Merge pull request 'ci(release): publie les images Docker sur le registre Forgejo' (#145) from feat/release-push-docker-images into main

Reviewed-on: #145

.env.example

@@ -15,6 +15,14 @@ JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
 # (docker-compose.yml), serving both the API and the built frontend.
 # APP_PORT=3000
 
+# Optional — tag of the prebuilt images the release CI pushes to the Forgejo
+# container registry (git.dev.kyuno.fr/kyuno/batchcooking-{app,intent-service,
+# llm-worker}). Used by `docker compose pull` and a pull-based Portainer
+# stack; leave it `latest` or pin a release tag (e.g. v0.2.4). Ignored when
+# building locally instead (`docker compose build`, or `up` with no image
+# present) — see docker-compose.yml's `image:`/`build:` comment.
+# IMAGE_TAG=latest
+
 # --- Admin surface (apps/web's /admin/* routes + the /admin/* API) --------
 # All optional: an instance that doesn't run the admin app needs none of
 # these. `requireAdmin` fails closed when ADMIN_JWT_SECRET is unset, so
@@ -32,6 +40,17 @@ JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
 # ADMIN_INITIAL_EMAIL=ops@example.com
 # ADMIN_INITIAL_PASSWORD=changeme-at-least-8-chars
 # ADMIN_INITIAL_NAME=Ops
+#
+# Optional — lets an admin open a Forgejo ticket from a contact message
+# (apps/web's /admin/messages, issue #81). All three needed together: the
+# button stays hidden and the endpoint answers 503 unless all are set to a
+# non-empty value. docker-compose.yml forwards these into the "app"
+# container, so setting them here is enough (a blank value counts as
+# unset). FORGEJO_TOKEN is a personal access token with the write:issue
+# scope — generate it in Forgejo, never commit the real value.
+# FORGEJO_BASE_URL=https://git.example.com
+# FORGEJO_TOKEN=changeme-a-forgejo-personal-access-token
+# FORGEJO_REPO=owner/repo
 
 # Optional — only set this to false if THIS deployment is served over
 # plain HTTP (no TLS in front of it). Left unset, the session cookie

.github/workflows/release.yml

@@ -1,20 +1,34 @@
 name: Release
 
-# No image registry involved: Portainer is wired to this repo's Git remote
+# On a `vX.Y.Z` tag: build the three service images and push them to this
-# and builds/redeploys apps/api/Dockerfile itself. This workflow sanity-checks
+# Forgejo instance's built-in container registry (git.dev.kyuno.fr/<owner>/
-# that the image actually builds at the tagged commit, builds+attaches a
+# batchcooking-{app,intent-service,llm-worker}, tagged with the release tag
-# signed Android APK, publishes a Forgejo Release, then (best-effort) pings
+# and `latest`), build+attach a signed Android APK, publish a Forgejo
-# Portainer's deploy webhook so it doesn't have to wait for its own polling
+# Release, then (best-effort) ping Portainer's deploy webhook. Portainer can
-# interval.
+# pull those prebuilt images (docker-compose.yml references them via
+# ${IMAGE_TAG}) or keep building from the Git remote — `docker-compose.yml`
+# keeps a `build:` fallback next to every `image:`.
 on:
   push:
     tags: ["v*.*.*"]
 
 permissions:
   contents: write
+  # Lets this workflow's GITHUB_TOKEN push to the Forgejo container registry
+  # (the `build-and-push-images` job below `docker login`s with it). If a
+  # future instance policy scopes the run token tighter, swap that login's
+  # password for a `write:package` PAT added as a repo secret.
+  packages: write
 
 jobs:
-  sanity-build:
+  # Build the three service images at the tagged commit and push them to the
+  # Forgejo container registry. A successful push also *is* the "does it
+  # still build" check the old `sanity-build` job did (which only covered
+  # apps/api). One sequential job, not a per-image matrix: three concurrent
+  # `docker build`s hammer this single persistent runner's Docker daemon
+  # (the contended resource per project memory `ci-forgejo-runner-constraints`)
+  # for no real gain on a release, which is rare and usually runs alone.
+  build-and-push-images:
     runs-on: ubuntu-latest
     steps:
       # This runner's job containers don't come with docker preinstalled —
@@ -25,10 +39,36 @@ jobs:
 
       - uses: https://github.com/actions/checkout@v4
 
-      # Build only, no push, no registry — just confirms Portainer will be
+      - name: Build et push des 3 images vers le registre Forgejo
-      # able to build this same Dockerfile successfully at this tag before
+        env:
-      # anyone points it at this ref.
+          # The per-run token Forgejo Actions mints — has `packages: write`
-      - run: docker build -f apps/api/Dockerfile .
+          # via this workflow's `permissions:` block. `docker login` accepts
+          # it as the password for the actor who pushed the tag.
+          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -eu
+          # $GITHUB_SERVER_URL is "https://git.dev.kyuno.fr" — the registry
+          # is that same host. $GITHUB_REPOSITORY is "<owner>/<repo>"; the
+          # registry namespace is the owner, lower-cased (Forgejo package
+          # names are case-insensitive but the CLI wants a stable form).
+          registry="${GITHUB_SERVER_URL#http*://}"
+          owner="$(printf '%s' "${GITHUB_REPOSITORY%%/*}" | tr '[:upper:]' '[:lower:]')"
+          tag="$GITHUB_REF_NAME"
+          echo "$REGISTRY_TOKEN" | docker login "$registry" -u "$GITHUB_ACTOR" --password-stdin
+
+          # Every Dockerfile's build context is the repo root (see
+          # docker-compose.yml's `build.context: .`), hence the trailing `.`.
+          build_push() {
+            image="$registry/$owner/$1"
+            echo "::group::$1"
+            docker build -f "$2" -t "$image:$tag" -t "$image:latest" .
+            docker push "$image:$tag"
+            docker push "$image:latest"
+            echo "::endgroup::"
+          }
+          build_push batchcooking-app            apps/api/Dockerfile
+          build_push batchcooking-intent-service services/tech-step-intent-service/Dockerfile
+          build_push batchcooking-llm-worker     services/tech-step-llm-worker/Dockerfile
 
   # Builds the same signed APK as ci.yml's build-android job (issue #64),
   # with one difference: the version baked into the APK is derived from the
@@ -124,11 +164,11 @@ jobs:
 
   forgejo-release:
     runs-on: ubuntu-latest
-    needs: [sanity-build, build-android-apk]
+    needs: [build-and-push-images, build-android-apk]
     steps:
       # Ce runner ne fournit ni docker ni curl par défaut dans ses
       # conteneurs de job — même constat déjà fait pour docker (voir
-      # sanity-build) et pour curl dans ci.yml's test job.
+      # build-and-push-images) et pour curl dans ci.yml's test job.
       - name: Install curl
         run: apt-get update && apt-get install -y curl
 

README.md

@@ -207,10 +207,18 @@ depuis la même origine. Les deux autres services du fichier
 (`tech-step-intent-service`, `tech-step-llm-worker`) n'exposent eux aucun port
 au host — voir leurs propres README pour leur rôle.
 
-**Pas de registre d'image** dans cette configuration : l'instance **Portainer** de
+**Registre d'image** : la CI de release (voir plus bas) construit et pousse les
-production est reliée directement au dépôt Git et reconstruit elle-même
+trois images de service — `batchcooking-app`, `batchcooking-intent-service`,
-`docker-compose.yml`/`apps/api/Dockerfile` à chaque déploiement — la CI ne pousse
+`batchcooking-llm-worker` — sur le **registre de conteneurs intégré à Forgejo**
-donc aucune image nulle part.
+(`git.dev.kyuno.fr/kyuno/…`), taguées à la fois avec le tag de release (`vX.Y.Z`)
+et `latest`. `docker-compose.yml` référence ces images via `IMAGE_TAG` (variable
+d'environnement, défaut `latest` — voir `.env.example`), tout en gardant un bloc
+`build:` local à côté de chaque `image:` : `docker compose pull` récupère les
+images pré-construites, `docker compose up`/`build` retombe sur un build local si
+elles sont absentes. L'instance **Portainer** de production peut donc désormais
+tirer les images pré-construites (stack en mode *pull*, `IMAGE_TAG` pinné sur la
+release voulue) **ou** continuer à builder elle-même depuis le dépôt Git — les
+deux modes fonctionnent avec le même `docker-compose.yml`.
 
 ### Release (`.github/workflows/release.yml`)
 
@@ -221,14 +229,16 @@ git tag vX.Y.Z
 git push --tags
 ```
 
-Le pipeline enchaîne trois jobs : `sanity-build` (build de l'image Docker sans
+Le pipeline enchaîne quatre jobs : `build-and-push-images` (build des 3 images à
-push, juste pour vérifier qu'elle build encore à ce tag avant de laisser Portainer
+ce tag + push sur le registre Forgejo sous `vX.Y.Z` et `latest` — un push
-redéployer dessus), `github-release` (crée une Release GitHub avec changelog
+réussi vaut aussi vérification que tout build encore à ce commit),
-auto-généré à partir des PRs mergées), puis `notify-portainer` — envoie une requête
+`build-android-apk` (APK signé, `versionName` dérivé du tag), `forgejo-release`
-au webhook de redeploy de Portainer si le secret de dépôt `PORTAINER_WEBHOOK_URL`
+(crée la Release Forgejo `vX.Y.Z` et y attache `batchcooking.apk`), puis
-est configuré (sinon Portainer se resynchronise simplement à son prochain
+`notify-portainer` — envoie une requête au webhook de redeploy de Portainer si
-polling Git). Pour l'activer : récupérer l'URL du webhook depuis les réglages du
+le secret de dépôt `PORTAINER_WEBHOOK_URL` est configuré (sinon Portainer se
-stack Portainer, puis l'ajouter comme secret GitHub `PORTAINER_WEBHOOK_URL`.
+resynchronise à son prochain polling). Pour l'activer : récupérer l'URL du
+webhook depuis les réglages du stack Portainer, puis l'ajouter comme secret de
+dépôt `PORTAINER_WEBHOOK_URL`.
 
 ## Application mobile (Android)
 

apps/api/src/config/env.ts

@@ -13,12 +13,26 @@ import { z } from "zod";
 // separate test database this now requires.
 dotenv.config({ path: process.env.NODE_ENV === "test" ? ".env.test" : ".env" });
 
+/**
+ * Treats a blank env var (`FOO=`) as unset. `docker-compose.yml` passes
+ * every optional var through as `${FOO:-}`, which resolves to `""` (not an
+ * absent key) when the stack's `.env` leaves it empty — and a `.env` file
+ * is `.dockerignore`d, so that passthrough is the container's only source
+ * of these. Fields that must *fail closed* on a blank value rather than run
+ * their own format check against `""` (and crash `parse()` at boot) wrap
+ * their schema in this. Used for the `FORGEJO_*` trio below; `COOKIE_SECURE`
+ * folds the same `"" -> undefined` step into its own `.transform`.
+ */
+const blankAsUnset = (value: unknown): unknown => (value === "" ? undefined : value);
+
 /**
  * Schema for every environment variable the API reads. Parsing (below)
  * fails fast at startup if something required is missing/invalid, instead
- * of surfacing as a confusing runtime error later.
+ * of surfacing as a confusing runtime error later. Exported so the parsing
+ * rules (e.g. `blankAsUnset` on the `FORGEJO_*` trio) can be unit-tested
+ * without the process-wide `process.env` the singleton below parses.
  */
-const envSchema = z.object({
+export const envSchema = z.object({
   /** Runtime mode — also toggles test-only behavior (e.g. cheaper argon2 cost, see auth.service.ts). */
   NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
   /** Port the HTTP server listens on. */
@@ -152,14 +166,17 @@ const envSchema = z.object({
    * `INTERNAL_WORKER_SECRET`). Only this one admin action reads them; the
    * rest of the app never talks to Forgejo.
    */
-  FORGEJO_BASE_URL: z.string().url().optional(),
+  FORGEJO_BASE_URL: z.preprocess(blankAsUnset, z.string().url().optional()),
   /** Forgejo personal access token with the `write:issue` (or `issue`) scope. Secret — `.env.example` shows only a `changeme`. */
-  FORGEJO_TOKEN: z.string().optional(),
+  FORGEJO_TOKEN: z.preprocess(blankAsUnset, z.string().optional()),
   /** Target repo as `owner/repo` (e.g. `kyuno/batchCooking`) — issues are always created here, never a repo chosen at call time. */
-  FORGEJO_REPO: z
+  FORGEJO_REPO: z.preprocess(
+    blankAsUnset,
+    z
       .string()
       .regex(/^[^/\s]+\/[^/\s]+$/, "FORGEJO_REPO must look like 'owner/repo'")
       .optional(),
+  ),
 });
 
 /** Parsed, validated environment — import this instead of reading `process.env` directly anywhere else. */

apps/api/src/modules/admin/admin-users.routes.ts

@@ -0,0 +1,31 @@
+import { wrapAsyncHandler } from "@batch-cooking/express-tools";
+import { adminCreateUserSchema } from "@batch-cooking/shared";
+import { Router } from "express";
+import { requireAdmin } from "../../middlewares/require-admin.js";
+import { createUserProfile, listUsers } from "./admin-users.service.js";
+
+/**
+ * Router mounted at `/admin/api/users` (via `admin.routes.ts`) — every route
+ * behind {@link requireAdmin}. Backs the `/admin/utilisateurs` page: a
+ * read-only list of end-user accounts and a "create an account by hand"
+ * form. The server generates a one-time temporary password on create and
+ * returns it in the response (see `admin-users.service.ts`).
+ */
+export const adminUsersRouter = Router();
+
+adminUsersRouter.get(
+  "/",
+  requireAdmin,
+  wrapAsyncHandler(async (_req, res) => {
+    res.status(200).json(await listUsers());
+  }),
+);
+
+adminUsersRouter.post(
+  "/",
+  requireAdmin,
+  wrapAsyncHandler(async (req, res) => {
+    const input = adminCreateUserSchema.parse(req.body);
+    res.status(201).json(await createUserProfile(input));
+  }),
+);

apps/api/src/modules/admin/admin-users.service.ts

@@ -0,0 +1,145 @@
+import { randomInt } from "node:crypto";
+import { HttpError } from "@batch-cooking/error-tools";
+import {
+  type AdminCreateUserInput,
+  type AdminUserCreatedView,
+  type AdminUserListItemView,
+  ErrorCode,
+} from "@batch-cooking/shared";
+import argon2 from "argon2";
+import { env } from "../../config/env.js";
+import { prisma } from "../../db/prisma.js";
+import { analytics } from "../../lib/analytics.service.js";
+
+/**
+ * How many accounts `listUsers` returns per call. Like `CONTACT_MESSAGES_PAGE_SIZE`
+ * this is a triage view, not an export — the admin creates/looks up a handful
+ * of accounts, it never needs the whole table paginated.
+ */
+const USERS_PAGE_SIZE = 200;
+
+// Same reasoning as `admin-auth.service.ts`'s / `auth.service.ts`'s `hashOptions`:
+// argon2's real defaults are deliberately expensive; the test suite hashes
+// against throwaway data many times per run, so a cheaper cost keeps it fast
+// without weakening anything real. Never applies outside NODE_ENV=test.
+const testHashOptions = { memoryCost: 8192, timeCost: 2, parallelism: 1 };
+const hashOptions = env.NODE_ENV === "test" ? testHashOptions : undefined;
+
+/**
+ * Charset for {@link generateTemporaryPassword} — upper/lower letters + digits,
+ * minus the visually ambiguous ones (`0`/`O`/`1`/`l`/`I`), same spirit as
+ * `house.service.ts`'s `INVITE_CODE_CHARS`: this string is read off one screen
+ * and typed into another (or pasted, but not always).
+ */
+const TEMP_PASSWORD_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789";
+
+/** Length of a generated temporary password — comfortably above `signupSchema`'s 8-char floor. */
+const TEMP_PASSWORD_LENGTH = 16;
+
+/**
+ * A fresh random temporary password for an admin-created account. Uses
+ * `node:crypto`'s `randomInt` (not `Math.random`) exactly like
+ * `generateInviteCode()` — this value guards a real account until its owner
+ * changes it. Returned to the operator once and never stored in plain text.
+ */
+function generateTemporaryPassword(): string {
+  let password = "";
+  for (let i = 0; i < TEMP_PASSWORD_LENGTH; i++) {
+    password += TEMP_PASSWORD_CHARS[randomInt(TEMP_PASSWORD_CHARS.length)];
+  }
+  return password;
+}
+
+/** A `UserProfile` row with its household name joined in — the shape {@link toListItem} maps from. */
+type UserRow = Awaited<
+  ReturnType<
+    typeof prisma.userProfile.findFirstOrThrow<{
+      include: { house: { select: { name: true } } };
+    }>
+  >
+>;
+
+/** Shapes one Prisma `UserProfile` row (with its `house` name) into the admin list view — drops `passwordHash`/`tokenVersion`, resolves the household name. */
+function toListItem(row: UserRow): AdminUserListItemView {
+  return {
+    id: row.id,
+    firstName: row.firstName,
+    lastName: row.lastName,
+    email: row.email,
+    householdName: row.house?.name ?? null,
+    createdAt: row.createdAt.toISOString(),
+  };
+}
+
+/**
+ * Every end-user account for the admin `/admin/utilisateurs` list — newest
+ * first, capped at {@link USERS_PAGE_SIZE}. Read-only: this first version has
+ * no edit/disable/delete (deleting an account is irreversible and stays a
+ * deliberate self-service action in `AccountSettingsPage`).
+ */
+export async function listUsers(): Promise<AdminUserListItemView[]> {
+  try {
+    const rows = await prisma.userProfile.findMany({
+      // `id` as a tiebreaker so the order is total even if two accounts share
+      // a `createdAt` (bulk-provisioned in the same tick) — `id` ascends with
+      // `createdAt` anyway.
+      orderBy: [{ createdAt: "desc" }, { id: "desc" }],
+      take: USERS_PAGE_SIZE,
+      include: { house: { select: { name: true } } },
+    });
+    return rows.map(toListItem);
+  } catch (err) {
+    // Rethrown as-is — `wrapAsyncHandler`/the error middleware handles it,
+    // this layer just isn't allowed a bare `await`. Same as `admin-contact.service.ts`.
+    throw err;
+  }
+}
+
+/**
+ * Provisions a new end-user account by hand and returns it together with the
+ * one-time temporary password the caller must relay to the user. Mirrors
+ * `auth.service.ts`'s `signup` for the parts that matter (email-uniqueness
+ * check, argon2 hash, `UserProfile` row with `houseId`/`dietId` left `null`)
+ * but issues **no session token** — the operator isn't logging in as this
+ * user — and generates the password instead of accepting one.
+ *
+ * @throws {HttpError} `409 EMAIL_ALREADY_IN_USE` if the email is already taken.
+ */
+export async function createUserProfile(
+  input: AdminCreateUserInput,
+): Promise<AdminUserCreatedView> {
+  try {
+    const existing = await prisma.userProfile.findUnique({ where: { email: input.email } });
+    if (existing) {
+      throw new HttpError(409, ErrorCode.EMAIL_ALREADY_IN_USE, "Email already in use");
+    }
+
+    const temporaryPassword = generateTemporaryPassword();
+    const passwordHash = await argon2.hash(temporaryPassword, hashOptions);
+
+    const profile = await prisma.userProfile.create({
+      // No household/diet here, same as `signup` — the user picks those in the
+      // onboarding wizard after their first login.
+      data: {
+        firstName: input.firstName,
+        lastName: input.lastName,
+        email: input.email,
+        passwordHash,
+      },
+      include: { house: { select: { name: true } } },
+    });
+
+    // Fire-and-forget, one line, no migration (see `analytics.service.ts`). A
+    // distinct type from `user.signup` so the dashboard can tell hand-provisioned
+    // accounts apart; `actorType: "system"` because the actor is an operator, not
+    // the new user (and `AnalyticsEvent.actorId` only ever means a `UserProfile.id`).
+    analytics.recordEvent("admin.user_created", {
+      actorType: "system",
+      context: { userId: profile.id },
+    });
+
+    return { user: toListItem(profile), temporaryPassword };
+  } catch (err) {
+    throw err; // see listUsers()'s catch comment
+  }
+}

apps/api/src/modules/admin/admin.routes.ts

@@ -5,6 +5,7 @@ import { adminContactRouter } from "./admin-contact.routes.js";
 import { adminMetricsRouter } from "./admin-metrics.routes.js";
 import { adminTechStepsRouter } from "./admin-tech-steps.routes.js";
 import { adminToursRouter } from "./admin-tours.routes.js";
+import { adminUsersRouter } from "./admin-users.routes.js";
 
 /**
  * Aggregator for the admin application's API surface, mounted at
@@ -28,3 +29,4 @@ adminRouter.use("/tech-steps", adminTechStepsRouter);
 adminRouter.use("/catalog", adminCatalogRouter);
 adminRouter.use("/tours", adminToursRouter);
 adminRouter.use("/contact", adminContactRouter);
+adminRouter.use("/users", adminUsersRouter);

apps/api/test/admin-users.test.ts

@@ -0,0 +1,160 @@
+import { ErrorCode } from "@batch-cooking/shared";
+import { faker } from "@faker-js/faker";
+import { expect } from "chai";
+import request from "supertest";
+import { createApp } from "../src/app.js";
+import { prisma } from "../src/db/prisma.js";
+import { hashAdminPassword } from "../src/modules/admin/admin-auth.service.js";
+import { resetDatabase } from "../test-support/reset-db.js";
+
+async function seedAdmin(): Promise<{ email: string; password: string }> {
+  const email = faker.internet.email().toLowerCase();
+  const password = faker.internet.password({ length: 16 });
+  await prisma.adminUser.create({
+    data: { email, name: faker.person.fullName(), passwordHash: await hashAdminPassword(password) },
+  });
+  return { email, password };
+}
+
+/** A fresh, fake (never real-looking) create-user payload — same rationale as `auth.test.ts`'s `buildSignupPayload`. */
+function buildCreateUserPayload() {
+  const firstName = faker.person.firstName();
+  const lastName = faker.person.lastName();
+  return {
+    firstName,
+    lastName,
+    email: faker.internet.email({ firstName, lastName }).toLowerCase(),
+  };
+}
+
+/**
+ * `/admin/api/users/*` — the admin surface for provisioning end-user
+ * accounts by hand (`/admin/utilisateurs` page). Every route behind
+ * `requireAdmin`. Creation generates a one-time temporary password and
+ * returns it in the response; the account starts with no household, exactly
+ * like a self-service signup.
+ */
+describe("Admin users — account provisioning", () => {
+  const app = createApp();
+
+  beforeEach(async () => {
+    await resetDatabase();
+  });
+
+  after(async () => {
+    await prisma.$disconnect();
+  });
+
+  async function adminAgent() {
+    const { email, password } = await seedAdmin();
+    const agent = request.agent(app);
+    await agent.post("/admin/api/auth/login").send({ email, password });
+    return agent;
+  }
+
+  it("rejects every route without an admin session", async () => {
+    expect((await request(app).get("/admin/api/users")).status).to.equal(401);
+    expect(
+      (await request(app).post("/admin/api/users").send(buildCreateUserPayload())).status,
+    ).to.equal(401);
+  });
+
+  it("creates a profile with no household and returns a one-time temporary password", async () => {
+    const agent = await adminAgent();
+    const payload = buildCreateUserPayload();
+
+    const res = await agent.post("/admin/api/users").send(payload);
+
+    expect(res.status).to.equal(201);
+    expect(res.body.user).to.include({
+      firstName: payload.firstName,
+      lastName: payload.lastName,
+      email: payload.email,
+      householdName: null,
+    });
+    expect(res.body.user).to.not.have.property("passwordHash");
+    expect(res.body.user).to.not.have.property("tokenVersion");
+    expect(res.body.temporaryPassword).to.be.a("string").with.length.greaterThan(8);
+
+    const stored = await prisma.userProfile.findUnique({ where: { email: payload.email } });
+    expect(stored?.houseId).to.equal(null);
+    expect(stored?.dietId).to.equal(null);
+  });
+
+  it("issues a password the new account can actually log in with", async () => {
+    const agent = await adminAgent();
+    const payload = buildCreateUserPayload();
+
+    const created = await agent.post("/admin/api/users").send(payload);
+    const login = await request(app)
+      .post("/auth/login")
+      .send({ email: payload.email, password: created.body.temporaryPassword });
+
+    expect(login.status).to.equal(200);
+    expect(login.body.email).to.equal(payload.email);
+  });
+
+  it("rejects a duplicate email with 409 EMAIL_ALREADY_IN_USE", async () => {
+    const agent = await adminAgent();
+    const payload = buildCreateUserPayload();
+    await agent.post("/admin/api/users").send(payload);
+
+    const res = await agent
+      .post("/admin/api/users")
+      .send({ ...buildCreateUserPayload(), email: payload.email });
+
+    expect(res.status).to.equal(409);
+    expect(res.body.code).to.equal(ErrorCode.EMAIL_ALREADY_IN_USE);
+  });
+
+  it("rejects an invalid body with 400 VALIDATION_ERROR", async () => {
+    const agent = await adminAgent();
+
+    const badEmail = await agent
+      .post("/admin/api/users")
+      .send({ ...buildCreateUserPayload(), email: "not-an-email" });
+    expect(badEmail.status).to.equal(400);
+    expect(badEmail.body.code).to.equal(ErrorCode.VALIDATION_ERROR);
+
+    const noFirstName = await agent
+      .post("/admin/api/users")
+      .send({ ...buildCreateUserPayload(), firstName: "" });
+    expect(noFirstName.status).to.equal(400);
+  });
+
+  it("lists accounts newest-first with their household name resolved, never the password", async () => {
+    const agent = await adminAgent();
+    const first = buildCreateUserPayload();
+    const second = buildCreateUserPayload();
+    const firstRes = await agent.post("/admin/api/users").send(first);
+    await agent.post("/admin/api/users").send(second);
+
+    // Put the first account in a household so `householdName` has something to
+    // resolve — `House.adminId` is required, so the account is its own admin.
+    const house = await prisma.house.create({
+      data: {
+        name: "Le Foyer Test",
+        adminId: firstRes.body.user.id,
+        inviteCode: faker.string.alphanumeric(8).toUpperCase(),
+      },
+    });
+    await prisma.userProfile.update({
+      where: { email: first.email },
+      data: { houseId: house.id },
+    });
+
+    const res = await agent.get("/admin/api/users");
+
+    expect(res.status).to.equal(200);
+    expect(res.body).to.have.length(2);
+    // Newest first: `second` was created after `first`.
+    expect(res.body[0].email).to.equal(second.email);
+    expect(res.body[1].email).to.equal(first.email);
+    expect(res.body[1].householdName).to.equal("Le Foyer Test");
+    expect(res.body[0].householdName).to.equal(null);
+    for (const row of res.body) {
+      expect(row).to.not.have.property("temporaryPassword");
+      expect(row).to.not.have.property("passwordHash");
+    }
+  });
+});

apps/api/test/env.test.ts

@@ -0,0 +1,59 @@
+import { expect } from "chai";
+import { envSchema } from "../src/config/env.js";
+
+/**
+ * Pure schema test — no DB, no `process.env`. Covers `blankAsUnset` on the
+ * `FORGEJO_*` trio: `docker-compose.yml` forwards every optional var as
+ * `${FOO:-}`, which the container receives as `""` (not an absent key) when
+ * the stack's `.env` leaves it blank. Those three must read a blank value
+ * as "not configured" and still boot, rather than trip `FORGEJO_BASE_URL`'s
+ * `.url()` / `FORGEJO_REPO`'s regex and abort `parse()` at startup.
+ */
+describe("envSchema — FORGEJO_* blank handling", () => {
+  // The only two vars with no default and no `.optional()`.
+  const base = {
+    JWT_SECRET: "x".repeat(32),
+    INTENT_SERVICE_SECRET: "y".repeat(32),
+  };
+
+  it("treats blank FORGEJO_* values as unset instead of failing validation", () => {
+    const parsed = envSchema.parse({
+      ...base,
+      FORGEJO_BASE_URL: "",
+      FORGEJO_TOKEN: "",
+      FORGEJO_REPO: "",
+    });
+
+    expect(parsed.FORGEJO_BASE_URL).to.equal(undefined);
+    expect(parsed.FORGEJO_TOKEN).to.equal(undefined);
+    expect(parsed.FORGEJO_REPO).to.equal(undefined);
+  });
+
+  it("treats a fully absent FORGEJO_* trio the same way", () => {
+    const parsed = envSchema.parse({ ...base });
+    expect(parsed.FORGEJO_BASE_URL).to.equal(undefined);
+    expect(parsed.FORGEJO_TOKEN).to.equal(undefined);
+    expect(parsed.FORGEJO_REPO).to.equal(undefined);
+  });
+
+  it("still passes through and validates non-blank FORGEJO_* values", () => {
+    const parsed = envSchema.parse({
+      ...base,
+      FORGEJO_BASE_URL: "https://git.example.com",
+      FORGEJO_TOKEN: "a-token",
+      FORGEJO_REPO: "owner/repo",
+    });
+
+    expect(parsed.FORGEJO_BASE_URL).to.equal("https://git.example.com");
+    expect(parsed.FORGEJO_TOKEN).to.equal("a-token");
+    expect(parsed.FORGEJO_REPO).to.equal("owner/repo");
+  });
+
+  it("still rejects a non-blank but malformed FORGEJO_BASE_URL", () => {
+    expect(() => envSchema.parse({ ...base, FORGEJO_BASE_URL: "git.example.com" })).to.throw();
+  });
+
+  it("still rejects a non-blank but malformed FORGEJO_REPO", () => {
+    expect(() => envSchema.parse({ ...base, FORGEJO_REPO: "not-a-repo" })).to.throw();
+  });
+});

apps/web/cypress/component/PasswordInput.cy.tsx

@@ -0,0 +1,105 @@
+import { useState } from "react";
+import "../../src/i18n/i18n";
+import { PasswordInput } from "../../src/components/ui/PasswordInput";
+
+// Mounts PasswordInput in isolation (no form, no router, no backend) — the
+// same "generic component test" posture as CheckboxOption.cy.tsx. Needs
+// `../../src/i18n/i18n` imported for its side effect: unlike Checkbox/Radio,
+// this component calls `useTranslation()` for the eye button's aria-label,
+// and with no <I18nextProvider> in the tree it falls back to that default
+// instance (see TechStepCorrectionPopover.cy.tsx for the same note).
+
+const SHOW_LABEL = "Afficher le mot de passe";
+const HIDE_LABEL = "Masquer le mot de passe";
+
+/**
+ * Controlled wrapper — PasswordInput holds no text state of its own, so a
+ * real caller (LoginPage, SignupPage) always owns the value. `onSpy` lets a
+ * test assert on what each change reports.
+ */
+function Wrapper({ onSpy }: { onSpy?: (value: string) => void }) {
+  const [value, setValue] = useState("");
+  return (
+    <PasswordInput
+      id="password"
+      value={value}
+      onChange={(next) => {
+        setValue(next);
+        onSpy?.(next);
+      }}
+      autoComplete="current-password"
+    />
+  );
+}
+
+describe("PasswordInput", () => {
+  it("renders a masked password field by default", () => {
+    cy.mount(<Wrapper />);
+    cy.get("input#password").should("have.attr", "type", "password");
+  });
+
+  it("forwards id and autoComplete to the native input", () => {
+    cy.mount(<Wrapper />);
+    cy.get("input#password").should("have.attr", "autocomplete", "current-password");
+  });
+
+  it("reveals the text when the eye is clicked, then re-masks it on a second click", () => {
+    cy.mount(<Wrapper />);
+    cy.get("input#password").type("hunter2").should("have.attr", "type", "password");
+
+    cy.get("button.password-input__toggle").click();
+    cy.get("input#password").should("have.attr", "type", "text").and("have.value", "hunter2");
+
+    cy.get("button.password-input__toggle").click();
+    cy.get("input#password").should("have.attr", "type", "password").and("have.value", "hunter2");
+  });
+
+  it("labels the toggle with the action the next click performs, and exposes state via aria-pressed", () => {
+    cy.mount(<Wrapper />);
+    cy.get("button.password-input__toggle")
+      .should("have.attr", "aria-label", SHOW_LABEL)
+      .and("have.attr", "aria-pressed", "false");
+
+    cy.get("button.password-input__toggle").click();
+    cy.get("button.password-input__toggle")
+      .should("have.attr", "aria-label", HIDE_LABEL)
+      .and("have.attr", "aria-pressed", "true");
+  });
+
+  it("is a controlled input — it shows the parent's value and reports every change", () => {
+    const onSpy = cy.stub().as("onSpy");
+    cy.mount(<Wrapper onSpy={onSpy} />);
+
+    cy.get("input#password").type("abc");
+    cy.get("input#password").should("have.value", "abc");
+    cy.get("@onSpy").should("have.been.calledWith", "abc");
+  });
+
+  it("does not submit a surrounding form when the eye is clicked — the toggle is a plain button", () => {
+    const onSubmit = cy.stub().as("onSubmit");
+    cy.mount(
+      <form
+        onSubmit={(e) => {
+          e.preventDefault();
+          onSubmit();
+        }}
+      >
+        <Wrapper />
+        <button type="submit">Go</button>
+      </form>,
+    );
+
+    cy.get("button.password-input__toggle").click();
+    cy.get("@onSubmit").should("not.have.been.called");
+  });
+
+  it("starts hidden again on a fresh mount — visibility is never persisted", () => {
+    cy.mount(<Wrapper />);
+    cy.get("button.password-input__toggle").click();
+    cy.get("input#password").should("have.attr", "type", "text");
+
+    // A brand-new mount, as if the visitor navigated back to the page later.
+    cy.mount(<Wrapper />);
+    cy.get("input#password").should("have.attr", "type", "password");
+  });
+});

apps/web/cypress/e2e/admin-users.cy.ts

@@ -0,0 +1,111 @@
+// Mocks the admin API via cy.intercept — no live backend. Covers the
+// `/admin/utilisateurs` page: the account list, the create dialog, the
+// one-time temporary-password reveal, and the duplicate-email error.
+
+const adminBody = {
+  id: 1,
+  email: "ops@example.com",
+  name: "Ops",
+  createdAt: "2026-08-01T00:00:00.000Z",
+  lastLoginAt: "2026-08-28T09:00:00.000Z",
+};
+
+function users() {
+  return [
+    {
+      id: 2,
+      firstName: "Alice",
+      lastName: "Martin",
+      email: "alice@example.com",
+      householdName: "Foyer Martin",
+      createdAt: "2026-09-09T10:00:00.000Z",
+    },
+    {
+      id: 3,
+      firstName: "Bob",
+      lastName: "Durand",
+      email: "bob@example.com",
+      householdName: null,
+      createdAt: "2026-09-08T08:00:00.000Z",
+    },
+  ];
+}
+
+describe("Admin — utilisateurs", () => {
+  beforeEach(() => {
+    cy.viewport(1400, 900);
+    cy.intercept("GET", "**/admin/api/auth/me", { statusCode: 200, body: adminBody });
+    cy.intercept("GET", "**/admin/api/users", { statusCode: 200, body: users() }).as("list");
+  });
+
+  it("lists every account with its household (or a dash when none)", () => {
+    cy.visit("/admin/utilisateurs");
+    cy.wait("@list");
+
+    cy.contains(".users-table tr", "alice@example.com").should("contain.text", "Foyer Martin");
+    cy.contains(".users-table tr", "bob@example.com").should("contain.text", "—");
+  });
+
+  it("creates an account and reveals the one-time temporary password", () => {
+    cy.intercept("POST", "**/admin/api/users", (req) => {
+      req.reply({
+        statusCode: 201,
+        body: {
+          user: {
+            id: 4,
+            firstName: req.body.firstName,
+            lastName: req.body.lastName,
+            email: req.body.email,
+            householdName: null,
+            createdAt: "2026-09-10T12:00:00.000Z",
+          },
+          temporaryPassword: "Tmp4kR7qWzP2xY9n",
+        },
+      });
+    }).as("create");
+
+    cy.visit("/admin/utilisateurs");
+    cy.wait("@list");
+    cy.contains("button", "Nouvel utilisateur").click();
+
+    cy.get('[data-testid="create-user-form"]').within(() => {
+      cy.get("#newUserFirstName").type("Chloé");
+      cy.get("#newUserLastName").type("Petit");
+      cy.get("#newUserEmail").type("chloe@example.com");
+    });
+    cy.contains(".dialog-panel__footer button", "Créer le compte").click();
+
+    cy.wait("@create").its("request.body").should("deep.equal", {
+      firstName: "Chloé",
+      lastName: "Petit",
+      email: "chloe@example.com",
+    });
+
+    cy.get('[data-testid="temp-password-reveal"]')
+      .find("#tempPassword")
+      .should("have.value", "Tmp4kR7qWzP2xY9n");
+  });
+
+  it("shows the localized error when the email is already in use", () => {
+    cy.intercept("POST", "**/admin/api/users", {
+      statusCode: 409,
+      body: { code: 4001, message: "Email already in use" },
+    }).as("createDup");
+
+    cy.visit("/admin/utilisateurs");
+    cy.wait("@list");
+    cy.contains("button", "Nouvel utilisateur").click();
+
+    cy.get('[data-testid="create-user-form"]').within(() => {
+      cy.get("#newUserFirstName").type("Alice");
+      cy.get("#newUserLastName").type("Martin");
+      cy.get("#newUserEmail").type("alice@example.com");
+    });
+    cy.contains(".dialog-panel__footer button", "Créer le compte").click();
+
+    cy.wait("@createDup");
+    cy.get('[data-testid="create-user-form"]').should("contain.text", "Cet email est déjà utilisé");
+    // Still on the form — no password reveal.
+    cy.get('[data-testid="temp-password-reveal"]').should("not.exist");
+  });
+});

apps/web/cypress/e2e/auth-form.cy.ts

@@ -0,0 +1,50 @@
+// Mocks the API via cy.intercept — this job runs no live backend (see
+// .github/workflows/ci.yml). The signup/login *journeys* live in
+// auth.feature; this plain layout spec covers only the show/hide password
+// toggle (PasswordInput) wired into both auth pages — "a section of an
+// existing page" in specs/dev-conventions.md's test taxonomy, so a plain
+// `.cy.ts`, not a Gherkin scenario.
+
+describe("Auth forms — password show/hide toggle", () => {
+  beforeEach(() => {
+    // Both pages sit behind RedirectIfAuthenticated; a 401 on the session
+    // check keeps the visitor logged out so the form actually renders.
+    cy.intercept("GET", "**/auth/me", { statusCode: 401 });
+  });
+
+  for (const { label, path } of [
+    { label: "login", path: "/login" },
+    { label: "signup", path: "/signup" },
+  ]) {
+    it(`reveals then re-masks the password field on ${label}`, () => {
+      cy.visit(path);
+
+      // Starts masked, with the toggle offering to reveal it.
+      cy.get("#password").should("have.attr", "type", "password");
+      cy.get('[aria-label="Afficher le mot de passe"]')
+        .should("be.visible")
+        .and("have.attr", "aria-pressed", "false");
+
+      // Reveal.
+      cy.get('[aria-label="Afficher le mot de passe"]').click();
+      cy.get("#password").should("have.attr", "type", "text");
+      cy.get('[aria-label="Masquer le mot de passe"]').should("have.attr", "aria-pressed", "true");
+
+      // Re-mask.
+      cy.get('[aria-label="Masquer le mot de passe"]').click();
+      cy.get("#password").should("have.attr", "type", "password");
+    });
+  }
+
+  it("does not submit the login form when the eye is clicked", () => {
+    cy.intercept("POST", "**/auth/login", cy.spy().as("loginRequest"));
+    cy.visit("/login");
+
+    cy.get("#email").type("alice@example.com");
+    cy.get("#password").type("correct-horse-battery-staple");
+    cy.get('[aria-label="Afficher le mot de passe"]').click();
+
+    cy.get("#password").should("have.attr", "type", "text");
+    cy.get("@loginRequest").should("not.have.been.called");
+  });
+});

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "private": true,
   "type": "module",
   "scripts": {

apps/web/src/App.tsx

@@ -14,6 +14,7 @@ import { AdminLoginPage } from "./pages/admin/login/AdminLoginPage";
 import { MessagesPage as AdminMessagesPage } from "./pages/admin/messages/MessagesPage";
 import { MonitoringPage as AdminMonitoringPage } from "./pages/admin/monitoring/MonitoringPage";
 import { ToursPage as AdminToursPage } from "./pages/admin/tours/ToursPage";
+import { UsersPage as AdminUsersPage } from "./pages/admin/users/UsersPage";
 import { LoginPage } from "./pages/auth/LoginPage";
 import { SignupPage } from "./pages/auth/SignupPage";
 import { CookingSessionPage } from "./pages/cooking-session/CookingSessionPage";
@@ -198,6 +199,7 @@ export function App() {
             }
           >
             <Route index element={<AdminDashboardPage />} />
+            <Route path="utilisateurs" element={<AdminUsersPage />} />
             <Route path="monitoring" element={<AdminMonitoringPage />} />
             <Route path="corrections" element={<AdminCorrectionsPage />} />
             <Route path="catalogue" element={<AdminCatalogPage />} />

apps/web/src/api/admin-client.ts

@@ -1,6 +1,9 @@
 import {
+  type AdminCreateUserInput,
   type AdminLoginInput,
   type AdminTourScenarioView,
+  type AdminUserCreatedView,
+  type AdminUserListItemView,
   type AdminUserView,
   type ApiErrorResponse,
   type CatalogPlaceholderGroupView,
@@ -131,6 +134,20 @@ export class AdminApiClient {
     return this._request(`/metrics?days=${days}`);
   }
 
+  /** End-user accounts for the `/admin/utilisateurs` list — newest first, capped server-side at 200. */
+  public getUsers(): Promise<AdminUserListItemView[]> {
+    return this._request("/users");
+  }
+
+  /**
+   * Provisions an end-user account by hand. Returns the created account plus
+   * the one-time temporary password the server generated — show it once,
+   * it's never retrievable again. Rejects with `EMAIL_ALREADY_IN_USE`.
+   */
+  public createUser(input: AdminCreateUserInput): Promise<AdminUserCreatedView> {
+    return this._request("/users", { method: "POST", body: JSON.stringify(input) });
+  }
+
   /** Training suggestions, grouped by technique, filtered by the given (all-optional) criteria. */
   public getSuggestions(filters: {
     status?: string;

apps/web/src/components/ui/PasswordInput.tsx

@@ -0,0 +1,78 @@
+import { Eye, EyeOff } from "lucide-react";
+import { type ChangeEvent, useState } from "react";
+import { useTranslation } from "react-i18next";
+import "./password-input.scss";
+
+/**
+ * A password `<input>` paired with a show/hide "eye" toggle — the button
+ * swaps the field's `type` between `"password"` and `"text"` so a visitor
+ * can re-read what they typed before submitting. A bare password field
+ * gives no feedback at all, and a mistyped-but-invisible password is one
+ * of the most common causes of a failed login; this makes it checkable
+ * without a password manager.
+ *
+ * Lives in `components/ui/` rather than `features/auth/` because nothing
+ * about it is auth-specific — it is just a password field. Used today by
+ * {@link LoginPage} and {@link SignupPage}.
+ *
+ * Visibility is local state that always starts hidden on mount and is
+ * never persisted: revealing a password is a deliberate, momentary action,
+ * not a preference worth remembering across page loads or sessions.
+ *
+ * The field's own look (border, padding, background) is inherited from the
+ * surrounding context — the same arrangement as {@link CheckboxOption},
+ * which is styled through `global.scss` rather than carrying its own CSS.
+ * The colocated `password-input.scss` only positions the toggle inside the
+ * field and reserves horizontal room for it.
+ */
+export function PasswordInput({
+  id,
+  value,
+  onChange,
+  autoComplete,
+}: {
+  /** Forwarded to the `<input>` so an external `<label htmlFor>` keeps targeting it. */
+  id: string;
+  /** Controlled value — this component holds no text state of its own. */
+  value: string;
+  /** Called with the new text on each change (event unwrapped, like {@link CheckboxOption}). */
+  onChange: (value: string) => void;
+  /**
+   * Password-manager hint, forwarded verbatim — callers pass
+   * `"current-password"` on a login form, `"new-password"` on signup.
+   */
+  autoComplete?: string;
+}) {
+  const { t } = useTranslation();
+  // Always hidden on mount — see the component doc comment on why this is
+  // never persisted.
+  const [visible, setVisible] = useState(false);
+
+  // The label always names the action the *next* click performs; the
+  // pressed state is carried separately by `aria-pressed` below.
+  const toggleLabel = visible ? t("common.passwordInput.hide") : t("common.passwordInput.show");
+
+  return (
+    <span className="password-input">
+      <input
+        id={id}
+        type={visible ? "text" : "password"}
+        value={value}
+        onChange={(e: ChangeEvent<HTMLInputElement>) => onChange(e.target.value)}
+        autoComplete={autoComplete}
+      />
+      <button
+        type="button"
+        className="password-input__toggle"
+        // `type="button"` (not the implicit `"submit"`) so toggling
+        // visibility never submits the form the field sits in.
+        aria-pressed={visible}
+        aria-label={toggleLabel}
+        title={toggleLabel}
+        onClick={() => setVisible((v) => !v)}
+      >
+        {visible ? <EyeOff aria-hidden="true" /> : <Eye aria-hidden="true" />}
+      </button>
+    </span>
+  );
+}

apps/web/src/components/ui/password-input.scss

@@ -0,0 +1,58 @@
+// =============================================================================
+// PasswordInput (components/ui/PasswordInput.tsx) — positions the show/hide
+// "eye" toggle inside the password field and keeps typed text clear of it.
+//
+// The field's own look (border, padding, colours) is inherited from the
+// surrounding context — e.g. `.auth-card input` in features/auth/auth-form.scss
+// — exactly as CheckboxOption leans on global.scss. This sheet owns only the
+// wrapper, the toggle button, and the space the icon needs.
+// =============================================================================
+
+// No `@use` of the theme partial: every token below (--color-*, --space-*) is a
+// CSS custom property declared on :root in styles/global.scss, available at
+// runtime without a compile-time import.
+
+.password-input {
+  // Positioning context for the absolutely-placed toggle. `display: flex` lets
+  // the inner <input> fill the row on its own (it replaces a bare <input> that
+  // used to be a direct flex child of the form column).
+  position: relative;
+  display: flex;
+
+  input {
+    flex: 1;
+    min-width: 0;
+    // Keep the caret and text from sliding under the icon: field padding on the
+    // left + the ~20px glyph + matching breathing room on the right.
+    padding-right: calc(var(--space-sm) + 20px + var(--space-sm));
+  }
+}
+
+// The eye button: sits flush inside the field's right edge, full height so its
+// hit area matches the input, no surface of its own so it reads as part of the
+// field rather than a second control.
+.password-input__toggle {
+  position: absolute;
+  top: 0;
+  right: 0;
+  height: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0 var(--space-sm);
+  border: none;
+  background: transparent;
+  color: var(--color-text-muted);
+  cursor: pointer;
+
+  &:hover {
+    color: var(--color-text);
+  }
+
+  // lucide-react renders a 24×24 <svg> by default — bring it closer to the
+  // field's text size.
+  svg {
+    width: 20px;
+    height: 20px;
+  }
+}

apps/web/src/features/auth/auth-form.scss

@@ -61,7 +61,11 @@
   }
 
   // Submit button: full-width, visually separated from the fields above it.
-  button {
+  // Scoped to `[type="submit"]` specifically — the card also contains the
+  // PasswordInput's `type="button"` eye toggle, which must NOT inherit this
+  // full-width primary-coloured treatment (it styles itself in
+  // components/ui/password-input.scss).
+  button[type="submit"] {
     margin-top: var(--space-md);
     padding: 0.6rem;
     font-family: var(--font-body);

apps/web/src/layouts/AdminLayout.tsx

@@ -5,6 +5,7 @@ import {
   LayoutDashboard,
   ListChecks,
   PackageSearch,
+  Users,
 } from "lucide-react";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
@@ -20,6 +21,7 @@ import "./AdminLayout.scss";
  */
 const NAV_ITEMS = [
   { to: "/admin", key: "dashboard", Icon: LayoutDashboard, end: true },
+  { to: "/admin/utilisateurs", key: "users", Icon: Users, end: false },
   { to: "/admin/monitoring", key: "monitoring", Icon: Activity, end: false },
   { to: "/admin/corrections", key: "corrections", Icon: ListChecks, end: false },
   { to: "/admin/catalogue", key: "catalog", Icon: PackageSearch, end: false },

apps/web/src/locales/fr/translation.json

@@ -27,6 +27,10 @@
       "vendredi": "Vendredi",
       "samedi": "Samedi",
       "dimanche": "Dimanche"
+    },
+    "passwordInput": {
+      "show": "Afficher le mot de passe",
+      "hide": "Masquer le mot de passe"
     }
   },
   "errors": {
@@ -1230,6 +1234,7 @@
     },
     "nav": {
       "dashboard": "Tableau de bord",
+      "users": "Utilisateurs",
       "monitoring": "Monitoring",
       "corrections": "Corrections",
       "catalog": "Catalogue",
@@ -1239,6 +1244,37 @@
     "layout": {
       "logout": "Se déconnecter"
     },
+    "users": {
+      "title": "Utilisateurs",
+      "lead": "Comptes utilisateurs de l'application.",
+      "newButton": "Nouvel utilisateur",
+      "empty": "Aucun compte pour le moment.",
+      "noHousehold": "—",
+      "col": {
+        "date": "Créé le",
+        "name": "Nom",
+        "email": "Email",
+        "household": "Foyer"
+      },
+      "form": {
+        "title": "Créer un compte",
+        "firstName": "Prénom",
+        "lastName": "Nom",
+        "email": "Email",
+        "submit": "Créer le compte",
+        "submitting": "Création…",
+        "cancel": "Annuler"
+      },
+      "created": {
+        "title": "Compte créé",
+        "intro": "Transmettez ce mot de passe temporaire à",
+        "passwordLabel": "Mot de passe temporaire",
+        "copy": "Copier",
+        "copied": "Copié",
+        "warning": "Notez-le maintenant : il ne sera plus affiché.",
+        "done": "Terminé"
+      }
+    },
     "dashboard": {
       "title": "Tableau de bord",
       "lead": "Métriques d'utilisation de l'application.",

apps/web/src/pages/admin/users/UsersPage.tsx

@@ -0,0 +1,269 @@
+import {
+  type AdminUserCreatedView,
+  type AdminUserListItemView,
+  adminCreateUserSchema,
+  ErrorCode,
+} from "@batch-cooking/shared";
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { AdminApiError, adminApiClient } from "../../../api/admin-client";
+import { Dialog } from "../../../components/ui/Dialog";
+import { fieldErrorsFrom } from "../../../lib/zod-errors";
+import { errorMessageService } from "../../../services/error-message.service";
+import "../admin-page.scss";
+import "./users-page.scss";
+import { copyToClipboard, formatCreatedAt, fullName } from "./users";
+
+/** Load state for `GET /admin/api/users` — same discriminated-union shape as the other admin pages. */
+type UsersState =
+  | { status: "loading" }
+  | { status: "loaded"; rows: AdminUserListItemView[] }
+  | { status: "error" };
+
+/**
+ * Admin user management (`/admin/utilisateurs`). A read-only table of every
+ * end-user account plus a "create an account by hand" dialog: the operator
+ * fills in name + email, the server generates a one-time temporary password
+ * and hands it back for the operator to relay. No edit/disable/delete —
+ * deleting an account stays a deliberate self-service action.
+ */
+export function UsersPage() {
+  const { t } = useTranslation();
+  const [state, setState] = useState<UsersState>({ status: "loading" });
+  const [isCreating, setIsCreating] = useState(false);
+  const requestSeq = useRef(0);
+
+  const load = useCallback(() => {
+    const seq = ++requestSeq.current;
+    setState({ status: "loading" });
+    adminApiClient
+      .getUsers()
+      .then((rows) => {
+        if (seq === requestSeq.current) setState({ status: "loaded", rows });
+      })
+      .catch(() => {
+        if (seq === requestSeq.current) setState({ status: "error" });
+      });
+  }, []);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  return (
+    <div className="admin-page users-page">
+      <header className="users-page__header">
+        <div>
+          <h1 className="admin-page__title">{t("admin.users.title")}</h1>
+          <p className="admin-page__lead">{t("admin.users.lead")}</p>
+        </div>
+        <button type="button" className="users-page__new" onClick={() => setIsCreating(true)}>
+          {t("admin.users.newButton")}
+        </button>
+      </header>
+
+      {state.status === "loading" && (
+        <p className="admin-page__placeholder">{t("admin.common.loading")}</p>
+      )}
+      {state.status === "error" && (
+        <p className="admin-page__placeholder">{t("admin.common.loadError")}</p>
+      )}
+      {state.status === "loaded" && state.rows.length === 0 && (
+        <p className="admin-page__placeholder">{t("admin.users.empty")}</p>
+      )}
+      {state.status === "loaded" && state.rows.length > 0 && (
+        <div className="users-table-wrap">
+          <table className="users-table">
+            <thead>
+              <tr>
+                <th>{t("admin.users.col.date")}</th>
+                <th>{t("admin.users.col.name")}</th>
+                <th>{t("admin.users.col.email")}</th>
+                <th>{t("admin.users.col.household")}</th>
+              </tr>
+            </thead>
+            <tbody>
+              {state.rows.map((row) => (
+                <tr key={row.id}>
+                  <td className="users-table__date">{formatCreatedAt(row.createdAt)}</td>
+                  <td>{fullName(row)}</td>
+                  <td className="users-table__email">{row.email}</td>
+                  <td>{row.householdName ?? t("admin.users.noHousehold")}</td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      )}
+
+      {isCreating && (
+        <CreateUserDialog
+          onClose={(created) => {
+            setIsCreating(false);
+            if (created) load();
+          }}
+        />
+      )}
+    </div>
+  );
+}
+
+/**
+ * Two-step create dialog: the form, then — on success — a one-time reveal of
+ * the generated temporary password. `onClose(created)` tells the parent
+ * whether to refetch the list (`true` once an account was created, even if
+ * the operator then closes from the reveal step).
+ */
+function CreateUserDialog({ onClose }: { onClose: (created: boolean) => void }) {
+  const { t } = useTranslation();
+  const [firstName, setFirstName] = useState("");
+  const [lastName, setLastName] = useState("");
+  const [email, setEmail] = useState("");
+  const [fieldErrors, setFieldErrors] = useState<Record<string, string>>({});
+  const [formError, setFormError] = useState<string | null>(null);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [result, setResult] = useState<AdminUserCreatedView | null>(null);
+
+  async function submit() {
+    setFormError(null);
+    const parsed = adminCreateUserSchema.safeParse({ firstName, lastName, email });
+    if (!parsed.success) {
+      setFieldErrors(fieldErrorsFrom(parsed.error));
+      return;
+    }
+    setFieldErrors({});
+    setIsSubmitting(true);
+    try {
+      setResult(await adminApiClient.createUser(parsed.data));
+    } catch (err) {
+      setFormError(
+        errorMessageService.getLabel(
+          err instanceof AdminApiError ? err.code : ErrorCode.INTERNAL_ERROR,
+        ),
+      );
+      setIsSubmitting(false);
+    }
+  }
+
+  if (result) {
+    return <PasswordRevealDialog result={result} onDone={() => onClose(true)} />;
+  }
+
+  return (
+    <Dialog
+      title={t("admin.users.form.title")}
+      onClose={() => onClose(false)}
+      className="user-create-dialog"
+      footer={
+        <>
+          <button type="button" onClick={() => onClose(false)} disabled={isSubmitting}>
+            {t("admin.users.form.cancel")}
+          </button>
+          <button
+            type="button"
+            className="user-create-dialog__submit"
+            onClick={() => void submit()}
+            disabled={isSubmitting}
+          >
+            {isSubmitting ? t("admin.users.form.submitting") : t("admin.users.form.submit")}
+          </button>
+        </>
+      }
+    >
+      <form
+        data-testid="create-user-form"
+        onSubmit={(event) => {
+          event.preventDefault();
+          void submit();
+        }}
+      >
+        <label htmlFor="newUserFirstName">{t("admin.users.form.firstName")}</label>
+        <input
+          id="newUserFirstName"
+          type="text"
+          value={firstName}
+          maxLength={100}
+          autoComplete="off"
+          onChange={(event) => setFirstName(event.target.value)}
+        />
+        {fieldErrors.firstName && <p className="field-error">{fieldErrors.firstName}</p>}
+
+        <label htmlFor="newUserLastName">{t("admin.users.form.lastName")}</label>
+        <input
+          id="newUserLastName"
+          type="text"
+          value={lastName}
+          maxLength={100}
+          autoComplete="off"
+          onChange={(event) => setLastName(event.target.value)}
+        />
+        {fieldErrors.lastName && <p className="field-error">{fieldErrors.lastName}</p>}
+
+        <label htmlFor="newUserEmail">{t("admin.users.form.email")}</label>
+        <input
+          id="newUserEmail"
+          type="email"
+          value={email}
+          autoComplete="off"
+          onChange={(event) => setEmail(event.target.value)}
+        />
+        {fieldErrors.email && <p className="field-error">{fieldErrors.email}</p>}
+
+        {formError && <p className="form-error">{formError}</p>}
+        {/* Submit on Enter without showing a second button — the footer's is the visible one. */}
+        <button type="submit" hidden />
+      </form>
+    </Dialog>
+  );
+}
+
+/** The one-time temporary-password reveal shown after a successful create. */
+function PasswordRevealDialog({
+  result,
+  onDone,
+}: {
+  result: AdminUserCreatedView;
+  onDone: () => void;
+}) {
+  const { t } = useTranslation();
+  const [copied, setCopied] = useState(false);
+
+  return (
+    <Dialog
+      title={t("admin.users.created.title")}
+      onClose={onDone}
+      className="user-create-dialog"
+      footer={
+        <button type="button" className="user-create-dialog__submit" onClick={onDone}>
+          {t("admin.users.created.done")}
+        </button>
+      }
+    >
+      <div data-testid="temp-password-reveal">
+        <p>
+          {t("admin.users.created.intro")} <strong>{fullName(result.user)}</strong> (
+          {result.user.email})
+        </p>
+        <label htmlFor="tempPassword">{t("admin.users.created.passwordLabel")}</label>
+        <div className="user-create-dialog__password-row">
+          <input
+            id="tempPassword"
+            type="text"
+            readOnly
+            value={result.temporaryPassword}
+            onFocus={(event) => event.target.select()}
+          />
+          <button
+            type="button"
+            onClick={() => {
+              void copyToClipboard(result.temporaryPassword).then(setCopied);
+            }}
+          >
+            {copied ? t("admin.users.created.copied") : t("admin.users.created.copy")}
+          </button>
+        </div>
+        <p className="user-create-dialog__warning">{t("admin.users.created.warning")}</p>
+      </div>
+    </Dialog>
+  );
+}

apps/web/src/pages/admin/users/users-page.scss

@@ -0,0 +1,148 @@
+// =============================================================================
+// UsersPage — the admin user-account list + "create an account" dialog.
+// Shares the table language of messages-page.scss / corrections-page.scss;
+// its own file since nothing outside this page uses these classes.
+// =============================================================================
+
+.users-page__header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: var(--space-md);
+  flex-wrap: wrap;
+}
+
+// "Nouvel utilisateur" — the page's single primary action.
+.users-page__new {
+  flex-shrink: 0;
+  padding: var(--space-sm) var(--space-md);
+  font-family: var(--font-body);
+  font-size: var(--font-size-sm);
+  font-weight: 600;
+  color: #fff;
+  background: var(--color-primary);
+  border: 1px solid var(--color-primary);
+  border-radius: var(--radius-base);
+  cursor: pointer;
+
+  &:hover {
+    opacity: 0.9;
+  }
+}
+
+.users-table-wrap {
+  overflow-x: auto;
+}
+
+.users-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: var(--font-size-sm);
+
+  th,
+  td {
+    padding: var(--space-xs) var(--space-sm);
+    border-bottom: 1px solid var(--color-border);
+    text-align: left;
+    vertical-align: top;
+  }
+
+  th {
+    color: var(--color-text-muted);
+    font-weight: 600;
+  }
+
+  &__date {
+    white-space: nowrap;
+  }
+
+  &__email {
+    color: var(--color-text-muted);
+    font-size: var(--font-size-xs);
+  }
+}
+
+// Create-user modal — the `Dialog` primitive supplies the panel/scroll/close;
+// this only sizes the fields, the footer buttons and the password reveal.
+.user-create-dialog {
+  &.dialog-panel {
+    max-width: 32rem;
+    width: 100%;
+  }
+
+  label {
+    display: block;
+    margin: var(--space-sm) 0 var(--space-xs);
+    font-size: var(--font-size-sm);
+    font-weight: 600;
+  }
+
+  input {
+    width: 100%;
+    padding: var(--space-sm);
+    font-family: var(--font-body);
+    font-size: var(--font-size-sm);
+    color: var(--color-text);
+    background: var(--color-background);
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-base);
+  }
+
+  .field-error {
+    margin: var(--space-xs) 0 0;
+    font-size: var(--font-size-xs);
+    color: var(--color-error);
+  }
+
+  .form-error {
+    margin: var(--space-sm) 0 0;
+    font-size: var(--font-size-sm);
+    color: var(--color-error);
+  }
+
+  &__submit {
+    color: #fff;
+    background: var(--color-primary);
+    border-color: var(--color-primary);
+
+    &:hover:not(:disabled) {
+      opacity: 0.9;
+    }
+  }
+
+  // Read-only temp password + its "Copier" button, side by side.
+  &__password-row {
+    display: flex;
+    gap: var(--space-sm);
+
+    input {
+      font-family: var(--font-mono);
+      letter-spacing: 0.03em;
+    }
+
+    button {
+      flex-shrink: 0;
+      padding: var(--space-sm) var(--space-md);
+      font-family: var(--font-body);
+      font-size: var(--font-size-sm);
+      font-weight: 600;
+      color: var(--color-text);
+      background: var(--color-surface);
+      border: 1px solid var(--color-border);
+      border-radius: var(--radius-base);
+      cursor: pointer;
+
+      &:hover {
+        border-color: var(--color-primary);
+        color: var(--color-primary);
+      }
+    }
+  }
+
+  &__warning {
+    margin: var(--space-sm) 0 0;
+    font-size: var(--font-size-xs);
+    color: var(--color-text-muted);
+    font-style: italic;
+  }
+}

apps/web/src/pages/admin/users/users.ts

@@ -0,0 +1,32 @@
+import type { AdminUserListItemView } from "@batch-cooking/shared";
+
+/**
+ * Pure helpers for `UsersPage` — kept out of the `.tsx` (repo convention: no
+ * derivation/formatting logic in a component file) so they're trivially
+ * testable and the component stays markup + wiring only.
+ */
+
+/** Full name of an account, for the list's "Nom" column. */
+export function fullName(user: Pick<AdminUserListItemView, "firstName" | "lastName">): string {
+  return `${user.firstName} ${user.lastName}`.trim();
+}
+
+/** `createdAt` (ISO 8601) rendered for the "Créé le" column, French locale. */
+export function formatCreatedAt(isoDate: string): string {
+  return new Date(isoDate).toLocaleString("fr-FR");
+}
+
+/**
+ * Copies `text` to the clipboard, resolving `true` on success and `false`
+ * when the browser blocks it (insecure context, permission denied, no
+ * `navigator.clipboard`). Never throws — the caller just shows/withholds a
+ * "Copié" confirmation.
+ */
+export async function copyToClipboard(text: string): Promise<boolean> {
+  try {
+    await navigator.clipboard.writeText(text);
+    return true;
+  } catch {
+    return false;
+  }
+}

apps/web/src/pages/auth/LoginPage.tsx

@@ -3,6 +3,7 @@ import { type FormEvent, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Link, useNavigate } from "react-router-dom";
 import { ApiError } from "../../api/client";
+import { PasswordInput } from "../../components/ui/PasswordInput";
 import { useAuth } from "../../features/auth/AuthContext";
 // Shared with SignupPage — see the file for why it's colocated in
 // features/auth/ rather than duplicated per page.
@@ -78,11 +79,10 @@ export function LoginPage() {
         {fieldErrors.email && <p className="field-error">{fieldErrors.email}</p>}
 
         <label htmlFor="password">{t("auth.login.passwordLabel")}</label>
-        <input
+        <PasswordInput
           id="password"
-          type="password"
           value={password}
-          onChange={(e) => setPassword(e.target.value)}
+          onChange={setPassword}
           autoComplete="current-password"
         />
         {fieldErrors.password && <p className="field-error">{fieldErrors.password}</p>}

apps/web/src/pages/auth/SignupPage.tsx

@@ -3,6 +3,7 @@ import { type FormEvent, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Link, useNavigate } from "react-router-dom";
 import { ApiError } from "../../api/client";
+import { PasswordInput } from "../../components/ui/PasswordInput";
 import { useAuth } from "../../features/auth/AuthContext";
 // Shared with LoginPage — see the file for why it's colocated in
 // features/auth/ rather than duplicated per page.
@@ -98,11 +99,10 @@ export function SignupPage() {
         {fieldErrors.email && <p className="field-error">{fieldErrors.email}</p>}
 
         <label htmlFor="password">{t("auth.signup.passwordLabel")}</label>
-        <input
+        <PasswordInput
           id="password"
-          type="password"
           value={password}
-          onChange={(e) => setPassword(e.target.value)}
+          onChange={setPassword}
           autoComplete="new-password"
         />
         {fieldErrors.password && <p className="field-error">{fieldErrors.password}</p>}

docker-compose.yml

@@ -23,6 +23,13 @@ services:
   # apps/api/Dockerfile) — no separate nginx/web container, no cross-origin
   # CORS_ORIGIN to keep in sync between two ports.
   app:
+    # Prebuilt image pushed by .github/workflows/release.yml to the Forgejo
+    # container registry on every `vX.Y.Z` tag. `IMAGE_TAG` (root .env,
+    # default `latest`) pins which release to run — a pull-based Portainer
+    # stack / `docker compose pull` uses this. The `build:` block below stays
+    # as a local fallback: `docker compose up` builds it if the image isn't
+    # present, `docker compose build` (re)creates it under this same name.
+    image: git.dev.kyuno.fr/kyuno/batchcooking-app:${IMAGE_TAG:-latest}
     build:
       context: .
       dockerfile: apps/api/Dockerfile
@@ -54,6 +61,16 @@ services:
       # has every /admin/* route 401. Must be a *different* secret than
       # JWT_SECRET.
       ADMIN_JWT_SECRET: ${ADMIN_JWT_SECRET:-}
+      # Forgejo integration for "create a ticket from a contact message"
+      # (apps/web's /admin/messages, issue #81). All three read from this
+      # stack's .env; the feature fails closed — the button is hidden and
+      # the endpoint answers 503 — unless all three are set to a non-empty
+      # value, same posture as ADMIN_JWT_SECRET above. A `.dockerignore`d
+      # `.env` never reaches this container, so they must be passed here
+      # explicitly; a blank value counts as unset (see config/env.ts).
+      FORGEJO_BASE_URL: ${FORGEJO_BASE_URL:-}
+      FORGEJO_TOKEN: ${FORGEJO_TOKEN:-}
+      FORGEJO_REPO: ${FORGEJO_REPO:-}
       # Compose network service name, not localhost — same reasoning as
       # DATABASE_URL above. Unlike INTERNAL_WORKER_SECRET, no `:-` fallback:
       # tech-step-intent-service is a core dependency (see its own entry
@@ -77,6 +94,9 @@ services:
   # port — reachable only from `app` on the compose network, nothing ever
   # calls into it from outside.
   tech-step-intent-service:
+    # See the `app` service's `image:` comment — same release-pushed / local
+    # fallback split, shared `IMAGE_TAG`.
+    image: git.dev.kyuno.fr/kyuno/batchcooking-intent-service:${IMAGE_TAG:-latest}
     build:
       context: .
       dockerfile: services/tech-step-intent-service/Dockerfile
@@ -121,6 +141,9 @@ services:
   # less deployment can omit this service entirely and `app` still runs
   # fine, just without the offline audit/feedback-loop jobs.
   tech-step-llm-worker:
+    # See the `app` service's `image:` comment — same release-pushed / local
+    # fallback split, shared `IMAGE_TAG`.
+    image: git.dev.kyuno.fr/kyuno/batchcooking-llm-worker:${IMAGE_TAG:-latest}
     build:
       context: .
       dockerfile: services/tech-step-llm-worker/Dockerfile

packages/shared/src/schemas/admin.ts

@@ -17,6 +17,24 @@ export const adminLoginSchema = z.object({
 /** Inferred TS type for {@link adminLoginSchema}'s validated output. */
 export type AdminLoginInput = z.infer<typeof adminLoginSchema>;
 
+/**
+ * Payload accepted by `POST /admin/api/users` — an operator provisioning an
+ * end-user account by hand (test accounts, pre-registration, support). Its
+ * own contract, not a re-export of `signupSchema` (same stance as
+ * {@link adminLoginSchema} vs `loginSchema`), and notably **without a
+ * `password` field**: the server generates a one-time temporary password
+ * and returns it once (see `apps/api`'s `admin-users.service.ts`). The
+ * name/email rules mirror `signupSchema` so a hand-created account is
+ * indistinguishable from a self-signed-up one afterwards.
+ */
+export const adminCreateUserSchema = z.object({
+  firstName: z.string().trim().min(1, "Le prénom est requis").max(100),
+  lastName: z.string().trim().min(1, "Le nom est requis").max(100),
+  email: z.string().trim().toLowerCase().email("Email invalide"),
+});
+/** Inferred TS type for {@link adminCreateUserSchema}'s validated output. */
+export type AdminCreateUserInput = z.infer<typeof adminCreateUserSchema>;
+
 /**
  * Query params for `GET /admin/api/metrics` — `?days=` bounds how far back the
  * time-series go (and how many daily buckets they carry). Coerced from the

packages/shared/src/types/admin.ts

@@ -15,6 +15,37 @@ export interface AdminUserView {
   lastLoginAt: string | null;
 }
 
+/**
+ * One row of `GET /admin/api/users` — an end-user account as shown in the
+ * admin's user list. Declared by hand rather than derived from the Prisma
+ * `UserProfile` type (same reason as {@link AdminUserView} / {@link
+ * SafeUserProfile}: apps/web must not depend on `@prisma/client`), and
+ * deliberately *not* {@link SafeUserProfile}: this view drops `tokenVersion`
+ * (internal) and adds `householdName` (resolved server-side) + `createdAt`.
+ * `householdName` is `null` when the account belongs to no household;
+ * `createdAt` is an ISO 8601 string.
+ */
+export interface AdminUserListItemView {
+  id: number;
+  firstName: string;
+  lastName: string;
+  email: string;
+  householdName: string | null;
+  createdAt: string;
+}
+
+/**
+ * Response of `POST /admin/api/users`. Carries the freshly-created account
+ * plus the **one-time** temporary password the server generated for it —
+ * never stored in plain text, never retrievable again, so the operator must
+ * copy it now and relay it to the user out of band.
+ */
+export interface AdminUserCreatedView {
+  user: AdminUserListItemView;
+  /** Plain-text temporary password, shown exactly once. */
+  temporaryPassword: string;
+}
+
 /** One `{ key, count }` breakdown row — e.g. recipes per source, corrections per status. */
 export interface MetricsBreakdownRow {
   key: string;

specs/frontend-architecture.md

@@ -762,6 +762,14 @@ Clic sur une ligne :
   `:hover`/`:focus-within` (aucun état JS). `children` doit être un seul
   élément focusable ; cloné pour y attacher `aria-describedby` (lecteurs
   d'écran). Utilisé par `StepDescription.tsx` pour l'infobulle des techniques.
+- **`PasswordInput.tsx`** (+ `password-input.scss`) — un `<input>` de mot de
+  passe avec un bouton œil (`lucide-react` `Eye`/`EyeOff`) qui bascule son
+  `type` entre `"password"` et `"text"`. Visibilité en état local, toujours
+  masquée au montage, jamais persistée. Bouton `type="button"` +
+  `aria-label` traduit (`common.passwordInput.*`) + `aria-pressed`. Le style
+  du champ lui-même est hérité du contexte (comme `CheckboxOption` via
+  `global.scss`) ; la feuille colocalisée ne fait que positionner le bouton.
+  Utilisé par `LoginPage` et `SignupPage`.
 
 ---