fix(#96 ): protéger le super admin en édition et suppression

Empêche la suppression d'un super administrateur et fige son identité (nom/prénom) côté API, avec alignement de la modale frontend pour masquer la suppression et verrouiller ces champs. Co-authored-by: Cursor <cursoragent@cursor.com>
feat(#96 ): différencier la consultation admin et le mode édition
2026-02-24 22:05:17 +01:00 · 2026-02-24 21:48:11 +01:00
4 changed files with 142 additions and 41 deletions
--- a/backend/src/routes/user/user.service.ts
+++ b/backend/src/routes/user/user.service.ts
@ -155,6 +155,16 @@ export class UserService {
    async updateUser(id: string, dto: UpdateUserDto, currentUser: Users): Promise<Users> {
        const user = await this.findOne(id);

+        // Le super administrateur conserve une identité figée.
+        if (
+            user.role === RoleType.SUPER_ADMIN &&
+            (dto.nom !== undefined || dto.prenom !== undefined)
+        ) {
+            throw new ForbiddenException(
+                'Le nom et le prénom du super administrateur ne peuvent pas être modifiés',
+            );
+        }
+
        // Interdire changement de rôle si pas super admin
        if (dto.role && currentUser.role !== RoleType.SUPER_ADMIN) {
            throw new ForbiddenException('Accès réservé aux super admins');
@ -251,6 +261,12 @@ export class UserService {
        if (currentUser.role !== RoleType.SUPER_ADMIN) {
            throw new ForbiddenException('Accès réservé aux super admins');
        }
+        const user = await this.findOne(id);
+        if (user.role === RoleType.SUPER_ADMIN) {
+            throw new ForbiddenException(
+                'Le super administrateur ne peut pas être supprimé',
+            );
+        }
        const result = await this.usersRepository.delete(id);
        if (result.affected === 0) {
            throw new NotFoundException('Utilisateur introuvable');
--- a/frontend/lib/screens/administrateurs/creation/gestionnaires_create.dart
+++ b/frontend/lib/screens/administrateurs/creation/gestionnaires_create.dart
@ -9,12 +9,14 @@ class AdminUserFormDialog extends StatefulWidget {
  final AppUser? initialUser;
  final bool withRelais;
  final bool adminMode;
+  final bool readOnly;

  const AdminUserFormDialog({
    super.key,
    this.initialUser,
    this.withRelais = true,
    this.adminMode = false,
+    this.readOnly = false,
  });

  @override
@ -37,6 +39,10 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
  List<RelaisModel> _relais = [];
  String? _selectedRelaisId;
  bool get _isEditMode => widget.initialUser != null;
+  bool get _isSuperAdminTarget =>
+      widget.initialUser?.role.toLowerCase() == 'super_admin';
+  bool get _isLockedAdminIdentity =>
+      _isEditMode && widget.adminMode && _isSuperAdminTarget;

  @override
  void initState() {
@ -194,6 +200,7 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
  }

  Future<void> _submit() async {
+    if (widget.readOnly) return;
    if (_isSubmitting) return;
    if (!_formKey.currentState!.validate()) return;

@ -209,10 +216,12 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {

      if (_isEditMode) {
        if (widget.adminMode) {
+          final lockedNom = _toTitleCase(widget.initialUser!.nom ?? '');
+          final lockedPrenom = _toTitleCase(widget.initialUser!.prenom ?? '');
          await UserService.updateAdministrateur(
            adminId: widget.initialUser!.id,
-            nom: normalizedNom,
-            prenom: normalizedPrenom,
+            nom: _isLockedAdminIdentity ? lockedNom : normalizedNom,
+            prenom: _isLockedAdminIdentity ? lockedPrenom : normalizedPrenom,
            email: _emailController.text.trim(),
            telephone: normalizedPhone.isEmpty
                ? _normalizePhone(widget.initialUser!.telephone ?? '')
@ -304,6 +313,8 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
  }

  Future<void> _delete() async {
+    if (widget.readOnly) return;
+    if (_isSuperAdminTarget) return;
    if (!_isEditMode || _isSubmitting) return;

    final confirmed = await showDialog<bool>(
@ -363,15 +374,19 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
          Expanded(
            child: Text(
              _isEditMode
-                  ? (widget.adminMode
-                      ? 'Modifier un administrateur'
-                      : 'Modifier un gestionnaire')
+                  ? (widget.readOnly
+                      ? (widget.adminMode
+                          ? 'Consulter un administrateur'
+                          : 'Consulter un gestionnaire')
+                      : (widget.adminMode
+                          ? 'Modifier un administrateur'
+                          : 'Modifier un gestionnaire'))
                  : (widget.adminMode
                      ? 'Créer un administrateur'
                      : 'Créer un gestionnaire'),
            ),
          ),
-          if (_isEditMode)
+          if (_isEditMode && !widget.readOnly)
            IconButton(
              icon: const Icon(Icons.close),
              tooltip: 'Fermer',
@ -416,12 +431,18 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
        ),
      ),
      actions: [
-        if (_isEditMode) ...[
-          OutlinedButton(
-            onPressed: _isSubmitting ? null : _delete,
-            style: OutlinedButton.styleFrom(foregroundColor: Colors.red.shade700),
-            child: const Text('Supprimer'),
+        if (widget.readOnly) ...[
+          FilledButton(
+            onPressed: _isSubmitting ? null : () => Navigator.of(context).pop(false),
+            child: const Text('Fermer'),
          ),
+        ] else if (_isEditMode) ...[
+          if (!_isSuperAdminTarget)
+            OutlinedButton(
+              onPressed: _isSubmitting ? null : _delete,
+              style: OutlinedButton.styleFrom(foregroundColor: Colors.red.shade700),
+              child: const Text('Supprimer'),
+            ),
          FilledButton.icon(
            onPressed: _isSubmitting ? null : _submit,
            icon: _isSubmitting
@ -458,42 +479,50 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
  Widget _buildNomField() {
    return TextFormField(
      controller: _nomController,
+      readOnly: widget.readOnly || _isLockedAdminIdentity,
      textCapitalization: TextCapitalization.words,
      decoration: const InputDecoration(
        labelText: 'Nom',
        border: OutlineInputBorder(),
      ),
-      validator: (v) => _required(v, 'Nom'),
+      validator: (widget.readOnly || _isLockedAdminIdentity)
+          ? null
+          : (v) => _required(v, 'Nom'),
    );
  }

  Widget _buildPrenomField() {
    return TextFormField(
      controller: _prenomController,
+      readOnly: widget.readOnly || _isLockedAdminIdentity,
      textCapitalization: TextCapitalization.words,
      decoration: const InputDecoration(
        labelText: 'Prénom',
        border: OutlineInputBorder(),
      ),
-      validator: (v) => _required(v, 'Prénom'),
+      validator: (widget.readOnly || _isLockedAdminIdentity)
+          ? null
+          : (v) => _required(v, 'Prénom'),
    );
  }

  Widget _buildEmailField() {
    return TextFormField(
      controller: _emailController,
+      readOnly: widget.readOnly,
      keyboardType: TextInputType.emailAddress,
      decoration: const InputDecoration(
        labelText: 'Email',
        border: OutlineInputBorder(),
      ),
-      validator: _validateEmail,
+      validator: widget.readOnly ? null : _validateEmail,
    );
  }

  Widget _buildPasswordField() {
    return TextFormField(
      controller: _passwordController,
+      readOnly: widget.readOnly,
      obscureText: _obscurePassword,
      enableSuggestions: false,
      autocorrect: false,
@ -505,38 +534,43 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
            ? 'Nouveau mot de passe'
            : 'Mot de passe',
        border: const OutlineInputBorder(),
-        suffixIcon: ExcludeFocus(
-          child: IconButton(
-            focusNode: _passwordToggleFocusNode,
-            onPressed: () {
-              setState(() {
-                _obscurePassword = !_obscurePassword;
-              });
-            },
-            icon: Icon(
-              _obscurePassword ? Icons.visibility_off : Icons.visibility,
-            ),
-          ),
-        ),
+        suffixIcon: widget.readOnly
+            ? null
+            : ExcludeFocus(
+                child: IconButton(
+                  focusNode: _passwordToggleFocusNode,
+                  onPressed: () {
+                    setState(() {
+                      _obscurePassword = !_obscurePassword;
+                    });
+                  },
+                  icon: Icon(
+                    _obscurePassword ? Icons.visibility_off : Icons.visibility,
+                  ),
+                ),
+              ),
      ),
-      validator: _validatePassword,
+      validator: widget.readOnly ? null : _validatePassword,
    );
  }

  Widget _buildTelephoneField() {
    return TextFormField(
      controller: _telephoneController,
+      readOnly: widget.readOnly,
      keyboardType: TextInputType.phone,
-      inputFormatters: [
-        FilteringTextInputFormatter.digitsOnly,
-        LengthLimitingTextInputFormatter(10),
-        _FrenchPhoneNumberFormatter(),
-      ],
+      inputFormatters: widget.readOnly
+          ? null
+          : [
+              FilteringTextInputFormatter.digitsOnly,
+              LengthLimitingTextInputFormatter(10),
+              _FrenchPhoneNumberFormatter(),
+            ],
      decoration: const InputDecoration(
        labelText: 'Téléphone (ex: 06 12 34 56 78)',
        border: OutlineInputBorder(),
      ),
-      validator: _validatePhone,
+      validator: widget.readOnly ? null : _validatePhone,
    );
  }

@ -568,7 +602,7 @@ class _AdminUserFormDialogState extends State<AdminUserFormDialog> {
              ),
            ),
          ],
-          onChanged: _isLoadingRelais
+          onChanged: (_isLoadingRelais || widget.readOnly)
              ? null
              : (value) {
                  setState(() {
--- a/frontend/lib/widgets/admin/admin_management_widget.dart
+++ b/frontend/lib/widgets/admin/admin_management_widget.dart
@ -1,6 +1,7 @@
 import 'package:flutter/material.dart';
 import 'package:p_tits_pas/models/user.dart';
 import 'package:p_tits_pas/screens/administrateurs/creation/gestionnaires_create.dart';
+import 'package:p_tits_pas/services/auth_service.dart';
 import 'package:p_tits_pas/services/user_service.dart';
 import 'package:p_tits_pas/widgets/admin/common/admin_user_card.dart';
 import 'package:p_tits_pas/widgets/admin/common/user_list.dart';
@ -21,10 +22,12 @@ class _AdminManagementWidgetState extends State<AdminManagementWidget> {
  bool _isLoading = false;
  String? _error;
  List<AppUser> _admins = [];
+  String? _currentUserRole;

  @override
  void initState() {
    super.initState();
+    _loadCurrentUserRole();
    _loadAdmins();
  }

@ -52,7 +55,31 @@ class _AdminManagementWidgetState extends State<AdminManagementWidget> {
    }
  }

+  Future<void> _loadCurrentUserRole() async {
+    final cached = await AuthService.getCurrentUser();
+    if (!mounted) return;
+    if (cached != null) {
+      setState(() {
+        _currentUserRole = cached.role.toLowerCase();
+      });
+      return;
+    }
+    final refreshed = await AuthService.refreshCurrentUser();
+    if (!mounted || refreshed == null) return;
+    setState(() {
+      _currentUserRole = refreshed.role.toLowerCase();
+    });
+  }
+
+  bool _isSuperAdmin(AppUser user) => user.role.toLowerCase() == 'super_admin';
+
+  bool _canEditAdmin(AppUser target) {
+    if (!_isSuperAdmin(target)) return true;
+    return _currentUserRole == 'super_admin';
+  }
+
  Future<void> _openAdminEditDialog(AppUser user) async {
+    final canEdit = _canEditAdmin(user);
    final changed = await showDialog<bool>(
      context: context,
      barrierDismissible: false,
@ -61,10 +88,11 @@ class _AdminManagementWidgetState extends State<AdminManagementWidget> {
          initialUser: user,
          adminMode: true,
          withRelais: false,
+          readOnly: !canEdit,
        );
      },
    );
-    if (changed == true) {
+    if (changed == true && canEdit) {
      await _loadAdmins();
    }
  }
@ -86,6 +114,8 @@ class _AdminManagementWidgetState extends State<AdminManagementWidget> {
      itemCount: filteredAdmins.length,
      itemBuilder: (context, index) {
        final user = filteredAdmins[index];
+        final isSuperAdmin = _isSuperAdmin(user);
+        final canEdit = _canEditAdmin(user);
        return AdminUserCard(
          title: user.fullName,
          subtitleLines: [
@ -93,10 +123,22 @@ class _AdminManagementWidgetState extends State<AdminManagementWidget> {
            'Rôle : ${user.role}',
          ],
          avatarUrl: user.photoUrl,
+          borderColor: isSuperAdmin
+              ? const Color(0xFF8E6AC8)
+              : Colors.grey.shade300,
+          backgroundColor: isSuperAdmin
+              ? const Color(0xFFF4EEFF)
+              : Colors.white,
+          titleColor: isSuperAdmin ? const Color(0xFF5D2F99) : null,
+          infoColor: isSuperAdmin
+              ? const Color(0xFF6D4EA1)
+              : Colors.black54,
          actions: [
            IconButton(
-              icon: const Icon(Icons.edit),
-              tooltip: 'Modifier',
+              icon: Icon(
+                canEdit ? Icons.edit_outlined : Icons.visibility_outlined,
+              ),
+              tooltip: canEdit ? 'Modifier' : 'Consulter',
              onPressed: () {
                _openAdminEditDialog(user);
              },
--- a/frontend/lib/widgets/admin/common/admin_user_card.dart
+++ b/frontend/lib/widgets/admin/common/admin_user_card.dart
@ -6,6 +6,10 @@ class AdminUserCard extends StatefulWidget {
  final String? avatarUrl;
  final IconData fallbackIcon;
  final List<Widget> actions;
+  final Color? borderColor;
+  final Color? backgroundColor;
+  final Color? titleColor;
+  final Color? infoColor;

  const AdminUserCard({
    super.key,
@ -14,6 +18,10 @@ class AdminUserCard extends StatefulWidget {
    this.avatarUrl,
    this.fallbackIcon = Icons.person,
    this.actions = const [],
+    this.borderColor,
+    this.backgroundColor,
+    this.titleColor,
+    this.infoColor,
  });

  @override
@ -43,9 +51,10 @@ class _AdminUserCardState extends State<AdminUserCard> {
          child: Card(
            margin: const EdgeInsets.only(bottom: 12),
            elevation: 0,
+            color: widget.backgroundColor,
            shape: RoundedRectangleBorder(
              borderRadius: BorderRadius.circular(10),
-              side: BorderSide(color: Colors.grey.shade300),
+              side: BorderSide(color: widget.borderColor ?? Colors.grey.shade300),
            ),
            child: Padding(
              padding: const EdgeInsets.symmetric(horizontal: 12, vertical: 9),
@ -76,7 +85,7 @@ class _AdminUserCardState extends State<AdminUserCard> {
                            style: const TextStyle(
                              fontWeight: FontWeight.w600,
                              fontSize: 14,
-                            ),
+                            ).copyWith(color: widget.titleColor),
                            maxLines: 1,
                            overflow: TextOverflow.ellipsis,
                          ),
@ -88,7 +97,7 @@ class _AdminUserCardState extends State<AdminUserCard> {
                            style: const TextStyle(
                              color: Colors.black54,
                              fontSize: 12,
-                            ),
+                            ).copyWith(color: widget.infoColor),
                            maxLines: 1,
                            overflow: TextOverflow.ellipsis,
                          ),