Rôle modérateur + gestion des comptes admin/modérateur

- Nouveau rôle users.role='moderator' (contrainte CHECK migrée via
  DROP+ADD CONSTRAINT, idempotent) : accès à Membres, Rencontres,
  Inscriptions uniquement. Dashboard, Catégories (écriture), Contenu du
  site, Demandes d'adhésion et gestion des comptes restent admin-only,
  imposé côté serveur (requireAuth accepte désormais un tableau de rôles)
- Nouvel onglet « Administrateurs » (admin-only) : créer un compte admin
  ou modérateur (mot de passe temporaire généré, même mécanique que pour
  les membres — visible tant que non changé, changement forcé à la
  première connexion), réinitialiser l'accès, promouvoir/rétrograder,
  supprimer. Garde-fous : impossible de se supprimer ou de se rétrograder
  soi-même, impossible de supprimer le dernier administrateur
- users.full_name (colonne migrée) pour l'affichage des comptes staff
- AccessCell/CredentialsModal extraits dans AccessControls.jsx, partagés
  entre la gestion des membres et celle des comptes admin/modérateur
- AdminShell filtre ses onglets par rôle ; Espace.jsx route admin et
  modérateur vers le back-office

Corrigé en cours de route : GET /api/admin/categories doit rester lisible
par les modérateurs (nécessaire au formulaire membre) même si sa gestion
en écriture reste admin-only — sans quoi le Promise.all du frontend
échouait silencieusement et vidait la liste des membres.

Vérifié : 34 + 21 tests existants toujours au vert, 26 nouveaux tests de
permissions par rôle, parcours navigateur complet (création modérateur,
connexion, changement forcé, menu restreint, accès aux membres).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fkg15RCxNgUys4ru73He2o

server/src/errors.js

@@ -0,0 +1,9 @@
+// Thrown by access-management helpers (member/staff account creation and
+// resets) for expected, user-facing failures — routes map these to the
+// right HTTP status instead of a generic 500.
+export class AccessError extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+}

server/src/memberAccess.js

@@ -1,13 +1,7 @@
 import bcrypt from 'bcryptjs';
 import { query } from './db.js';
 import { generateTempPassword } from './passwords.js';
-
-export class AccessError extends Error {
-  constructor(status, message) {
-    super(message);
-    this.status = status;
-  }
-}
+import { AccessError } from './errors.js';
 
 // Creates the member's login if it doesn't exist yet, or resets it if it
 // does — same operation either way, used for "create member" and for

server/src/middleware/auth.js

@@ -31,10 +31,13 @@ export function attachUser(req, _res, next) {
   next();
 }
 
-export function requireAuth(role) {
+// `roles` may be a single role string, an array of allowed roles, or
+// omitted to just require any authenticated session.
+export function requireAuth(roles) {
+  const allowed = roles ? (Array.isArray(roles) ? roles : [roles]) : null;
   return (req, res, next) => {
     if (!req.user) return res.status(401).json({ error: 'Authentification requise' });
-    if (role && req.user.role !== role) return res.status(403).json({ error: 'Accès refusé' });
+    if (allowed && !allowed.includes(req.user.role)) return res.status(403).json({ error: 'Accès refusé' });
     next();
   };
 }

server/src/routes/admin.js

@@ -8,14 +8,22 @@ import {
   inscriptionAdminSchema,
   categorySchema,
   contentSchema,
+  staffUserSchema,
+  roleChangeSchema,
   idParam,
 } from '../schemas.js';
 import { imageUpload, saveImage, deleteImage } from '../uploads.js';
-import { ensureMemberAccess, AccessError } from '../memberAccess.js';
+import { ensureMemberAccess } from '../memberAccess.js';
+import { createStaffUser, resetStaffAccess } from '../userAccess.js';
+import { AccessError } from '../errors.js';
 
 export const adminRouter = Router();
 
-adminRouter.use(requireAuth('admin'));
+// Every route below requires at least an authenticated staff session
+// (admin or moderator); individual routes further restrict to admin-only
+// where noted.
+adminRouter.use(requireAuth(['admin', 'moderator']));
+const adminOnly = requireAuth('admin');
 
 const MEMBER_SQL = `
   SELECT m.id, m.nom, m.secteur, m.categorie_id, c.name AS categorie, m.dirigeant,
@@ -38,8 +46,8 @@ const INSCR_SQL = `
          i.rencontre_id, r.titre AS rencontre
     FROM inscriptions i JOIN rencontres r ON r.id = i.rencontre_id`;
 
-// ---------- Dashboard ----------
-adminRouter.get('/dashboard', async (_req, res, next) => {
+// ---------- Dashboard (admin only) ----------
+adminRouter.get('/dashboard', adminOnly, async (_req, res, next) => {
   try {
     const [kpis, latest, upcoming] = await Promise.all([
       query(`
@@ -60,7 +68,7 @@ adminRouter.get('/dashboard', async (_req, res, next) => {
   }
 });
 
-// ---------- Members ----------
+// ---------- Members (admin + moderator) ----------
 adminRouter.get('/members', async (_req, res, next) => {
   try {
     const result = await query(`${MEMBER_SQL} ORDER BY m.nom`);
@@ -145,7 +153,7 @@ adminRouter.post('/members/:id/reset-access', validate(idParam, 'params'), async
   }
 });
 
-// ---------- Rencontres ----------
+// ---------- Rencontres (admin + moderator) ----------
 adminRouter.get('/rencontres', async (_req, res, next) => {
   try {
     const result = await query(`${RENC_SQL} GROUP BY r.id ORDER BY r.date_renc`);
@@ -202,7 +210,7 @@ adminRouter.get('/rencontres/:id/inscriptions', validate(idParam, 'params'), asy
   }
 });
 
-// ---------- Inscriptions ----------
+// ---------- Inscriptions (admin + moderator) ----------
 adminRouter.get('/inscriptions', async (_req, res, next) => {
   try {
     const result = await query(`${INSCR_SQL} ORDER BY i.created_at DESC, i.id DESC`);
@@ -250,6 +258,9 @@ adminRouter.delete('/inscriptions/:id', validate(idParam, 'params'), async (req,
 });
 
 // ---------- Categories ----------
+// Read access is shared with moderators: the member form's category
+// dropdown needs it. Managing categories (create/rename/delete) stays
+// admin-only.
 adminRouter.get('/categories', async (_req, res, next) => {
   try {
     const result = await query(`
@@ -262,7 +273,7 @@ adminRouter.get('/categories', async (_req, res, next) => {
   }
 });
 
-adminRouter.post('/categories', validate(categorySchema), async (req, res, next) => {
+adminRouter.post('/categories', adminOnly, validate(categorySchema), async (req, res, next) => {
   try {
     const result = await query(
       'INSERT INTO categories (name) VALUES ($1) ON CONFLICT (name) DO NOTHING RETURNING id',
@@ -275,7 +286,7 @@ adminRouter.post('/categories', validate(categorySchema), async (req, res, next)
   }
 });
 
-adminRouter.put('/categories/:id', validate(idParam, 'params'), validate(categorySchema), async (req, res, next) => {
+adminRouter.put('/categories/:id', adminOnly, validate(idParam, 'params'), validate(categorySchema), async (req, res, next) => {
   try {
     const result = await query('UPDATE categories SET name = $1 WHERE id = $2 RETURNING id', [
       req.data.name,
@@ -289,7 +300,7 @@ adminRouter.put('/categories/:id', validate(idParam, 'params'), validate(categor
   }
 });
 
-adminRouter.delete('/categories/:id', validate(idParam, 'params'), async (req, res, next) => {
+adminRouter.delete('/categories/:id', adminOnly, validate(idParam, 'params'), async (req, res, next) => {
   try {
     // members.categorie_id has ON DELETE SET NULL: they become "Non classée"
     await query('DELETE FROM categories WHERE id = $1', [req.params.id]);
@@ -299,8 +310,8 @@ adminRouter.delete('/categories/:id', validate(idParam, 'params'), async (req, r
   }
 });
 
-// ---------- Site content ----------
-adminRouter.put('/content', validate(contentSchema), async (req, res, next) => {
+// ---------- Site content (admin only) ----------
+adminRouter.put('/content', adminOnly, validate(contentSchema), async (req, res, next) => {
   try {
     const entries = Object.entries(req.data).filter(([, v]) => v !== undefined);
     for (const [key, value] of entries) {
@@ -316,7 +327,7 @@ adminRouter.put('/content', validate(contentSchema), async (req, res, next) => {
   }
 });
 
-adminRouter.post('/content/hero-photo', (req, res, next) => {
+adminRouter.post('/content/hero-photo', adminOnly, (req, res, next) => {
   imageUpload(req, res, async (err) => {
     if (err) return res.status(400).json({ error: 'Fichier invalide (2 Mo max).' });
     try {
@@ -337,8 +348,8 @@ adminRouter.post('/content/hero-photo', (req, res, next) => {
   });
 });
 
-// ---------- Demandes d'adhésion ----------
-adminRouter.get('/demandes', async (_req, res, next) => {
+// ---------- Demandes d'adhésion (admin only) ----------
+adminRouter.get('/demandes', adminOnly, async (_req, res, next) => {
   try {
     const result = await query('SELECT * FROM demandes_adhesion ORDER BY created_at DESC');
     res.json({ demandes: result.rows });
@@ -346,3 +357,79 @@ adminRouter.get('/demandes', async (_req, res, next) => {
     next(err);
   }
 });
+
+// ---------- Admin & moderator accounts (admin only) ----------
+adminRouter.get('/users', adminOnly, async (req, res, next) => {
+  try {
+    const result = await query(`
+      SELECT id, email, full_name, role, must_change_password,
+             CASE WHEN must_change_password THEN temp_password ELSE NULL END AS temp_password,
+             created_at
+        FROM users WHERE role IN ('admin', 'moderator')
+       ORDER BY role, full_name, email`);
+    res.json({ users: result.rows.map((u) => ({ ...u, is_self: u.id === req.user.sub })) });
+  } catch (err) {
+    next(err);
+  }
+});
+
+adminRouter.post('/users', adminOnly, validate(staffUserSchema), async (req, res, next) => {
+  try {
+    const { fullName, email, role } = req.data;
+    const { id, tempPassword } = await createStaffUser({ fullName, email, role });
+    res.status(201).json({ id, tempPassword });
+  } catch (err) {
+    if (err instanceof AccessError) return res.status(err.status).json({ error: err.message });
+    next(err);
+  }
+});
+
+adminRouter.post('/users/:id/reset-access', adminOnly, validate(idParam, 'params'), async (req, res, next) => {
+  try {
+    const tempPassword = await resetStaffAccess(req.params.id);
+    res.json({ tempPassword });
+  } catch (err) {
+    if (err instanceof AccessError) return res.status(err.status).json({ error: err.message });
+    next(err);
+  }
+});
+
+adminRouter.put('/users/:id/role', adminOnly, validate(idParam, 'params'), validate(roleChangeSchema), async (req, res, next) => {
+  try {
+    if (req.params.id === req.user.sub) {
+      return res.status(400).json({ error: 'Vous ne pouvez pas modifier votre propre rôle.' });
+    }
+    const target = await query(`SELECT role FROM users WHERE id = $1 AND role IN ('admin', 'moderator')`, [req.params.id]);
+    if (target.rowCount === 0) return res.status(404).json({ error: 'Compte introuvable' });
+    if (target.rows[0].role === 'admin' && req.data.role !== 'admin') {
+      const adminCount = await query(`SELECT COUNT(*)::int AS n FROM users WHERE role = 'admin'`);
+      if (adminCount.rows[0].n <= 1) {
+        return res.status(400).json({ error: 'Impossible : il doit rester au moins un administrateur.' });
+      }
+    }
+    await query('UPDATE users SET role = $1 WHERE id = $2', [req.data.role, req.params.id]);
+    res.json({ ok: true });
+  } catch (err) {
+    next(err);
+  }
+});
+
+adminRouter.delete('/users/:id', adminOnly, validate(idParam, 'params'), async (req, res, next) => {
+  try {
+    if (req.params.id === req.user.sub) {
+      return res.status(400).json({ error: 'Vous ne pouvez pas supprimer votre propre compte.' });
+    }
+    const target = await query(`SELECT role FROM users WHERE id = $1 AND role IN ('admin', 'moderator')`, [req.params.id]);
+    if (target.rowCount === 0) return res.status(404).json({ error: 'Compte introuvable' });
+    if (target.rows[0].role === 'admin') {
+      const adminCount = await query(`SELECT COUNT(*)::int AS n FROM users WHERE role = 'admin'`);
+      if (adminCount.rows[0].n <= 1) {
+        return res.status(400).json({ error: 'Impossible de supprimer le dernier compte administrateur.' });
+      }
+    }
+    await query(`DELETE FROM users WHERE id = $1 AND role IN ('admin', 'moderator')`, [req.params.id]);
+    res.json({ ok: true });
+  } catch (err) {
+    next(err);
+  }
+});

server/src/schemas.js

@@ -68,6 +68,16 @@ export const inscriptionAdminSchema = z.object({
 
 export const categorySchema = z.object({ name: trimmed(80, 1) });
 
+export const staffRoleEnum = z.enum(['admin', 'moderator']);
+
+export const staffUserSchema = z.object({
+  fullName: trimmed(120, 1),
+  email: trimmed(254, 3).email(),
+  role: staffRoleEnum,
+});
+
+export const roleChangeSchema = z.object({ role: staffRoleEnum });
+
 export const contentSchema = z.object({
   hero_quote_text: trimmed(300).optional(),
   hero_quote_author: trimmed(120).optional(),

server/src/sql/schema.sql

@@ -28,8 +28,11 @@ CREATE TABLE IF NOT EXISTS users (
     id                   SERIAL PRIMARY KEY,
     email                CITEXT NOT NULL UNIQUE CHECK (char_length(email) <= 254),
     password_hash        TEXT NOT NULL,
-    role                 TEXT NOT NULL CHECK (role IN ('member', 'admin')),
+    role                 TEXT NOT NULL CHECK (role IN ('member', 'admin', 'moderator')),
     member_id            INTEGER UNIQUE REFERENCES members(id) ON DELETE CASCADE,
+    -- Display name for admin/moderator accounts (member accounts show their
+    -- name via the linked members row instead, this stays NULL for them).
+    full_name            TEXT,
     -- Temporary password shown to the admin (create / reset access), kept
     -- readable only until the user changes it — cleared automatically at
     -- that point. NULL once a real password has been chosen by the user.
@@ -37,10 +40,13 @@ CREATE TABLE IF NOT EXISTS users (
     must_change_password BOOLEAN NOT NULL DEFAULT false,
     created_at           TIMESTAMPTZ NOT NULL DEFAULT now()
 );
--- ALTER ... IF NOT EXISTS heals databases that already had this table
--- before these columns were introduced.
+-- ALTER ... IF NOT EXISTS / DROP+ADD CONSTRAINT heal databases that already
+-- had this table before these columns/roles were introduced.
 ALTER TABLE users ADD COLUMN IF NOT EXISTS temp_password TEXT;
 ALTER TABLE users ADD COLUMN IF NOT EXISTS must_change_password BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE users ADD COLUMN IF NOT EXISTS full_name TEXT;
+ALTER TABLE users DROP CONSTRAINT IF EXISTS users_role_check;
+ALTER TABLE users ADD CONSTRAINT users_role_check CHECK (role IN ('member', 'admin', 'moderator'));
 
 CREATE TABLE IF NOT EXISTS rencontres (
     id          SERIAL PRIMARY KEY,

server/src/sql/seed.sql

@@ -62,6 +62,6 @@ INSERT INTO users (email, password_hash, role, member_id)
 SELECT email, '*seed*', 'member', id FROM members WHERE email IS NOT NULL
 ON CONFLICT (email) DO NOTHING;
 
-INSERT INTO users (email, password_hash, role) VALUES
-  ('admin@sluc-businessclub.fr', '*seed*', 'admin')
+INSERT INTO users (email, password_hash, role, full_name) VALUES
+  ('admin@sluc-businessclub.fr', '*seed*', 'admin', 'Administrateur')
 ON CONFLICT (email) DO NOTHING;

server/src/userAccess.js

@@ -0,0 +1,39 @@
+import bcrypt from 'bcryptjs';
+import { query } from './db.js';
+import { generateTempPassword } from './passwords.js';
+import { AccessError } from './errors.js';
+
+const STAFF_ROLES = ['admin', 'moderator'];
+
+// Creates an admin or moderator account with a temporary password — same
+// readable-until-changed mechanic as member accounts (see memberAccess.js).
+export async function createStaffUser({ fullName, email, role }) {
+  if (!STAFF_ROLES.includes(role)) throw new AccessError(400, 'Rôle invalide.');
+  const tempPassword = generateTempPassword();
+  const hash = await bcrypt.hash(tempPassword, 12);
+  try {
+    const result = await query(
+      `INSERT INTO users (email, password_hash, role, full_name, temp_password, must_change_password)
+       VALUES ($1, $2, $3, $4, $5, true) RETURNING id`,
+      [email, hash, role, fullName, tempPassword]
+    );
+    return { id: result.rows[0].id, tempPassword };
+  } catch (err) {
+    if (err.code === '23505') throw new AccessError(409, 'Cet email est déjà utilisé.');
+    throw err;
+  }
+}
+
+// Regenerates the temporary password for an existing admin/moderator
+// account (e.g. they lost it).
+export async function resetStaffAccess(userId) {
+  const tempPassword = generateTempPassword();
+  const hash = await bcrypt.hash(tempPassword, 12);
+  const result = await query(
+    `UPDATE users SET password_hash=$1, temp_password=$2, must_change_password=true
+      WHERE id=$3 AND role IN ('admin', 'moderator') RETURNING id`,
+    [hash, tempPassword, userId]
+  );
+  if (result.rowCount === 0) throw new AccessError(404, 'Compte introuvable.');
+  return tempPassword;
+}