fix(front,db,ci): déploiement web, API même origine, Flutter 3.29, schéma validations

Frontend (prod web):
- Image builder Flutter 3.29.3 (Dockerfile + workflow CI alignés)
- web/index.html: bootstrap Flutter 3.29 (flutter_bootstrap.js), scripts pdf.js conservés
- Dockerfile: rm html avant COPY pour éviter l’index « Welcome to nginx »
- nginx: server_name _ pour Traefik
- env: sur le web, API = Uri.base.origin si pas de API_BASE_URL (évite mixed content http/https)
- auth: message d’erreur réseau avec type/détail si non-Exception
- CGU/PDF: commentaire sans mention Flutter 3.19 obsolète
- pubspec.lock: résolution dépendances Flutter 3.29

Base de données & doc:
- BDD.sql: validations.commentaire, valide_par, FK ON DELETE SET NULL + commentaire
- patch 2026-04-17: valide_par avec ON DELETE SET NULL
- patch 2026-04-18: FK validations en SET NULL sur bases existantes
- seed: statut validation « valide » (enum)
- FK_POLICIES.md: valide_par
- doc workflow: Flutter 3.29.3

Made-with: Cursor

database/BDD.sql

@@ -269,13 +269,17 @@ CREATE TABLE notifications (
 -- ==========================================================
 -- Table : validations
 -- ==========================================================
+-- Historique des décisions (validation / refus / suspension de compte).
+-- Colonnes commentaire + valide_par : requises par l’API Nest (TypeORM).
+-- FK en ON DELETE SET NULL : conserver la ligne si l’utilisateur référencé
+-- est supprimé (voir database/docs/FK_POLICIES.md).
 CREATE TABLE validations (
     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    id_utilisateur UUID REFERENCES utilisateurs(id),
+    id_utilisateur UUID REFERENCES utilisateurs(id) ON DELETE SET NULL,
     type VARCHAR(50),
     statut statut_validation_type DEFAULT 'en_attente',
     commentaire TEXT,
-    valide_par UUID REFERENCES utilisateurs(id),
+    valide_par UUID REFERENCES utilisateurs(id) ON DELETE SET NULL,
     cree_le TIMESTAMPTZ DEFAULT now(),
     modifie_le TIMESTAMPTZ DEFAULT now()
 );

database/docs/FK_POLICIES.md

@@ -47,6 +47,7 @@ Documenter, de façon unique et partagée, les règles de suppression/mise à jo
 | **uploads(id_utilisateur)** → `utilisateurs(id)` | **SET NULL** | Fichier reste référencé sans l’auteur |
 | **notifications(id_utilisateur)** → `utilisateurs(id)` | **CASCADE** | Notifications propres à l’utilisateur |
 | **validations(id_utilisateur)** → `utilisateurs(id)` | **SET NULL** | Garder l’historique de décision |
+| **validations(valide_par)** → `utilisateurs(id)` | **SET NULL** | Décideur supprimé : la ligne reste |
 
 > **ON UPDATE** : **NO ACTION** partout (les UUID ne changent pas).
 
@@ -84,7 +85,8 @@ Documenter, de façon unique et partagée, les règles de suppression/mise à jo
 - `signalements_bugs.id_utilisateur` → **SET NULL**  
 - `uploads.id_utilisateur` → **SET NULL**  
 - `notifications.id_utilisateur` → **CASCADE**  
-- `validations.id_utilisateur` → **SET NULL**
+- `validations.id_utilisateur` → **SET NULL**  
+- `validations.valide_par` → **SET NULL**
 
 ---
 

database/patches/2026-04-17-validations-commentaire-valide-par.sql

@@ -5,4 +5,4 @@ ALTER TABLE validations
   ADD COLUMN IF NOT EXISTS commentaire TEXT;
 
 ALTER TABLE validations
-  ADD COLUMN IF NOT EXISTS valide_par UUID REFERENCES utilisateurs(id);
+  ADD COLUMN IF NOT EXISTS valide_par UUID REFERENCES utilisateurs(id) ON DELETE SET NULL;

database/patches/2026-04-18-validations-fk-on-delete-set-null.sql

@@ -0,0 +1,13 @@
+-- Alignement FK validations ↔ BDD.sql / FK_POLICIES (ON DELETE SET NULL).
+-- À exécuter sur les bases créées avant la mise à jour du 2026-04-18.
+-- Noms de contraintes par défaut PostgreSQL : {table}_{colonne}_fkey.
+
+ALTER TABLE validations DROP CONSTRAINT IF EXISTS validations_id_utilisateur_fkey;
+ALTER TABLE validations
+  ADD CONSTRAINT validations_id_utilisateur_fkey
+  FOREIGN KEY (id_utilisateur) REFERENCES utilisateurs(id) ON DELETE SET NULL;
+
+ALTER TABLE validations DROP CONSTRAINT IF EXISTS validations_valide_par_fkey;
+ALTER TABLE validations
+  ADD CONSTRAINT validations_valide_par_fkey
+  FOREIGN KEY (valide_par) REFERENCES utilisateurs(id) ON DELETE SET NULL;

database/patches/README.md

@@ -5,5 +5,6 @@ Scripts à appliquer **manuellement** sur les bases déjà créées (ex. `psql`
 | Fichier | Objet |
 |---------|--------|
 | `2026-04-17-validations-commentaire-valide-par.sql` | Ajoute `commentaire` et `valide_par` sur `validations` (requis par l’API / TypeORM). |
+| `2026-04-18-validations-fk-on-delete-set-null.sql` | Passe les FK `id_utilisateur` et `valide_par` en **ON DELETE SET NULL** (comme `BDD.sql` à jour). |
 
-Les nouvelles installs via `BDD.sql` à jour incluent déjà ces colonnes.
+Les nouvelles installs via `BDD.sql` à jour incluent déjà ces colonnes et ces politiques de suppression.

database/seed/02_seed.sql

@@ -212,7 +212,7 @@ INSERT INTO validations (id, id_utilisateur, statut, commentaire, cree_le)
 VALUES (
   'v0000000-0000-0000-0000-000000000001',
   '66666666-6666-6666-6666-666666666666',
-  'accepte',
+  'valide',
   'Dossier AM vérifié par gestionnaire.',
   NOW()
 )

docs/20_WORKFLOW-CREATION-COMPTE.md

@@ -1528,7 +1528,7 @@ sequenceDiagram
 
 ### Architecture Frontend
 
-**Framework** : Flutter 3.19.0  
+**Framework** : Flutter 3.29.3  
 **Langage** : Dart 3.x  
 **State Management** : Provider / Riverpod  
 **HTTP Client** : Dio / http  

frontend/.github/workflows/flutter-check.yml

@@ -18,7 +18,7 @@ jobs:
       - name: 💡 Set up Flutter
         uses: subosito/flutter-action@v2
         with:
-          flutter-version: '3.19.0'  # ou celle que tu utilises
+          flutter-version: '3.29.3'
           channel: stable
 
       - name: 📦 Install dependencies

frontend/Dockerfile

@@ -1,5 +1,5 @@
 # Stage builder
-FROM ghcr.io/cirruslabs/flutter:3.19.0 AS builder
+FROM ghcr.io/cirruslabs/flutter:3.29.3 AS builder
 WORKDIR /app
 COPY pubspec.* ./
 RUN flutter pub get
@@ -8,6 +8,10 @@ RUN flutter build web --release
 
 # Stage production
 FROM nginx:alpine
+# Image nginx:alpine contient déjà index.html « Welcome to nginx ».
+# Un merge de dossiers sans nettoyage peut laisser ce fichier si le build
+# Flutter n’écrase pas tous les fichiers → SPA invisible. On vide d’abord.
+RUN rm -rf /usr/share/nginx/html/*
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=builder /app/build/web /usr/share/nginx/html
 

frontend/lib/config/env.dart

@@ -1,14 +1,24 @@
+import 'package:flutter/foundation.dart' show kIsWeb;
+
 class Env {
-  // Base URL de l'API, surchargeable à la compilation via --dart-define=API_BASE_URL
+  /// Base URL de l’API (sans `/api/v1`).
-  static const String apiBaseUrl = String.fromEnvironment(
+  ///
-    'API_BASE_URL',
+  /// - **Web prod** : par défaut on utilise [Uri.base.origin] (même schéma + hôte que la page),
-    defaultValue: 'https://app.ptits-pas.fr',
+  ///   ce qui évite les blocages « mixed content » (ex. page en `http://` vs API en `https://`)
-  );
+  ///   et les builds où `--dart-define=API_BASE_URL` ne serait pas passé.
+  /// - **Web dev** : surcharger avec `--dart-define=API_BASE_URL=http://localhost:3000` (ou l’URL du back).
+  /// - **Mobile** : défaut `https://app.ptits-pas.fr` ou `API_BASE_URL` en `--dart-define`.
+  static String get apiBaseUrl {
+    const fromEnv = String.fromEnvironment('API_BASE_URL');
+    if (fromEnv.isNotEmpty) {
+      return fromEnv;
+    }
+    if (kIsWeb) {
+      return Uri.base.origin;
+    }
+    return 'https://app.ptits-pas.fr';
+  }
 
-  // Construit une URL vers l'API v1 à partir d'un chemin (commençant par '/')
+  /// Construit une URL vers l'API v1 à partir d'un chemin (commençant par '/')
-  static String apiV1(String path) => '$apiBaseUrl/api/v1$path';
+  static String apiV1(String path) => '${apiBaseUrl}/api/v1$path';
 }
-
-
-
-

frontend/lib/services/auth_service.dart

@@ -69,7 +69,10 @@ class AuthService {
       }
     } catch (e) {
       if (e is Exception) rethrow;
-      throw Exception('Erreur réseau: impossible de se connecter au serveur');
+      // Erreurs non-Exception (ex. certains cas côté web) : afficher le détail pour le diagnostic
+      throw Exception(
+        'Erreur réseau: impossible de se connecter au serveur (${e.runtimeType}: $e)',
+      );
     }
   }
 

frontend/lib/widgets/cgu_privacy_validation_dialog.dart

@@ -325,8 +325,8 @@ class _CguPrivacyValidationDialogState extends State<CguPrivacyValidationDialog>
   }
 }
 
-/// [PdfViewPinch] pour le web / mobile (Flutter 3.19 + pdfx 2.6 : pas de
+/// [PdfViewPinch] pour le web / mobile avec `pdfx` 2.6 (pas de
-/// `documentProgress` / `minScale` comme sur les versions plus récentes).
+/// `documentProgress` / `minScale` dans cette API).
 class _PdfPaneWithScrollbar extends StatefulWidget {
   const _PdfPaneWithScrollbar({
     super.key,

frontend/nginx.conf

@@ -1,6 +1,7 @@
 server {
     listen 80;
-    server_name ynov.ptits-pas.fr;
+    # Host réel fourni par Traefik (app.ptits-pas.fr, etc.)
+    server_name _;
     
     location / {
         root /usr/share/nginx/html;

frontend/pubspec.lock

@@ -5,42 +5,42 @@ packages:
     dependency: transitive
     description:
       name: async
-      sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c"
+      sha256: d2872f9c19731c2e5f10444b14686eb7cc85c76274bd6c16e1816bff9a3bab63
       url: "https://pub.dev"
     source: hosted
-    version: "2.11.0"
+    version: "2.12.0"
   boolean_selector:
     dependency: transitive
     description:
       name: boolean_selector
-      sha256: "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66"
+      sha256: "8aab1771e1243a5063b8b0ff68042d67334e3feab9e95b9490f9a6ebf73b42ea"
       url: "https://pub.dev"
     source: hosted
-    version: "2.1.1"
+    version: "2.1.2"
   characters:
     dependency: transitive
     description:
       name: characters
-      sha256: "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605"
+      sha256: f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803
       url: "https://pub.dev"
     source: hosted
-    version: "1.3.0"
+    version: "1.4.0"
   clock:
     dependency: transitive
     description:
       name: clock
-      sha256: cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf
+      sha256: fddb70d9b5277016c77a80201021d40a2247104d9f4aa7bab7157b7e3f05b84b
       url: "https://pub.dev"
     source: hosted
-    version: "1.1.1"
+    version: "1.1.2"
   collection:
     dependency: transitive
     description:
       name: collection
-      sha256: ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a
+      sha256: "2f5709ae4d3d59dd8f7cd309b4e023046b57d8a6c82130785d2b0e5868084e76"
       url: "https://pub.dev"
     source: hosted
-    version: "1.18.0"
+    version: "1.19.1"
   cross_file:
     dependency: transitive
     description:
@@ -85,10 +85,10 @@ packages:
     dependency: transitive
     description:
       name: fake_async
-      sha256: "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78"
+      sha256: "6a95e56b2449df2273fd8c45a662d6947ce1ebb7aafe80e550a3f68297f3cacc"
       url: "https://pub.dev"
     source: hosted
-    version: "1.3.1"
+    version: "1.3.2"
   ffi:
     dependency: transitive
     description:
@@ -281,10 +281,10 @@ packages:
     dependency: transitive
     description:
       name: intl
-      sha256: "3bc132a9dbce73a7e4a21a17d06e1878839ffbf975568bc875c60537824b0c4d"
+      sha256: d6f56758b7d3014a48af9701c085700aac781a92a87a62b1333b46d8879661cf
       url: "https://pub.dev"
     source: hosted
-    version: "0.18.1"
+    version: "0.19.0"
   js:
     dependency: "direct main"
     description:
@@ -297,26 +297,26 @@ packages:
     dependency: transitive
     description:
       name: leak_tracker
-      sha256: "78eb209deea09858f5269f5a5b02be4049535f568c07b275096836f01ea323fa"
+      sha256: c35baad643ba394b40aac41080300150a4f08fd0fd6a10378f8f7c6bc161acec
       url: "https://pub.dev"
     source: hosted
-    version: "10.0.0"
+    version: "10.0.8"
   leak_tracker_flutter_testing:
     dependency: transitive
     description:
       name: leak_tracker_flutter_testing
-      sha256: b46c5e37c19120a8a01918cfaf293547f47269f7cb4b0058f21531c2465d6ef0
+      sha256: f8b613e7e6a13ec79cfdc0e97638fddb3ab848452eff057653abd3edba760573
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.1"
+    version: "3.0.9"
   leak_tracker_testing:
     dependency: transitive
     description:
       name: leak_tracker_testing
-      sha256: a597f72a664dbd293f3bfc51f9ba69816f84dcd403cdac7066cb3f6003f3ab47
+      sha256: "6ba465d5d76e67ddf503e1161d1f4a6bc42306f9d66ca1e8f079a47290fb06d3"
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.1"
+    version: "3.0.1"
   lints:
     dependency: transitive
     description:
@@ -337,26 +337,26 @@ packages:
     dependency: transitive
     description:
       name: matcher
-      sha256: d2323aa2060500f906aa31a895b4030b6da3ebdcc5619d14ce1aada65cd161cb
+      sha256: dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2
       url: "https://pub.dev"
     source: hosted
-    version: "0.12.16+1"
+    version: "0.12.17"
   material_color_utilities:
     dependency: transitive
     description:
       name: material_color_utilities
-      sha256: "0e0a020085b65b6083975e499759762399b4475f766c21668c4ecca34ea74e5a"
+      sha256: f7142bb1154231d7ea5f96bc7bde4bda2a0945d2806bb11670e30b850d56bdec
       url: "https://pub.dev"
     source: hosted
-    version: "0.8.0"
+    version: "0.11.1"
   meta:
     dependency: transitive
     description:
       name: meta
-      sha256: d584fa6707a52763a52446f02cc621b077888fb63b93bbcb1143a7be5a0c0c04
+      sha256: e3641ec5d63ebf0d9b41bd43201a66e3fc79a65db5f61fc181f04cd27aab950c
       url: "https://pub.dev"
     source: hosted
-    version: "1.11.0"
+    version: "1.16.0"
   mime:
     dependency: transitive
     description:
@@ -377,10 +377,10 @@ packages:
     dependency: transitive
     description:
       name: path
-      sha256: "087ce49c3f0dc39180befefc60fdb4acd8f8620e5682fe2476afd0b3688bb4af"
+      sha256: "75cca69d1490965be98c73ceaea117e8a04dd21217b37b292c9ddbec0d955bc5"
       url: "https://pub.dev"
     source: hosted
-    version: "1.9.0"
+    version: "1.9.1"
   path_provider:
     dependency: transitive
     description:
@@ -529,39 +529,39 @@ packages:
     dependency: transitive
     description: flutter
     source: sdk
-    version: "0.0.99"
+    version: "0.0.0"
   source_span:
     dependency: transitive
     description:
       name: source_span
-      sha256: "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c"
+      sha256: "254ee5351d6cb365c859e20ee823c3bb479bf4a293c22d17a9f1bf144ce86f7c"
       url: "https://pub.dev"
     source: hosted
-    version: "1.10.0"
+    version: "1.10.1"
   stack_trace:
     dependency: transitive
     description:
       name: stack_trace
-      sha256: "73713990125a6d93122541237550ee3352a2d84baad52d375a4cad2eb9b7ce0b"
+      sha256: "8b27215b45d22309b5cddda1aa2b19bdfec9df0e765f2de506401c071d38d1b1"
       url: "https://pub.dev"
     source: hosted
-    version: "1.11.1"
+    version: "1.12.1"
   stream_channel:
     dependency: transitive
     description:
       name: stream_channel
-      sha256: ba2aa5d8cc609d96bbb2899c28934f9e1af5cddbd60a827822ea467161eb54e7
+      sha256: "969e04c80b8bcdf826f8f16579c7b14d780458bd97f56d107d3950fdbeef059d"
       url: "https://pub.dev"
     source: hosted
-    version: "2.1.2"
+    version: "2.1.4"
   string_scanner:
     dependency: transitive
     description:
       name: string_scanner
-      sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde"
+      sha256: "921cd31725b72fe181906c6a94d987c78e3b98c2e205b397ea399d4054872b43"
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.0"
+    version: "1.4.1"
   synchronized:
     dependency: transitive
     description:
@@ -574,18 +574,18 @@ packages:
     dependency: transitive
     description:
       name: term_glyph
-      sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84
+      sha256: "7f554798625ea768a7518313e58f83891c7f5024f88e46e7182a4558850a4b8e"
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.1"
+    version: "1.2.2"
   test_api:
     dependency: transitive
     description:
       name: test_api
-      sha256: "5c2f730018264d276c20e4f1503fd1308dfbbae39ec8ee63c5236311ac06954b"
+      sha256: fb31f383e2ee25fbbfe06b40fe21e1e458d14080e3c67e7ba0acfde4df4e0bbd
       url: "https://pub.dev"
     source: hosted
-    version: "0.6.1"
+    version: "0.7.4"
   typed_data:
     dependency: transitive
     description:
@@ -686,10 +686,10 @@ packages:
     dependency: transitive
     description:
       name: vm_service
-      sha256: b3d56ff4341b8f182b96aceb2fa20e3dcb336b9f867bc0eafc0de10f1048e957
+      sha256: "0968250880a6c5fe7edc067ed0a13d4bae1577fe2771dcf3010d52c4a9d3ca14"
       url: "https://pub.dev"
     source: hosted
-    version: "13.0.0"
+    version: "14.3.1"
   web:
     dependency: transitive
     description:
@@ -723,5 +723,5 @@ packages:
     source: hosted
     version: "1.1.0"
 sdks:
-  dart: ">=3.3.0 <4.0.0"
+  dart: ">=3.7.0-0 <4.0.0"
   flutter: ">=3.19.0"

frontend/web/index.html

@@ -32,21 +32,9 @@
 
   <title>P'titsPas</title>
   <link rel="manifest" href="manifest.json">
-
-  <!-- Suppression des dépendances image_cropper web -->
-  <!--
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/cropperjs/1.5.12/cropper.min.js"></script>
-  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/cropperjs/1.5.12/cropper.min.css">
-  -->
-
-  <script>
-    // The value below is injected by flutter build, do not touch.
-    const serviceWorkerVersion = "{{flutter_service_worker_version}}";
-  </script>
-  <!-- This script adds the flutter initialization JS code -->
-  <script src="flutter.js" defer></script>
 </head>
 <body>
+  <!-- pdf.js (pdfx) — chargé avant le moteur Flutter -->
   <script src='https://cdn.jsdelivr.net/npm/pdfjs-dist@4.6.82/build/pdf.min.mjs' type='module'></script>
   <script type='module'>
   var { pdfjsLib } = globalThis;
@@ -57,20 +45,8 @@
     cMapPacked: true,
   }
   </script>
-  <script>
+  <!-- Flutter 3.29+ : le build génère flutter_bootstrap.js ; index.html doit le référencer
-    window.addEventListener('load', function(ev) {
+       (voir https://docs.flutter.dev/platform-integration/web/initialization) -->
-      // Download main.dart.js
+  <script src="flutter_bootstrap.js" async></script>
-      _flutter.loader.loadEntrypoint({
-        serviceWorker: {
-          serviceWorkerVersion: serviceWorkerVersion,
-        },
-        onEntrypointLoaded: function(engineInitializer) {
-          engineInitializer.initializeEngine().then(function(appRunner) {
-            appRunner.runApp();
-          });
-        }
-      });
-    });
-  </script>
 </body>
 </html>