diff --git a/drizzle/0015_recaptcha_settings.sql b/drizzle/0015_recaptcha_settings.sql
new file mode 100644
index 0000000..2127f28
--- /dev/null
+++ b/drizzle/0015_recaptcha_settings.sql
@@ -0,0 +1,5 @@
+ALTER TABLE "association_settings" ADD COLUMN "recaptcha_enabled" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "association_settings" ADD COLUMN "recaptcha_site_key" text;--> statement-breakpoint
+ALTER TABLE "association_settings" ADD COLUMN "encrypted_recaptcha_secret" text;--> statement-breakpoint
+ALTER TABLE "association_settings" ADD COLUMN "recaptcha_min_score" integer DEFAULT 50 NOT NULL;--> statement-breakpoint
+ALTER TABLE "association_settings" ADD CONSTRAINT "association_settings_recaptcha_min_score_check" CHECK ("association_settings"."recaptcha_min_score" >= 0 and "association_settings"."recaptcha_min_score" <= 100);
\ No newline at end of file
diff --git a/drizzle/meta/0015_snapshot.json b/drizzle/meta/0015_snapshot.json
new file mode 100644
index 0000000..a97c68f
--- /dev/null
+++ b/drizzle/meta/0015_snapshot.json
@@ -0,0 +1,2973 @@
+{
+ "id": "226673d8-0632-46b4-99a4-8534fe0c123b",
+ "prevId": "5667c180-701d-4a21-8a65-c9c0cf945103",
+ "version": "7",
+ "dialect": "postgresql",
+ "tables": {
+ "public.accounting_categories": {
+ "name": "accounting_categories",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "type": {
+ "name": "type",
+ "type": "accounting_category_type",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "description": {
+ "name": "description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "is_active": {
+ "name": "is_active",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": true
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "accounting_categories_type_active_idx": {
+ "name": "accounting_categories_type_active_idx",
+ "columns": [
+ {
+ "expression": "type",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "is_active",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.accounting_entries": {
+ "name": "accounting_entries",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "type": {
+ "name": "type",
+ "type": "accounting_entry_type",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "status": {
+ "name": "status",
+ "type": "accounting_entry_status",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'draft'"
+ },
+ "account_id": {
+ "name": "account_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "category_id": {
+ "name": "category_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "event_id": {
+ "name": "event_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "label": {
+ "name": "label",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "amount_cents": {
+ "name": "amount_cents",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "occurred_at": {
+ "name": "occurred_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "counterparty": {
+ "name": "counterparty",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "payment_method": {
+ "name": "payment_method",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "reference": {
+ "name": "reference",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "notes": {
+ "name": "notes",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "attachment_url": {
+ "name": "attachment_url",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_by": {
+ "name": "created_by",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "version": {
+ "name": "version",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "accounting_entries_occurred_at_idx": {
+ "name": "accounting_entries_occurred_at_idx",
+ "columns": [
+ {
+ "expression": "occurred_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "accounting_entries_status_occurred_at_idx": {
+ "name": "accounting_entries_status_occurred_at_idx",
+ "columns": [
+ {
+ "expression": "status",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "occurred_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "accounting_entries_account_idx": {
+ "name": "accounting_entries_account_idx",
+ "columns": [
+ {
+ "expression": "account_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "accounting_entries_category_idx": {
+ "name": "accounting_entries_category_idx",
+ "columns": [
+ {
+ "expression": "category_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "accounting_entries_event_idx": {
+ "name": "accounting_entries_event_idx",
+ "columns": [
+ {
+ "expression": "event_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "accounting_entries_account_id_financial_accounts_id_fk": {
+ "name": "accounting_entries_account_id_financial_accounts_id_fk",
+ "tableFrom": "accounting_entries",
+ "tableTo": "financial_accounts",
+ "columnsFrom": [
+ "account_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ },
+ "accounting_entries_category_id_accounting_categories_id_fk": {
+ "name": "accounting_entries_category_id_accounting_categories_id_fk",
+ "tableFrom": "accounting_entries",
+ "tableTo": "accounting_categories",
+ "columnsFrom": [
+ "category_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ },
+ "accounting_entries_event_id_events_id_fk": {
+ "name": "accounting_entries_event_id_events_id_fk",
+ "tableFrom": "accounting_entries",
+ "tableTo": "events",
+ "columnsFrom": [
+ "event_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ },
+ "accounting_entries_created_by_users_id_fk": {
+ "name": "accounting_entries_created_by_users_id_fk",
+ "tableFrom": "accounting_entries",
+ "tableTo": "users",
+ "columnsFrom": [
+ "created_by"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {
+ "accounting_entries_amount_cents_check": {
+ "name": "accounting_entries_amount_cents_check",
+ "value": "\"accounting_entries\".\"amount_cents\" > 0"
+ }
+ },
+ "isRLSEnabled": false
+ },
+ "public.association_documents": {
+ "name": "association_documents",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "type": {
+ "name": "type",
+ "type": "association_document_type",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "status": {
+ "name": "status",
+ "type": "association_document_status",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'draft'"
+ },
+ "title": {
+ "name": "title",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "document_date": {
+ "name": "document_date",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "content": {
+ "name": "content",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "''"
+ },
+ "member_id": {
+ "name": "member_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "file_url": {
+ "name": "file_url",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_by": {
+ "name": "created_by",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "version": {
+ "name": "version",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "association_documents_type_status_date_idx": {
+ "name": "association_documents_type_status_date_idx",
+ "columns": [
+ {
+ "expression": "type",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "status",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "document_date",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "association_documents_member_idx": {
+ "name": "association_documents_member_idx",
+ "columns": [
+ {
+ "expression": "member_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "association_documents_member_id_association_members_id_fk": {
+ "name": "association_documents_member_id_association_members_id_fk",
+ "tableFrom": "association_documents",
+ "tableTo": "association_members",
+ "columnsFrom": [
+ "member_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ },
+ "association_documents_created_by_users_id_fk": {
+ "name": "association_documents_created_by_users_id_fk",
+ "tableFrom": "association_documents",
+ "tableTo": "users",
+ "columnsFrom": [
+ "created_by"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.association_members": {
+ "name": "association_members",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "first_name": {
+ "name": "first_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "last_name": {
+ "name": "last_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "email": {
+ "name": "email",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "phone": {
+ "name": "phone",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "address_line_1": {
+ "name": "address_line_1",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "address_line_2": {
+ "name": "address_line_2",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "postal_code": {
+ "name": "postal_code",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "city": {
+ "name": "city",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "country": {
+ "name": "country",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'France'"
+ },
+ "status": {
+ "name": "status",
+ "type": "association_member_status",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'pending'"
+ },
+ "school_year": {
+ "name": "school_year",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "membership_fee_cents": {
+ "name": "membership_fee_cents",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "fee_paid_at": {
+ "name": "fee_paid_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "joined_at": {
+ "name": "joined_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "notes": {
+ "name": "notes",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "version": {
+ "name": "version",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "association_members_user_idx": {
+ "name": "association_members_user_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "where": "\"association_members\".\"user_id\" is not null",
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "association_members_status_school_year_idx": {
+ "name": "association_members_status_school_year_idx",
+ "columns": [
+ {
+ "expression": "status",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "school_year",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "association_members_name_idx": {
+ "name": "association_members_name_idx",
+ "columns": [
+ {
+ "expression": "last_name",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "first_name",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "association_members_user_id_users_id_fk": {
+ "name": "association_members_user_id_users_id_fk",
+ "tableFrom": "association_members",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {
+ "association_members_membership_fee_cents_check": {
+ "name": "association_members_membership_fee_cents_check",
+ "value": "\"association_members\".\"membership_fee_cents\" >= 0"
+ }
+ },
+ "isRLSEnabled": false
+ },
+ "public.association_settings": {
+ "name": "association_settings",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "'default'"
+ },
+ "association_name": {
+ "name": "association_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'APEL Manager'"
+ },
+ "school_name": {
+ "name": "school_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'Votre établissement'"
+ },
+ "contact_email": {
+ "name": "contact_email",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "rna": {
+ "name": "rna",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "''"
+ },
+ "logo_url": {
+ "name": "logo_url",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "task_reminder_window_days": {
+ "name": "task_reminder_window_days",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 3
+ },
+ "volunteer_reminder_window_days": {
+ "name": "volunteer_reminder_window_days",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 2
+ },
+ "telegram_enabled": {
+ "name": "telegram_enabled",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "encrypted_telegram_bot_token": {
+ "name": "encrypted_telegram_bot_token",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "telegram_token_last_four": {
+ "name": "telegram_token_last_four",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "telegram_bot_username": {
+ "name": "telegram_bot_username",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "telegram_token_verified_at": {
+ "name": "telegram_token_verified_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "recaptcha_enabled": {
+ "name": "recaptcha_enabled",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "recaptcha_site_key": {
+ "name": "recaptcha_site_key",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "encrypted_recaptcha_secret": {
+ "name": "encrypted_recaptcha_secret",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "recaptcha_min_score": {
+ "name": "recaptcha_min_score",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 50
+ },
+ "updated_by": {
+ "name": "updated_by",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "association_settings_updated_by_users_id_fk": {
+ "name": "association_settings_updated_by_users_id_fk",
+ "tableFrom": "association_settings",
+ "tableTo": "users",
+ "columnsFrom": [
+ "updated_by"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {
+ "association_settings_singleton_check": {
+ "name": "association_settings_singleton_check",
+ "value": "\"association_settings\".\"id\" = 'default'"
+ },
+ "association_settings_task_reminder_window_check": {
+ "name": "association_settings_task_reminder_window_check",
+ "value": "\"association_settings\".\"task_reminder_window_days\" >= 0 and \"association_settings\".\"task_reminder_window_days\" <= 30"
+ },
+ "association_settings_recaptcha_min_score_check": {
+ "name": "association_settings_recaptcha_min_score_check",
+ "value": "\"association_settings\".\"recaptcha_min_score\" >= 0 and \"association_settings\".\"recaptcha_min_score\" <= 100"
+ },
+ "association_settings_volunteer_reminder_window_check": {
+ "name": "association_settings_volunteer_reminder_window_check",
+ "value": "\"association_settings\".\"volunteer_reminder_window_days\" >= 0 and \"association_settings\".\"volunteer_reminder_window_days\" <= 30"
+ }
+ },
+ "isRLSEnabled": false
+ },
+ "public.audit_logs": {
+ "name": "audit_logs",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "actor_user_id": {
+ "name": "actor_user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "oauth_client_id": {
+ "name": "oauth_client_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "action": {
+ "name": "action",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "entity_type": {
+ "name": "entity_type",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "entity_id": {
+ "name": "entity_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "source": {
+ "name": "source",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'web'"
+ },
+ "ip_address": {
+ "name": "ip_address",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "details": {
+ "name": "details",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'{}'::jsonb"
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "audit_logs_entity_idx": {
+ "name": "audit_logs_entity_idx",
+ "columns": [
+ {
+ "expression": "entity_type",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "entity_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "audit_logs_actor_created_idx": {
+ "name": "audit_logs_actor_created_idx",
+ "columns": [
+ {
+ "expression": "actor_user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "created_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "audit_logs_client_created_idx": {
+ "name": "audit_logs_client_created_idx",
+ "columns": [
+ {
+ "expression": "oauth_client_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "created_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "audit_logs_created_at_idx": {
+ "name": "audit_logs_created_at_idx",
+ "columns": [
+ {
+ "expression": "created_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "audit_logs_actor_user_id_users_id_fk": {
+ "name": "audit_logs_actor_user_id_users_id_fk",
+ "tableFrom": "audit_logs",
+ "tableTo": "users",
+ "columnsFrom": [
+ "actor_user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ },
+ "audit_logs_oauth_client_id_oauth_clients_id_fk": {
+ "name": "audit_logs_oauth_client_id_oauth_clients_id_fk",
+ "tableFrom": "audit_logs",
+ "tableTo": "oauth_clients",
+ "columnsFrom": [
+ "oauth_client_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.checklist_templates": {
+ "name": "checklist_templates",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "description": {
+ "name": "description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "tasks": {
+ "name": "tasks",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'[]'::jsonb"
+ },
+ "version": {
+ "name": "version",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.event_attachments": {
+ "name": "event_attachments",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "event_id": {
+ "name": "event_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "label": {
+ "name": "label",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "file_url": {
+ "name": "file_url",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "uploaded_by": {
+ "name": "uploaded_by",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "event_attachments_event_idx": {
+ "name": "event_attachments_event_idx",
+ "columns": [
+ {
+ "expression": "event_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "event_attachments_event_id_events_id_fk": {
+ "name": "event_attachments_event_id_events_id_fk",
+ "tableFrom": "event_attachments",
+ "tableTo": "events",
+ "columnsFrom": [
+ "event_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "event_attachments_uploaded_by_users_id_fk": {
+ "name": "event_attachments_uploaded_by_users_id_fk",
+ "tableFrom": "event_attachments",
+ "tableTo": "users",
+ "columnsFrom": [
+ "uploaded_by"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.events": {
+ "name": "events",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "title": {
+ "name": "title",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "description": {
+ "name": "description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "public_description": {
+ "name": "public_description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "location": {
+ "name": "location",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "start_at": {
+ "name": "start_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "end_at": {
+ "name": "end_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "status": {
+ "name": "status",
+ "type": "event_status",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'draft'"
+ },
+ "version": {
+ "name": "version",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "share_token": {
+ "name": "share_token",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "created_by": {
+ "name": "created_by",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "events_status_start_idx": {
+ "name": "events_status_start_idx",
+ "columns": [
+ {
+ "expression": "status",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "start_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "events_created_by_users_id_fk": {
+ "name": "events_created_by_users_id_fk",
+ "tableFrom": "events",
+ "tableTo": "users",
+ "columnsFrom": [
+ "created_by"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {
+ "events_share_token_unique": {
+ "name": "events_share_token_unique",
+ "nullsNotDistinct": false,
+ "columns": [
+ "share_token"
+ ]
+ }
+ },
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.financial_accounts": {
+ "name": "financial_accounts",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "type": {
+ "name": "type",
+ "type": "financial_account_type",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "description": {
+ "name": "description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "is_active": {
+ "name": "is_active",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": true
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "financial_accounts_type_active_idx": {
+ "name": "financial_accounts_type_active_idx",
+ "columns": [
+ {
+ "expression": "type",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "is_active",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.notifications_log": {
+ "name": "notifications_log",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "task_id": {
+ "name": "task_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "kind": {
+ "name": "kind",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "sent_at": {
+ "name": "sent_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "notifications_log_task_user_kind_idx": {
+ "name": "notifications_log_task_user_kind_idx",
+ "columns": [
+ {
+ "expression": "task_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "kind",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "notifications_log_task_id_tasks_id_fk": {
+ "name": "notifications_log_task_id_tasks_id_fk",
+ "tableFrom": "notifications_log",
+ "tableTo": "tasks",
+ "columnsFrom": [
+ "task_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "notifications_log_user_id_users_id_fk": {
+ "name": "notifications_log_user_id_users_id_fk",
+ "tableFrom": "notifications_log",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.oauth_authorization_codes": {
+ "name": "oauth_authorization_codes",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "code_hash": {
+ "name": "code_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "oauth_client_id": {
+ "name": "oauth_client_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "redirect_uri": {
+ "name": "redirect_uri",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "scopes": {
+ "name": "scopes",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'[]'::jsonb"
+ },
+ "code_challenge": {
+ "name": "code_challenge",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "code_challenge_method": {
+ "name": "code_challenge_method",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'S256'"
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "used_at": {
+ "name": "used_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "oauth_authorization_codes_code_hash_idx": {
+ "name": "oauth_authorization_codes_code_hash_idx",
+ "columns": [
+ {
+ "expression": "code_hash",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "oauth_authorization_codes_client_expires_idx": {
+ "name": "oauth_authorization_codes_client_expires_idx",
+ "columns": [
+ {
+ "expression": "oauth_client_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "expires_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "oauth_authorization_codes_user_idx": {
+ "name": "oauth_authorization_codes_user_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "oauth_authorization_codes_oauth_client_id_oauth_clients_id_fk": {
+ "name": "oauth_authorization_codes_oauth_client_id_oauth_clients_id_fk",
+ "tableFrom": "oauth_authorization_codes",
+ "tableTo": "oauth_clients",
+ "columnsFrom": [
+ "oauth_client_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "oauth_authorization_codes_user_id_users_id_fk": {
+ "name": "oauth_authorization_codes_user_id_users_id_fk",
+ "tableFrom": "oauth_authorization_codes",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.oauth_clients": {
+ "name": "oauth_clients",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "client_id": {
+ "name": "client_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "client_secret_hash": {
+ "name": "client_secret_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "redirect_uris": {
+ "name": "redirect_uris",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'[]'::jsonb"
+ },
+ "token_endpoint_auth_method": {
+ "name": "token_endpoint_auth_method",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'none'"
+ },
+ "grant_types": {
+ "name": "grant_types",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'[\"authorization_code\",\"refresh_token\"]'::jsonb"
+ },
+ "scopes": {
+ "name": "scopes",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'[]'::jsonb"
+ },
+ "enabled": {
+ "name": "enabled",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": true
+ },
+ "created_by": {
+ "name": "created_by",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "oauth_clients_client_id_idx": {
+ "name": "oauth_clients_client_id_idx",
+ "columns": [
+ {
+ "expression": "client_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "oauth_clients_enabled_idx": {
+ "name": "oauth_clients_enabled_idx",
+ "columns": [
+ {
+ "expression": "enabled",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "oauth_clients_created_by_users_id_fk": {
+ "name": "oauth_clients_created_by_users_id_fk",
+ "tableFrom": "oauth_clients",
+ "tableTo": "users",
+ "columnsFrom": [
+ "created_by"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.oauth_tokens": {
+ "name": "oauth_tokens",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "token_hash": {
+ "name": "token_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "type": {
+ "name": "type",
+ "type": "oauth_token_type",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "oauth_client_id": {
+ "name": "oauth_client_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "authorization_code_id": {
+ "name": "authorization_code_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "scopes": {
+ "name": "scopes",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'[]'::jsonb"
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "revoked_at": {
+ "name": "revoked_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "oauth_tokens_token_hash_idx": {
+ "name": "oauth_tokens_token_hash_idx",
+ "columns": [
+ {
+ "expression": "token_hash",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "oauth_tokens_client_type_expires_idx": {
+ "name": "oauth_tokens_client_type_expires_idx",
+ "columns": [
+ {
+ "expression": "oauth_client_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "type",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "expires_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "oauth_tokens_user_idx": {
+ "name": "oauth_tokens_user_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "oauth_tokens_authorization_code_idx": {
+ "name": "oauth_tokens_authorization_code_idx",
+ "columns": [
+ {
+ "expression": "authorization_code_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "oauth_tokens_oauth_client_id_oauth_clients_id_fk": {
+ "name": "oauth_tokens_oauth_client_id_oauth_clients_id_fk",
+ "tableFrom": "oauth_tokens",
+ "tableTo": "oauth_clients",
+ "columnsFrom": [
+ "oauth_client_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "oauth_tokens_user_id_users_id_fk": {
+ "name": "oauth_tokens_user_id_users_id_fk",
+ "tableFrom": "oauth_tokens",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "oauth_tokens_authorization_code_id_oauth_authorization_codes_id_fk": {
+ "name": "oauth_tokens_authorization_code_id_oauth_authorization_codes_id_fk",
+ "tableFrom": "oauth_tokens",
+ "tableTo": "oauth_authorization_codes",
+ "columnsFrom": [
+ "authorization_code_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.outbound_mail_settings": {
+ "name": "outbound_mail_settings",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "'default'"
+ },
+ "provider": {
+ "name": "provider",
+ "type": "outbound_mail_provider",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'resend'"
+ },
+ "enabled": {
+ "name": "enabled",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "from_name": {
+ "name": "from_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "from_email": {
+ "name": "from_email",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "reply_to": {
+ "name": "reply_to",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "domain": {
+ "name": "domain",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "encrypted_api_key": {
+ "name": "encrypted_api_key",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "key_last_four": {
+ "name": "key_last_four",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "smtp_host": {
+ "name": "smtp_host",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "smtp_port": {
+ "name": "smtp_port",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "smtp_secure": {
+ "name": "smtp_secure",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "smtp_username": {
+ "name": "smtp_username",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "encrypted_smtp_password": {
+ "name": "encrypted_smtp_password",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "last_tested_at": {
+ "name": "last_tested_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "last_test_status": {
+ "name": "last_test_status",
+ "type": "outbound_mail_test_status",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'untested'"
+ },
+ "updated_by": {
+ "name": "updated_by",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "outbound_mail_settings_updated_by_users_id_fk": {
+ "name": "outbound_mail_settings_updated_by_users_id_fk",
+ "tableFrom": "outbound_mail_settings",
+ "tableTo": "users",
+ "columnsFrom": [
+ "updated_by"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {
+ "outbound_mail_settings_singleton_check": {
+ "name": "outbound_mail_settings_singleton_check",
+ "value": "\"outbound_mail_settings\".\"id\" = 'default'"
+ },
+ "outbound_mail_settings_smtp_port_check": {
+ "name": "outbound_mail_settings_smtp_port_check",
+ "value": "\"outbound_mail_settings\".\"smtp_port\" is null or (\"outbound_mail_settings\".\"smtp_port\" >= 1 and \"outbound_mail_settings\".\"smtp_port\" <= 65535)"
+ }
+ },
+ "isRLSEnabled": false
+ },
+ "public.password_reset_tokens": {
+ "name": "password_reset_tokens",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "token_hash": {
+ "name": "token_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "used_at": {
+ "name": "used_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {
+ "password_reset_tokens_user_id_users_id_fk": {
+ "name": "password_reset_tokens_user_id_users_id_fk",
+ "tableFrom": "password_reset_tokens",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.task_assignees": {
+ "name": "task_assignees",
+ "schema": "",
+ "columns": {
+ "task_id": {
+ "name": "task_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ }
+ },
+ "indexes": {
+ "task_assignees_user_idx": {
+ "name": "task_assignees_user_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "task_assignees_task_id_tasks_id_fk": {
+ "name": "task_assignees_task_id_tasks_id_fk",
+ "tableFrom": "task_assignees",
+ "tableTo": "tasks",
+ "columnsFrom": [
+ "task_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "task_assignees_user_id_users_id_fk": {
+ "name": "task_assignees_user_id_users_id_fk",
+ "tableFrom": "task_assignees",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {
+ "task_assignees_task_id_user_id_pk": {
+ "name": "task_assignees_task_id_user_id_pk",
+ "columns": [
+ "task_id",
+ "user_id"
+ ]
+ }
+ },
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.tasks": {
+ "name": "tasks",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "event_id": {
+ "name": "event_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "title": {
+ "name": "title",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "description": {
+ "name": "description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "lead_time_days": {
+ "name": "lead_time_days",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 7
+ },
+ "lead_time_value": {
+ "name": "lead_time_value",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 7
+ },
+ "lead_time_unit": {
+ "name": "lead_time_unit",
+ "type": "task_lead_time_unit",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'days'"
+ },
+ "due_at": {
+ "name": "due_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "status": {
+ "name": "status",
+ "type": "task_status",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'todo'"
+ },
+ "position": {
+ "name": "position",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "version": {
+ "name": "version",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "completed_at": {
+ "name": "completed_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "tasks_event_idx": {
+ "name": "tasks_event_idx",
+ "columns": [
+ {
+ "expression": "event_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "tasks_status_due_idx": {
+ "name": "tasks_status_due_idx",
+ "columns": [
+ {
+ "expression": "status",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "due_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "tasks_event_id_events_id_fk": {
+ "name": "tasks_event_id_events_id_fk",
+ "tableFrom": "tasks",
+ "tableTo": "events",
+ "columnsFrom": [
+ "event_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {
+ "tasks_lead_time_value_check": {
+ "name": "tasks_lead_time_value_check",
+ "value": "\"tasks\".\"lead_time_value\" >= 0"
+ },
+ "tasks_lead_time_consistency_check": {
+ "name": "tasks_lead_time_consistency_check",
+ "value": "\"tasks\".\"lead_time_days\" = \"tasks\".\"lead_time_value\" * case \"tasks\".\"lead_time_unit\" when 'days' then 1 when 'weeks' then 7 when 'months' then 30 end"
+ }
+ },
+ "isRLSEnabled": false
+ },
+ "public.users": {
+ "name": "users",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "email": {
+ "name": "email",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "password_hash": {
+ "name": "password_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "role": {
+ "name": "role",
+ "type": "role",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'member'"
+ },
+ "telegram_chat_id": {
+ "name": "telegram_chat_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "session_epoch": {
+ "name": "session_epoch",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 0
+ },
+ "onboarding_seen_at": {
+ "name": "onboarding_seen_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {
+ "users_email_unique": {
+ "name": "users_email_unique",
+ "nullsNotDistinct": false,
+ "columns": [
+ "email"
+ ]
+ }
+ },
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.volunteer_signups": {
+ "name": "volunteer_signups",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "slot_id": {
+ "name": "slot_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "name": {
+ "name": "name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "email": {
+ "name": "email",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "phone": {
+ "name": "phone",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "cancel_token": {
+ "name": "cancel_token",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "reminded_at": {
+ "name": "reminded_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "volunteer_signups_slot_idx": {
+ "name": "volunteer_signups_slot_idx",
+ "columns": [
+ {
+ "expression": "slot_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "volunteer_signups_user_idx": {
+ "name": "volunteer_signups_user_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "volunteer_signups_cancel_token_idx": {
+ "name": "volunteer_signups_cancel_token_idx",
+ "columns": [
+ {
+ "expression": "cancel_token",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "volunteer_signups_slot_email_idx": {
+ "name": "volunteer_signups_slot_email_idx",
+ "columns": [
+ {
+ "expression": "slot_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "lower(\"email\")",
+ "asc": true,
+ "isExpression": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "where": "\"volunteer_signups\".\"email\" is not null",
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "volunteer_signups_slot_id_volunteer_slots_id_fk": {
+ "name": "volunteer_signups_slot_id_volunteer_slots_id_fk",
+ "tableFrom": "volunteer_signups",
+ "tableTo": "volunteer_slots",
+ "columnsFrom": [
+ "slot_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "volunteer_signups_user_id_users_id_fk": {
+ "name": "volunteer_signups_user_id_users_id_fk",
+ "tableFrom": "volunteer_signups",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.volunteer_slots": {
+ "name": "volunteer_slots",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "event_id": {
+ "name": "event_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "title": {
+ "name": "title",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "description": {
+ "name": "description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "start_at": {
+ "name": "start_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "end_at": {
+ "name": "end_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "capacity": {
+ "name": "capacity",
+ "type": "integer",
+ "primaryKey": false,
+ "notNull": true,
+ "default": 1
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "volunteer_slots_event_idx": {
+ "name": "volunteer_slots_event_idx",
+ "columns": [
+ {
+ "expression": "event_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "volunteer_slots_event_id_events_id_fk": {
+ "name": "volunteer_slots_event_id_events_id_fk",
+ "tableFrom": "volunteer_slots",
+ "tableTo": "events",
+ "columnsFrom": [
+ "event_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ }
+ },
+ "enums": {
+ "public.accounting_category_type": {
+ "name": "accounting_category_type",
+ "schema": "public",
+ "values": [
+ "income",
+ "expense"
+ ]
+ },
+ "public.accounting_entry_status": {
+ "name": "accounting_entry_status",
+ "schema": "public",
+ "values": [
+ "draft",
+ "posted"
+ ]
+ },
+ "public.accounting_entry_type": {
+ "name": "accounting_entry_type",
+ "schema": "public",
+ "values": [
+ "income",
+ "expense"
+ ]
+ },
+ "public.association_document_status": {
+ "name": "association_document_status",
+ "schema": "public",
+ "values": [
+ "draft",
+ "final",
+ "archived"
+ ]
+ },
+ "public.association_document_type": {
+ "name": "association_document_type",
+ "schema": "public",
+ "values": [
+ "ag_minutes",
+ "attestation",
+ "statutes",
+ "internal_rules",
+ "insurance",
+ "agreement",
+ "other"
+ ]
+ },
+ "public.association_member_status": {
+ "name": "association_member_status",
+ "schema": "public",
+ "values": [
+ "active",
+ "pending",
+ "inactive"
+ ]
+ },
+ "public.event_status": {
+ "name": "event_status",
+ "schema": "public",
+ "values": [
+ "draft",
+ "published",
+ "archived"
+ ]
+ },
+ "public.financial_account_type": {
+ "name": "financial_account_type",
+ "schema": "public",
+ "values": [
+ "bank",
+ "cash"
+ ]
+ },
+ "public.oauth_token_type": {
+ "name": "oauth_token_type",
+ "schema": "public",
+ "values": [
+ "access",
+ "refresh"
+ ]
+ },
+ "public.outbound_mail_provider": {
+ "name": "outbound_mail_provider",
+ "schema": "public",
+ "values": [
+ "resend",
+ "smtp"
+ ]
+ },
+ "public.outbound_mail_test_status": {
+ "name": "outbound_mail_test_status",
+ "schema": "public",
+ "values": [
+ "untested",
+ "success",
+ "failed"
+ ]
+ },
+ "public.role": {
+ "name": "role",
+ "schema": "public",
+ "values": [
+ "admin",
+ "manager",
+ "member"
+ ]
+ },
+ "public.task_lead_time_unit": {
+ "name": "task_lead_time_unit",
+ "schema": "public",
+ "values": [
+ "days",
+ "weeks",
+ "months"
+ ]
+ },
+ "public.task_status": {
+ "name": "task_status",
+ "schema": "public",
+ "values": [
+ "todo",
+ "in_progress",
+ "done"
+ ]
+ }
+ },
+ "schemas": {},
+ "sequences": {},
+ "roles": {},
+ "policies": {},
+ "views": {},
+ "_meta": {
+ "columns": {},
+ "schemas": {},
+ "tables": {}
+ }
+}
\ No newline at end of file
diff --git a/drizzle/meta/_journal.json b/drizzle/meta/_journal.json
index 2caef9d..e761f32 100644
--- a/drizzle/meta/_journal.json
+++ b/drizzle/meta/_journal.json
@@ -106,6 +106,13 @@
"when": 1786180289391,
"tag": "0014_onboarding_seen",
"breakpoints": true
+ },
+ {
+ "idx": 15,
+ "version": "7",
+ "when": 1786183503290,
+ "tag": "0015_recaptcha_settings",
+ "breakpoints": true
}
]
}
\ No newline at end of file
diff --git a/src/app/api/join/route.ts b/src/app/api/join/route.ts
index 839eac0..a5f4d8c 100644
--- a/src/app/api/join/route.ts
+++ b/src/app/api/join/route.ts
@@ -3,7 +3,11 @@ import { NextResponse } from "next/server";
import { handleApiError, HttpError } from "@/lib/auth/guards";
import { sendEmail } from "@/lib/notifications/email";
import { joinRequestEmail } from "@/lib/notifications/emails";
-import { getAssociationSettings } from "@/lib/services/association-settings";
+import {
+ getAssociationSettings,
+ getRecaptchaRuntimeConfig,
+} from "@/lib/services/association-settings";
+import { verifyRecaptcha } from "@/lib/services/recaptcha";
import { joinRequestSchema } from "@/lib/validation";
export const dynamic = "force-dynamic";
@@ -23,6 +27,17 @@ export async function POST(req: Request) {
return NextResponse.json({ ok: true });
}
+ const recaptcha = await getRecaptchaRuntimeConfig();
+ if (recaptcha) {
+ await verifyRecaptcha({
+ secret: recaptcha.secret,
+ token: data.recaptchaToken,
+ action: "contact",
+ minScore: recaptcha.minScore,
+ ip: req.headers.get("x-forwarded-for")?.split(",")[0]?.trim(),
+ });
+ }
+
const settings = await getAssociationSettings();
const destination = settings.contactEmail?.trim();
if (!destination) {
diff --git a/src/app/api/signup/route.ts b/src/app/api/signup/route.ts
index 3bee675..1b68623 100644
--- a/src/app/api/signup/route.ts
+++ b/src/app/api/signup/route.ts
@@ -10,7 +10,11 @@ import { db } from "@/lib/db";
import { events, volunteerSignups } from "@/lib/db/schema";
import { sendEmail } from "@/lib/notifications/email";
import { volunteerConfirmationEmail } from "@/lib/notifications/emails";
-import { getAssociationSettings } from "@/lib/services/association-settings";
+import {
+ getAssociationSettings,
+ getRecaptchaRuntimeConfig,
+} from "@/lib/services/association-settings";
+import { verifyRecaptcha } from "@/lib/services/recaptcha";
import { generateToken } from "@/lib/tokens";
import { emptyToNull } from "@/lib/utils";
import { signupSchema } from "@/lib/validation";
@@ -35,6 +39,17 @@ export async function POST(req: Request) {
return NextResponse.json({ ok: true });
}
+ const recaptcha = await getRecaptchaRuntimeConfig();
+ if (recaptcha) {
+ await verifyRecaptcha({
+ secret: recaptcha.secret,
+ token: data.recaptchaToken,
+ action: "inscription",
+ minScore: recaptcha.minScore,
+ ip: req.headers.get("x-forwarded-for")?.split(",")[0]?.trim(),
+ });
+ }
+
const event = await db.query.events.findFirst({
where: eq(events.shareToken, data.token),
with: { volunteerSlots: true },
diff --git a/src/app/confidentialite/page.tsx b/src/app/confidentialite/page.tsx
index 59f0e62..d7634a8 100644
--- a/src/app/confidentialite/page.tsx
+++ b/src/app/confidentialite/page.tsx
@@ -1,4 +1,5 @@
import {
+ Bot,
Clock3,
Database,
ShieldCheck,
@@ -14,11 +15,18 @@ import { getAssociationSettings } from "@/lib/services/association-settings";
export const dynamic = "force-dynamic";
export const metadata = { title: "Politique de confidentialité" };
-const sectionIcons = [ShieldCheck, Database, Target, Clock3, UserRoundCheck];
+const sectionIcons = [
+ ShieldCheck,
+ Database,
+ Target,
+ Clock3,
+ UserRoundCheck,
+ Bot,
+];
export default async function PrivacyPage() {
const settings = await getAssociationSettings();
- const sections = [
+ const sections: { title: string; content: React.ReactNode }[] = [
{
title: "Responsable",
content: (
@@ -76,6 +84,38 @@ export default async function PrivacyPage() {
},
];
+ if (settings.recaptchaReady) {
+ sections.push({
+ title: "Protection anti-robot",
+ content: (
+ <>
+ Les formulaires publics sont protégés par reCAPTCHA v3, un service de
+ Google qui analyse votre navigation sur la page pour distinguer un
+ visiteur d'un robot. Google peut à cette occasion déposer des
+ cookies et collecter des données techniques, soumis à sa{" "}
+
+ politique de confidentialité
+ {" "}
+ et à ses{" "}
+
+ conditions d'utilisation
+
+ . Ce contrôle sert uniquement à écarter les envois automatisés.
+
+ ),
+ });
+ }
+
return (
diff --git a/src/app/dashboard/settings/page.tsx b/src/app/dashboard/settings/page.tsx
index eaad624..6775527 100644
--- a/src/app/dashboard/settings/page.tsx
+++ b/src/app/dashboard/settings/page.tsx
@@ -39,6 +39,11 @@ export default async function SettingsPage() {
telegramBotUsername: associationStatus.telegramBotUsername,
telegramTokenVerifiedAt: associationStatus.telegramTokenVerifiedAt,
telegramReady: associationStatus.telegramReady,
+ recaptchaEnabled: associationStatus.recaptchaEnabled,
+ recaptchaSiteKey: associationStatus.recaptchaSiteKey,
+ recaptchaSecretConfigured: associationStatus.recaptchaSecretConfigured,
+ recaptchaMinScore: associationStatus.recaptchaMinScore,
+ recaptchaReady: associationStatus.recaptchaReady,
legacyEnvironment: associationStatus.legacyEnvironment,
};
const settings: MailSettingsView = {
diff --git a/src/app/globals.css b/src/app/globals.css
index a5d77af..bca3413 100644
--- a/src/app/globals.css
+++ b/src/app/globals.css
@@ -89,3 +89,79 @@ input[type="datetime-local"]::-webkit-calendar-picker-indicator {
animation: none !important;
}
}
+
+/*
+ * Menus déroulants : afficher en entier les libellés longs.
+ *
+ * Un
natif tronque ses options — ni le contrôle fermé ni la liste ne
+ * savent revenir à la ligne. Les navigateurs qui prennent en charge le select
+ * personnalisable (`appearance: base-select`) rendent la liste dans le DOM :
+ * on peut alors l'autoriser à passer à la ligne. Ailleurs, le comportement
+ * natif reste inchangé — c'est une amélioration progressive, pas un
+ * remplacement du composant.
+ */
+@supports (appearance: base-select) {
+ select.champ-select,
+ select.champ-select::picker(select) {
+ appearance: base-select;
+ }
+
+ select.champ-select {
+ display: flex;
+ align-items: center;
+ gap: 0.5rem;
+ text-align: left;
+ }
+
+ /* Le libellé retenu occupe la place disponible et passe à la ligne ; la
+ flèche du navigateur reste à droite, sans doublon de notre part. */
+ select.champ-select selectedcontent,
+ select.champ-select::selectedcontent {
+ flex: 1 1 auto;
+ min-width: 0;
+ white-space: normal;
+ text-align: left;
+ }
+
+ select.champ-select::picker-icon {
+ flex: none;
+ color: #64748b;
+ }
+
+ select.champ-select::picker(select) {
+ border: 2px solid #e2e8f0;
+ border-radius: 0.75rem;
+ background: #fff;
+ box-shadow: 0 12px 32px -12px rgb(8 42 64 / 0.35);
+ padding: 0.25rem;
+ max-height: 20rem;
+ overflow-y: auto;
+ /* La liste ne se limite plus à la largeur du champ, sans déborder. */
+ min-width: anchor-size(width);
+ max-width: min(32rem, 90vw);
+ }
+
+ select.champ-select option {
+ white-space: normal;
+ border-radius: 0.5rem;
+ padding: 0.5rem 0.75rem;
+ line-height: 1.4;
+ }
+
+ select.champ-select option:hover,
+ select.champ-select option:focus {
+ background: #e8f2f8;
+ }
+
+ select.champ-select option:checked {
+ font-weight: 700;
+ }
+
+ select.champ-select optgroup {
+ padding: 0.25rem 0.75rem;
+ font-size: 0.75rem;
+ letter-spacing: 0.08em;
+ text-transform: uppercase;
+ color: #64748b;
+ }
+}
diff --git a/src/app/inscription/[token]/page.tsx b/src/app/inscription/[token]/page.tsx
index 3663fb2..8316433 100644
--- a/src/app/inscription/[token]/page.tsx
+++ b/src/app/inscription/[token]/page.tsx
@@ -12,6 +12,7 @@ import Link from "next/link";
import { FormattedText } from "@/components/formatted-text";
import { SiteFooter } from "@/components/site-footer";
import { SiteHeader } from "@/components/site-header";
+import { getAssociationSettings } from "@/lib/services/association-settings";
import {
VolunteerSignupForm,
type SignupSlotOption,
@@ -76,7 +77,10 @@ export default async function InscriptionPage({
);
}
- const currentUser = await getCurrentUser();
+ const [currentUser, association] = await Promise.all([
+ getCurrentUser(),
+ getAssociationSettings(),
+ ]);
const slotOptions: SignupSlotOption[] = event.volunteerSlots.map((slot) => {
const remaining = Math.max(0, slot.capacity - slot.signups.length);
@@ -193,6 +197,9 @@ export default async function InscriptionPage({
-
diff --git a/src/components/association-settings-form.tsx b/src/components/association-settings-form.tsx
index 185189c..4a33b8c 100644
--- a/src/components/association-settings-form.tsx
+++ b/src/components/association-settings-form.tsx
@@ -14,7 +14,7 @@ import { useState } from "react";
import { LogoUploadField } from "@/components/logo-upload-field";
import { useToast } from "@/components/toast";
-import { Button, Card, Field, Input } from "@/components/ui";
+import { Button, Card, Field, Input, Select } from "@/components/ui";
import { api } from "@/lib/client";
export interface AssociationSettingsView {
@@ -31,6 +31,11 @@ export interface AssociationSettingsView {
telegramBotUsername: string | null;
telegramTokenVerifiedAt: Date | null;
telegramReady: boolean;
+ recaptchaEnabled: boolean;
+ recaptchaSiteKey: string | null;
+ recaptchaSecretConfigured: boolean;
+ recaptchaMinScore: number;
+ recaptchaReady: boolean;
legacyEnvironment: boolean;
}
@@ -50,6 +55,7 @@ export function AssociationSettingsForm({
const telegramBotToken = String(
form.get("telegramBotToken") ?? "",
).trim();
+ const recaptchaSecret = String(form.get("recaptchaSecret") ?? "").trim();
try {
await api("/api/settings/association", {
@@ -71,6 +77,12 @@ export function AssociationSettingsForm({
!telegramBotToken &&
form.get("clearTelegramBotToken") === "on",
...(telegramBotToken ? { telegramBotToken } : {}),
+ recaptchaEnabled: form.get("recaptchaEnabled") === "on",
+ recaptchaSiteKey: form.get("recaptchaSiteKey") || null,
+ recaptchaMinScore: Number(form.get("recaptchaMinScore")),
+ clearRecaptchaSecret:
+ !recaptchaSecret && form.get("clearRecaptchaSecret") === "on",
+ ...(recaptchaSecret ? { recaptchaSecret } : {}),
},
});
toast("Réglages de l’association enregistrés.");
@@ -325,6 +337,118 @@ export function AssociationSettingsForm({
+
+
+
+
+
+
+ Protection anti-robot
+
+
+ reCAPTCHA v3 sur l’inscription des bénévoles et le formulaire
+ de contact. Les deux clés se créent sur{" "}
+
+ google.com/recaptcha/admin
+ {" "}
+ en choisissant « v3 ».
+
+
+
+
+
+
+ Activer reCAPTCHA
+
+
+ {settings.recaptchaReady
+ ? "Actif : les formulaires publics sont vérifiés."
+ : "Sans clé valide, les formulaires restent protégés par le seul champ piège."}
+
+
+
+
+
+
Enregistrer les réglages
diff --git a/src/components/join-form.tsx b/src/components/join-form.tsx
index 2e39e87..e2679a1 100644
--- a/src/components/join-form.tsx
+++ b/src/components/join-form.tsx
@@ -5,8 +5,16 @@ import Link from "next/link";
import { useState } from "react";
import { api } from "@/lib/client";
+import { useRecaptcha } from "@/lib/use-recaptcha";
-export function JoinForm({ contactEmail }: { contactEmail: string | null }) {
+export function JoinForm({
+ contactEmail,
+ recaptchaSiteKey = null,
+}: {
+ contactEmail: string | null;
+ recaptchaSiteKey?: string | null;
+}) {
+ const executerRecaptcha = useRecaptcha(recaptchaSiteKey);
const [loading, setLoading] = useState(false);
const [sent, setSent] = useState(false);
const [error, setError] = useState(null);
@@ -25,6 +33,7 @@ export function JoinForm({ contactEmail }: { contactEmail: string | null }) {
message: form.get("message"),
consent: form.get("consent") === "on",
website: form.get("website"),
+ recaptchaToken: await executerRecaptcha("contact"),
},
});
setSent(true);
diff --git a/src/components/ui.tsx b/src/components/ui.tsx
index 974226b..6182392 100644
--- a/src/components/ui.tsx
+++ b/src/components/ui.tsx
@@ -111,8 +111,10 @@ export function Select({
className,
...props
}: SelectHTMLAttributes) {
+ // `champ-select` déclenche l'affichage sur plusieurs lignes des libellés
+ // longs, là où le navigateur sait rendre la liste (voir globals.css).
return (
- (null);
@@ -73,6 +77,7 @@ export function VolunteerSignupForm({
phone: form.get("phone"),
consent: form.get("consent") === "on",
website: form.get("website"), // honeypot
+ recaptchaToken: await executerRecaptcha("inscription"),
},
});
setDone(true);
diff --git a/src/lib/db/schema.ts b/src/lib/db/schema.ts
index ceee449..7d26962 100644
--- a/src/lib/db/schema.ts
+++ b/src/lib/db/schema.ts
@@ -578,6 +578,16 @@ export const associationSettings = pgTable(
telegramTokenVerifiedAt: timestamp("telegram_token_verified_at", {
withTimezone: true,
}),
+ /**
+ * reCAPTCHA v3 sur les formulaires publics. La clé de site est publique par
+ * nature — elle part dans la page — la clé secrète ne quitte jamais le
+ * serveur et reste chiffrée. Le score minimal est retenu en pourcentage
+ * pour rester un entier : Google renvoie une note de 0,0 à 1,0.
+ */
+ recaptchaEnabled: boolean("recaptcha_enabled").notNull().default(false),
+ recaptchaSiteKey: text("recaptcha_site_key"),
+ encryptedRecaptchaSecret: text("encrypted_recaptcha_secret"),
+ recaptchaMinScore: integer("recaptcha_min_score").notNull().default(50),
updatedBy: uuid("updated_by").references(() => users.id, {
onDelete: "set null",
}),
@@ -594,6 +604,10 @@ export const associationSettings = pgTable(
"association_settings_task_reminder_window_check",
sql`${t.taskReminderWindowDays} >= 0 and ${t.taskReminderWindowDays} <= 30`,
),
+ recaptchaMinScoreCheck: check(
+ "association_settings_recaptcha_min_score_check",
+ sql`${t.recaptchaMinScore} >= 0 and ${t.recaptchaMinScore} <= 100`,
+ ),
volunteerReminderWindowCheck: check(
"association_settings_volunteer_reminder_window_check",
sql`${t.volunteerReminderWindowDays} >= 0 and ${t.volunteerReminderWindowDays} <= 30`,
diff --git a/src/lib/services/association-settings.ts b/src/lib/services/association-settings.ts
index 3bd7efa..a998b1f 100644
--- a/src/lib/services/association-settings.ts
+++ b/src/lib/services/association-settings.ts
@@ -12,6 +12,7 @@ import {
import { db } from "@/lib/db";
import { associationSettings } from "@/lib/db/schema";
import { checkTelegramBotToken } from "@/lib/notifications/telegram";
+import { checkRecaptchaSecret } from "@/lib/services/recaptcha";
import { emptyToNull } from "@/lib/utils";
import { associationSettingsSchema } from "@/lib/validation";
@@ -84,6 +85,15 @@ export async function getAssociationSettings() {
settings.telegramEnabled &&
Boolean(settings.encryptedTelegramBotToken) &&
Boolean(settings.telegramTokenVerifiedAt),
+ recaptchaEnabled: settings.recaptchaEnabled,
+ recaptchaSiteKey: settings.recaptchaSiteKey,
+ recaptchaSecretConfigured: Boolean(settings.encryptedRecaptchaSecret),
+ recaptchaMinScore: settings.recaptchaMinScore,
+ /** Seul état où les formulaires publics présentent une vérification. */
+ recaptchaReady:
+ settings.recaptchaEnabled &&
+ Boolean(settings.recaptchaSiteKey) &&
+ Boolean(settings.encryptedRecaptchaSecret),
legacyEnvironment: false,
updatedAt: settings.updatedAt,
};
@@ -107,6 +117,11 @@ export async function getAssociationSettings() {
// n'a jamais pu être confirmé, le canal reste donc fermé aux membres tant
// qu'un administrateur n'a pas enregistré les réglages une fois.
telegramReady: false,
+ recaptchaEnabled: false,
+ recaptchaSiteKey: null,
+ recaptchaSecretConfigured: false,
+ recaptchaMinScore: 50,
+ recaptchaReady: false,
legacyEnvironment: Boolean(
process.env.NEXT_PUBLIC_ASSO_NAME ||
process.env.NEXT_PUBLIC_SCHOOL_NAME ||
@@ -186,6 +201,46 @@ export async function saveAssociationSettings(
// panne réseau passagère ne doit pas bloquer les autres réglages.
}
+ // Clé secrète reCAPTCHA : même traitement que le token Telegram — chiffrée,
+ // jamais relue par une API de lecture, et confirmée auprès de Google avant
+ // d'ouvrir la vérification sur les formulaires publics.
+ let encryptedRecaptchaSecret = current?.encryptedRecaptchaSecret ?? null;
+ const recaptchaSecret = data.recaptchaSecret?.trim() || null;
+ if (data.clearRecaptchaSecret) {
+ encryptedRecaptchaSecret = null;
+ } else if (recaptchaSecret) {
+ encryptedRecaptchaSecret = encryptSecret(recaptchaSecret);
+ }
+
+ const recaptchaSiteKey = emptyToNull(data.recaptchaSiteKey);
+ if (data.recaptchaEnabled && (!recaptchaSiteKey || !encryptedRecaptchaSecret)) {
+ throw new HttpError(
+ 400,
+ "Renseignez la clé de site et la clé secrète avant d’activer reCAPTCHA.",
+ );
+ }
+
+ if (recaptchaSecret || (data.recaptchaEnabled && !current?.recaptchaEnabled)) {
+ const brut =
+ recaptchaSecret ??
+ (encryptedRecaptchaSecret ? safeDecrypt(encryptedRecaptchaSecret) : null);
+ const controle = brut
+ ? await checkRecaptchaSecret(brut)
+ : ({ ok: false, reason: "refused" } as const);
+ if (!controle.ok && controle.reason === "refused") {
+ throw new HttpError(
+ 400,
+ "Clé secrète refusée par Google. Vérifiez qu’il s’agit bien de la clé secrète du même site reCAPTCHA.",
+ );
+ }
+ if (!controle.ok) {
+ throw new HttpError(
+ 502,
+ "Google est injoignable : impossible de confirmer la clé. Réessayez dans un instant.",
+ );
+ }
+ }
+
const values = {
associationName: data.associationName,
schoolName: data.schoolName,
@@ -199,6 +254,10 @@ export async function saveAssociationSettings(
telegramTokenLastFour,
telegramBotUsername,
telegramTokenVerifiedAt,
+ recaptchaEnabled: data.recaptchaEnabled,
+ recaptchaSiteKey,
+ encryptedRecaptchaSecret,
+ recaptchaMinScore: data.recaptchaMinScore,
updatedBy: actor.userId,
updatedAt: new Date(),
};
@@ -249,3 +308,25 @@ export async function getTelegramBotToken() {
return process.env.TELEGRAM_BOT_TOKEN?.trim() || null;
}
+
+/**
+ * Configuration reCAPTCHA côté serveur : la clé secrète déchiffrée n'est
+ * rendue qu'ici, jamais par une API de lecture.
+ */
+export async function getRecaptchaRuntimeConfig() {
+ const settings = await getAssociationSettingsRecord().catch(() => null);
+ if (
+ !settings?.recaptchaEnabled ||
+ !settings.recaptchaSiteKey ||
+ !settings.encryptedRecaptchaSecret
+ ) {
+ return null;
+ }
+ const secret = safeDecrypt(settings.encryptedRecaptchaSecret);
+ if (!secret) return null;
+ return {
+ siteKey: settings.recaptchaSiteKey,
+ secret,
+ minScore: settings.recaptchaMinScore / 100,
+ };
+}
diff --git a/src/lib/services/recaptcha.ts b/src/lib/services/recaptcha.ts
new file mode 100644
index 0000000..73a96cc
--- /dev/null
+++ b/src/lib/services/recaptcha.ts
@@ -0,0 +1,135 @@
+import "server-only";
+
+import { HttpError } from "@/lib/auth/guards";
+
+/**
+ * reCAPTCHA v3 sur les formulaires publics.
+ *
+ * Google ne rend pas un verdict mais une note de 0 à 1 : à l'association de
+ * fixer le seuil, dans Configuration. Le jeton est vérifié côté serveur —
+ * seul endroit où la clé secrète existe — et pour l'action attendue, sans quoi
+ * un jeton obtenu sur un formulaire servirait pour un autre.
+ */
+
+const VERIFY_URL = "https://www.google.com/recaptcha/api/siteverify";
+const TIMEOUT_MS = 6000;
+
+export type RecaptchaAction = "inscription" | "contact" | "compte" | "motdepasse";
+
+interface VerifyResponse {
+ success?: boolean;
+ score?: number;
+ action?: string;
+ "error-codes"?: string[];
+}
+
+async function callGoogle(
+ secret: string,
+ token: string,
+ ip?: string | null,
+): Promise {
+ const body = new URLSearchParams({ secret, response: token });
+ if (ip) body.set("remoteip", ip);
+
+ try {
+ const response = await fetch(VERIFY_URL, {
+ method: "POST",
+ headers: { "Content-Type": "application/x-www-form-urlencoded" },
+ body,
+ signal: AbortSignal.timeout(TIMEOUT_MS),
+ cache: "no-store",
+ });
+ if (!response.ok) return null;
+ return (await response.json()) as VerifyResponse;
+ } catch {
+ return null;
+ }
+}
+
+/**
+ * Confirme qu'une clé secrète est bien celle d'un compte reCAPTCHA, en la
+ * présentant avec un jeton volontairement invalide : Google distingue le jeton
+ * refusé (`invalid-input-response`) de la clé refusée (`invalid-input-secret`).
+ */
+export async function checkRecaptchaSecret(
+ secret: string,
+): Promise<
+ { ok: true } | { ok: false; reason: "refused" | "unreachable" }
+> {
+ const payload = await callGoogle(secret, "verification-de-la-cle");
+ if (!payload) return { ok: false, reason: "unreachable" };
+ const codes = payload["error-codes"] ?? [];
+ if (codes.includes("invalid-input-secret")) {
+ return { ok: false, reason: "refused" };
+ }
+ return { ok: true };
+}
+
+/**
+ * Vérifie le jeton d'un formulaire public.
+ *
+ * Une note trop basse ou un jeton refusé arrêtent l'envoi. En revanche, si
+ * Google est injoignable, le formulaire passe : sur le site d'une association,
+ * bloquer l'inscription d'un parent parce qu'un service tiers est en panne
+ * coûte plus cher que de laisser filer un message indésirable. La panne est
+ * journalisée.
+ */
+export async function verifyRecaptcha({
+ secret,
+ token,
+ action,
+ minScore,
+ ip,
+}: {
+ secret: string;
+ token: string | undefined | null;
+ action: RecaptchaAction;
+ /** Note minimale acceptée, de 0 à 1. */
+ minScore: number;
+ ip?: string | null;
+}): Promise {
+ if (!token) {
+ throw new HttpError(
+ 400,
+ "Vérification anti-robot absente : rechargez la page, et si le problème persiste désactivez votre bloqueur de publicité sur ce site.",
+ );
+ }
+
+ const payload = await callGoogle(secret, token, ip);
+ if (!payload) {
+ console.warn(
+ "[recaptcha] service injoignable — formulaire accepté sans vérification",
+ );
+ return;
+ }
+
+ if (!payload.success) {
+ const codes = payload["error-codes"] ?? [];
+ // Une clé serveur invalide est une erreur d'exploitation, pas la faute du
+ // visiteur : elle ne doit pas lui fermer le formulaire au nez.
+ if (codes.includes("invalid-input-secret")) {
+ console.error(
+ "[recaptcha] clé secrète refusée par Google — formulaire accepté sans vérification",
+ );
+ return;
+ }
+ throw new HttpError(
+ 400,
+ "Vérification anti-robot échouée. Rechargez la page et réessayez.",
+ );
+ }
+
+ if (payload.action && payload.action !== action) {
+ throw new HttpError(
+ 400,
+ "Vérification anti-robot invalide. Rechargez la page et réessayez.",
+ );
+ }
+
+ if (typeof payload.score === "number" && payload.score < minScore) {
+ throw new HttpError(
+ 400,
+ "Votre envoi a été pris pour celui d’un robot. Réessayez, ou écrivez directement à l’association.",
+ );
+ }
+}
diff --git a/src/lib/use-recaptcha.ts b/src/lib/use-recaptcha.ts
new file mode 100644
index 0000000..ee98633
--- /dev/null
+++ b/src/lib/use-recaptcha.ts
@@ -0,0 +1,62 @@
+"use client";
+
+import { useCallback, useEffect } from "react";
+
+/**
+ * Charge reCAPTCHA v3 à la demande et fournit un jeton par envoi de
+ * formulaire. Sans clé de site — la protection n'étant pas activée — le
+ * chargement n'a pas lieu du tout : aucune requête vers Google n'est faite sur
+ * un site qui ne s'en sert pas.
+ */
+
+const SCRIPT_ID = "recaptcha-v3";
+
+declare global {
+ interface Window {
+ grecaptcha?: {
+ ready: (callback: () => void) => void;
+ execute: (siteKey: string, options: { action: string }) => Promise;
+ };
+ }
+}
+
+function attendreGrecaptcha(timeoutMs = 8000) {
+ return new Promise((resolve) => {
+ const echeance = Date.now() + timeoutMs;
+ const tester = () => {
+ if (window.grecaptcha?.execute) return resolve(window.grecaptcha);
+ if (Date.now() > echeance) return resolve(null);
+ window.setTimeout(tester, 100);
+ };
+ tester();
+ });
+}
+
+export function useRecaptcha(siteKey: string | null) {
+ useEffect(() => {
+ if (!siteKey || document.getElementById(SCRIPT_ID)) return;
+ const script = document.createElement("script");
+ script.id = SCRIPT_ID;
+ script.src = `https://www.google.com/recaptcha/api.js?render=${encodeURIComponent(siteKey)}`;
+ script.async = true;
+ script.defer = true;
+ document.head.appendChild(script);
+ }, [siteKey]);
+
+ return useCallback(
+ async (action: string): Promise => {
+ if (!siteKey) return undefined;
+ const grecaptcha = await attendreGrecaptcha();
+ if (!grecaptcha) return undefined;
+ return new Promise((resolve) => {
+ grecaptcha.ready(() => {
+ grecaptcha
+ .execute(siteKey, { action })
+ .then(resolve)
+ .catch(() => resolve(undefined));
+ });
+ });
+ },
+ [siteKey],
+ );
+}
diff --git a/src/lib/validation.ts b/src/lib/validation.ts
index 432d08a..d6c0029 100644
--- a/src/lib/validation.ts
+++ b/src/lib/validation.ts
@@ -130,6 +130,8 @@ export const signupSchema = z.object({
consent: z.boolean().refine((v) => v === true, {
message: "Vous devez accepter la politique de confidentialité.",
}),
+ /** Jeton reCAPTCHA v3, présent uniquement si la protection est activée. */
+ recaptchaToken: z.string().max(5000).optional(),
});
/** Message public envoyé depuis la page « Rejoindre l'association ». */
@@ -147,6 +149,8 @@ export const joinRequestSchema = z.object({
}),
// Honeypot anti-robot : champ caché qui doit rester vide.
website: z.string().optional(),
+ /** Jeton reCAPTCHA v3, présent uniquement si la protection est activée. */
+ recaptchaToken: z.string().max(5000).optional(),
});
export const forgotSchema = z.object({
@@ -380,6 +384,12 @@ export const associationSettingsSchema = z.object({
.optional()
.or(z.literal("")),
clearTelegramBotToken: z.boolean().default(false),
+ recaptchaEnabled: z.boolean().default(false),
+ recaptchaSiteKey: optionalText(200),
+ recaptchaSecret: z.string().trim().min(10).max(500).optional().or(z.literal("")),
+ clearRecaptchaSecret: z.boolean().default(false),
+ /** Note minimale acceptée, en pourcentage : Google note de 0 à 1. */
+ recaptchaMinScore: z.coerce.number().int().min(0).max(100).default(50),
});
/**