);
}
-function CanvasRow({
+function BlockCard({
block,
- selected,
- onSelect,
+ label,
+ isFirst,
+ isLast,
+ onPatch,
+ onMove,
onRemove,
- previewText,
+ moveUpLabel,
+ moveDownLabel,
removeLabel,
dragLabel,
}: {
block: DraftBlock;
- selected: boolean;
- onSelect: () => void;
+ label: string;
+ isFirst: boolean;
+ isLast: boolean;
+ onPatch: (patch: BlockPayload) => void;
+ onMove: (delta: number) => void;
onRemove: () => void;
- previewText: string;
+ moveUpLabel: string;
+ moveDownLabel: string;
removeLabel: string;
dragLabel: string;
}) {
const { attributes, listeners, setNodeRef, setActivatorNodeRef, transform, transition, isDragging } =
useSortable({ id: block.localId });
+ const mod = getModule(block.kind);
const style = {
transform: CSS.Transform.toString(transform),
@@ -774,17 +930,16 @@ function CanvasRow({
opacity: isDragging ? 0.5 : undefined,
} as React.CSSProperties;
+ if (!mod) return null;
+ const Edit = mod.Edit;
+
return (
-
-
+
+
e.stopPropagation()}
>
-
- {block.kind}
-
-
- {previewText || "—"}
+
+ {label}
{
- e.stopPropagation();
- onRemove();
- }}
+ onClick={() => onMove(-1)}
+ disabled={isFirst}
+ aria-label={moveUpLabel}
+ className="rounded p-1 text-muted transition-colors hover:text-text disabled:cursor-not-allowed disabled:opacity-30"
+ >
+
+ onMove(1)}
+ disabled={isLast}
+ aria-label={moveDownLabel}
+ className="rounded p-1 text-muted transition-colors hover:text-text disabled:cursor-not-allowed disabled:opacity-30"
+ >
+
+
-
+
+
+
);
}
+
+// Small chevrons (rotated reuse of the shared chevron set kept inline to avoid new icon files).
+function ChevronUp() {
+ return
;
+}
+function ChevronDown() {
+ return
;
+}
diff --git a/apps/frontend/components/admin/course-form.tsx b/apps/frontend/components/admin/course-form.tsx
index 77d3f14..79e517b 100644
--- a/apps/frontend/components/admin/course-form.tsx
+++ b/apps/frontend/components/admin/course-form.tsx
@@ -112,6 +112,11 @@ export function CourseForm({ course, labels, cancelHref = "/admin/courses" }: Co
setError(r.error ?? labels.errorUnknown);
return;
}
+ // Création : on enchaîne directement sur l'éditeur de contenu.
+ setSaved(true);
+ router.refresh();
+ router.push(`/admin/courses/${r.course.id}/blocks`);
+ return;
}
setSaved(true);
router.refresh();
diff --git a/apps/frontend/components/admin/create-group-modal.tsx b/apps/frontend/components/admin/create-group-modal.tsx
new file mode 100644
index 0000000..31176e8
--- /dev/null
+++ b/apps/frontend/components/admin/create-group-modal.tsx
@@ -0,0 +1,118 @@
+"use client";
+
+import { useRef, useState, useTransition } from "react";
+import { useRouter } from "next/navigation";
+
+import { createGroup } from "@/app/actions/groups";
+import { GlassButton } from "@/components/ui/glass-button";
+import { GlassField, GlassInput } from "@/components/ui/glass-input";
+
+export interface CreateGroupModalLabels {
+ title: string;
+ name: string;
+ namePlaceholder: string;
+ slug: string;
+ slugPlaceholder: string;
+ slugHelper: string;
+ startsAt: string;
+ endsAt: string;
+ create: string;
+ cancel: string;
+}
+
+interface CreateGroupModalProps {
+ open: boolean;
+ onClose: () => void;
+ labels: CreateGroupModalLabels;
+}
+
+export function CreateGroupModal({ open, onClose, labels }: CreateGroupModalProps) {
+ const router = useRouter();
+ const [pending, start] = useTransition();
+ const [error, setError] = useState("");
+ const formRef = useRef
(null);
+
+ if (!open) return null;
+
+ function handleSubmit(e: React.FormEvent) {
+ e.preventDefault();
+ const form = e.currentTarget;
+ const fd = new FormData(form);
+ const name = (fd.get("name") as string).trim();
+ const slug = (fd.get("slug") as string).trim() || undefined;
+ const startsAt = (fd.get("startsAt") as string) || null;
+ const endsAt = (fd.get("endsAt") as string) || null;
+
+ setError("");
+ start(async () => {
+ const res = await createGroup({ name, slug, startsAt, endsAt });
+ if (res.ok) {
+ router.refresh();
+ onClose();
+ } else {
+ setError(res.error ?? "Une erreur est survenue.");
+ }
+ });
+ }
+
+ function handleClose() {
+ setError("");
+ onClose();
+ }
+
+ return (
+
+
+
+ {labels.title}
+
+
+
+
+
setOpen(true)}>
+ {newGroup}
+
+ setOpen(false)} labels={form} />
+
+ );
+}
diff --git a/apps/frontend/components/admin/groups-grid.tsx b/apps/frontend/components/admin/groups-grid.tsx
new file mode 100644
index 0000000..4481216
--- /dev/null
+++ b/apps/frontend/components/admin/groups-grid.tsx
@@ -0,0 +1,160 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useState, useTransition } from "react";
+
+import { deleteGroup } from "@/app/actions/groups";
+import { GlassCard, GlassCardContent } from "@/components/ui/glass-card";
+import { GlassChip } from "@/components/ui/glass-chip";
+import { ArrowRightIcon, BookIcon, TrashIcon, UsersIcon } from "@/components/ui/icons";
+
+interface GroupItem {
+ id: string;
+ name: string;
+ slug: string;
+ startsAt: string | null;
+ endsAt: string | null;
+}
+
+interface Labels {
+ members: string;
+ curriculum: string;
+ deleteConfirm: string;
+ deleteBtn: string;
+ empty: string;
+}
+
+interface GroupsGridProps {
+ groups: GroupItem[];
+ isAdmin: boolean;
+ labels: Labels;
+}
+
+interface GroupCardProps {
+ group: GroupItem;
+ isAdmin: boolean;
+ labels: Labels;
+}
+
+const PALETTE = [
+ { bg: "rgba(109,40,217,0.22)", text: "#a78bfa" },
+ { bg: "rgba(3,105,161,0.22)", text: "#38bdf8" },
+ { bg: "rgba(5,150,105,0.22)", text: "#34d399" },
+ { bg: "rgba(217,119,6,0.22)", text: "#fbbf24" },
+ { bg: "rgba(190,24,93,0.22)", text: "#f472b6" },
+ { bg: "rgba(126,34,206,0.22)", text: "#d8b4fe" },
+];
+
+function slugPalette(slug: string) {
+ let h = 0;
+ for (const c of slug) h = (h * 31 + c.charCodeAt(0)) >>> 0;
+ return PALETTE[h % PALETTE.length];
+}
+
+function formatDateRange(startsAt: string | null, endsAt: string | null) {
+ const fmt = (d: string) =>
+ new Date(d).toLocaleDateString("fr-FR", { month: "short", year: "numeric" });
+ if (startsAt && endsAt) return `${fmt(startsAt)} → ${fmt(endsAt)}`;
+ if (startsAt) return `Depuis ${fmt(startsAt)}`;
+ if (endsAt) return `Jusqu'au ${fmt(endsAt)}`;
+ return null;
+}
+
+function GroupCard({ group: g, isAdmin, labels }: GroupCardProps) {
+ const router = useRouter();
+ const [pending, start] = useTransition();
+ const [error, setError] = useState("");
+ const palette = slugPalette(g.slug);
+ const dateLabel = formatDateRange(g.startsAt, g.endsAt);
+
+ function handleDelete() {
+ if (!confirm(`${labels.deleteConfirm}\n\n"${g.name}"`)) return;
+ setError("");
+ start(async () => {
+ const res = await deleteGroup(g.id);
+ if (!res.ok) {
+ setError(res.error ?? "Erreur lors de la suppression.");
+ return;
+ }
+ router.refresh();
+ });
+ }
+
+ return (
+
+
+ {/* Header */}
+
+
+ {g.name[0]}
+
+
+
+
+ {isAdmin && (
+
+
+ )}
+
+ {dateLabel}
+
+ )}
+
+ {error && {error}
}
+
+
+
+ {labels.members}
+
+
+ {labels.curriculum}
+
+
+ );
+}
+
+export function GroupsGrid({ groups, isAdmin, labels }: GroupsGridProps) {
+ if (groups.length === 0) {
+ return {labels.empty}
;
+ }
+
+ return (
+
+ {groups.map((g) => (
+
+ );
+}
diff --git a/apps/frontend/components/admin/invitations-panel.tsx b/apps/frontend/components/admin/invitations-panel.tsx
new file mode 100644
index 0000000..fe0d65c
--- /dev/null
+++ b/apps/frontend/components/admin/invitations-panel.tsx
@@ -0,0 +1,176 @@
+"use client";
+
+import { useState, useTransition } from "react";
+import { useRouter } from "next/navigation";
+
+import { createInvitation, type Invitation } from "@/app/actions/groups";
+import { GlassButton } from "@/components/ui/glass-button";
+import { GlassCard, GlassCardContent } from "@/components/ui/glass-card";
+import { GlassField, GlassInput } from "@/components/ui/glass-input";
+
+interface Labels {
+ invitationsTitle: string;
+ invitationsDesc: string;
+ newInvitation: string;
+ invitationFormMaxUses: string;
+ invitationFormExpiresAt: string;
+ invitationFormCreate: string;
+ code: string;
+ uses: string;
+ expires: string;
+ noExpiry: string;
+ noInvitations: string;
+ copyCode: string;
+}
+
+interface InvitationsPanelProps {
+ groupId: string;
+ initialInvitations: Invitation[];
+ labels: Labels;
+}
+
+export function InvitationsPanel({
+ groupId,
+ initialInvitations,
+ labels,
+}: InvitationsPanelProps) {
+ const router = useRouter();
+ const [pending, start] = useTransition();
+ const [showForm, setShowForm] = useState(false);
+ const [error, setError] = useState("");
+ const [copied, setCopied] = useState(null);
+ // Local copy for optimistic updates
+ const [invitations, setInvitations] = useState(initialInvitations);
+
+ function handleCopy(code: string) {
+ navigator.clipboard.writeText(code).then(() => {
+ setCopied(code);
+ setTimeout(() => setCopied(null), 2000);
+ }).catch(() => {
+ // Fallback for non-secure contexts
+ setCopied(code);
+ setTimeout(() => setCopied(null), 2000);
+ });
+ }
+
+ function handleSubmit(e: React.FormEvent) {
+ e.preventDefault();
+ const form = e.currentTarget;
+ const fd = new FormData(form);
+ const maxUses = parseInt(fd.get("maxUses") as string, 10) || 1;
+ const rawExpiry = fd.get("expiresAt") as string;
+ const expiresAt = rawExpiry ? new Date(rawExpiry).toISOString() : undefined;
+
+ setError("");
+ start(async () => {
+ const res = await createInvitation(groupId, maxUses, expiresAt);
+ if (res.ok && res.invitation) {
+ setInvitations((prev) => [res.invitation!, ...prev]);
+ setShowForm(false);
+ form.reset();
+ router.refresh();
+ } else {
+ setError(res.error ?? "Erreur lors de la création.");
+ }
+ });
+ }
+
+ return (
+
+
+
+
{labels.invitationsTitle}
+
{labels.invitationsDesc}
+
+
setShowForm((v) => !v)}
+ className="shrink-0"
+ >
+ {labels.newInvitation}
+
+
+
+
+ {error && {error}
}
+
+
+ )}
+
+ {invitations.length === 0 ? (
+ {labels.noInvitations}
+ ) : (
+
+ {invitations.map((inv) => (
+
+
+
+
+ {inv.code}
+
+
+ {labels.uses
+ .replace("{used}", String(inv.usedCount))
+ .replace("{max}", String(inv.maxUses))}
+ {" · "}
+ {inv.expiresAt
+ ? labels.expires.replace(
+ "{date}",
+ new Date(inv.expiresAt).toLocaleDateString()
+ )
+ : labels.noExpiry}
+
+
+ handleCopy(inv.code)}
+ >
+ {copied === inv.code ? "✓" : labels.copyCode}
+
+
+
+ ))}
+
+ );
+}
diff --git a/apps/frontend/components/block-kinds/code.tsx b/apps/frontend/components/block-kinds/code.tsx
index 6aba827..6e7e41e 100644
--- a/apps/frontend/components/block-kinds/code.tsx
+++ b/apps/frontend/components/block-kinds/code.tsx
@@ -10,7 +10,7 @@ export const CodeModule: BlockKindModule = {
return (
{getStr(block.payload, "code")}
diff --git a/apps/frontend/components/block-kinds/sandbox.tsx b/apps/frontend/components/block-kinds/sandbox.tsx
index 1c77f22..c29bb28 100644
--- a/apps/frontend/components/block-kinds/sandbox.tsx
+++ b/apps/frontend/components/block-kinds/sandbox.tsx
@@ -31,7 +31,7 @@ export const SandboxModule: BlockKindModule = {
+
{code}
{expectedOutput && (
diff --git a/apps/frontend/components/course/catalog-course-card.tsx b/apps/frontend/components/course/catalog-course-card.tsx
new file mode 100644
index 0000000..dc1196e
--- /dev/null
+++ b/apps/frontend/components/course/catalog-course-card.tsx
@@ -0,0 +1,99 @@
+"use client";
+
+import Link from "next/link";
+import { useTranslations } from "next-intl";
+
+import { CourseMeta } from "@/components/course/course-meta";
+import { GlassCard } from "@/components/ui/glass-card";
+import { ArrowRightIcon } from "@/components/ui/icons";
+import type { CourseSummary } from "@/lib/types";
+
+/** Citron-aligned accent tokens used to give each cover a distinct hue. */
+const COVER_TOKENS = [
+ "--color-accent",
+ "--color-success",
+ "--color-warning",
+ "--color-danger",
+ "--color-tip",
+ "--color-green",
+] as const;
+
+/** Stable hash so a course always gets the same cover. */
+function pickToken(seed: string): string {
+ let h = 0;
+ for (let i = 0; i < seed.length; i++) h = (h * 31 + seed.charCodeAt(i)) >>> 0;
+ return COVER_TOKENS[h % COVER_TOKENS.length];
+}
+
+function initial(title: string): string {
+ const m = title.match(/\p{L}|\p{N}/u);
+ return (m?.[0] ?? "•").toUpperCase();
+}
+
+export function CatalogCourseCard({
+ course,
+ locale = "fr",
+}: {
+ course: CourseSummary;
+ locale?: "fr" | "en";
+}) {
+ const t = useTranslations("catalog");
+ const token = pickToken(course.slug || course.id);
+
+ return (
+
+ {/* Cover */}
+
+
+ {initial(course.title)}
+
+
+
+ {/* Body */}
+
+
+
+
+ {course.title}
+
+
+ {course.description && (
+
+ {course.description}
+
+ )}
+
+
+
+ {course.authorName ? t("by", { author: course.authorName }) : " "}
+
+
+
+
+
+
+ );
+}
diff --git a/apps/frontend/components/course/catalog-grid.tsx b/apps/frontend/components/course/catalog-grid.tsx
index 868ac83..ef1d76d 100644
--- a/apps/frontend/components/course/catalog-grid.tsx
+++ b/apps/frontend/components/course/catalog-grid.tsx
@@ -1,35 +1,28 @@
"use client";
import { useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
-import { CourseCard } from "@/components/course/course-card";
+import { CatalogCourseCard } from "@/components/course/catalog-course-card";
import { EmptyState } from "@/components/course/empty-state";
import { GlassChip } from "@/components/ui/glass-chip";
import { GlassInput } from "@/components/ui/glass-input";
import { BookIcon } from "@/components/ui/icons";
+import { cn } from "@/lib/utils";
import type { CourseSummary } from "@/lib/types";
-interface Labels {
- search: string;
- empty: string;
- emptyFiltered: string;
- tabAll: string;
- tabMine: string;
-}
-
interface CatalogGridProps {
allCourses: CourseSummary[];
groupCourseIds: string[];
- labels: Labels;
locale: "fr" | "en";
}
export function CatalogGrid({
allCourses,
groupCourseIds,
- labels,
locale,
}: CatalogGridProps) {
+ const t = useTranslations("catalog");
const [scope, setScope] = useState<"all" | "mine">("all");
const [query, setQuery] = useState("");
const [category, setCategory] = useState(null);
@@ -54,35 +47,46 @@ export function CatalogGrid({
});
}, [allCourses, scope, groupSet, category, query]);
+ const scopes: { id: "all" | "mine"; label: string }[] = [
+ { id: "all", label: t("tabs.all") },
+ { id: "mine", label: t("tabs.mine") },
+ ];
+
return (
-
-
-
-
setScope("all")}
- >
- {labels.tabAll}
-
-
setScope("mine")}
- >
- {labels.tabMine}
-
+
+ {/* Toolbar */}
+
+
+
+ {scopes.map((s) => (
+ setScope(s.id)}
+ aria-pressed={scope === s.id}
+ className={cn(
+ "rounded-full px-4 py-1.5 text-[0.85rem] transition-colors",
+ scope === s.id
+ ? "bg-[color:var(--color-accent)] text-[color:var(--color-accent-fg)]"
+ : "text-text-soft hover:text-text"
+ )}
+ >
+ {s.label}
+
+ ))}
+
+
+ {t("results", { count: filtered.length })}
+
-
- setQuery(e.target.value)}
- placeholder={labels.search}
- className="max-w-md"
- />
-
+
setQuery(e.target.value)}
+ placeholder={t("search")}
+ className="w-full"
+ />
{categories.length > 0 && (
@@ -92,7 +96,7 @@ export function CatalogGrid({
size="sm"
onClick={() => setCategory(null)}
>
- ✦
+ {t("allCategories")}
{categories.map((c) => (
}
- title={query || category ? labels.emptyFiltered : labels.empty}
+ title={query || category ? t("emptyFiltered") : t("empty")}
/>
) : (
-
+
{filtered.map((c) => (
-
))}
diff --git a/apps/frontend/components/course/course-save-button.tsx b/apps/frontend/components/course/course-save-button.tsx
new file mode 100644
index 0000000..c7ef6f6
--- /dev/null
+++ b/apps/frontend/components/course/course-save-button.tsx
@@ -0,0 +1,63 @@
+"use client";
+
+import { useState, useTransition } from "react";
+
+import { createBookmark, deleteBookmark } from "@/app/actions/bookmarks";
+import { GlassButton } from "@/components/ui/glass-button";
+import { BookmarkFilledIcon, BookmarkIcon } from "@/components/ui/icons";
+
+interface CourseSaveButtonProps {
+ courseId: string;
+ /** First block of the course — used as the (hidden) anchor of the course-level bookmark. */
+ firstBlockId: string | null;
+ initialId: string | null;
+ labelSave: string;
+ labelSaved: string;
+ size?: "sm" | "md" | "lg";
+}
+
+/**
+ * Course-level "save" toggle. The backend only stores block-level bookmarks,
+ * so a saved course is materialised as a single bookmark anchored on its first
+ * block. This anchor is invisible to the user: the UI only ever talks about
+ * saving the course.
+ */
+export function CourseSaveButton({
+ courseId,
+ firstBlockId,
+ initialId,
+ labelSave,
+ labelSaved,
+ size = "md",
+}: CourseSaveButtonProps) {
+ const [id, setId] = useState(initialId);
+ const [pending, start] = useTransition();
+ const active = id !== null;
+
+ function toggle() {
+ if (pending || !firstBlockId) return;
+ start(async () => {
+ if (active && id) {
+ const r = await deleteBookmark(id);
+ if (r.ok) setId(null);
+ } else {
+ const r = await createBookmark(courseId, firstBlockId);
+ if (r.ok && r.id) setId(r.id);
+ }
+ });
+ }
+
+ return (
+
+ {active ?
+ );
+}
diff --git a/apps/frontend/components/home/aurora-layer.tsx b/apps/frontend/components/home/aurora-layer.tsx
new file mode 100644
index 0000000..532952b
--- /dev/null
+++ b/apps/frontend/components/home/aurora-layer.tsx
@@ -0,0 +1,90 @@
+/**
+ * Couche décorative animée pour les pages publiques (home, auth).
+ * Aurora conique + orbes flottants + grille en fondu + particules
+ * scintillantes. Purement décoratif (`aria-hidden`), sans JS.
+ * Toutes les animations sont neutralisées par `prefers-reduced-motion`
+ * (cf. globals.css).
+ */
+
+// Positions déterministes (pas de Math.random → pas de mismatch d'hydratation).
+const PARTICLES = [
+ { top: "16%", left: "12%", size: 5, delay: "0s", dur: "5s" },
+ { top: "28%", left: "82%", size: 3, delay: "0.8s", dur: "4s" },
+ { top: "44%", left: "24%", size: 4, delay: "1.6s", dur: "6s" },
+ { top: "62%", left: "70%", size: 6, delay: "0.4s", dur: "5.5s" },
+ { top: "74%", left: "18%", size: 3, delay: "2.2s", dur: "4.5s" },
+ { top: "22%", left: "54%", size: 4, delay: "1.2s", dur: "6.5s" },
+ { top: "82%", left: "46%", size: 5, delay: "0.2s", dur: "5s" },
+ { top: "38%", left: "90%", size: 3, delay: "1.9s", dur: "4.2s" },
+ { top: "55%", left: "8%", size: 4, delay: "2.6s", dur: "6s" },
+ { top: "10%", left: "38%", size: 3, delay: "1.4s", dur: "5.2s" },
+ { top: "68%", left: "58%", size: 5, delay: "0.6s", dur: "4.8s" },
+ { top: "48%", left: "62%", size: 3, delay: "2.0s", dur: "5.6s" },
+];
+
+export function AuroraLayer({ className = "" }: { className?: string }) {
+ return (
+
+ {/* Faisceau conique en rotation — coeur lumineux de la scène. */}
+
+
+ {/* Orbes flottants. */}
+
+
+
+ {/* Grille fine, en fondu radial vers les bords. */}
+
+
+ {/* Particules scintillantes. */}
+ {PARTICLES.map((p, i) => (
+
+ ))}
+
(null);
+
+function systemResolved(): ResolvedTheme {
+ if (typeof window === "undefined") {
+ return DEFAULT_THEME === "light" ? "light" : "dark";
+ }
+ return window.matchMedia("(prefers-color-scheme: dark)").matches
+ ? "dark"
+ : "light";
+}
+
+function applyResolved(theme: Theme): ResolvedTheme {
+ const resolved: ResolvedTheme =
+ theme === "system" ? systemResolved() : theme;
+ if (typeof document !== "undefined") {
+ document.documentElement.dataset.theme = resolved;
+ }
+ return resolved;
+}
+
+export function ThemeProvider({
+ initialTheme,
+ initialResolved,
+ children,
+}: {
+ initialTheme: Theme;
+ initialResolved: ResolvedTheme;
+ children: React.ReactNode;
+}) {
+ const [theme, setThemeState] = React.useState(initialTheme);
+ const [resolved, setResolved] =
+ React.useState(initialResolved);
+
+ // Keep `system` in sync with OS changes while the page is open.
+ React.useEffect(() => {
+ if (theme !== "system") return;
+ const mq = window.matchMedia("(prefers-color-scheme: dark)");
+ const onChange = () => setResolved(applyResolved("system"));
+ mq.addEventListener("change", onChange);
+ return () => mq.removeEventListener("change", onChange);
+ }, [theme]);
+
+ const setTheme = React.useCallback((next: Theme) => {
+ setThemeState(next);
+ setResolved(applyResolved(next));
+ void setThemeAction(next);
+ }, []);
+
+ const toggle = React.useCallback(() => {
+ setTheme(
+ (theme === "system" ? systemResolved() : theme) === "dark"
+ ? "light"
+ : "dark"
+ );
+ }, [theme, setTheme]);
+
+ const value = React.useMemo(
+ () => ({ theme, resolved, setTheme, toggle }),
+ [theme, resolved, setTheme, toggle]
+ );
+
+ return (
+ {children}
+ );
+}
+
+export function useTheme(): ThemeContextValue {
+ const ctx = React.useContext(ThemeContext);
+ if (!ctx) throw new Error("useTheme must be used within ");
+ return ctx;
+}
diff --git a/apps/frontend/components/theme-script.tsx b/apps/frontend/components/theme-script.tsx
new file mode 100644
index 0000000..16989e6
--- /dev/null
+++ b/apps/frontend/components/theme-script.tsx
@@ -0,0 +1,15 @@
+/**
+ * Inline blocking script — runs before paint to correct the `system` theme.
+ *
+ * The server already sets from the cookie (default = dark).
+ * When the cookie is "system", the server cannot know the OS preference, so
+ * this script reads `matchMedia` synchronously and fixes data-theme before the
+ * first paint → no flash of the wrong theme (FOUC).
+ */
+
+import { THEME_COOKIE } from "@/lib/theme";
+
+export function ThemeScript() {
+ const js = `(function(){try{var m=document.cookie.match(/(?:^|; )${THEME_COOKIE}=([^;]+)/);var v=m?decodeURIComponent(m[1]):null;if(v==="system"||!v&&false){var d=window.matchMedia("(prefers-color-scheme: dark)").matches;document.documentElement.dataset.theme=d?"dark":"light";}}catch(e){}})();`;
+ return ;
+}
diff --git a/apps/frontend/components/theme-toggle.tsx b/apps/frontend/components/theme-toggle.tsx
new file mode 100644
index 0000000..50483c1
--- /dev/null
+++ b/apps/frontend/components/theme-toggle.tsx
@@ -0,0 +1,69 @@
+"use client";
+
+/**
+ * Light/dark toggle (glass pill). Shows the icon of the theme it will switch
+ * TO. Placed in the top-nav next to the locale switcher.
+ */
+
+import * as React from "react";
+import { useTranslations } from "next-intl";
+
+import { useTheme } from "@/components/theme-provider";
+
+function SunIcon({ size = 18 }: { size?: number }) {
+ return (
+
+
+ );
+}
+
+function MoonIcon({ size = 18 }: { size?: number }) {
+ return (
+
+
+ );
+}
+
+export function ThemeToggle({ className }: { className?: string }) {
+ const t = useTranslations("theme");
+ const { resolved, toggle } = useTheme();
+ const next = resolved === "dark" ? "light" : "dark";
+
+ return (
+
+ {resolved === "dark" ?
+ );
+}
diff --git a/apps/frontend/components/top-nav.tsx b/apps/frontend/components/top-nav.tsx
index 157028e..2c6a074 100644
--- a/apps/frontend/components/top-nav.tsx
+++ b/apps/frontend/components/top-nav.tsx
@@ -1,9 +1,7 @@
/**
- * TopNav publique — adaptative selon l'état d'authentification.
- * - Visiteur : CTA "Rejoindre avec un code" + "Se connecter"
- * - Authentifié : avatar + UserMenu (rôle, groupes, déconnexion)
- *
- * Liens contextuels supplémentaires affichés selon le rôle (admin, teacher).
+ * TopNav — adaptative selon l'état d'authentification.
+ * - Visiteur : toggle thème + CTA "Rejoindre avec un code" + "Se connecter"
+ * - Authentifié : liens contextuels par rôle + toggle thème + UserMenu
*/
import Link from "next/link";
@@ -12,11 +10,20 @@ import { getTranslations } from "next-intl/server";
import { getMe } from "@/app/actions/auth";
import { getInstanceBranding } from "@/app/actions/instance";
import { BrandMark, type LogoPreset } from "@/components/brand-mark";
+import { ThemeToggle } from "@/components/theme-toggle";
import { UserMenu } from "@/components/user-menu";
import { GlassButton } from "@/components/ui/glass-button";
import { GlassNav, GlassNavInner } from "@/components/ui/glass-nav";
import { KeyIcon } from "@/components/ui/icons";
import { isAdmin, isStaff } from "@/lib/roles";
+import type { Role } from "@/lib/types";
+
+/** Role-appropriate "home" route (matches the /dashboard dispatcher). */
+function homeHref(role: Role): string {
+ if (isAdmin(role)) return "/admin";
+ if (isStaff(role)) return "/studio";
+ return "/learn";
+}
export async function TopNav() {
const [t, branding, me] = await Promise.all([
@@ -26,6 +33,8 @@ export async function TopNav() {
]);
const preset = branding.logo.value as LogoPreset;
+ const navLinkClass =
+ "rounded-full px-3 py-1.5 text-[0.88rem] text-text-soft hover:bg-[color:var(--glass-bg)] hover:text-text";
return (
@@ -44,30 +53,30 @@ export async function TopNav() {
aria-label={t("sectionsLabel")}
className="ml-6 hidden items-center gap-1 md:flex"
>
- (null);
+
+ React.useEffect(() => {
+ const el = ref.current;
+ if (!el) return;
+ if (window.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
+
+ let raf = 0;
+ const onMove = (e: PointerEvent) => {
+ const rect = el.getBoundingClientRect();
+ const cx = rect.left + rect.width / 2;
+ const cy = rect.top + rect.height / 2;
+ const dx = (e.clientX - cx) / (rect.width / 2);
+ const dy = (e.clientY - cy) / (rect.height / 2);
+ if (raf) cancelAnimationFrame(raf);
+ raf = requestAnimationFrame(() => {
+ el.style.transform = `translate3d(${dx * strength}px, ${dy * strength}px, 0)`;
+ });
+ };
+ const reset = () => {
+ if (raf) cancelAnimationFrame(raf);
+ el.style.transform = "translate3d(0, 0, 0)";
+ };
+
+ el.addEventListener("pointermove", onMove);
+ el.addEventListener("pointerleave", reset);
+ return () => {
+ el.removeEventListener("pointermove", onMove);
+ el.removeEventListener("pointerleave", reset);
+ if (raf) cancelAnimationFrame(raf);
+ };
+ }, [strength]);
+
+ return (
+
+ {children}
+
+ );
+}
diff --git a/apps/frontend/components/ui/slide-to-confirm.tsx b/apps/frontend/components/ui/slide-to-confirm.tsx
new file mode 100644
index 0000000..6d3b41e
--- /dev/null
+++ b/apps/frontend/components/ui/slide-to-confirm.tsx
@@ -0,0 +1,255 @@
+"use client";
+
+/**
+ * SlideToConfirm — on valide en faisant glisser la poignée jusqu'au bout,
+ * au lieu d'un simple clic. Fantaisie maîtrisée : geste volontaire, retour
+ * élastique si on relâche trop tôt, état « confirmé » puis chargement.
+ *
+ * Accessibilité :
+ * - la poignée est un bouton focusable (rôle slider) ;
+ * - au clavier : ←/→ déplacent, Entrée/Espace confirment directement ;
+ * - `prefers-reduced-motion` → bascule en bouton plein classique (1 clic).
+ */
+
+import * as React from "react";
+
+import { cn } from "@/lib/utils";
+import { ArrowRightIcon, CheckIcon } from "@/components/ui/icons";
+
+interface SlideToConfirmProps {
+ onConfirm: () => void;
+ label: string;
+ confirmedLabel: string;
+ /** Libellé accessible de l'action (ex. « Créer mon compte »). */
+ ariaLabel: string;
+ loading?: boolean;
+ disabled?: boolean;
+ className?: string;
+}
+
+const THRESHOLD = 0.9;
+
+function usePrefersReducedMotion() {
+ return React.useSyncExternalStore(
+ (cb) => {
+ const m = window.matchMedia("(prefers-reduced-motion: reduce)");
+ m.addEventListener("change", cb);
+ return () => m.removeEventListener("change", cb);
+ },
+ () => window.matchMedia("(prefers-reduced-motion: reduce)").matches,
+ () => false
+ );
+}
+
+const Spinner = () => (
+
+
+);
+
+export function SlideToConfirm({
+ onConfirm,
+ label,
+ confirmedLabel,
+ ariaLabel,
+ loading = false,
+ disabled = false,
+ className,
+}: SlideToConfirmProps) {
+ const [progress, setProgress] = React.useState(0); // 0 → 1
+ const [confirmed, setConfirmed] = React.useState(false);
+ const [dragging, setDragging] = React.useState(false);
+ const reduce = usePrefersReducedMotion();
+
+ const trackRef = React.useRef(null);
+ const confirmedRef = React.useRef(false);
+
+ const fire = React.useCallback(() => {
+ if (confirmedRef.current) return;
+ confirmedRef.current = true;
+ setConfirmed(true);
+ setDragging(false);
+ setProgress(1);
+ onConfirm();
+ }, [onConfirm]);
+
+ // Après une tentative, on réarme la poignée si on est toujours là
+ // (échec de validation / d'auth). En cas de succès, le composant est
+ // démonté par la navigation — aucun reset visible.
+ React.useEffect(() => {
+ if (!confirmed || loading) return;
+ const id = window.setTimeout(() => {
+ confirmedRef.current = false;
+ setConfirmed(false);
+ setProgress(0);
+ }, 650);
+ return () => window.clearTimeout(id);
+ }, [confirmed, loading]);
+
+ const locked = disabled || loading || confirmed;
+
+ const computeProgress = (clientX: number) => {
+ const track = trackRef.current;
+ if (!track) return 0;
+ const rect = track.getBoundingClientRect();
+ const usable = rect.width - rect.height; // largeur moins la poignée
+ if (usable <= 0) return 0;
+ return Math.min(
+ 1,
+ Math.max(0, (clientX - rect.left - rect.height / 2) / usable)
+ );
+ };
+
+ const onPointerDown = (e: React.PointerEvent) => {
+ if (locked) return;
+ setDragging(true);
+ (e.target as HTMLElement).setPointerCapture?.(e.pointerId);
+ setProgress(computeProgress(e.clientX));
+ };
+
+ const onPointerMove = (e: React.PointerEvent) => {
+ if (!dragging || locked) return;
+ const p = computeProgress(e.clientX);
+ setProgress(p);
+ if (p >= THRESHOLD) fire();
+ };
+
+ const endDrag = () => {
+ if (!dragging) return;
+ setDragging(false);
+ if (!confirmedRef.current) setProgress(0); // retour élastique
+ };
+
+ const onKeyDown = (e: React.KeyboardEvent) => {
+ if (locked) return;
+ if (e.key === "Enter" || e.key === " ") {
+ e.preventDefault();
+ fire();
+ } else if (e.key === "ArrowRight") {
+ e.preventDefault();
+ setProgress((p) => {
+ const next = Math.min(1, p + 0.2);
+ if (next >= THRESHOLD) fire();
+ return next;
+ });
+ } else if (e.key === "ArrowLeft") {
+ e.preventDefault();
+ setProgress((p) => Math.max(0, p - 0.2));
+ }
+ };
+
+ // ── Fallback mouvement réduit : bouton plein classique ──
+ if (reduce) {
+ return (
+ !locked && fire()}
+ disabled={disabled || loading}
+ aria-busy={loading || undefined}
+ className={cn(
+ "inline-flex h-14 w-full items-center justify-center gap-2 rounded-full font-medium",
+ "bg-[color:var(--color-accent)] text-[color:var(--color-accent-fg)]",
+ "disabled:pointer-events-none disabled:opacity-50",
+ className
+ )}
+ >
+ {loading ?
+ );
+ }
+
+ const pct = Math.round(progress * 100);
+ const settle = !dragging;
+
+ return (
+
+ {/* Remplissage accent qui suit la poignée. */}
+
+
+ {/* Libellé centré, qui s'efface à mesure qu'on glisse. */}
+
+ {label}
+
+
+ {confirmedLabel}
+
+
+ {/* Poignée. */}
+
+ {loading ? (
+
+
to avoid a flash of the wrong theme.
+ */
+
+export const THEME_COOKIE = "codestar_theme";
+
+export type Theme = "light" | "dark" | "system";
+export type ResolvedTheme = "light" | "dark";
+
+/** Default when no cookie is present. Design system is "citron-dark". */
+export const DEFAULT_THEME: Theme = "dark";
+
+export function isTheme(value: string | undefined | null): value is Theme {
+ return value === "light" || value === "dark" || value === "system";
+}
+
+/**
+ * Server-side resolution. `system` cannot be resolved on the server (the OS
+ * preference is unknown), so it falls back to the default resolved theme; the
+ * inline script then corrects it on the client before paint.
+ */
+export function resolveTheme(theme: Theme): ResolvedTheme {
+ if (theme === "light" || theme === "dark") return theme;
+ return DEFAULT_THEME === "light" ? "light" : "dark";
+}
diff --git a/apps/frontend/messages/en.json b/apps/frontend/messages/en.json
index c86eb69..7b62c95 100644
--- a/apps/frontend/messages/en.json
+++ b/apps/frontend/messages/en.json
@@ -8,7 +8,15 @@
"catalog": "Catalog",
"myCourses": "My courses",
"teach": "Teach",
- "admin": "Admin"
+ "admin": "Admin",
+ "manageCourses": "Courses",
+ "users": "Users",
+ "groups": "Groups"
+ },
+ "theme": {
+ "toggleTo": "Switch to {mode} mode",
+ "light": "light",
+ "dark": "dark"
},
"footer": {
"rights": "© {year} · All rights reserved",
@@ -20,45 +28,12 @@
"label": "Footer"
},
"home": {
- "hero": {
- "chip": "New courses every week",
- "ctaSecondary": "Browse catalog",
- "comingSoon": "soon",
- "stats": {
- "courses": "courses",
- "learnersValue": "{count, number}",
- "learners": "learners",
- "ratingLabel": "{value} average"
- },
- "previewLabel": "Preview"
- },
- "featured": {
- "title": "Featured courses",
- "subtitle": "A deliberately short selection. The full catalog is available once you're signed in.",
- "by": "by {author}",
- "linkAria": "View {title} (sign-in required)"
- },
- "pillars": {
- "reader": {
- "title": "A reader you'll come back to",
- "description": "Table of contents, bookmarks, per-section notes. Built for return visits, not endless scroll."
- },
- "progress": {
- "title": "Motivating progression",
- "description": "XP, leaderboard, streaks. Keep the flame, don't force it. Weekly reset."
- },
- "authors": {
- "title": "Courses by people who know",
- "description": "Curated authors, content kept up to date, examples that match real work."
+ "landing": {
+ "facts": {
+ "openSource": "Open-source",
+ "license": "GPL v3",
+ "selfHosted": "Self-hosted"
}
- },
- "finalCta": {
- "titlePart1": "Ready to",
- "titlePart2": "begin",
- "titlePart3": "?",
- "subtitle": "Create a free account. Five minutes, your first lesson is already waiting.",
- "primary": "Get started",
- "secondary": "Join with a code"
}
},
"login": {
@@ -88,6 +63,10 @@
"signup": "Create my account",
"join": "Join"
},
+ "slide": {
+ "label": "Slide to confirm",
+ "confirmed": "Here we go"
+ },
"fields": {
"email": "Email",
"password": "Password",
@@ -123,14 +102,13 @@
"and": "and",
"privacy": "privacy policy"
},
- "decorative": {
- "license": "GPL v3",
- "selfHosted": "Self-hosted",
- "quote": "“We replaced our LMS with {name}. Our teachers love it.”",
- "quoteAuthor": "Naïma Mansouri",
- "quoteRole": "Head of Learning · Atelier 89",
- "streakLabel": "Today's streak",
- "streakValue": "14 days"
+ "aside": {
+ "subline": "Learn at your own pace, on an instance you control end to end.",
+ "facts": {
+ "openSource": "Open-source",
+ "license": "GPL v3",
+ "selfHosted": "Self-hosted"
+ }
}
},
"instance": {
@@ -194,6 +172,7 @@
"p": "Paragraph",
"quote": "Quote",
"code": "Code",
+ "callout": "Callout",
"image": "Image",
"table": "Table",
"quiz": "Quiz",
@@ -277,6 +256,24 @@
"export": {
"button": "Export"
},
+ "publish": "Save & publish",
+ "saveDraft": "Save draft",
+ "unpublish": "Unpublish",
+ "viewPublic": "View public page",
+ "addBlock": "Add block",
+ "more": "More",
+ "moveUp": "Move block up",
+ "moveDown": "Move block down",
+ "start": {
+ "title": "Where to begin?",
+ "lead": "Import a ready-made course, or compose your own block by block.",
+ "importTitle": "Import a file",
+ "importDesc": "Upload a course as JSON (.json). Its content and details will replace this course.",
+ "importButton": "Choose a file",
+ "composeTitle": "Compose by hand",
+ "composeDesc": "Start from a blank page and add your blocks: headings, paragraphs, quizzes, code…",
+ "composeButton": "Start writing"
+ },
"canvasEmpty": "No blocks yet. Click a block in the palette to start.",
"previewEmpty": "The preview will appear here.",
"inspectorTitle": "Inspector",
@@ -365,6 +362,8 @@
"start": "Start",
"resume": "Resume",
"review": "Review",
+ "save": "Save course",
+ "saved": "Course saved",
"progressLabel": "Your progress",
"bookmarksTitle": "Your bookmarks in this course",
"bookmarksEmpty": "No bookmark yet. Open the reader and tap the bookmark icon on a block.",
@@ -405,7 +404,10 @@
},
"search": "Search a course",
"empty": "No course yet.",
- "emptyFiltered": "No course matches your search."
+ "emptyFiltered": "No course matches your search.",
+ "results": "{count, plural, =0 {No course} one {# course} other {# courses}}",
+ "allCategories": "All",
+ "by": "By {author}"
},
"studentHome": {
"kicker": "{date}",
@@ -421,6 +423,47 @@
"discoverDesc": "Curated from your groups.",
"browseCta": "See full catalog"
},
+ "learn": {
+ "greeting": "Hi {name},",
+ "continueWithCourse": "Let's pick up where you left off.",
+ "startSomething": "Ready to start something new?",
+ "statInProgress": "In progress",
+ "statCompleted": "Completed",
+ "statBookmarks": "Bookmarks",
+ "resumeTitle": "Resume",
+ "allCourses": "All my courses",
+ "resumeEmpty": "Nothing in progress",
+ "resumeEmptyDesc": "Pick a course and start your streak today.",
+ "browseCta": "Browse catalog",
+ "resumeCta": "Resume",
+ "discoverTitle": "Discover",
+ "discoverDesc": "Published courses and those assigned to your groups.",
+ "discoverEmpty": "No course available yet.",
+ "openCta": "Open",
+ "groupsTitle": "My groups"
+ },
+ "studio": {
+ "kicker": "Studio · {name}",
+ "title": "Your courses and groups.",
+ "description": "Author, publish and assign courses to the groups you teach.",
+ "newCourse": "New course",
+ "generateAi": "Generate with AI",
+ "soon": "soon",
+ "statCourses": "My courses",
+ "statPublished": "Published",
+ "statDrafts": "Drafts",
+ "statGroups": "Groups taught",
+ "myCoursesTitle": "My courses",
+ "manageAll": "Manage all",
+ "noCourses": "No course yet",
+ "noCoursesDesc": "Create your first course to get started.",
+ "groupsTitle": "Groups I teach",
+ "noGroups": "You don't teach any group yet.",
+ "curriculumLink": "Curriculum",
+ "membersLink": "Members",
+ "settingsTitle": "Editor settings",
+ "maxBlocks": "Max blocks per page"
+ },
"myCourses": {
"title": "My courses",
"kicker": "Learning",
@@ -440,10 +483,11 @@
"ctaReview": "Review"
},
"bookmarks": {
- "title": "My bookmarks",
- "kicker": "Bookmarks",
- "description": "All your bookmarks, grouped by course.",
- "empty": "No bookmark yet. Tap the bookmark icon while reading a course.",
+ "title": "My saved courses",
+ "kicker": "Saved course",
+ "description": "The courses you saved to find them again later.",
+ "empty": "No saved course yet. Open a course and click \"Save course\".",
+ "open": "Open course",
"viewBlock": "Open in course",
"remove": "Remove",
"bookmarksCount": "{count, plural, one {# bookmark} other {# bookmarks}}"
@@ -481,6 +525,23 @@
"students": "Active students",
"groups": "Groups"
},
+ "kpi": {
+ "publishedDrafts": "{published} published · {drafts} drafts",
+ "users": "Users",
+ "disabled": "{count} disabled",
+ "active": "{count} active",
+ "catalogHealth": "Catalog health",
+ "usersByRole": "Users by role",
+ "published": "Published",
+ "drafts": "Drafts",
+ "archived": "Archived"
+ },
+ "superAdmin": {
+ "kicker": "SUPER-ADMIN",
+ "title": "Instance & branding · {name}",
+ "maxBlocks": "Max blocks/page: {n}",
+ "manageRoles": "Manage roles"
+ },
"recentTitle": "Recent courses",
"groupsTitle": "My groups",
"groupsManage": "Curriculum",
@@ -622,6 +683,47 @@
"save": "Save",
"cancel": "Cancel",
"saved": "Saved"
+ },
+ "groups": {
+ "kicker": "Group management",
+ "title": "Groups",
+ "description": "Create and manage your classes. Add students via invitation codes.",
+ "newGroup": "Create a group",
+ "empty": "No groups yet.",
+ "members": "Members",
+ "curriculum": "Courses",
+ "invitations": "Invitations",
+ "deleteConfirm": "Permanently delete this group?",
+ "deleteBtn": "Delete",
+ "form": {
+ "title": "Create a group",
+ "name": "Group name",
+ "namePlaceholder": "e.g. Year 9 class",
+ "slug": "Identifier (slug)",
+ "slugPlaceholder": "e.g. year-9-class",
+ "slugHelper": "Leave blank to auto-generate",
+ "startsAt": "Start date",
+ "endsAt": "End date",
+ "create": "Create",
+ "cancel": "Cancel"
+ },
+ "hub": {
+ "kicker": "Group · {name}",
+ "membersDesc": "Manage members and their roles in this group",
+ "curriculumDesc": "Assign courses accessible to this group",
+ "invitationsTitle": "Invitation codes",
+ "invitationsDesc": "Generate codes so users can join this group",
+ "newInvitation": "Generate a code",
+ "invitationFormMaxUses": "Max uses",
+ "invitationFormExpiresAt": "Expiry date (optional)",
+ "invitationFormCreate": "Generate",
+ "code": "Code",
+ "uses": "{used}/{max} uses",
+ "expires": "Expires {date}",
+ "noExpiry": "No expiry",
+ "noInvitations": "No active codes.",
+ "copyCode": "Copy"
+ }
}
}
}
diff --git a/apps/frontend/messages/fr.json b/apps/frontend/messages/fr.json
index fd874bc..f2f6ecc 100644
--- a/apps/frontend/messages/fr.json
+++ b/apps/frontend/messages/fr.json
@@ -8,7 +8,15 @@
"catalog": "Catalogue",
"myCourses": "Mes cours",
"teach": "Enseigner",
- "admin": "Admin"
+ "admin": "Admin",
+ "manageCourses": "Cours",
+ "users": "Utilisateurs",
+ "groups": "Groupes"
+ },
+ "theme": {
+ "toggleTo": "Passer en mode {mode}",
+ "light": "clair",
+ "dark": "sombre"
},
"footer": {
"rights": "© {year} · Tous droits réservés",
@@ -20,45 +28,12 @@
"label": "Pied de page"
},
"home": {
- "hero": {
- "chip": "Nouveaux cours chaque semaine",
- "ctaSecondary": "Voir le catalogue",
- "comingSoon": "bientôt",
- "stats": {
- "courses": "cours",
- "learnersValue": "{count, number}",
- "learners": "apprenants",
- "ratingLabel": "{value} de moyenne"
- },
- "previewLabel": "Aperçu"
- },
- "featured": {
- "title": "Cours mis en avant",
- "subtitle": "Une sélection volontairement courte. Tout le catalogue est accessible une fois connecté.",
- "by": "par {author}",
- "linkAria": "Voir {title} (connexion requise)"
- },
- "pillars": {
- "reader": {
- "title": "Lecteur soigné",
- "description": "Sommaire, marque-pages, notes par section. Pensé pour qu'on revienne, pas qu'on scroll."
- },
- "progress": {
- "title": "Progression motivante",
- "description": "XP, classement, séries. Garder la flamme, pas se forcer. Reset hebdomadaire."
- },
- "authors": {
- "title": "Cours faits par des gens qui savent",
- "description": "Auteurs sélectionnés, contenus mis à jour, exemples qui collent au métier."
+ "landing": {
+ "facts": {
+ "openSource": "Open-source",
+ "license": "GPL v3",
+ "selfHosted": "Self-hébergé"
}
- },
- "finalCta": {
- "titlePart1": "Prêt·e à",
- "titlePart2": "commencer",
- "titlePart3": "?",
- "subtitle": "Créez un compte gratuit. Cinq minutes, votre première leçon est déjà là.",
- "primary": "Commencer maintenant",
- "secondary": "Rejoindre avec un code"
}
},
"login": {
@@ -88,6 +63,10 @@
"signup": "Créer mon compte",
"join": "Rejoindre"
},
+ "slide": {
+ "label": "Glissez pour confirmer",
+ "confirmed": "C'est parti"
+ },
"fields": {
"email": "Email",
"password": "Mot de passe",
@@ -123,14 +102,13 @@
"and": "et",
"privacy": "politique de confidentialité"
},
- "decorative": {
- "license": "GPL v3",
- "selfHosted": "Self-hosted",
- "quote": "« On a remplacé notre LMS par {name}. Nos profs adorent. »",
- "quoteAuthor": "Naïma Mansouri",
- "quoteRole": "Head of Learning · Atelier 89",
- "streakLabel": "Série du jour",
- "streakValue": "14 jours"
+ "aside": {
+ "subline": "Apprenez à votre rythme, sur une instance que vous maîtrisez de bout en bout.",
+ "facts": {
+ "openSource": "Open-source",
+ "license": "GPL v3",
+ "selfHosted": "Self-hébergé"
+ }
}
},
"instance": {
@@ -194,6 +172,7 @@
"p": "Paragraphe",
"quote": "Citation",
"code": "Code",
+ "callout": "Encadré",
"image": "Image",
"table": "Tableau",
"quiz": "Quiz",
@@ -277,6 +256,24 @@
"export": {
"button": "Exporter"
},
+ "publish": "Enregistrer et publier",
+ "saveDraft": "Enregistrer le brouillon",
+ "unpublish": "Dépublier",
+ "viewPublic": "Voir la page publique",
+ "addBlock": "Ajouter un bloc",
+ "more": "Plus",
+ "moveUp": "Monter le bloc",
+ "moveDown": "Descendre le bloc",
+ "start": {
+ "title": "Par où commencer ?",
+ "lead": "Importez un cours déjà rédigé, ou composez le vôtre bloc par bloc.",
+ "importTitle": "Importer un fichier",
+ "importDesc": "Chargez un cours au format JSON (.json). Son contenu et ses informations remplaceront ce cours.",
+ "importButton": "Choisir un fichier",
+ "composeTitle": "Composer à la main",
+ "composeDesc": "Partez d'une page vierge et ajoutez vos blocs : titres, paragraphes, quiz, code…",
+ "composeButton": "Commencer à écrire"
+ },
"canvasEmpty": "Aucun bloc. Cliquez un bloc dans la palette pour commencer.",
"previewEmpty": "L'aperçu apparaîtra ici.",
"inspectorTitle": "Inspecteur",
@@ -365,6 +362,8 @@
"start": "Commencer",
"resume": "Reprendre",
"review": "Revoir",
+ "save": "Enregistrer le cours",
+ "saved": "Cours enregistré",
"progressLabel": "Votre progression",
"bookmarksTitle": "Vos favoris dans ce cours",
"bookmarksEmpty": "Aucun favori. Ouvrez le cours et cliquez sur l'icône favori sur un bloc.",
@@ -405,7 +404,10 @@
},
"search": "Rechercher un cours",
"empty": "Aucun cours pour l'instant.",
- "emptyFiltered": "Aucun cours ne correspond à votre recherche."
+ "emptyFiltered": "Aucun cours ne correspond à votre recherche.",
+ "results": "{count, plural, =0 {Aucun cours} one {# cours} other {# cours}}",
+ "allCategories": "Toutes",
+ "by": "Par {author}"
},
"studentHome": {
"kicker": "{date}",
@@ -421,6 +423,47 @@
"discoverDesc": "Sélection issue de vos groupes.",
"browseCta": "Voir tout le catalogue"
},
+ "learn": {
+ "greeting": "Bonjour {name},",
+ "continueWithCourse": "Reprenons là où vous vous êtes arrêté.",
+ "startSomething": "Prêt·e à démarrer quelque chose de nouveau ?",
+ "statInProgress": "En cours",
+ "statCompleted": "Terminés",
+ "statBookmarks": "Favoris",
+ "resumeTitle": "Reprendre",
+ "allCourses": "Tous mes cours",
+ "resumeEmpty": "Rien en cours",
+ "resumeEmptyDesc": "Choisissez un cours et démarrez votre série aujourd'hui.",
+ "browseCta": "Voir le catalogue",
+ "resumeCta": "Reprendre",
+ "discoverTitle": "Découvrir",
+ "discoverDesc": "Cours publiés et ceux assignés à vos groupes.",
+ "discoverEmpty": "Aucun cours disponible pour l'instant.",
+ "openCta": "Ouvrir",
+ "groupsTitle": "Mes groupes"
+ },
+ "studio": {
+ "kicker": "Studio · {name}",
+ "title": "Vos cours et groupes.",
+ "description": "Créez, publiez et assignez des cours aux groupes que vous animez.",
+ "newCourse": "Nouveau cours",
+ "generateAi": "Générer avec l'IA",
+ "soon": "bientôt",
+ "statCourses": "Mes cours",
+ "statPublished": "Publiés",
+ "statDrafts": "Brouillons",
+ "statGroups": "Groupes animés",
+ "myCoursesTitle": "Mes cours",
+ "manageAll": "Tout gérer",
+ "noCourses": "Aucun cours",
+ "noCoursesDesc": "Créez votre premier cours pour commencer.",
+ "groupsTitle": "Groupes que j'anime",
+ "noGroups": "Vous n'animez aucun groupe pour l'instant.",
+ "curriculumLink": "Curriculum",
+ "membersLink": "Membres",
+ "settingsTitle": "Réglages éditeur",
+ "maxBlocks": "Blocs max par page"
+ },
"myCourses": {
"title": "Mes cours",
"kicker": "Apprentissage",
@@ -440,13 +483,14 @@
"ctaReview": "Revoir"
},
"bookmarks": {
- "title": "Mes favoris",
- "kicker": "Favoris",
- "description": "Tous vos marque-pages, groupés par cours.",
- "empty": "Aucun favori pour l'instant. Cliquez sur l'icône favori dans le lecteur d'un cours.",
- "viewBlock": "Voir dans le cours",
+ "title": "Mes cours enregistrés",
+ "kicker": "Cours enregistré",
+ "description": "Les cours que vous avez enregistrés pour les retrouver plus tard.",
+ "empty": "Aucun cours enregistré pour l'instant. Ouvrez un cours et cliquez sur « Enregistrer le cours ».",
+ "open": "Ouvrir le cours",
+ "viewBlock": "Ouvrir dans le cours",
"remove": "Retirer",
- "bookmarksCount": "{count, plural, one {# favori} other {# favoris}}"
+ "bookmarksCount": "{count, plural, one {# cours enregistré} other {# cours enregistrés}}"
},
"dash": {
"title": "Mes progrès",
@@ -481,6 +525,23 @@
"students": "Étudiants actifs",
"groups": "Groupes"
},
+ "kpi": {
+ "publishedDrafts": "{published} publiés · {drafts} brouillons",
+ "users": "Utilisateurs",
+ "disabled": "{count} désactivés",
+ "active": "{count} actifs",
+ "catalogHealth": "Santé du catalogue",
+ "usersByRole": "Utilisateurs par rôle",
+ "published": "Publiés",
+ "drafts": "Brouillons",
+ "archived": "Archivés"
+ },
+ "superAdmin": {
+ "kicker": "SUPER-ADMIN",
+ "title": "Instance & branding · {name}",
+ "maxBlocks": "Blocs max/page : {n}",
+ "manageRoles": "Gérer les rôles"
+ },
"recentTitle": "Cours récents",
"groupsTitle": "Mes groupes",
"groupsManage": "Curriculum",
@@ -622,6 +683,47 @@
"save": "Enregistrer",
"cancel": "Annuler",
"saved": "Enregistré"
+ },
+ "groups": {
+ "kicker": "Gestion des groupes",
+ "title": "Groupes",
+ "description": "Créez et gérez vos classes. Ajoutez des élèves via des codes d'invitation.",
+ "newGroup": "Créer un groupe",
+ "empty": "Aucun groupe pour l'instant.",
+ "members": "Membres",
+ "curriculum": "Cours",
+ "invitations": "Invitations",
+ "deleteConfirm": "Supprimer ce groupe définitivement ?",
+ "deleteBtn": "Supprimer",
+ "form": {
+ "title": "Créer un groupe",
+ "name": "Nom du groupe",
+ "namePlaceholder": "ex. Classe de 3ème",
+ "slug": "Identifiant (slug)",
+ "slugPlaceholder": "ex. classe-3eme",
+ "slugHelper": "Laissez vide pour générer automatiquement",
+ "startsAt": "Date de début",
+ "endsAt": "Date de fin",
+ "create": "Créer",
+ "cancel": "Annuler"
+ },
+ "hub": {
+ "kicker": "Groupe · {name}",
+ "membersDesc": "Gérer les membres et leurs rôles dans ce groupe",
+ "curriculumDesc": "Assigner des cours accessibles à ce groupe",
+ "invitationsTitle": "Codes d'invitation",
+ "invitationsDesc": "Générez des codes pour inviter des utilisateurs à rejoindre ce groupe",
+ "newInvitation": "Générer un code",
+ "invitationFormMaxUses": "Utilisations maximum",
+ "invitationFormExpiresAt": "Date d'expiration (optionnel)",
+ "invitationFormCreate": "Générer",
+ "code": "Code",
+ "uses": "{used}/{max} utilisations",
+ "expires": "Expire le {date}",
+ "noExpiry": "Pas d'expiration",
+ "noInvitations": "Aucun code actif.",
+ "copyCode": "Copier"
+ }
}
}
}
diff --git a/apps/frontend/package.json b/apps/frontend/package.json
index e7ea010..e68ddd4 100644
--- a/apps/frontend/package.json
+++ b/apps/frontend/package.json
@@ -6,7 +6,8 @@
"dev": "next dev",
"build": "next build",
"start": "next start",
- "lint": "eslint"
+ "lint": "eslint",
+ "typecheck": "tsc --noEmit"
},
"engines": {
"node": ">=20.9.0"
diff --git a/apps/frontend/proxy.ts b/apps/frontend/proxy.ts
index 4681683..151c7b2 100644
--- a/apps/frontend/proxy.ts
+++ b/apps/frontend/proxy.ts
@@ -69,7 +69,7 @@ export async function proxy(req: NextRequest) {
}
if (hasValidToken && isOnLogin(pathname)) {
- return NextResponse.redirect(new URL("/", req.url));
+ return NextResponse.redirect(new URL("/dashboard", req.url));
}
if (!hasValidToken && !isPublic(pathname)) {
diff --git a/deploy/systemd/codestar-update.service b/deploy/systemd/codestar-update.service
new file mode 100644
index 0000000..7b2c016
--- /dev/null
+++ b/deploy/systemd/codestar-update.service
@@ -0,0 +1,22 @@
+# Codestar — auto-update unit (oneshot, triggered by codestar-update.timer).
+#
+# Install (edit User and the repo path to match your setup):
+# sudo cp deploy/systemd/codestar-update.* /etc/systemd/system/
+# sudo systemctl daemon-reload
+# sudo systemctl enable --now codestar-update.timer
+#
+# Inspect:
+# systemctl list-timers codestar-update.timer
+# journalctl -u codestar-update.service -f
+[Unit]
+Description=Codestar instance auto-update
+Wants=network-online.target
+After=network-online.target docker.service
+
+[Service]
+Type=oneshot
+User=ray
+WorkingDirectory=/home/ray/codestar
+ExecStart=/home/ray/codestar/update.sh --yes
+# Don't let a deploy hang forever.
+TimeoutStartSec=1800
diff --git a/deploy/systemd/codestar-update.timer b/deploy/systemd/codestar-update.timer
new file mode 100644
index 0000000..2cba7fc
--- /dev/null
+++ b/deploy/systemd/codestar-update.timer
@@ -0,0 +1,15 @@
+# Codestar — schedule for the auto-update service.
+# Default: every 15 minutes. Adjust OnCalendar to taste, e.g. "*-*-* 03:00:00"
+# for a nightly update at 3am.
+[Unit]
+Description=Run Codestar auto-update on a schedule
+
+[Timer]
+OnCalendar=*:0/15
+# Run a missed update if the VPS was off at the scheduled time.
+Persistent=true
+# Avoid all instances hitting GitHub at the same second.
+RandomizedDelaySec=120
+
+[Install]
+WantedBy=timers.target
diff --git a/docker-compose.monitoring.yml b/docker-compose.monitoring.yml
new file mode 100644
index 0000000..443d8f9
--- /dev/null
+++ b/docker-compose.monitoring.yml
@@ -0,0 +1,125 @@
+# ─────────────────────────────────────────────────────────────
+# Monitoring overlay — Prometheus + Grafana + Loki stack.
+#
+# Usage (always combined with the base, prod optional):
+# docker compose \
+# -f docker-compose.yml \
+# -f docker-compose.prod.yml \
+# -f docker-compose.monitoring.yml up -d
+#
+# The app runs perfectly WITHOUT this file — monitoring is opt-in.
+#
+# Security model (same as the rest of the stack):
+# • No service is published to the Internet.
+# • Grafana is bound to 127.0.0.1 only → reach it through an SSH tunnel:
+# ssh -L 3000:localhost:3001 user@vps # then open http://localhost:3000
+# • All collectors live on the internal "codestar-net" network and scrape
+# the app containers by their service/container names.
+# ─────────────────────────────────────────────────────────────
+services:
+
+ # ── Metrics store ──────────────────────────────────────────
+ prometheus:
+ image: prom/prometheus:v2.53.0
+ container_name: codestar-prometheus
+ restart: unless-stopped
+ command:
+ - "--config.file=/etc/prometheus/prometheus.yml"
+ - "--storage.tsdb.path=/prometheus"
+ - "--storage.tsdb.retention.time=15d" # retention decided: 15 days
+ - "--web.enable-lifecycle"
+ volumes:
+ - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+ - prometheus_data:/prometheus
+ networks:
+ - codestar-net
+
+ # ── Logs store ─────────────────────────────────────────────
+ loki:
+ image: grafana/loki:3.1.0
+ container_name: codestar-loki
+ restart: unless-stopped
+ command: "-config.file=/etc/loki/loki-config.yml"
+ volumes:
+ - ./monitoring/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
+ - loki_data:/loki
+ networks:
+ - codestar-net
+
+ # ── Log collector (containers' stdout → Loki) ──────────────
+ promtail:
+ image: grafana/promtail:3.1.0
+ container_name: codestar-promtail
+ restart: unless-stopped
+ depends_on:
+ - loki
+ command: "-config.file=/etc/promtail/promtail-config.yml"
+ volumes:
+ - ./monitoring/promtail/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
+ # Container logs + Docker socket for service discovery & labels.
+ - /var/lib/docker/containers:/var/lib/docker/containers:ro
+ - /var/run/docker.sock:/var/run/docker.sock:ro
+ - promtail_positions:/tmp
+ networks:
+ - codestar-net
+
+ # ── Host metrics (CPU / RAM / disk of the VPS) ─────────────
+ node-exporter:
+ image: prom/node-exporter:v1.8.1
+ container_name: codestar-node-exporter
+ restart: unless-stopped
+ command:
+ - "--path.rootfs=/host"
+ pid: host
+ volumes:
+ - /:/host:ro,rslave
+ networks:
+ - codestar-net
+
+ # ── Per-container metrics (CPU / RAM / net per service) ────
+ cadvisor:
+ image: gcr.io/cadvisor/cadvisor:v0.49.1
+ container_name: codestar-cadvisor
+ restart: unless-stopped
+ privileged: true
+ devices:
+ - /dev/kmsg
+ volumes:
+ - /:/rootfs:ro
+ - /var/run:/var/run:ro
+ - /sys:/sys:ro
+ - /var/lib/docker/:/var/lib/docker:ro
+ - /dev/disk/:/dev/disk:ro
+ networks:
+ - codestar-net
+
+ # ── Dashboards (SSH-tunnel access only) ────────────────────
+ grafana:
+ image: grafana/grafana:11.1.0
+ container_name: codestar-grafana
+ restart: unless-stopped
+ depends_on:
+ - prometheus
+ - loki
+ environment:
+ GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
+ GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?set GRAFANA_ADMIN_PASSWORD in .env}
+ # Never exposed publicly → sign-up off, anonymous off.
+ GF_USERS_ALLOW_SIGN_UP: "false"
+ GF_AUTH_ANONYMOUS_ENABLED: "false"
+ volumes:
+ - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
+ - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
+ - grafana_data:/var/lib/grafana
+ ports:
+ # Loopback only. Tunnel in: ssh -L 3000:localhost:3001 user@vps
+ # (host port 3001 because the frontend already owns 3000).
+ - "127.0.0.1:3001:3000"
+ networks:
+ - codestar-net
+
+volumes:
+ prometheus_data:
+ loki_data:
+ grafana_data:
+ promtail_positions:
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
new file mode 100644
index 0000000..a3dd031
--- /dev/null
+++ b/docker-compose.prod.yml
@@ -0,0 +1,33 @@
+# ─────────────────────────────────────────────────────────────
+# Production overlay — adds the Caddy reverse proxy (automatic HTTPS).
+#
+# Usage:
+# docker compose -f docker-compose.yml -f docker-compose.prod.yml up --build -d
+#
+# In the base file, backend (8080) and frontend (3000) are bound to
+# 127.0.0.1 only, so they are NOT public. Caddy reaches the frontend
+# through the internal "codestar-net" network (service name "frontend").
+# ─────────────────────────────────────────────────────────────
+services:
+ caddy:
+ image: caddy:2-alpine
+ container_name: codestar-caddy
+ restart: unless-stopped
+ depends_on:
+ - frontend
+ ports:
+ - "80:80"
+ - "443:443"
+ - "443:443/udp" # HTTP/3 (QUIC)
+ environment:
+ DOMAIN: ${DOMAIN}
+ volumes:
+ - ./Caddyfile:/etc/caddy/Caddyfile:ro
+ - caddy_data:/data # certificates & ACME account (persisted)
+ - caddy_config:/config
+ networks:
+ - codestar-net
+
+volumes:
+ caddy_data:
+ caddy_config:
diff --git a/docker-compose.yml b/docker-compose.yml
index 26deb9b..18ea01d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -48,7 +48,9 @@ services:
# uploaded course images (persisted across restarts)
- media_data:/app/media
ports:
- - "${BACKEND_PORT:-8080}:8080"
+ # Bound to loopback only: never public. In prod, Caddy reaches the
+ # backend indirectly via the frontend over the internal network.
+ - "127.0.0.1:${BACKEND_PORT:-8080}:8080"
healthcheck:
test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/actuator/health"]
interval: 10s
@@ -77,7 +79,9 @@ services:
JWT_SECRET: ${JWT_SECRET}
SITE_URL: ${SITE_URL:-http://localhost:3000}
ports:
- - "${FRONTEND_PORT:-3000}:3000"
+ # Bound to loopback only: never public. Caddy (prod overlay) proxies
+ # to this service over the internal "codestar-net" network.
+ - "127.0.0.1:${FRONTEND_PORT:-3000}:3000"
networks:
- codestar-net
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..5cac366
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────
+# Codestar — VPS bootstrap installer (day 0, run once).
+#
+# What it does:
+# 1. Installs Docker + compose plugin (if missing)
+# 2. Hardens the host (ufw firewall + fail2ban)
+# 3. Creates .env (random secrets + your answers) — never overwrites
+# an existing .env, so your secrets and customization are safe
+# 4. Builds and starts the full stack behind Caddy (automatic HTTPS)
+# 5. Waits for health and prints the final URL
+#
+# Interactive:
+# sudo ./install.sh
+#
+# Non-interactive (CI / repeatable):
+# sudo DOMAIN=codestar.example.com \
+# ADMIN_EMAIL=you@example.com \
+# ADMIN_PASSWORD='a-strong-password' \
+# ADMIN_NAME='Admin' \
+# SIGNUP_OPEN=false \
+# ./install.sh
+#
+# Re-running is safe: an existing .env is reused as-is; the stack is
+# rebuilt and restarted (your data lives in Docker volumes, untouched).
+# ─────────────────────────────────────────────────────────────
+set -euo pipefail
+
+# ── pretty logging ───────────────────────────────────────────
+c_blue=$'\033[1;34m'; c_green=$'\033[1;32m'; c_yellow=$'\033[1;33m'; c_red=$'\033[1;31m'; c_reset=$'\033[0m'
+log() { printf '%s==>%s %s\n' "$c_blue" "$c_reset" "$*"; }
+ok() { printf '%s✓%s %s\n' "$c_green" "$c_reset" "$*"; }
+warn() { printf '%s!%s %s\n' "$c_yellow" "$c_reset" "$*"; }
+err() { printf '%s✗%s %s\n' "$c_red" "$c_reset" "$*" >&2; }
+
+# Run from the repo root (directory of this script).
+cd "$(dirname "$0")"
+
+# ── privilege handling ───────────────────────────────────────
+if [ "$(id -u)" -eq 0 ]; then SUDO=""; else SUDO="sudo"; fi
+if [ -n "$SUDO" ] && ! command -v sudo >/dev/null 2>&1; then
+ err "Please run as root (sudo not available)."; exit 1
+fi
+
+# ── helpers ──────────────────────────────────────────────────
+# ask VARNAME "prompt" [secret] [default]
+# Uses an existing environment value if set; otherwise prompts (TTY required).
+ask() {
+ local __var="$1" __prompt="$2" __secret="${3:-}" __default="${4:-}"
+ if [ -n "${!__var:-}" ]; then return 0; fi
+ if [ ! -t 0 ]; then
+ if [ -n "$__default" ]; then printf -v "$__var" '%s' "$__default"; return 0; fi
+ err "Missing required value '$__var' and no TTY to prompt."; exit 1
+ fi
+ if [ "$__secret" = "secret" ]; then
+ read -rsp "$__prompt: " "$__var"; echo
+ else
+ local __hint=""; [ -n "$__default" ] && __hint=" [$__default]"
+ read -rp "$__prompt$__hint: " "$__var"
+ if [ -z "${!__var}" ] && [ -n "$__default" ]; then printf -v "$__var" '%s' "$__default"; fi
+ fi
+ return 0
+}
+
+# set_env KEY VALUE [file] — replace or append KEY=VALUE (literal, no sed pitfalls)
+set_env() {
+ local key="$1" val="$2" file="${3:-.env}"
+ if grep -qE "^${key}=" "$file" 2>/dev/null; then
+ grep -vE "^${key}=" "$file" > "$file.tmp" && mv "$file.tmp" "$file"
+ fi
+ printf '%s=%s\n' "$key" "$val" >> "$file"
+}
+
+rand_hex() { openssl rand -hex "$1"; }
+
+# wait_healthy CONTAINER [tries]
+wait_healthy() {
+ local name="$1" tries="${2:-60}" status
+ for _ in $(seq 1 "$tries"); do
+ status="$(docker inspect -f '{{.State.Health.Status}}' "$name" 2>/dev/null || echo missing)"
+ [ "$status" = "healthy" ] && return 0
+ [ "$status" = "missing" ] && { sleep 5; continue; }
+ printf ' backend health: %s\n' "$status"
+ sleep 5
+ done
+ return 1
+}
+
+# ── 1. Docker ────────────────────────────────────────────────
+log "Checking Docker…"
+if ! command -v docker >/dev/null 2>&1; then
+ log "Docker not found — installing via get.docker.com"
+ curl -fsSL https://get.docker.com | $SUDO sh
+ ok "Docker installed"
+else
+ ok "Docker present: $(docker --version)"
+fi
+if ! docker compose version >/dev/null 2>&1; then
+ err "Docker Compose v2 plugin missing. Install 'docker-compose-plugin' and re-run."; exit 1
+fi
+
+# ── 2. Host hardening (firewall + fail2ban) ──────────────────
+log "Hardening host (ufw + fail2ban)…"
+if command -v apt-get >/dev/null 2>&1; then
+ $SUDO apt-get update -qq
+ $SUDO apt-get install -y -qq ufw fail2ban openssl >/dev/null
+ $SUDO ufw allow 22/tcp >/dev/null 2>&1 || true
+ $SUDO ufw allow 80/tcp >/dev/null 2>&1 || true
+ $SUDO ufw allow 443/tcp >/dev/null 2>&1 || true
+ $SUDO ufw --force enable >/dev/null 2>&1 || true
+ $SUDO systemctl enable --now fail2ban >/dev/null 2>&1 || true
+ ok "Firewall (22/80/443) + fail2ban active"
+else
+ warn "Non-apt system: skipping ufw/fail2ban (configure your firewall manually)."
+fi
+
+# ── 3. .env ──────────────────────────────────────────────────
+if [ -f .env ]; then
+ ok "Existing .env found — reusing it (no secrets overwritten)."
+ DOMAIN="$(grep -E '^DOMAIN=' .env | head -1 | cut -d= -f2- || true)"
+ [ -z "${DOMAIN:-}" ] && { err "Existing .env has no DOMAIN= line. Add it and re-run."; exit 1; }
+else
+ log "Creating .env…"
+ [ -f .env.example ] || { err ".env.example missing — are you in the repo root?"; exit 1; }
+
+ ask DOMAIN "Domain name (e.g. codestar.example.com)"
+ ask ADMIN_EMAIL "Super-admin email"
+ ask ADMIN_PASSWORD "Super-admin password" secret
+ ask ADMIN_NAME "Super-admin display name" "" "Admin"
+ ask SIGNUP_OPEN "Open signups without invitation? (true/false)" "" "false"
+
+ # Create .env only after all answers are collected (no half-written file).
+ cp .env.example .env
+
+ set_env DB_USER "codestar"
+ set_env DB_NAME "codestardb"
+ set_env DB_PASSWORD "$(rand_hex 24)"
+ set_env JWT_SECRET "$(rand_hex 48)" # 96 hex chars (>= 64 required)
+ set_env SITE_URL "https://${DOMAIN}"
+ set_env DOMAIN "${DOMAIN}"
+ set_env SIGNUP_OPEN "${SIGNUP_OPEN}"
+ set_env CODESTAR_BOOTSTRAP_SUPER_ADMIN_EMAIL "${ADMIN_EMAIL}"
+ set_env CODESTAR_BOOTSTRAP_SUPER_ADMIN_PASSWORD "${ADMIN_PASSWORD}"
+ set_env CODESTAR_BOOTSTRAP_SUPER_ADMIN_DISPLAY_NAME "${ADMIN_NAME}"
+
+ ok ".env created (random DB_PASSWORD & JWT_SECRET generated)"
+fi
+
+# ── 4. Build & start ─────────────────────────────────────────
+log "Building and starting the stack (this can take a few minutes)…"
+$SUDO docker compose -f docker-compose.yml -f docker-compose.prod.yml up --build -d
+
+# ── 5. Wait for health ───────────────────────────────────────
+log "Waiting for the backend to become healthy…"
+if wait_healthy codestar-backend 60; then
+ ok "Backend healthy"
+else
+ warn "Backend not healthy yet. Check logs: docker compose logs -f backend"
+fi
+
+cat <}
+
+ First-time HTTPS note:
+ Caddy fetches a Let's Encrypt certificate on first request.
+ It only works once your DNS A record points ${DOMAIN} -> this server,
+ and ports 80/443 are open. First load may take ~30s.
+
+ Useful commands:
+ docker compose -f docker-compose.yml -f docker-compose.prod.yml logs -f
+ docker compose -f docker-compose.yml -f docker-compose.prod.yml ps
+${c_green}────────────────────────────────────────────────${c_reset}
+EOF
diff --git a/monitoring/grafana/dashboards/containers.json b/monitoring/grafana/dashboards/containers.json
new file mode 100644
index 0000000..ec479fb
--- /dev/null
+++ b/monitoring/grafana/dashboards/containers.json
@@ -0,0 +1,48 @@
+{
+ "uid": "codestar-containers",
+ "title": "Codestar — Containers",
+ "tags": ["codestar", "docker"],
+ "timezone": "browser",
+ "schemaVersion": 39,
+ "version": 1,
+ "refresh": "30s",
+ "time": { "from": "now-6h", "to": "now" },
+ "templating": { "list": [] },
+ "panels": [
+ {
+ "id": 1, "type": "timeseries", "title": "CPU per container (cores)",
+ "gridPos": { "h": 9, "w": 12, "x": 0, "y": 0 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "targets": [
+ { "refId": "A", "expr": "sum by (name) (rate(container_cpu_usage_seconds_total{name=~\"codestar-.+\"}[5m]))", "legendFormat": "{{name}}" }
+ ]
+ },
+ {
+ "id": 2, "type": "timeseries", "title": "Memory per container",
+ "gridPos": { "h": 9, "w": 12, "x": 12, "y": 0 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "bytes" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "sum by (name) (container_memory_usage_bytes{name=~\"codestar-.+\"})", "legendFormat": "{{name}}" }
+ ]
+ },
+ {
+ "id": 3, "type": "timeseries", "title": "Network RX per container",
+ "gridPos": { "h": 9, "w": 12, "x": 0, "y": 9 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "Bps" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "sum by (name) (rate(container_network_receive_bytes_total{name=~\"codestar-.+\"}[5m]))", "legendFormat": "{{name}}" }
+ ]
+ },
+ {
+ "id": 4, "type": "timeseries", "title": "Network TX per container",
+ "gridPos": { "h": 9, "w": 12, "x": 12, "y": 9 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "Bps" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "sum by (name) (rate(container_network_transmit_bytes_total{name=~\"codestar-.+\"}[5m]))", "legendFormat": "{{name}}" }
+ ]
+ }
+ ]
+}
diff --git a/monitoring/grafana/dashboards/jvm-spring.json b/monitoring/grafana/dashboards/jvm-spring.json
new file mode 100644
index 0000000..ccfbb0e
--- /dev/null
+++ b/monitoring/grafana/dashboards/jvm-spring.json
@@ -0,0 +1,70 @@
+{
+ "uid": "codestar-jvm",
+ "title": "Codestar — JVM / Spring Boot",
+ "tags": ["codestar", "backend"],
+ "timezone": "browser",
+ "schemaVersion": 39,
+ "version": 1,
+ "refresh": "30s",
+ "time": { "from": "now-6h", "to": "now" },
+ "templating": { "list": [] },
+ "panels": [
+ {
+ "id": 1, "type": "timeseries", "title": "JVM heap used",
+ "gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "bytes" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "sum(jvm_memory_used_bytes{area=\"heap\"})", "legendFormat": "heap used" },
+ { "refId": "B", "expr": "sum(jvm_memory_max_bytes{area=\"heap\"})", "legendFormat": "heap max" }
+ ]
+ },
+ {
+ "id": 2, "type": "timeseries", "title": "GC pause rate",
+ "gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "s" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "rate(jvm_gc_pause_seconds_sum[5m])", "legendFormat": "{{action}}" }
+ ]
+ },
+ {
+ "id": 3, "type": "timeseries", "title": "HTTP request rate (req/s)",
+ "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "reqps" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "sum by (status) (rate(http_server_requests_seconds_count[5m]))", "legendFormat": "{{status}}" }
+ ]
+ },
+ {
+ "id": 4, "type": "timeseries", "title": "HTTP p95 latency",
+ "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "s" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "histogram_quantile(0.95, sum by (le) (rate(http_server_requests_seconds_bucket[5m])))", "legendFormat": "p95" }
+ ]
+ },
+ {
+ "id": 5, "type": "stat", "title": "Live threads",
+ "gridPos": { "h": 6, "w": 8, "x": 0, "y": 16 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "targets": [ { "refId": "A", "expr": "jvm_threads_live_threads" } ]
+ },
+ {
+ "id": 6, "type": "stat", "title": "Process CPU",
+ "gridPos": { "h": 6, "w": 8, "x": 8, "y": 16 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "percentunit" }, "overrides": [] },
+ "targets": [ { "refId": "A", "expr": "process_cpu_usage" } ]
+ },
+ {
+ "id": 7, "type": "stat", "title": "Uptime",
+ "gridPos": { "h": 6, "w": 8, "x": 16, "y": 16 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "s" }, "overrides": [] },
+ "targets": [ { "refId": "A", "expr": "process_uptime_seconds" } ]
+ }
+ ]
+}
diff --git a/monitoring/grafana/dashboards/logs.json b/monitoring/grafana/dashboards/logs.json
new file mode 100644
index 0000000..f5c685b
--- /dev/null
+++ b/monitoring/grafana/dashboards/logs.json
@@ -0,0 +1,44 @@
+{
+ "uid": "codestar-logs",
+ "title": "Codestar — Logs (Loki)",
+ "tags": ["codestar", "logs"],
+ "timezone": "browser",
+ "schemaVersion": 39,
+ "version": 1,
+ "refresh": "30s",
+ "time": { "from": "now-1h", "to": "now" },
+ "templating": {
+ "list": [
+ {
+ "name": "container",
+ "label": "Container",
+ "type": "query",
+ "datasource": { "type": "loki", "uid": "loki" },
+ "query": { "label": "container", "stream": "{stack=\"codestar\"}", "type": 1 },
+ "refresh": 2,
+ "includeAll": true,
+ "multi": true,
+ "current": { "text": "All", "value": "$__all" }
+ }
+ ]
+ },
+ "panels": [
+ {
+ "id": 1, "type": "timeseries", "title": "Log volume per container",
+ "gridPos": { "h": 7, "w": 24, "x": 0, "y": 0 },
+ "datasource": { "type": "loki", "uid": "loki" },
+ "targets": [
+ { "refId": "A", "expr": "sum by (container) (count_over_time({stack=\"codestar\", container=~\"$container\"}[1m]))", "legendFormat": "{{container}}" }
+ ]
+ },
+ {
+ "id": 2, "type": "logs", "title": "Logs",
+ "gridPos": { "h": 17, "w": 24, "x": 0, "y": 7 },
+ "datasource": { "type": "loki", "uid": "loki" },
+ "options": { "showTime": true, "wrapLogMessage": true, "sortOrder": "Descending", "enableLogDetails": true },
+ "targets": [
+ { "refId": "A", "expr": "{stack=\"codestar\", container=~\"$container\"}" }
+ ]
+ }
+ ]
+}
diff --git a/monitoring/grafana/dashboards/vps-system.json b/monitoring/grafana/dashboards/vps-system.json
new file mode 100644
index 0000000..08c9512
--- /dev/null
+++ b/monitoring/grafana/dashboards/vps-system.json
@@ -0,0 +1,56 @@
+{
+ "uid": "codestar-vps",
+ "title": "Codestar — VPS system",
+ "tags": ["codestar", "host"],
+ "timezone": "browser",
+ "schemaVersion": 39,
+ "version": 1,
+ "refresh": "30s",
+ "time": { "from": "now-6h", "to": "now" },
+ "templating": { "list": [] },
+ "panels": [
+ {
+ "id": 1, "type": "timeseries", "title": "CPU usage (%)",
+ "gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "percent", "max": 100 }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "100 - (avg(rate(node_cpu_seconds_total{mode=\"idle\"}[5m])) * 100)", "legendFormat": "cpu" }
+ ]
+ },
+ {
+ "id": 2, "type": "timeseries", "title": "Memory used (%)",
+ "gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "percent", "max": 100 }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100", "legendFormat": "mem" }
+ ]
+ },
+ {
+ "id": 3, "type": "timeseries", "title": "Disk free (root)",
+ "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "bytes" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "node_filesystem_avail_bytes{mountpoint=\"/host\"}", "legendFormat": "free" }
+ ]
+ },
+ {
+ "id": 4, "type": "timeseries", "title": "Load average (1m)",
+ "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "targets": [ { "refId": "A", "expr": "node_load1", "legendFormat": "load1" } ]
+ },
+ {
+ "id": 5, "type": "timeseries", "title": "Network traffic",
+ "gridPos": { "h": 8, "w": 24, "x": 0, "y": 16 },
+ "datasource": { "type": "prometheus", "uid": "prometheus" },
+ "fieldConfig": { "defaults": { "unit": "Bps" }, "overrides": [] },
+ "targets": [
+ { "refId": "A", "expr": "sum(rate(node_network_receive_bytes_total{device!~\"lo|veth.*|docker.*|br.*\"}[5m]))", "legendFormat": "rx" },
+ { "refId": "B", "expr": "sum(rate(node_network_transmit_bytes_total{device!~\"lo|veth.*|docker.*|br.*\"}[5m]))", "legendFormat": "tx" }
+ ]
+ }
+ ]
+}
diff --git a/monitoring/grafana/provisioning/dashboards/dashboards.yml b/monitoring/grafana/provisioning/dashboards/dashboards.yml
new file mode 100644
index 0000000..1d470f0
--- /dev/null
+++ b/monitoring/grafana/provisioning/dashboards/dashboards.yml
@@ -0,0 +1,14 @@
+# Loads every dashboard JSON dropped in /var/lib/grafana/dashboards.
+apiVersion: 1
+
+providers:
+ - name: codestar
+ orgId: 1
+ folder: Codestar
+ type: file
+ disableDeletion: false
+ updateIntervalSeconds: 30
+ allowUiUpdates: true
+ options:
+ path: /var/lib/grafana/dashboards
+ foldersFromFilesStructure: false
diff --git a/monitoring/grafana/provisioning/datasources/datasources.yml b/monitoring/grafana/provisioning/datasources/datasources.yml
new file mode 100644
index 0000000..353425d
--- /dev/null
+++ b/monitoring/grafana/provisioning/datasources/datasources.yml
@@ -0,0 +1,18 @@
+# Grafana datasources — provisioned at startup, no manual clicking.
+apiVersion: 1
+
+datasources:
+ - name: Prometheus
+ type: prometheus
+ uid: prometheus
+ access: proxy
+ url: http://prometheus:9090
+ isDefault: true
+ editable: false
+
+ - name: Loki
+ type: loki
+ uid: loki
+ access: proxy
+ url: http://loki:3100
+ editable: false
diff --git a/monitoring/loki/loki-config.yml b/monitoring/loki/loki-config.yml
new file mode 100644
index 0000000..92f68ac
--- /dev/null
+++ b/monitoring/loki/loki-config.yml
@@ -0,0 +1,48 @@
+# Loki — single-binary, filesystem storage. Sized for a small VPS.
+# Retention decided: 7 days (168h). The compactor deletes older chunks.
+auth_enabled: false
+
+server:
+ http_listen_port: 3100
+ log_level: warn
+
+common:
+ instance_addr: 127.0.0.1
+ path_prefix: /loki
+ storage:
+ filesystem:
+ chunks_directory: /loki/chunks
+ rules_directory: /loki/rules
+ replication_factor: 1
+ ring:
+ kvstore:
+ store: inmemory
+
+schema_config:
+ configs:
+ - from: 2024-01-01
+ store: tsdb
+ object_store: filesystem
+ schema: v13
+ index:
+ prefix: index_
+ period: 24h
+
+limits_config:
+ retention_period: 168h # 7 days
+ reject_old_samples: true
+ reject_old_samples_max_age: 168h
+ ingestion_rate_mb: 8
+ ingestion_burst_size_mb: 16
+
+compactor:
+ working_directory: /loki/compactor
+ retention_enabled: true # required for retention_period to take effect
+ delete_request_store: filesystem
+
+query_range:
+ results_cache:
+ cache:
+ embedded_cache:
+ enabled: true
+ max_size_mb: 100
diff --git a/monitoring/prometheus/prometheus.yml b/monitoring/prometheus/prometheus.yml
new file mode 100644
index 0000000..384f852
--- /dev/null
+++ b/monitoring/prometheus/prometheus.yml
@@ -0,0 +1,33 @@
+# Prometheus scrape configuration.
+# Targets are reached by their Docker container names over codestar-net.
+global:
+ scrape_interval: 15s
+ evaluation_interval: 15s
+
+scrape_configs:
+ # Prometheus itself.
+ - job_name: prometheus
+ static_configs:
+ - targets: ["localhost:9090"]
+
+ # Spring Boot backend — Micrometer exposes Prometheus format here.
+ - job_name: backend
+ metrics_path: /actuator/prometheus
+ static_configs:
+ - targets: ["codestar-backend:8080"]
+
+ # VPS host metrics (CPU / RAM / disk / network).
+ - job_name: node
+ static_configs:
+ - targets: ["codestar-node-exporter:9100"]
+
+ # Per-container metrics.
+ - job_name: cadvisor
+ static_configs:
+ - targets: ["codestar-cadvisor:8080"]
+
+ # Caddy metrics — the admin API is exposed on 2019 via the Caddyfile global block.
+ - job_name: caddy
+ metrics_path: /metrics
+ static_configs:
+ - targets: ["codestar-caddy:2019"]
diff --git a/monitoring/promtail/promtail-config.yml b/monitoring/promtail/promtail-config.yml
new file mode 100644
index 0000000..e08dc7b
--- /dev/null
+++ b/monitoring/promtail/promtail-config.yml
@@ -0,0 +1,29 @@
+# Promtail — discovers running containers via the Docker socket and ships
+# their stdout/stderr to Loki. Backend & Caddy already log JSON, so the
+# raw line is the JSON object; Grafana parses it at query time.
+server:
+ http_listen_port: 9080
+ log_level: warn
+
+positions:
+ filename: /tmp/positions.yaml
+
+clients:
+ - url: http://loki:3100/loki/api/v1/push
+
+scrape_configs:
+ - job_name: docker
+ docker_sd_configs:
+ - host: unix:///var/run/docker.sock
+ refresh_interval: 15s
+ relabel_configs:
+ # container name (strip the leading "/").
+ - source_labels: ["__meta_docker_container_name"]
+ regex: "/(.*)"
+ target_label: container
+ # compose service name when present.
+ - source_labels: ["__meta_docker_container_label_com_docker_compose_service"]
+ target_label: service
+ # Static label to find everything under the stack quickly.
+ - replacement: codestar
+ target_label: stack
diff --git a/scripts/ci/flyway-governance.sh b/scripts/ci/flyway-governance.sh
new file mode 100755
index 0000000..48731d6
--- /dev/null
+++ b/scripts/ci/flyway-governance.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────
+# Flyway migration governance gate.
+#
+# Flyway applies each V.sql once and records its checksum. Editing or
+# deleting an already-applied migration makes Flyway refuse to start in
+# production ("checksum mismatch"). This script enforces, on every PR:
+# 1. existing migrations are never modified or deleted (only new ones added)
+# 2. version numbers are unique and strictly increasing (no gap / collision)
+#
+# Usage: flyway-governance.sh [BASE_REF]
+# BASE_REF defaults to $BASE_REF env, then origin/main.
+# Exit: 0 ok · 1 violation
+# ─────────────────────────────────────────────────────────────
+set -euo pipefail
+
+MIG_DIR="apps/backend/src/main/resources/db/migration"
+BASE="${1:-${BASE_REF:-origin/main}}"
+fail=0
+
+cd "$(git rev-parse --show-toplevel)"
+
+# Resolve base; if unknown (e.g. shallow clone), skip the diff-based check.
+if ! git rev-parse --verify --quiet "$BASE" >/dev/null; then
+ echo "! base ref '$BASE' not found — skipping modified/deleted check"
+else
+ echo "==> Checking migrations against $BASE"
+ # Status of migration files between base and HEAD: A=added M=modified D=deleted R=renamed
+ while IFS=$'\t' read -r status path rest; do
+ [ -z "$status" ] && continue
+ case "$status" in
+ M*) echo "✗ Modified an existing migration: $path (forbidden — add a new V### instead)"; fail=1 ;;
+ D*) echo "✗ Deleted an existing migration: $path (forbidden)"; fail=1 ;;
+ R*) echo "✗ Renamed an existing migration: $path -> $rest (forbidden)"; fail=1 ;;
+ A*) echo " + new migration: $path" ;;
+ esac
+ done < <(git diff --name-status "$BASE"...HEAD -- "$MIG_DIR")
+fi
+
+# Numbering integrity on the current tree: unique + contiguous (V001, V002, …).
+echo "==> Checking version numbering"
+nums="$(ls "$MIG_DIR" 2>/dev/null | grep -oE '^V[0-9]+' | grep -oE '[0-9]+' | sed 's/^0*//;s/^$/0/' | sort -n || true)"
+if [ -n "$nums" ]; then
+ dups="$(echo "$nums" | uniq -d)"
+ if [ -n "$dups" ]; then echo "✗ Duplicate migration version(s): $dups"; fail=1; fi
+ expected=1
+ for n in $nums; do
+ if [ "$n" -ne "$expected" ]; then
+ echo "✗ Non-contiguous numbering: expected V$(printf '%03d' "$expected"), found V$(printf '%03d' "$n")"
+ fail=1; break
+ fi
+ expected=$((expected + 1))
+ done
+fi
+
+if [ "$fail" -eq 0 ]; then echo "✓ Flyway governance OK"; fi
+exit "$fail"
diff --git a/scripts/ci/i18n-parity.sh b/scripts/ci/i18n-parity.sh
new file mode 100755
index 0000000..a34dcba
--- /dev/null
+++ b/scripts/ci/i18n-parity.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────
+# i18n key-parity gate.
+#
+# English is the default locale; French ships in v1. A key present in one
+# file but missing in the other means a missing or orphan translation.
+# This compares the full set of leaf key-paths between en.json and fr.json.
+#
+# Requires: jq
+# Exit: 0 keys match · 1 mismatch
+# ─────────────────────────────────────────────────────────────
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+DIR="apps/frontend/messages"
+EN="$DIR/en.json"
+FR="$DIR/fr.json"
+
+command -v jq >/dev/null || { echo "✗ jq is required"; exit 1; }
+[ -f "$EN" ] && [ -f "$FR" ] || { echo "✗ missing $EN or $FR"; exit 1; }
+
+# Leaf key-paths (e.g. nav.signin), sorted.
+keys() { jq -r 'paths(scalars) | join(".")' "$1" | sort; }
+
+only_en="$(comm -23 <(keys "$EN") <(keys "$FR"))"
+only_fr="$(comm -13 <(keys "$EN") <(keys "$FR"))"
+
+fail=0
+if [ -n "$only_en" ]; then
+ echo "✗ Keys in en.json missing from fr.json:"; echo "$only_en" | sed 's/^/ /'; fail=1
+fi
+if [ -n "$only_fr" ]; then
+ echo "✗ Keys in fr.json missing from en.json:"; echo "$only_fr" | sed 's/^/ /'; fail=1
+fi
+
+if [ "$fail" -eq 0 ]; then echo "✓ i18n parity OK ($(keys "$EN" | wc -l | tr -d ' ') keys)"; fi
+exit "$fail"
diff --git a/update.sh b/update.sh
new file mode 100755
index 0000000..49409c4
--- /dev/null
+++ b/update.sh
@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────
+# Codestar — instance updater (day-N).
+#
+# Pulls the latest code, rebuilds the stack and verifies health.
+# Safe by design: backs up the database first, and on a failed
+# health check it rolls back BOTH the code and the database.
+#
+# Run as the repo owner (so git uses the deploy key) with Docker
+# access (add the user to the "docker" group: usermod -aG docker ).
+#
+# Usage:
+# ./update.sh interactive (asks before applying)
+# ./update.sh --yes non-interactive (for systemd timer / CI)
+# ./update.sh --no-backup skip the pre-update DB dump
+# ./update.sh --help
+#
+# Exit codes: 0 = updated or already up to date · 1 = error/rolled back
+# ─────────────────────────────────────────────────────────────
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+# ── options ──────────────────────────────────────────────────
+ASSUME_YES=0
+DO_BACKUP=1
+for arg in "$@"; do
+ case "$arg" in
+ --yes|-y) ASSUME_YES=1 ;;
+ --no-backup) DO_BACKUP=0 ;;
+ --help|-h) sed -n '2,20p' "$0"; exit 0 ;;
+ *) echo "Unknown option: $arg" >&2; exit 1 ;;
+ esac
+done
+
+# ── logging ──────────────────────────────────────────────────
+c_blue=$'\033[1;34m'; c_green=$'\033[1;32m'; c_yellow=$'\033[1;33m'; c_red=$'\033[1;31m'; c_reset=$'\033[0m'
+log() { printf '%s==>%s %s\n' "$c_blue" "$c_reset" "$*"; }
+ok() { printf '%s✓%s %s\n' "$c_green" "$c_reset" "$*"; }
+warn() { printf '%s!%s %s\n' "$c_yellow" "$c_reset" "$*"; }
+err() { printf '%s✗%s %s\n' "$c_red" "$c_reset" "$*" >&2; }
+
+# ── single-instance lock (avoid concurrent updates) ──────────
+exec 9>/tmp/codestar-update.lock
+if ! flock -n 9; then err "Another update is already running."; exit 1; fi
+
+# ── prerequisites ────────────────────────────────────────────
+[ -f .env ] || { err "No .env found — is this an installed instance?"; exit 1; }
+command -v docker >/dev/null || { err "docker not found."; exit 1; }
+docker info >/dev/null 2>&1 || { err "Cannot talk to Docker. Add your user to the 'docker' group."; exit 1; }
+
+COMPOSE="docker compose -f docker-compose.yml -f docker-compose.prod.yml"
+
+# DB credentials (read from .env without sourcing arbitrary content)
+DB_USER="$(grep -E '^DB_USER=' .env | head -1 | cut -d= -f2-)"
+DB_NAME="$(grep -E '^DB_NAME=' .env | head -1 | cut -d= -f2-)"
+DB_CONTAINER="codestar-db"
+BACKUP_DIR="./backups"
+KEEP_BACKUPS=7
+
+# ── helpers ──────────────────────────────────────────────────
+wait_healthy() {
+ local name="$1" tries="${2:-60}" status
+ for _ in $(seq 1 "$tries"); do
+ status="$(docker inspect -f '{{.State.Health.Status}}' "$name" 2>/dev/null || echo missing)"
+ [ "$status" = "healthy" ] && return 0
+ sleep 5
+ done
+ return 1
+}
+
+backup_db() {
+ mkdir -p "$BACKUP_DIR"
+ local f="$BACKUP_DIR/db-$(date +%Y%m%d-%H%M%S).sql.gz"
+ log "Backing up database → $f"
+ if docker exec "$DB_CONTAINER" pg_dump --clean --if-exists -U "$DB_USER" "$DB_NAME" | gzip > "$f"; then
+ ok "Backup done"
+ echo "$f"
+ # rotation: keep the most recent $KEEP_BACKUPS
+ ls -1t "$BACKUP_DIR"/db-*.sql.gz 2>/dev/null | tail -n +$((KEEP_BACKUPS + 1)) | xargs -r rm -f
+ else
+ rm -f "$f"; err "Backup failed — aborting (no update applied)."; exit 1
+ fi
+}
+
+restore_db() {
+ local f="$1"
+ [ -n "$f" ] && [ -f "$f" ] || { warn "No backup to restore."; return 1; }
+ log "Restoring database from $f"
+ gunzip -c "$f" | docker exec -i "$DB_CONTAINER" psql -U "$DB_USER" -d "$DB_NAME" >/dev/null
+ ok "Database restored"
+}
+
+# ── 1. is there anything new? ────────────────────────────────
+log "Checking for updates…"
+git fetch --quiet
+OLD_COMMIT="$(git rev-parse HEAD)"
+NEW_COMMIT="$(git rev-parse '@{u}')"
+if [ "$OLD_COMMIT" = "$NEW_COMMIT" ]; then
+ ok "Already up to date ($(git rev-parse --short HEAD)). Nothing to do."
+ exit 0
+fi
+
+log "New version available:"
+git --no-pager log --oneline "$OLD_COMMIT..$NEW_COMMIT" | sed 's/^/ /'
+
+if [ "$ASSUME_YES" -ne 1 ]; then
+ read -rp "Apply this update? [y/N] " a
+ [ "$a" = "y" ] || [ "$a" = "Y" ] || { warn "Cancelled."; exit 0; }
+fi
+
+# ── 2. backup ────────────────────────────────────────────────
+BACKUP_FILE=""
+[ "$DO_BACKUP" -eq 1 ] && BACKUP_FILE="$(backup_db)"
+
+# ── 3. apply ─────────────────────────────────────────────────
+log "Pulling new code…"
+git merge --ff-only "$NEW_COMMIT"
+
+log "Rebuilding and restarting…"
+$COMPOSE up --build -d
+
+# ── 4. verify, else rollback ─────────────────────────────────
+log "Waiting for backend health…"
+if wait_healthy codestar-backend 60; then
+ ok "Update applied successfully → $(git rev-parse --short HEAD)"
+ docker image prune -f >/dev/null 2>&1 || true
+ exit 0
+fi
+
+err "Backend unhealthy after update. Rolling back to $(git rev-parse --short "$OLD_COMMIT")…"
+git reset --hard "$OLD_COMMIT"
+$COMPOSE up --build -d
+[ -n "$BACKUP_FILE" ] && restore_db "$BACKUP_FILE" || warn "No DB restore (backup was skipped)."
+if wait_healthy codestar-backend 60; then
+ warn "Rolled back successfully. The update was NOT applied."
+else
+ err "Rollback finished but backend still unhealthy. Check: $COMPOSE logs backend"
+fi
+exit 1