminder {\n vaultId: string;\n createdBy: string;\n title: string;\n notes: string;\n kind: string;\n dueAt: string | null;\n ticketId: string | null;\n brandId: string | null;\n tags: string[];\n recurrence: string;\n}\n\nexport async function insertReminder(r: NewReminder): Promise {\n const rows = (await db()`\n insert into reminders (vault_id, created_by, title, notes, kind, due_at, ticket_id, brand_id, tags, recurrence)\n values (${r.vaultId}, ${r.createdBy}, ${r.title}, ${r.notes}, ${r.kind}, ${r.dueAt}, ${r.ticketId},\n ${r.brandId}, ${r.tags}, ${r.recurrence})\n returning *`) as unknown as ReminderRow[];\n return rows[0];\n}\n\nexport interface ReminderPatch {\n title?: string;\n notes?: string;\n dueAt?: string | null;\n done?: boolean;\n brandId?: string | null;\n tags?: string[];\n recurrence?: string;\n /** Marque l'occurrence comme traitée (rappel récurrent replanifié). */\n completedNow?: boolean;\n}\n\nexport async function updateReminder(\n id: string,\n body: ReminderPatch,\n): Promise {\n const sets: string[] = [];\n const params: unknown[] = [];\n if (body.title !== undefined) {\n params.push(body.title);\n sets.push(`title = $${params.length}`);\n }\n if (body.notes !== undefined) {\n params.push(body.notes);\n sets.push(`notes = $${params.length}`);\n }\n if (body.dueAt !== undefined) {\n params.push(body.dueAt);\n sets.push(`due_at = $${params.length}::timestamptz`);\n }\n if (body.brandId !== undefined) {\n params.push(body.brandId);\n sets.push(`brand_id = $${params.length}::uuid`);\n }\n if (body.tags !== undefined) {\n params.push(body.tags);\n sets.push(`tags = $${params.length}::text[]`);\n }\n if (body.recurrence !== undefined) {\n params.push(body.recurrence);\n sets.push(`recurrence = $${params.length}`);\n }\n if (body.done !== undefined) {\n params.push(body.done);\n sets.push(`done = $${params.length}::boolean`);\n if (body.done) {\n sets.push(\"completed_at = now(), last_completed_at = now()\");\n } else {\n sets.push(\"completed_at = null\");\n }\n }\n if (body.completedNow) {\n sets.push(\"completed_at = now(), last_completed_at = now()\");\n }\n if (!sets.length) return null;\n params.push(id);\n const rows = (await db().unsafe(\n `update reminders set ${\n sets.join(\", \")\n } where id = $${params.length}::uuid returning *`,\n params as never[],\n )) as unknown as ReminderRow[];\n return rows[0] ?? null;\n}\n\nexport async function deleteReminder(id: string): Promise {\n await db()`delete from reminders where id = ${id}`;\n}\n\n/* --------------------------- journal de notifications --------------------- */\n\n/** Enregistre « notification déjà envoyée aujourd'hui » ; renvoie true si c'est la 1re fois. */\nexport async function logNotification(\n userId: string,\n type: string,\n refId: string,\n): Promise {\n const rows = (await db()`\n insert into notification_log (user_id, type, ref_id, day)\n values (${userId}, ${type}, ${refId}, current_date)\n on conflict (user_id, type, ref_id, day) do nothing\n returning id`) as unknown as { id: string }[];\n return rows.length > 0;\n}\n\n/* ---------------------------------- stats --------------------------------- */\n\nexport interface StatsRow {\n tickets: number;\n brands: number;\n tags: number;\n expiringSoon: number;\n withExpiry: number;\n pdfs: number;\n images: number;\n bytes: number;\n /** Total dépensé (somme des montants renseignés) et nombre de dépenses. */\n spent: number;\n expenses: number;\n byBrand: Record;\n byTag: Record;\n}\n\nexport async function computeStats(vaultId: string): Promise {\n const sql = db();\n const totals = await sql`\n select\n count(*)::int as tickets,\n count(*) filter (where kind = 'pdf')::int as pdfs,\n count(*) filter (where kind = 'image')::int as images,\n coalesce(sum(size), 0)::bigint as bytes,\n count(*) filter (where expires_at is not null)::int as with_expiry,\n count(*) filter (where expires_at >= now() and expires_at < now() + interval '7 days')::int as expiring_soon,\n coalesce(sum(amount), 0)::float8 as spent,\n count(*) filter (where amount > 0)::int as expenses\n from tickets where vault_id = ${vaultId}`;\n const brandCount =\n await sql`select count(*)::int as n from brands where vault_id = ${vaultId}`;\n const byBrand = await sql`\n select coalesce(b.name, 'Sans marque') as label, count(*)::int as n\n from tickets t left join brands b on b.id = t.brand_id\n where t.vault_id = ${vaultId}\n group by 1 order by n desc`;\n const byTag = await sql`\n select tag, count(*)::int as n\n from tickets t, unnest(t.tags) as tag\n where t.vault_id = ${vaultId}\n group by 1 order by n desc`;\n const t = totals[0];\n return {\n tickets: t.tickets,\n brands: brandCount[0].n,\n tags: byTag.length,\n expiringSoon: t.expiring_soon,\n withExpiry: t.with_expiry,\n pdfs: t.pdfs,\n images: t.images,\n bytes: Number(t.bytes),\n spent: Number(t.spent),\n expenses: t.expenses,\n byBrand: Object.fromEntries(byBrand.map((r) => [r.label, r.n])),\n byTag: Object.fromEntries(byTag.map((r) => [r.tag, r.n])),\n };\n}\n\nexport async function listTags(vaultId: string): Promise {\n const rows = await db()`\n select distinct tag from tickets t, unnest(t.tags) as tag\n where t.vault_id = ${vaultId} order by tag asc`;\n return (rows as unknown as { tag: string }[]).map((r) => r.tag);\n}",[145],"pulls","branches",1,"forks","envVars",{"_161":163,"_164":62},"connections",{"_161":62,"_162":62},"count","unfilledCount",29,"emptyCount",{"_43":144,"_32":145,"_30":146,"_132":-5,"_41":42,"_40":147,"_134":25,"_38":175,"_13":149,"_33":150,"_35":151,"_24":25,"_139":-5,"_169":176,"_27":177},{"_43":141,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_134":25,"_38":172,"_13":136,"_33":34,"_35":37,"_24":25,"_139":45,"_169":173,"_27":174},{"_43":129,"_32":130,"_30":131,"_132":-5,"_41":42,"_40":133,"_134":58,"_38":168,"_13":136,"_33":137,"_35":138,"_24":25,"_139":-5,"_169":170,"_27":171},["D",1787751953719],"children",[],[130],["D",1788018201883],[],[28],["D",1787762297021],[],[145],["D",1787751631620],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_123":215,"_216":217,"_218":219,"_220":25,"_221":25,"_222":25,"_223":58,"_224":-5,"_225":-7,"_226":-7,"_227":62,"_228":25,"_229":25,"_230":-5,"_231":25,"_232":25,"_233":25,"_234":-5},"ENV",{"_186":187,"_188":189,"_190":86,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v13