fix: VITE_API_URL fallback to include /api suffix

Secret was missing /api — frontend called /auth/session instead of
/api/auth/session, Apache SPA fallback returned index.html instead
of proxying to Express backend.

.claude/settings.json

@@ -0,0 +1,19 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm *)",
+      "Bash(git *)",
+      "Bash(pm2 *)",
+      "Bash(curl *)",
+      "Bash(ls *)",
+      "Bash(cat *)",
+      "Bash(grep *)",
+      "Bash(mkdir *)",
+      "Bash(cp *)",
+      "Bash(mv *)",
+      "Bash(node *)",
+      "Bash(npx *)",
+      "Write(*)"
+    ]
+  }
+}

.gitea/workflows/deploy.yml

@@ -32,15 +32,16 @@ jobs:
       - name: Restart pm2
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
-          pm2 restart originsdigital-backend || pm2 start /var/www/originsdigital/backend/dist/index.js --name originsdigital-backend
+          su - tetardtek-brain -c 'pm2 reload originsdigital-backend --update-env'
-          pm2 save
 
       # ── Frontend ─────────────────────────────────────────────────────────────
       - name: Install & build frontend
         working-directory: frontend
         env:
-          VITE_API_URL: ${{ secrets.VITE_API_URL }}
+          VITE_API_URL: ${{ secrets.VITE_API_URL || 'https://origins.tetardtek.com/api' }}
           VITE_SUPEROAUTH_URL: ${{ secrets.VITE_SUPEROAUTH_URL }}
+          VITE_OAUTH_URL: ${{ secrets.VITE_SUPEROAUTH_URL }}
+          VITE_OAUTH_CLIENT_ID: origins
         run: |
           npm ci
           npm run build

backend/package.json

@@ -10,7 +10,8 @@
     "migration:generate": "npm run typeorm -- migration:generate",
     "migration:run": "npm run typeorm -- migration:run",
     "migration:revert": "npm run typeorm -- migration:revert",
-    "seed:videos": "ts-node --transpile-only src/seeds/videos.ts"
+    "seed:videos": "ts-node --transpile-only src/seeds/videos.ts",
+    "test": "vitest run"
   },
   "dependencies": {
     "bcrypt": "^5.1.1",
@@ -18,11 +19,13 @@
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.18.3",
+    "express-rate-limit": "^8.3.1",
     "jsonwebtoken": "^9.0.2",
     "multer": "^2.1.1",
     "mysql2": "^3.9.3",
     "reflect-metadata": "^0.2.2",
-    "typeorm": "^0.3.20"
+    "typeorm": "^0.3.20",
+    "winston": "^3.19.0"
   },
   "devDependencies": {
     "@types/bcrypt": "^5.0.2",
@@ -32,8 +35,12 @@
     "@types/jsonwebtoken": "^9.0.6",
     "@types/multer": "^2.1.0",
     "@types/node": "^20.12.2",
+    "@types/supertest": "^7.2.0",
+    "@types/winston": "^2.4.4",
+    "supertest": "^7.2.2",
     "ts-node": "^10.9.2",
     "ts-node-dev": "^2.0.0",
-    "typescript": "^5.4.3"
+    "typescript": "^5.4.3",
+    "vitest": "^4.1.0"
   }
 }

backend/src/index.ts

@@ -10,10 +10,13 @@ import playlistRoutes from "./routes/playlist.routes";
 import adminRoutes from "./routes/admin.routes";
 import streamRoutes from "./routes/stream.routes";
 import userRoutes from "./routes/user.routes";
+import logger from "./utils/logger";
+import { loginRateLimiter, adminRateLimiter } from "./middleware/rateLimiter";
 
 dotenv.config();
 
 const app = express();
+app.set("trust proxy", 1);
 const PORT = parseInt(process.env.PORT ?? "4000");
 
 const allowedOrigins = (process.env.FRONTEND_URL ?? "http://localhost:5173")
@@ -35,21 +38,22 @@ app.get("/api/health", (_req, res) => {
   res.json({ status: "ok", timestamp: new Date().toISOString() });
 });
 
+app.use("/api/auth/login", loginRateLimiter);
 app.use("/api/auth", authRoutes);
 app.use("/api/videos", videoRoutes);
 app.use("/api/playlists", playlistRoutes);
-app.use("/api/admin", adminRoutes);
+app.use("/api/admin", adminRateLimiter, adminRoutes);
 app.use("/api/stream", streamRoutes);
 app.use("/api/users", userRoutes);
 
 AppDataSource.initialize()
   .then(() => {
-    console.log("Database connected");
+    logger.info("Database connected");
     app.listen(PORT, () => {
-      console.log(`Server running on port ${PORT}`);
+      logger.info(`Server running on port ${PORT}`);
     });
   })
-  .catch((err) => {
+  .catch((err: unknown) => {
-    console.error("Database connection failed:", err);
+    logger.error("Database connection failed", { err });
     process.exit(1);
   });

backend/src/middleware/admin.middleware.ts

@@ -1,8 +1,8 @@
 import { Response, NextFunction } from "express";
 import { AppDataSource } from "../config/data-source";
 import { User } from "../entities/User";
-import { UserRole } from "../entities/UserRole";
 import { AuthenticatedRequest } from "./auth.middleware";
+import logger from "../utils/logger";
 
 /**
  * Middleware requireAdmin — s'exécute APRÈS requireAuth.
@@ -18,6 +18,7 @@ export const requireAdmin = async (
   try {
     const localUser = await AppDataSource.getRepository(User).findOne({
       where: { superOAuthId: req.user.id },
+      relations: { userRoles: { role: true } },
     });
 
     if (!localUser) {
@@ -25,12 +26,7 @@ export const requireAdmin = async (
       return;
     }
 
-    const userRoles = await AppDataSource.getRepository(UserRole).find({
+    const slugs = localUser.userRoles.map((ur) => ur.role.slug);
-      where: { userId: localUser.id },
-      relations: ["role"],
-    });
-
-    const slugs = userRoles.map((ur) => ur.role.slug);
     const isAdmin = slugs.includes("admin") || slugs.includes("super_admin");
 
     if (!isAdmin) {
@@ -39,7 +35,8 @@ export const requireAdmin = async (
     }
 
     next();
-  } catch {
+  } catch (err) {
+    logger.error("requireAdmin — DB error", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 };

backend/src/middleware/auth.middleware.ts

@@ -1,4 +1,5 @@
 import { Request, Response, NextFunction } from "express";
+import logger from "../utils/logger";
 
 export interface AuthenticatedUser {
   id: string;
@@ -40,7 +41,7 @@ export const requireAuth = async (
 
   const superOAuthUrl = process.env.SUPER_OAUTH_URL;
   if (!superOAuthUrl) {
-    console.error("SUPER_OAUTH_URL not configured");
+    logger.error("SUPER_OAUTH_URL not configured");
     res.status(500).json({ success: false, error: "INTERNAL_ERROR", message: "Auth service not configured" });
     return;
   }
@@ -63,9 +64,15 @@ export const requireAuth = async (
       return;
     }
 
+    if (!data.data.user.isActive) {
+      res.status(401).json({ success: false, error: "ACCOUNT_DISABLED", message: "Account is disabled" });
+      return;
+    }
+
     (req as AuthenticatedRequest).user = data.data.user;
     next();
-  } catch {
+  } catch (err) {
+    logger.error("requireAuth — auth service unreachable", { err });
     res.status(500).json({ success: false, error: "AUTH_SERVICE_UNAVAILABLE", message: "Authentication service unreachable" });
   }
 };

backend/src/middleware/rateLimiter.ts

@@ -0,0 +1,25 @@
+import rateLimit from "express-rate-limit";
+
+const rateLimitResponse = { error: "RATE_LIMIT_EXCEEDED" };
+
+/** POST /api/auth/login — 10 req / 15 min par IP */
+export const loginRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (_req, res) => {
+    res.status(429).json(rateLimitResponse);
+  },
+});
+
+/** /api/admin/* — 50 req / min par IP */
+export const adminRateLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 50,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (_req, res) => {
+    res.status(429).json(rateLimitResponse);
+  },
+});

backend/src/routes/admin.routes.ts

@@ -1,6 +1,23 @@
 import { Router, Request, Response } from "express";
 import path from "path";
 import fs from "fs";
+
+/**
+ * Vérifie les magic bytes d'un fichier vidéo déjà écrit sur disque.
+ * MP4  : bytes 4-7 = 'ftyp' (0x66 0x74 0x79 0x70)
+ * WebM : bytes 0-3 = 0x1A 0x45 0xDF 0xA3
+ */
+const isValidVideoMagicBytes = (filePath: string): boolean => {
+  const fd = fs.openSync(filePath, "r");
+  const buf = Buffer.alloc(12);
+  fs.readSync(fd, buf, 0, 12, 0);
+  fs.closeSync(fd);
+
+  const isWebM = buf[0] === 0x1a && buf[1] === 0x45 && buf[2] === 0xdf && buf[3] === 0xa3;
+  const isMP4 = buf[4] === 0x66 && buf[5] === 0x74 && buf[6] === 0x79 && buf[7] === 0x70;
+
+  return isMP4 || isWebM;
+};
 import multer, { FileFilterCallback } from "multer";
 import { AppDataSource } from "../config/data-source";
 import { Video } from "../entities/Video";
@@ -11,6 +28,7 @@ import { UserSubscription } from "../entities/UserSubscription";
 import { SubscriptionPlan } from "../entities/SubscriptionPlan";
 import { requireAuth, AuthenticatedRequest } from "../middleware/auth.middleware";
 import { requireAdmin } from "../middleware/admin.middleware";
+import logger from "../utils/logger";
 
 const UPLOADS_DIR = process.env.UPLOADS_DIR ?? path.join(process.cwd(), "uploads");
 fs.mkdirSync(UPLOADS_DIR, { recursive: true });
@@ -70,6 +88,13 @@ router.post(
       res.status(400).json({ success: false, error: "NO_FILE" });
       return;
     }
+
+    if (!isValidVideoMagicBytes(req.file.path)) {
+      fs.unlinkSync(req.file.path);
+      res.status(415).json({ success: false, error: "INVALID_FILE_CONTENT", message: "File content does not match a valid video format" });
+      return;
+    }
+
     res.status(201).json({
       success: true,
       data: { storageKey: req.file.filename, storageType: "local" },
@@ -80,14 +105,27 @@ router.post(
 /**
  * GET /api/admin/videos
  * Liste toutes les vidéos (publiées et non publiées), tous les champs.
+ * Query: ?page=1&limit=20
  */
-router.get("/videos", async (_req: Request, res: Response): Promise<void> => {
+router.get("/videos", async (req: Request, res: Response): Promise<void> => {
+  const rawPage  = Number(req.query.page  ?? 1);
+  const rawLimit = Number(req.query.limit ?? 20);
+
+  if (!Number.isInteger(rawPage)  || rawPage  < 1 ||
+      !Number.isInteger(rawLimit) || rawLimit < 1 || rawLimit > 100) {
+    res.status(400).json({ success: false, error: "INVALID_PAGINATION" });
+    return;
+  }
+
   try {
-    const videos = await AppDataSource.getRepository(Video).find({
+    const [videos, total] = await AppDataSource.getRepository(Video).findAndCount({
       order: { createdAt: "DESC" },
+      skip: (rawPage - 1) * rawLimit,
+      take: rawLimit,
     });
-    res.json({ success: true, data: { videos } });
+    res.json({ success: true, data: { videos }, total, page: rawPage, limit: rawLimit });
-  } catch {
+  } catch (err) {
+    logger.error("GET /admin/videos — failed to list videos", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -139,7 +177,8 @@ router.post("/videos", async (req: Request, res: Response): Promise<void> => {
 
     await AppDataSource.getRepository(Video).save(video);
     res.status(201).json({ success: true, data: { video } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /admin/videos — failed to create video", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -179,7 +218,8 @@ router.patch("/videos/:id", async (req: Request, res: Response): Promise<void> =
 
     await repo.save(video);
     res.json({ success: true, data: { video } });
-  } catch {
+  } catch (err) {
+    logger.error("PATCH /admin/videos/:id — failed to update video", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -200,7 +240,8 @@ router.delete("/videos/:id", async (req: Request, res: Response): Promise<void>
 
     await repo.remove(video);
     res.json({ success: true, data: { deleted: req.params.id } });
-  } catch {
+  } catch (err) {
+    logger.error("DELETE /admin/videos/:id — failed to delete video", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -212,15 +253,27 @@ router.delete("/videos/:id", async (req: Request, res: Response): Promise<void>
 /**
  * GET /api/admin/users
  * Liste tous les utilisateurs avec leurs rôles et abonnement actif.
+ * Query: ?page=1&limit=20
  */
-router.get("/users", async (_req: Request, res: Response): Promise<void> => {
+router.get("/users", async (req: Request, res: Response): Promise<void> => {
+  const rawPage  = Number(req.query.page  ?? 1);
+  const rawLimit = Number(req.query.limit ?? 20);
+
+  if (!Number.isInteger(rawPage)  || rawPage  < 1 ||
+      !Number.isInteger(rawLimit) || rawLimit < 1 || rawLimit > 100) {
+    res.status(400).json({ success: false, error: "INVALID_PAGINATION" });
+    return;
+  }
+
   try {
-    const users = await AppDataSource.getRepository(User).find({
+    const [users, total] = await AppDataSource.getRepository(User).findAndCount({
       relations: ["userRoles", "userRoles.role", "subscriptions", "subscriptions.plan"],
       order: { createdAt: "DESC" },
+      skip: (rawPage - 1) * rawLimit,
+      take: rawLimit,
     });
 
-    const result = users.map((u) => ({
+    const data = users.map((u) => ({
       id: u.id,
       email: u.email,
       nickname: u.nickname,
@@ -228,13 +281,44 @@ router.get("/users", async (_req: Request, res: Response): Promise<void> => {
       createdAt: u.createdAt,
       roles: u.userRoles.map((ur) => ({ id: ur.role.id, slug: ur.role.slug, name: ur.role.name })),
       activeSubscription: (() => {
-            const sub = u.subscriptions.find((s) => s.status === "active");
+        const sub = u.subscriptions.find((s) => s.status === "active");
-            return sub ? { id: sub.id, status: sub.status, startsAt: sub.startsAt, endsAt: sub.endsAt, plan: sub.plan } : null;
+        return sub ? { id: sub.id, status: sub.status, startsAt: sub.startsAt, endsAt: sub.endsAt, plan: sub.plan } : null;
-          })(),
+      })(),
     }));
 
-    res.json({ success: true, data: { users: result } });
+    res.json({ success: true, data: { users: data }, total, page: rawPage, limit: rawLimit });
-  } catch {
+  } catch (err) {
+    logger.error("GET /admin/users — failed to list users", { err });
+    res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
+  }
+});
+
+/**
+ * PATCH /api/admin/users/:id
+ * Met à jour isActive (ban / unban) d'un utilisateur.
+ */
+router.patch("/users/:id", async (req: Request, res: Response): Promise<void> => {
+  const { isActive } = req.body as { isActive?: boolean };
+
+  if (typeof isActive !== "boolean") {
+    res.status(400).json({ success: false, error: "INVALID_BODY" });
+    return;
+  }
+
+  try {
+    const repo = AppDataSource.getRepository(User);
+    const user = await repo.findOne({ where: { id: req.params.id } });
+
+    if (!user) {
+      res.status(404).json({ success: false, error: "NOT_FOUND" });
+      return;
+    }
+
+    user.isActive = isActive;
+    await repo.save(user);
+    res.json({ success: true, data: { userId: user.id, isActive: user.isActive } });
+  } catch (err) {
+    logger.error("PATCH /admin/users/:id — failed to update user", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -296,7 +380,30 @@ router.patch("/users/:id/roles", async (req: Request, res: Response): Promise<vo
         roles: roleEntities.map((r) => ({ id: r.id, slug: r.slug, name: r.name })),
       },
     });
-  } catch {
+  } catch (err) {
+    logger.error("PATCH /admin/users/:id/roles — failed to assign roles", { err, id: req.params.id });
+    res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// STATS (super_admin)
+// ---------------------------------------------------------------------------
+
+/**
+ * GET /api/admin/stats
+ * Métriques globales de la plateforme.
+ */
+router.get("/stats", async (_req: Request, res: Response): Promise<void> => {
+  try {
+    const [totalUsers, totalVideos, activeSubscriptions] = await Promise.all([
+      AppDataSource.getRepository(User).count(),
+      AppDataSource.getRepository(Video).count({ where: { isPublished: true } }),
+      AppDataSource.getRepository(UserSubscription).count({ where: { status: "active" } }),
+    ]);
+    res.json({ success: true, data: { totalUsers, totalVideos, activeSubscriptions } });
+  } catch (err) {
+    logger.error("GET /admin/stats — failed", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -315,7 +422,8 @@ router.get("/plans", async (_req: Request, res: Response): Promise<void> => {
       order: { level: "ASC" },
     });
     res.json({ success: true, data: { plans } });
-  } catch {
+  } catch (err) {
+    logger.error("GET /admin/plans — failed to list plans", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -360,7 +468,8 @@ router.post("/plans", async (req: Request, res: Response): Promise<void> => {
 
     await AppDataSource.getRepository(SubscriptionPlan).save(plan);
     res.status(201).json({ success: true, data: { plan } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /admin/plans — failed to create plan", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -390,7 +499,8 @@ router.patch("/plans/:id", async (req: Request, res: Response): Promise<void> =>
 
     await repo.save(plan);
     res.json({ success: true, data: { plan } });
-  } catch {
+  } catch (err) {
+    logger.error("PATCH /admin/plans/:id — failed to update plan", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -445,7 +555,8 @@ router.post("/users/:id/subscriptions", async (req: Request, res: Response): Pro
 
     await subRepo.save(sub);
     res.status(201).json({ success: true, data: { subscription: { ...sub, plan } } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /admin/users/:id/subscriptions — failed to assign subscription", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });

backend/src/routes/auth.routes.ts

@@ -1,5 +1,6 @@
 import { Router, Request, Response } from "express";
 import { AppDataSource } from "../config/data-source";
+import logger from "../utils/logger";
 import { User } from "../entities/User";
 import { UserSubscription } from "../entities/UserSubscription";
 import { requireAuth, AuthenticatedRequest } from "../middleware/auth.middleware";
@@ -79,7 +80,8 @@ router.post("/login", async (req: Request, res: Response): Promise<void> => {
       res.cookie(REFRESH_COOKIE_NAME, data.data.tokens.refreshToken, REFRESH_COOKIE_OPTIONS);
     }
     res.json({ success: true, data: { user: data.data.user } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /auth/login — auth service unavailable", { err });
     res.status(500).json({ success: false, error: "AUTH_SERVICE_UNAVAILABLE" });
   }
 });
@@ -90,7 +92,7 @@ router.post("/login", async (req: Request, res: Response): Promise<void> => {
  * le valide, puis le pose en httpOnly cookie.
  */
 router.post("/session", async (req: Request, res: Response): Promise<void> => {
-  const { token } = req.body as { token?: string };
+  const { token, refreshToken } = req.body as { token?: string; refreshToken?: string };
 
   if (!token) {
     res.status(400).json({ success: false, error: "MISSING_TOKEN" });
@@ -124,8 +126,12 @@ router.post("/session", async (req: Request, res: Response): Promise<void> => {
     await upsertUser(data.data.user as { id: string; email: string | null; nickname: string });
 
     res.cookie(COOKIE_NAME, token, COOKIE_OPTIONS);
+    if (refreshToken) {
+      res.cookie(REFRESH_COOKIE_NAME, refreshToken, REFRESH_COOKIE_OPTIONS);
+    }
     res.json({ success: true, data: { user: data.data.user } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /auth/session — auth service unavailable", { err });
     res.status(500).json({ success: false, error: "AUTH_SERVICE_UNAVAILABLE" });
   }
 });
@@ -149,7 +155,7 @@ router.post("/refresh", async (req: Request, res: Response): Promise<void> => {
   }
 
   try {
-    const response = await fetch(`${superOAuthUrl}/api/v1/auth/token/refresh`, {
+    const response = await fetch(`${superOAuthUrl}/api/v1/auth/refresh`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ refreshToken }),
@@ -157,23 +163,24 @@ router.post("/refresh", async (req: Request, res: Response): Promise<void> => {
 
     const data = await response.json() as {
       success: boolean;
-      data?: { tokens: { accessToken: string; refreshToken?: string }; user?: { id: string; email: string | null; nickname: string } };
+      data?: { accessToken: string; refreshToken?: string };
       error?: string;
     };
 
-    if (!response.ok || !data.data?.tokens?.accessToken) {
+    if (!response.ok || !data.data?.accessToken) {
       res.clearCookie(COOKIE_NAME);
       res.clearCookie(REFRESH_COOKIE_NAME);
       res.status(401).json({ success: false, error: "REFRESH_FAILED" });
       return;
     }
 
-    res.cookie(COOKIE_NAME, data.data.tokens.accessToken, COOKIE_OPTIONS);
+    res.cookie(COOKIE_NAME, data.data.accessToken, COOKIE_OPTIONS);
-    if (data.data.tokens.refreshToken) {
+    if (data.data.refreshToken) {
-      res.cookie(REFRESH_COOKIE_NAME, data.data.tokens.refreshToken, REFRESH_COOKIE_OPTIONS);
+      res.cookie(REFRESH_COOKIE_NAME, data.data.refreshToken, REFRESH_COOKIE_OPTIONS);
     }
-    res.json({ success: true, data: { user: data.data.user ?? null } });
+    res.json({ success: true });
-  } catch {
+  } catch (err) {
+    logger.error("POST /auth/refresh — auth service unavailable", { err });
     res.status(500).json({ success: false, error: "AUTH_SERVICE_UNAVAILABLE" });
   }
 });
@@ -275,7 +282,8 @@ router.get("/me/optional", async (req: Request, res: Response): Promise<void> =>
     }
 
     res.json({ success: true, data: { user: data.data.user } });
-  } catch {
+  } catch (err) {
+    logger.error("GET /auth/me/optional — auth service unavailable", { err });
     res.json({ success: true, data: { user: null } });
   }
 });

backend/src/routes/playlist.routes.ts

@@ -6,6 +6,7 @@ import { PlaylistShare } from "../entities/PlaylistShare";
 import { User } from "../entities/User";
 import { Video } from "../entities/Video";
 import { requireAuth, AuthenticatedRequest } from "../middleware/auth.middleware";
+import logger from "../utils/logger";
 
 const router = Router();
 
@@ -42,7 +43,8 @@ router.get("/", requireAuth, async (req: Request, res: Response): Promise<void>
         shared: shared.map((s) => ({ ...s.playlist, permission: s.permission })),
       },
     });
-  } catch {
+  } catch (err) {
+    logger.error("GET /playlists — failed to list playlists", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -78,7 +80,8 @@ router.post("/", requireAuth, async (req: Request, res: Response): Promise<void>
 
     await AppDataSource.getRepository(Playlist).save(playlist);
     res.status(201).json({ success: true, data: { playlist } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /playlists — failed to create playlist", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -96,7 +99,7 @@ router.get("/:id", requireAuth, async (req: Request, res: Response): Promise<voi
   try {
     const playlist = await AppDataSource.getRepository(Playlist).findOne({
       where: { id: req.params.id },
-      relations: ["playlistVideos", "playlistVideos.video", "shares"],
+      relations: ["playlistVideos", "playlistVideos.video"],
     });
 
     if (!playlist) {
@@ -105,8 +108,12 @@ router.get("/:id", requireAuth, async (req: Request, res: Response): Promise<voi
     }
 
     const isOwner = playlist.ownerId === dbUserId;
-    const share = playlist.shares.find((s) => s.userId === dbUserId && s.status === "active");
     const isPublic = playlist.visibility === "public";
+    const share = (!isOwner && !isPublic)
+      ? await AppDataSource.getRepository(PlaylistShare).findOne({
+          where: { playlistId: playlist.id, userId: dbUserId, status: "active" },
+        })
+      : null;
 
     if (!isOwner && !share && !isPublic) {
       res.status(403).json({ success: false, error: "FORBIDDEN" });
@@ -125,7 +132,8 @@ router.get("/:id", requireAuth, async (req: Request, res: Response): Promise<voi
         permission: isOwner ? "owner" : share?.permission ?? "view",
       },
     });
-  } catch {
+  } catch (err) {
+    logger.error("GET /playlists/:id — failed to fetch playlist", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -158,7 +166,8 @@ router.patch("/:id", requireAuth, async (req: Request, res: Response): Promise<v
 
     await repo.save(playlist);
     res.json({ success: true, data: { playlist } });
-  } catch {
+  } catch (err) {
+    logger.error("PATCH /playlists/:id — failed to update playlist", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -181,7 +190,8 @@ router.delete("/:id", requireAuth, async (req: Request, res: Response): Promise<
 
     await repo.remove(playlist);
     res.json({ success: true, data: { deleted: req.params.id } });
-  } catch {
+  } catch (err) {
+    logger.error("DELETE /playlists/:id — failed to delete playlist", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -200,15 +210,14 @@ router.post("/:id/videos", requireAuth, async (req: Request, res: Response): Pro
   if (!videoId) { res.status(400).json({ success: false, error: "MISSING_VIDEO_ID" }); return; }
 
   try {
-    const playlist = await AppDataSource.getRepository(Playlist).findOne({
+    const playlist = await AppDataSource.getRepository(Playlist).findOneBy({ id: req.params.id });
-      where: { id: req.params.id },
-      relations: ["shares"],
-    });
 
     if (!playlist) { res.status(404).json({ success: false, error: "NOT_FOUND" }); return; }
 
     const isOwner = playlist.ownerId === dbUserId;
-    const canEdit = isOwner || playlist.shares.some((s) => s.userId === dbUserId && s.status === "active" && s.permission === "edit");
+    const canEdit = isOwner || !!(await AppDataSource.getRepository(PlaylistShare).findOne({
+      where: { playlistId: playlist.id, userId: dbUserId, status: "active", permission: "edit" },
+    }));
 
     if (!canEdit) { res.status(403).json({ success: false, error: "FORBIDDEN" }); return; }
 
@@ -226,7 +235,8 @@ router.post("/:id/videos", requireAuth, async (req: Request, res: Response): Pro
 
     await AppDataSource.getRepository(PlaylistVideo).save(pv);
     res.status(201).json({ success: true, data: { playlistVideo: pv } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /playlists/:id/videos — failed to add video", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -241,15 +251,14 @@ router.delete("/:id/videos/:videoId", requireAuth, async (req: Request, res: Res
   if (!dbUserId) { res.status(401).json({ success: false, error: "USER_NOT_FOUND" }); return; }
 
   try {
-    const playlist = await AppDataSource.getRepository(Playlist).findOne({
+    const playlist = await AppDataSource.getRepository(Playlist).findOneBy({ id: req.params.id });
-      where: { id: req.params.id },
-      relations: ["shares"],
-    });
 
     if (!playlist) { res.status(404).json({ success: false, error: "NOT_FOUND" }); return; }
 
     const isOwner = playlist.ownerId === dbUserId;
-    const canEdit = isOwner || playlist.shares.some((s) => s.userId === dbUserId && s.status === "active" && s.permission === "edit");
+    const canEdit = isOwner || !!(await AppDataSource.getRepository(PlaylistShare).findOne({
+      where: { playlistId: playlist.id, userId: dbUserId, status: "active", permission: "edit" },
+    }));
 
     if (!canEdit) { res.status(403).json({ success: false, error: "FORBIDDEN" }); return; }
 
@@ -262,7 +271,8 @@ router.delete("/:id/videos/:videoId", requireAuth, async (req: Request, res: Res
 
     await AppDataSource.getRepository(PlaylistVideo).remove(pv);
     res.json({ success: true, data: { deleted: req.params.videoId } });
-  } catch {
+  } catch (err) {
+    logger.error("DELETE /playlists/:id/videos/:videoId — failed to remove video", { err, id: req.params.id, videoId: req.params.videoId });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -305,7 +315,8 @@ router.post("/:id/share", requireAuth, async (req: Request, res: Response): Prom
 
     await AppDataSource.getRepository(PlaylistShare).save(share);
     res.status(201).json({ success: true, data: { share } });
-  } catch {
+  } catch (err) {
+    logger.error("POST /playlists/:id/share — failed to create share", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -343,7 +354,8 @@ router.patch("/:id/share/:shareId", requireAuth, async (req: Request, res: Respo
 
     await AppDataSource.getRepository(PlaylistShare).save(share);
     res.json({ success: true, data: { share } });
-  } catch {
+  } catch (err) {
+    logger.error("PATCH /playlists/:id/share/:shareId — failed to update share", { err, id: req.params.id, shareId: req.params.shareId });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });

backend/src/routes/stream.routes.ts

@@ -5,6 +5,7 @@ import { AppDataSource } from "../config/data-source";
 import { Video } from "../entities/Video";
 import { User } from "../entities/User";
 import { UserSubscription } from "../entities/UserSubscription";
+import logger from "../utils/logger";
 
 const router = Router();
 
@@ -41,7 +42,8 @@ async function getUserLevel(token: string | undefined): Promise<number> {
     });
 
     return sub?.plan.level ?? 0;
-  } catch {
+  } catch (err) {
+    logger.warn("getUserLevel — auth/DB error", { err });
     return 0;
   }
 }
@@ -128,7 +130,8 @@ router.get("/:key(*)", async (req: Request, res: Response): Promise<void> => {
       });
       fs.createReadStream(resolved).pipe(res);
     }
-  } catch {
+  } catch (err) {
+    logger.error("GET /stream/:key — unexpected error", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });

backend/src/routes/user.routes.ts

@@ -3,6 +3,7 @@ import { AppDataSource } from "../config/data-source";
 import { User } from "../entities/User";
 import { UserSubscription } from "../entities/UserSubscription";
 import { requireAuth, AuthenticatedRequest } from "../middleware/auth.middleware";
+import logger from "../utils/logger";
 
 const router = Router();
 
@@ -27,45 +28,50 @@ async function getActiveSub(userId: string) {
 router.get("/me/profile", requireAuth, async (req: Request, res: Response): Promise<void> => {
   const { user } = req as AuthenticatedRequest;
 
-  const localUser = await AppDataSource.getRepository(User).findOne({
+  try {
-    where: { superOAuthId: user.id },
+    const localUser = await AppDataSource.getRepository(User).findOne({
-    relations: ["userRoles", "userRoles.role"],
+      where: { superOAuthId: user.id },
-  });
+      relations: ["userRoles", "userRoles.role"],
+    });
 
-  if (!localUser) {
+    if (!localUser) {
-    res.status(404).json({ success: false, error: "USER_NOT_FOUND" });
+      res.status(404).json({ success: false, error: "USER_NOT_FOUND" });
-    return;
+      return;
+    }
+
+    const roles = localUser.userRoles.map((ur) => ur.role.slug);
+    const activeSub = await getActiveSub(localUser.id);
+
+    const plan = activeSub
+      ? { slug: activeSub.plan.slug, name: activeSub.plan.name, level: activeSub.plan.level }
+      : null;
+
+    const subscription = activeSub
+      ? {
+          status: activeSub.status,
+          startsAt: activeSub.startsAt.toISOString(),
+          endsAt: activeSub.endsAt ? activeSub.endsAt.toISOString() : null,
+        }
+      : null;
+
+    res.json({
+      success: true,
+      data: {
+        id: localUser.id,
+        superOAuthId: localUser.superOAuthId,
+        email: localUser.email,
+        nickname: localUser.nickname,
+        avatar: localUser.avatar,
+        roles,
+        plan,
+        subscription,
+        createdAt: localUser.createdAt.toISOString(),
+      },
+    });
+  } catch (err) {
+    logger.error("GET /users/me/profile — DB error", { err });
+    res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
-
-  const roles = localUser.userRoles.map((ur) => ur.role.slug);
-  const activeSub = await getActiveSub(localUser.id);
-
-  const plan = activeSub
-    ? { slug: activeSub.plan.slug, name: activeSub.plan.name, level: activeSub.plan.level }
-    : null;
-
-  const subscription = activeSub
-    ? {
-        status: activeSub.status,
-        startsAt: activeSub.startsAt.toISOString(),
-        endsAt: activeSub.endsAt ? activeSub.endsAt.toISOString() : null,
-      }
-    : null;
-
-  res.json({
-    success: true,
-    data: {
-      id: localUser.id,
-      superOAuthId: localUser.superOAuthId,
-      email: localUser.email,
-      nickname: localUser.nickname,
-      avatar: localUser.avatar,
-      roles,
-      plan,
-      subscription,
-      createdAt: localUser.createdAt.toISOString(),
-    },
-  });
 });
 
 /**
@@ -95,33 +101,38 @@ router.patch("/me", requireAuth, async (req: Request, res: Response): Promise<vo
       if (!["http:", "https:"].includes(parsed.protocol)) {
         throw new Error("invalid protocol");
       }
-    } catch {
+    } catch (_err) {
       res.status(400).json({ success: false, error: "INVALID_AVATAR", message: "avatar must be a valid http/https URL or null" });
       return;
     }
   }
 
-  const userRepo = AppDataSource.getRepository(User);
+  try {
-  const localUser = await userRepo.findOne({ where: { superOAuthId: user.id } });
+    const userRepo = AppDataSource.getRepository(User);
+    const localUser = await userRepo.findOne({ where: { superOAuthId: user.id } });
 
-  if (!localUser) {
+    if (!localUser) {
-    res.status(404).json({ success: false, error: "USER_NOT_FOUND" });
+      res.status(404).json({ success: false, error: "USER_NOT_FOUND" });
-    return;
+      return;
+    }
+
+    if (nickname !== undefined) localUser.nickname = (nickname as string).trim();
+    if (avatar !== undefined) localUser.avatar = avatar as string | null;
+
+    await userRepo.save(localUser);
+
+    res.json({
+      success: true,
+      data: {
+        id: localUser.id,
+        nickname: localUser.nickname,
+        avatar: localUser.avatar,
+      },
+    });
+  } catch (err) {
+    logger.error("PATCH /users/me — DB error", { err });
+    res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
-
-  if (nickname !== undefined) localUser.nickname = (nickname as string).trim();
-  if (avatar !== undefined) localUser.avatar = avatar as string | null;
-
-  await userRepo.save(localUser);
-
-  res.json({
-    success: true,
-    data: {
-      id: localUser.id,
-      nickname: localUser.nickname,
-      avatar: localUser.avatar,
-    },
-  });
 });
 
 export default router;

backend/src/routes/video.routes.ts

@@ -1,5 +1,6 @@
 import { Router, Request, Response } from "express";
 import { AppDataSource } from "../config/data-source";
+import logger from "../utils/logger";
 import { Video } from "../entities/Video";
 import { User } from "../entities/User";
 import { requireAuth, AuthenticatedRequest, AuthenticatedUser } from "../middleware/auth.middleware";
@@ -34,24 +35,32 @@ router.get("/", async (req: Request, res: Response): Promise<void> => {
   try {
     const user = (req as AuthenticatedRequest).user as AuthenticatedUser | undefined;
     const userLevel = user ? await getUserPlanLevel(user.id) : 0;
+    const q = typeof req.query.q === "string" ? req.query.q.trim() : "";
 
-    const videos = await AppDataSource.getRepository(Video).find({
+    const qb = AppDataSource.getRepository(Video)
-      where: { isPublished: true },
+      .createQueryBuilder("v")
-      order: { publishedAt: "DESC" },
+      .where("v.isPublished = :pub", { pub: true })
-      select: ["id", "title", "description", "thumbnailUrl", "duration",
+      .select([
-               "storageType", "storageKey", "requiredLevel", "publishedAt"],
+        "v.id", "v.title", "v.description", "v.thumbnailUrl", "v.duration",
-    });
+        "v.storageType", "v.storageKey", "v.requiredLevel", "v.publishedAt",
+      ])
+      .orderBy("v.publishedAt", "DESC");
+
+    if (q) {
+      qb.andWhere("(v.title LIKE :q OR v.description LIKE :q)", { q: `%${q}%` });
+    }
+
+    const videos = await qb.getMany();
 
-    // Injequer un flag `locked` côté client pour les vidéos hors niveau
     const result = videos.map((v) => ({
       ...v,
       locked: v.requiredLevel > userLevel,
-      // Ne pas exposer storageKey si la vidéo est verrouillée
       storageKey: v.requiredLevel > userLevel ? null : v.storageKey,
     }));
 
     res.json({ success: true, data: { videos: result } });
-  } catch {
+  } catch (err) {
+    logger.error("GET /videos — failed to list videos", { err });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });
@@ -84,7 +93,8 @@ router.get("/:id", async (req: Request, res: Response): Promise<void> => {
     }
 
     res.json({ success: true, data: { video } });
-  } catch {
+  } catch (err) {
+    logger.error("GET /videos/:id — failed to fetch video", { err, id: req.params.id });
     res.status(500).json({ success: false, error: "INTERNAL_ERROR" });
   }
 });

backend/src/utils/logger.ts

@@ -0,0 +1,25 @@
+import winston from "winston";
+
+const { combine, timestamp, json, colorize, printf } = winston.format;
+
+const devFormat = combine(
+  colorize(),
+  timestamp({ format: "HH:mm:ss" }),
+  printf(({ level, message, timestamp: ts, ...meta }) => {
+    const metaStr = Object.keys(meta).length ? ` ${JSON.stringify(meta)}` : "";
+    return `${ts} [${level}] ${message}${metaStr}`;
+  })
+);
+
+const prodFormat = combine(
+  timestamp(),
+  json()
+);
+
+const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL ?? "info",
+  format: process.env.NODE_ENV === "production" ? prodFormat : devFormat,
+  transports: [new winston.transports.Console()],
+});
+
+export default logger;

backend/tests/auth.middleware.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import express, { Request, Response } from "express";
+import request from "supertest";
+import cookieParser from "cookie-parser";
+import { requireAuth } from "../src/middleware/auth.middleware";
+
+function buildApp() {
+  const app = express();
+  app.use(express.json());
+  app.use(cookieParser());
+  app.get("/protected", requireAuth, (_req: Request, res: Response) => {
+    res.json({ success: true });
+  });
+  return app;
+}
+
+describe("requireAuth middleware", () => {
+  beforeEach(() => {
+    process.env.SUPER_OAUTH_URL = "http://fake-oauth";
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete process.env.SUPER_OAUTH_URL;
+  });
+
+  it("retourne 401 quand le token est invalide (SuperOAuth répond valid: false)", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ success: true, data: { valid: false } }),
+      })
+    );
+
+    const res = await request(buildApp())
+      .get("/protected")
+      .set("Authorization", "Bearer invalid-token");
+
+    expect(res.status).toBe(401);
+    expect(res.body.error).toBeDefined();
+  });
+
+  it("retourne 401 quand aucun cookie ni header Authorization", async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const res = await request(buildApp()).get("/protected");
+
+    expect(res.status).toBe(401);
+    expect(res.body.message).toBe("Access token required");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});

backend/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    globals: true,
+  },
+});

docs/vision-b2b.md

@@ -0,0 +1,80 @@
+# OriginsDigital — Vision B2B
+
+> Sprint 3 — Step 1 output
+> Date : 2026-03-17
+
+---
+
+## Segment cible
+
+**Studios indépendants et créateurs professionnels**
+
+- Studios indé : 1-10 personnes, besoin d'une vitrine pro sans ressources design
+- Créateurs pro : streamers, YouTubers, artistes digitaux qui monétisent leur audience
+- Critère d'exclusion V1 : pas de grandes agences (cycle vente trop long), pas de B2C pur
+
+---
+
+## White-label — Ce qui est personnalisable
+
+| Élément | Personnalisable | Notes |
+|---------|----------------|-------|
+| Logo | ✅ | Upload SVG/PNG, remplacement complet |
+| Couleurs | ✅ | Palette primaire + secondaire via config |
+| Domaine | ✅ | CNAME custom (studio.client.com) |
+| Emails transactionnels | ✅ | Templates brandés (sender name + domaine) |
+| Favicon | ✅ | |
+| Nom de la plateforme | ✅ | Affiché dans les headers + emails |
+| Code source | ❌ | Pas d'accès au code — SaaS uniquement |
+
+Isolation tenant complète via **SuperOAuth Tier 3** (per-tenant providers, déjà en prod ✅).
+
+---
+
+## Identité visuelle cible
+
+**3 mots** : Sobre. Précis. Autoritaire.
+
+Références : Linear, Vercel, Pika.art
+
+- Socle : Void Dark conservé
+- Accent : or inchangé
+- Typographie : ajout d'une typo display (Geist / Cal Sans) pour les H1
+- Pas de gradients agressifs — micro-détails subtils (bordures fines, shadows légères)
+- Motion : transitions rapides (150ms), pas d'animations décoratives
+
+---
+
+## Pricing model B2B
+
+**Abonnement mensuel par tier** — pas de per-seat, pas de commission en V1
+
+| Tier | Prix/mois | Inclus |
+|------|-----------|--------|
+| Starter | 29€ | 1 projet, domaine custom, white-label basique |
+| Studio | 99€ | 5 projets, analytics, intégration SuperOAuth |
+| Pro | 249€ | Projets illimités, API access, support prioritaire |
+| Enterprise | Sur devis | SLA, déploiement dédié, onboarding |
+
+**Pourquoi abonnement et pas per-seat ?**
+Cible studios indé = équipes petites → per-seat pénalise la croissance et complexifie la facturation.
+Commission découragerait les cas d'usage à fort volume. Abonnement = prévisibilité pour le client et pour nous.
+
+---
+
+## Différenciateur principal
+
+**SuperOAuth Tier 3 intégré nativement** = auth multi-tenant per-tenant providers, en standard.
+
+Aucun concurrent direct dans la cible (studios indé / créateurs pro) ne propose ça en standard.
+C'est notre moat technique visible dès l'onboarding.
+
+---
+
+## Brief refonte visuelle → Step 2
+
+- Palette : fond `#0a0a0a`, surface `#111`, accent `#c9a84c` (or mat)
+- Typo display : Cal Sans ou Geist — pour H1 uniquement
+- Composants prioritaires : hero landing, pricing card, CTA button, navbar avec login OAuth
+- Mobile-first, dark mode natif (pas de toggle — dark only en V1)
+- Densité : élevée — pas d'espaces vides décoratifs, chaque pixel justifié

frontend/.env.example

@@ -2,3 +2,7 @@
 # Le flow : /api/v1/auth/oauth/:provider?redirectUrl=<callback_url>
 # Valeur : voir brain/MYSECRETS section originsdigital
 VITE_SUPEROAUTH_URL=
+
+# SuperOAuth PKCE (Step 3) — flow authorization_code avec PKCE
+VITE_OAUTH_URL=https://oauth.tetardtek.com
+VITE_OAUTH_CLIENT_ID=originsdigital

frontend/index.html

@@ -4,6 +4,9 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>OriginsDigital</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
   </head>
   <body>
     <div id="root"></div>

frontend/src/App.tsx

@@ -1,8 +1,8 @@
-import { useState, useEffect } from 'react';
 import { BrowserRouter, Routes, Route } from 'react-router-dom';
 import { AuthProvider } from './context/AuthContext';
 import Layout from './components/layout/Layout';
 import RequireAuth from './components/RequireAuth';
+import LandingPage from './pages/LandingPage';
 import HomePage from './pages/HomePage';
 import LoginPage from './pages/LoginPage';
 import CallbackPage from './pages/CallbackPage';
@@ -10,27 +10,16 @@ import VideoPage from './pages/VideoPage';
 import PlaylistsPage from './pages/PlaylistsPage';
 import PlaylistPage from './pages/PlaylistPage';
 import AdminPage from './pages/AdminPage';
-
+import ProfilePage from './pages/ProfilePage';
-type Theme = 'dark' | 'light';
 
 function App() {
-  const [theme, setTheme] = useState<Theme>(() => {
-    return (localStorage.getItem('od-theme') as Theme) ?? 'dark';
-  });
-
-  useEffect(() => {
-    document.documentElement.setAttribute('data-theme', theme);
-    localStorage.setItem('od-theme', theme);
-  }, [theme]);
-
-  const toggleTheme = () => setTheme((t) => (t === 'dark' ? 'light' : 'dark'));
-
   return (
     <AuthProvider>
       <BrowserRouter>
         <Routes>
-          <Route element={<Layout theme={theme} onToggleTheme={toggleTheme} />}>
+          <Route element={<Layout />}>
-            <Route path="/" element={<HomePage />} />
+            <Route path="/" element={<LandingPage />} />
+            <Route path="/app" element={<HomePage />} />
             <Route path="/login" element={<LoginPage />} />
             <Route path="/callback" element={<CallbackPage />} />
             <Route path="/video/:id" element={<VideoPage />} />
@@ -38,6 +27,7 @@ function App() {
               <Route path="/playlists" element={<PlaylistsPage />} />
               <Route path="/playlists/:id" element={<PlaylistPage />} />
               <Route path="/admin" element={<AdminPage />} />
+              <Route path="/profile" element={<ProfilePage />} />
             </Route>
           </Route>
         </Routes>

frontend/src/components/ErrorBoundary.tsx

@@ -0,0 +1,31 @@
+import { Component, type ReactNode } from 'react';
+
+interface Props { children: ReactNode; }
+interface State { hasError: boolean; }
+
+export default class ErrorBoundary extends Component<Props, State> {
+  state: State = { hasError: false };
+
+  static getDerivedStateFromError(): State {
+    return { hasError: true };
+  }
+
+  render() {
+    if (this.state.hasError) {
+      return (
+        <div className="flex min-h-screen items-center justify-center bg-od-bg">
+          <div className="rounded border border-od-crit/40 bg-od-surface p-8 text-center">
+            <p className="font-mono text-sm text-od-crit">Une erreur inattendue s'est produite.</p>
+            <button
+              className="mt-4 rounded border border-od-border px-4 py-2 text-xs text-od-muted hover:border-od-accent/40"
+              onClick={() => window.location.reload()}
+            >
+              Recharger
+            </button>
+          </div>
+        </div>
+      );
+    }
+    return this.props.children;
+  }
+}

frontend/src/components/UserBadge.tsx

@@ -0,0 +1,29 @@
+import type { User } from '../context/AuthContext';
+
+interface UserBadgeProps {
+  user: User;
+}
+
+export default function UserBadge({ user }: UserBadgeProps) {
+  const planLabel = user.plan?.slug ?? 'free';
+
+  return (
+    <span className="flex items-center gap-2">
+      {user.avatar ? (
+        <img
+          src={user.avatar}
+          alt={user.nickname}
+          className="h-6 w-6 rounded-full object-cover border border-od-border"
+        />
+      ) : (
+        <span className="flex h-6 w-6 items-center justify-center rounded-full bg-od-surface border border-od-border font-mono text-[10px] text-od-accent">
+          {user.nickname[0].toUpperCase()}
+        </span>
+      )}
+      <span className="font-mono text-xs text-od-accent">{user.nickname}</span>
+      <span className="font-mono text-[10px] px-1.5 py-0.5 rounded border border-od-border text-od-muted">
+        {planLabel}
+      </span>
+    </span>
+  );
+}

frontend/src/components/VideoPlayer.tsx

@@ -69,7 +69,7 @@ function NativePlayer({ url }: { url: string }) {
         hls = new Hls();
         hls.loadSource(url);
         hls.attachMedia(video);
-      });
+      }).catch(() => { /* HLS non disponible — dégradation silencieuse */ });
     }
 
     return () => { hls?.destroy(); };

frontend/src/components/auth/LoginButton.tsx

@@ -0,0 +1,40 @@
+import { useState } from 'react';
+import { buildAuthUrl, saveVerifier } from '../../lib/oauth';
+
+interface LoginButtonProps {
+  className?: string;
+  provider?: string;
+}
+
+export default function LoginButton({ className, provider = 'discord' }: LoginButtonProps) {
+  const [loading, setLoading] = useState(false);
+
+  async function handleClick() {
+    if (loading) return;
+    setLoading(true);
+    try {
+      const redirectUri = `${window.location.origin}/callback`;
+      const { url, verifier } = await buildAuthUrl(redirectUri, provider);
+      saveVerifier(verifier);
+      window.location.href = url;
+    } catch {
+      setLoading(false);
+    }
+  }
+
+  return (
+    <button
+      onClick={handleClick}
+      disabled={loading}
+      className={[
+        'rounded border border-[#c9a84c] px-4 py-2 font-mono text-xs text-[#c9a84c]',
+        'transition-all duration-150',
+        'hover:bg-[#c9a84c] hover:text-od-bg',
+        'disabled:opacity-40 disabled:cursor-not-allowed',
+        className ?? '',
+      ].join(' ')}
+    >
+      {loading ? '…' : 'Se connecter avec SuperOAuth'}
+    </button>
+  );
+}

frontend/src/components/auth/UserMenu.tsx

@@ -0,0 +1,43 @@
+import { clearAccessToken } from '../../lib/oauth';
+import { useAuthContext } from '../../context/AuthContext';
+import LoginButton from './LoginButton';
+
+interface UserMenuProps {
+  /** Optionnel : si fourni, prend le dessus sur le nickname de l'utilisateur */
+  displayName?: string;
+}
+
+export default function UserMenu({ displayName }: UserMenuProps) {
+  const { user } = useAuthContext();
+
+  function handleLogout() {
+    clearAccessToken();
+    window.location.href = '/';
+  }
+
+  if (!user) {
+    return <LoginButton />;
+  }
+
+  const name = displayName ?? user.nickname ?? 'Mon compte';
+
+  return (
+    <div className="flex items-center gap-3">
+      {/* Avatar placeholder */}
+      <span className="flex h-7 w-7 items-center justify-center rounded-full bg-od-surface border border-[#c9a84c] font-mono text-[10px] text-[#c9a84c]">
+        {name !== 'Mon compte' ? name[0].toUpperCase() : '●'}
+      </span>
+
+      <span className="font-mono text-xs text-[#c9a84c]">
+        {name}
+      </span>
+
+      <button
+        onClick={handleLogout}
+        className="font-mono text-xs text-od-muted hover:text-od-crit transition-colors duration-150"
+      >
+        Se déconnecter
+      </button>
+    </div>
+  );
+}

frontend/src/components/layout/Footer.tsx

@@ -0,0 +1,21 @@
+export default function Footer() {
+  return (
+    <footer className="border-t border-od-border bg-od-bg">
+      <div className="mx-auto flex max-w-6xl items-center justify-between px-6 py-6">
+        <div className="flex items-center gap-2">
+          <span className="font-mono text-xs font-bold tracking-[0.2em] text-od-accent">OD</span>
+          <span className="text-xs text-od-muted">OriginsDigital</span>
+        </div>
+        <p className="font-mono text-2xs text-od-muted">
+          © {new Date().getFullYear()} OriginsDigital — Tous droits réservés
+        </p>
+        <div className="flex items-center gap-6">
+          <a href="mailto:contact@originsdigital.com" className="font-mono text-2xs text-od-muted hover:text-od-text transition-colors duration-150">
+            Contact
+          </a>
+          <span className="font-mono text-2xs text-od-muted">Powered by SuperOAuth</span>
+        </div>
+      </div>
+    </footer>
+  );
+}

frontend/src/components/layout/Header.tsx

@@ -1,77 +1,107 @@
+import { useEffect, useRef, useState } from 'react';
 import { Link } from 'react-router-dom';
 import { apiFetch } from '../../lib/api';
 import type { User } from '../../context/AuthContext';
+import UserBadge from '../UserBadge';
 
 interface HeaderProps {
-  theme: 'dark' | 'light';
-  onToggleTheme: () => void;
   user: User | null;
   onLogout: () => void;
 }
 
-export default function Header({ theme, onToggleTheme, user, onLogout }: HeaderProps) {
+export default function Header({ user, onLogout }: HeaderProps) {
+  const [open, setOpen] = useState(false);
+  const dropdownRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    if (!open) return;
+    function handleClick(e: MouseEvent) {
+      if (dropdownRef.current && !dropdownRef.current.contains(e.target as Node)) {
+        setOpen(false);
+      }
+    }
+    document.addEventListener('mousedown', handleClick);
+    return () => document.removeEventListener('mousedown', handleClick);
+  }, [open]);
+
   async function handleLogout() {
     await apiFetch('/auth/logout', { method: 'POST' }).catch(() => {});
+    setOpen(false);
     onLogout();
   }
 
   return (
-    <header className="border-b border-od-border bg-od-surface">
+    <header className="sticky top-0 z-40 border-b border-od-border bg-od-bg/90 backdrop-blur-sm">
-      <div className="mx-auto flex h-14 max-w-5xl items-center justify-between px-4">
+      <div className="mx-auto flex h-14 max-w-6xl items-center justify-between px-6">
 
         {/* Logo */}
-        <Link to="/" className="flex items-center gap-2 group">
+        <Link to="/" className="flex items-center gap-2.5 group">
-          <span className="font-mono text-xs font-bold text-od-accent tracking-widest group-hover:text-od-accent-dim transition-colors">
+          <span className="font-mono text-xs font-bold tracking-[0.2em] text-od-accent group-hover:text-od-accent-dim transition-colors duration-150">
             OD
           </span>
-          <span className="text-sm font-semibold text-od-text">
+          <span className="text-sm font-semibold text-od-text tracking-tight">
             OriginsDigital
           </span>
         </Link>
 
         {/* Navigation */}
-        <nav className="flex gap-6">
+        <nav className="flex items-center gap-8">
-          <Link to="/" className="text-sm text-od-muted hover:text-od-text transition-colors">
+          <Link to="/" className="text-sm text-od-muted hover:text-od-text transition-colors duration-150">
             Accueil
           </Link>
           {user && (
-            <Link to="/playlists" className="text-sm text-od-muted hover:text-od-text transition-colors">
+            <Link to="/playlists" className="text-sm text-od-muted hover:text-od-text transition-colors duration-150">
               Playlists
             </Link>
           )}
-          {user?.roles?.includes('admin') && (
+          {!user && (
-            <Link to="/admin" className="font-mono text-xs text-od-muted hover:text-od-accent transition-colors">
+            <Link to="/#pricing" className="text-sm text-od-muted hover:text-od-text transition-colors duration-150">
+              Tarifs
+            </Link>
+          )}
+          {user?.roles?.some((r) => r === 'admin' || r === 'super_admin') && (
+            <Link to="/admin" className="font-mono text-xs text-od-muted hover:text-od-accent transition-colors duration-150">
               admin
             </Link>
           )}
         </nav>
 
-        {/* Right — thème + auth */}
+        {/* Right — auth */}
-        <div className="flex items-center gap-4">
+        <div className="flex items-center gap-3">
-          <button
-            onClick={onToggleTheme}
-            aria-label="Changer le thème"
-            className="font-mono text-xs text-od-muted hover:text-od-text transition-colors"
-          >
-            {theme === 'dark' ? '◑' : '◐'}
-          </button>
-
           {user ? (
-            <div className="flex items-center gap-3">
+            <div className="relative" ref={dropdownRef}>
-              <span className="font-mono text-xs text-od-accent">{user.nickname}</span>
               <button
-                onClick={handleLogout}
+                onClick={() => setOpen((o) => !o)}
-                className="font-mono text-xs text-od-muted hover:text-od-crit transition-colors"
+                className="flex items-center gap-1.5 hover:opacity-80 transition-opacity duration-150"
               >
-                ↩
+                <UserBadge user={user} />
+                <span className="font-mono text-xs text-od-muted">▾</span>
               </button>
+              {open && (
+                <div className="absolute right-0 top-full mt-1.5 w-40 rounded border border-od-border bg-od-surface shadow-xl z-50 animate-fade-in">
+                  <Link
+                    to="/profile"
+                    onClick={() => setOpen(false)}
+                    className="block px-4 py-2.5 text-xs text-od-muted hover:text-od-text transition-colors duration-150"
+                  >
+                    Profil
+                  </Link>
+                  <div className="border-t border-od-border" />
+                  <button
+                    onClick={handleLogout}
+                    className="w-full text-left px-4 py-2.5 font-mono text-xs text-od-muted hover:text-od-crit transition-colors duration-150"
+                  >
+                    Déconnexion
+                  </button>
+                </div>
+              )}
             </div>
           ) : (
             <Link
               to="/login"
-              className="rounded border border-od-border px-3 py-1 font-mono text-xs text-od-muted hover:border-od-accent hover:text-od-accent transition-colors"
+              className="rounded border border-od-accent px-4 py-1.5 font-mono text-xs text-od-accent hover:bg-od-accent hover:text-od-bg transition-all duration-150"
             >
-              Connexion
+              Se connecter
             </Link>
           )}
         </div>

frontend/src/components/layout/Layout.tsx

@@ -1,26 +1,21 @@
 import { Outlet } from 'react-router-dom';
 import Header from './Header';
+import Footer from './Footer';
 import { useAuthContext } from '../../context/AuthContext';
 
-interface LayoutProps {
+export default function Layout() {
-  theme: 'dark' | 'light';
-  onToggleTheme: () => void;
-}
-
-export default function Layout({ theme, onToggleTheme }: LayoutProps) {
   const { user, loading, setUser } = useAuthContext();
 
   return (
-    <div className="min-h-screen bg-od-bg text-od-text">
+    <div className="min-h-screen bg-od-bg text-od-text flex flex-col">
       <Header
-        theme={theme}
-        onToggleTheme={onToggleTheme}
         user={loading ? null : user}
         onLogout={() => setUser(null)}
       />
-      <main className="mx-auto max-w-5xl px-4 py-8">
+      <main className="flex-1 mx-auto w-full max-w-6xl px-6 py-10">
         <Outlet />
       </main>
+      <Footer />
     </div>
   );
 }

frontend/src/context/AuthContext.tsx

@@ -5,6 +5,8 @@ export interface User {
   id: string;
   email: string | null;
   nickname: string;
+  avatar?: string | null;
+  plan?: { slug: string; name: string; level: number } | null;
   subscriptionLevel?: number;
   roles: string[];
 }
@@ -37,6 +39,13 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     return () => { cancelled = true; };
   }, []);
 
+  // Token expiré et refresh impossible → déconnexion silencieuse
+  useEffect(() => {
+    const handler = () => setUser(null);
+    window.addEventListener('auth:expired', handler);
+    return () => window.removeEventListener('auth:expired', handler);
+  }, []);
+
   return (
     <AuthContext.Provider value={{ user, loading, setUser }}>
       {children}

frontend/src/hooks/useAuth.ts

@@ -1,38 +1,4 @@
-import { useState, useEffect } from 'react';
+// Réexporte depuis AuthContext — source unique de vérité auth.
-import { apiFetch } from '../lib/api';
+// Ne pas dupliquer User ou la logique de fetch ici.
-
+export type { User } from '../context/AuthContext';
-export interface User {
+export { useAuthContext as useAuth } from '../context/AuthContext';
-  id: string;
-  email: string | null;
-  nickname: string;
-  subscriptionLevel?: number;
-}
-
-interface AuthState {
-  user: User | null;
-  loading: boolean;
-  setUser: (u: User | null) => void;
-}
-
-interface MeResponse {
-  success: boolean;
-  data: { user: User };
-}
-
-export function useAuth(): AuthState {
-  const [user, setUser] = useState<User | null>(null);
-  const [loading, setLoading] = useState(true);
-
-  useEffect(() => {
-    let cancelled = false;
-
-    apiFetch<MeResponse>('/auth/me')
-      .then((res) => { if (!cancelled) setUser(res.data.user); })
-      .catch(() => { if (!cancelled) setUser(null); })
-      .finally(() => { if (!cancelled) setLoading(false); });
-
-    return () => { cancelled = true; };
-  }, []);
-
-  return { user, loading, setUser };
-}

frontend/src/lib/api.ts

@@ -2,19 +2,45 @@
 // En prod : VITE_API_URL=https://origins.tetardtek.com/api
 const BASE = import.meta.env.VITE_API_URL || '/api';
 
-export async function apiFetch<T>(path: string, init?: RequestInit): Promise<T> {
+export class ApiError extends Error {
-  const res = await fetch(`${BASE}${path}`, {
+  constructor(public readonly status: number, path: string) {
-    credentials: 'include', // transmet le cookie httpOnly automatiquement
+    super(`API ${status}: ${path}`);
-    ...init,
+  }
-    headers: {
+}
-      'Content-Type': 'application/json',
-      ...init?.headers,
-    },
-  });
 
-  if (!res.ok) {
+function buildInit(init?: RequestInit): RequestInit {
-    throw new Error(`API ${res.status}: ${path}`);
+  return {
+    credentials: 'include',
+    ...init,
+    headers: { 'Content-Type': 'application/json', ...init?.headers },
+  };
+}
+
+// Déduplique les appels refresh simultanés
+let refreshingPromise: Promise<boolean> | null = null;
+
+async function tryRefresh(): Promise<boolean> {
+  if (refreshingPromise) return refreshingPromise;
+  refreshingPromise = fetch(`${BASE}/auth/refresh`, { method: 'POST', credentials: 'include' })
+    .then((r) => r.ok)
+    .finally(() => { refreshingPromise = null; });
+  return refreshingPromise;
+}
+
+export async function apiFetch<T>(path: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(`${BASE}${path}`, buildInit(init));
+
+  if (res.status === 401 && path !== '/auth/refresh') {
+    const refreshed = await tryRefresh();
+    if (refreshed) {
+      const retry = await fetch(`${BASE}${path}`, buildInit(init));
+      if (!retry.ok) throw new ApiError(retry.status, path);
+      return retry.json() as Promise<T>;
+    }
+    window.dispatchEvent(new Event('auth:expired'));
+    throw new ApiError(401, path);
   }
 
+  if (!res.ok) throw new ApiError(res.status, path);
   return res.json() as Promise<T>;
 }

frontend/src/lib/oauth.ts

@@ -0,0 +1,119 @@
+// OAuth 2.0 PKCE client — SuperOAuth Tier 3 multi-tenant
+// Token stocké en sessionStorage (pas localStorage — sécurité, scope onglet)
+
+const OAUTH_URL     = import.meta.env.VITE_OAUTH_URL     || '';
+const OAUTH_CLIENT_ID = import.meta.env.VITE_OAUTH_CLIENT_ID || '';
+
+const SESSION_KEY_TOKEN    = 'od_access_token';
+const SESSION_KEY_VERIFIER = 'od_pkce_verifier';
+
+// --- PKCE helpers ---
+
+function base64UrlEncode(buffer: ArrayBuffer): string {
+  return btoa(String.fromCharCode(...new Uint8Array(buffer)))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+}
+
+export function generateCodeVerifier(): string {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return base64UrlEncode(array.buffer);
+}
+
+export async function generateCodeChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const data    = encoder.encode(verifier);
+  const digest  = await crypto.subtle.digest('SHA-256', data);
+  return base64UrlEncode(digest);
+}
+
+// --- Auth URL ---
+
+export async function buildAuthUrl(
+  redirectUri: string,
+  provider: string,
+  scope = 'openid profile email',
+  clientId  = OAUTH_CLIENT_ID,
+): Promise<{ url: string; verifier: string }> {
+  const verifier  = generateCodeVerifier();
+  const challenge = await generateCodeChallenge(verifier);
+  const state     = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)).buffer);
+
+  const params = new URLSearchParams({
+    response_type:         'code',
+    client_id:             clientId,
+    redirect_uri:          redirectUri,
+    scope,
+    state,
+    provider,
+    code_challenge:        challenge,
+    code_challenge_method: 'S256',
+  });
+
+  return {
+    url:      `${OAUTH_URL}/oauth/authorize?${params.toString()}`,
+    verifier,
+  };
+}
+
+// --- Token exchange ---
+
+export interface TokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  token_type: string;
+  expires_in: number;
+  scope?: string;
+}
+
+export async function exchangeCode(
+  code: string,
+  verifier: string,
+  redirectUri: string,
+  clientId = OAUTH_CLIENT_ID,
+): Promise<TokenResponse> {
+  const response = await fetch(`${OAUTH_URL}/oauth/token`, {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type:    'authorization_code',
+      client_id:     clientId,
+      code,
+      code_verifier: verifier,
+      redirect_uri:  redirectUri,
+    }).toString(),
+  });
+
+  if (!response.ok) {
+    const text = await response.text().catch(() => '');
+    throw new Error(`OAuth token exchange failed (${response.status}): ${text}`);
+  }
+
+  const data = await response.json() as TokenResponse;
+  if (!data.access_token) throw new Error('No access_token in OAuth response');
+
+  return data;
+}
+
+// --- Token accessors ---
+
+export function getAccessToken(): string | null {
+  return sessionStorage.getItem(SESSION_KEY_TOKEN);
+}
+
+export function clearAccessToken(): void {
+  sessionStorage.removeItem(SESSION_KEY_TOKEN);
+  sessionStorage.removeItem(SESSION_KEY_VERIFIER);
+}
+
+// --- PKCE verifier persistence (avant redirect) ---
+
+export function saveVerifier(verifier: string): void {
+  sessionStorage.setItem(SESSION_KEY_VERIFIER, verifier);
+}
+
+export function loadVerifier(): string | null {
+  return sessionStorage.getItem(SESSION_KEY_VERIFIER);
+}

frontend/src/main.tsx

@@ -2,9 +2,12 @@ import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
 import "./styles/index.css";
 import App from "./App";
+import ErrorBoundary from "./components/ErrorBoundary";
 
 createRoot(document.getElementById("root")!).render(
   <StrictMode>
-    <App />
+    <ErrorBoundary>
+      <App />
+    </ErrorBoundary>
   </StrictMode>
 );

frontend/src/pages/AdminPage.tsx

@@ -41,21 +41,32 @@ interface AdminUser {
   } | null;
 }
 
+interface Stats {
+  totalUsers: number;
+  totalVideos: number;
+  activeSubscriptions: number;
+}
+
 // ── Tabs ─────────────────────────────────────────────────────────────────────
 
-type Tab = 'videos' | 'users' | 'plans';
+type Tab = 'videos' | 'users' | 'plans' | 'system';
 
 export default function AdminPage() {
   const { user, loading: authLoading } = useAuthContext();
+  const isSuperAdmin = user?.roles?.includes('super_admin') ?? false;
   const [tab, setTab] = useState<Tab>('videos');
 
   if (authLoading) return null;
-  if (!user?.roles?.includes('admin')) return <Navigate to="/" replace />;
+  if (!user?.roles?.some((r) => r === 'admin' || r === 'super_admin')) return <Navigate to="/" replace />;
+
+  const tabs: Tab[] = isSuperAdmin
+    ? ['videos', 'users', 'plans', 'system']
+    : ['videos', 'users', 'plans'];
 
   return (
     <div className="flex flex-col gap-6">
       <div className="flex items-center gap-1 border-b border-od-border pb-4">
-        {(['videos', 'users', 'plans'] as Tab[]).map((t) => (
+        {tabs.map((t) => (
           <button
             key={t}
             onClick={() => setTab(t)}
@@ -71,8 +82,9 @@ export default function AdminPage() {
       </div>
 
       {tab === 'videos' && <VideosTab />}
-      {tab === 'users'  && <UsersTab />}
+      {tab === 'users'  && <UsersTab isSuperAdmin={isSuperAdmin} />}
       {tab === 'plans'  && <PlansTab />}
+      {tab === 'system' && isSuperAdmin && <SystemTab />}
     </div>
   );
 }
@@ -85,7 +97,8 @@ function VideosTab() {
   const [fetchError, setFetchError] = useState<string | null>(null);
   const [actionError, setActionError] = useState<string | null>(null);
   const [form, setForm] = useState({
-    title: '', storageType: 'youtube', storageKey: '',
+    title: '', description: '', thumbnailUrl: '',
+    storageType: 'youtube', storageKey: '',
     requiredLevel: 0, isPublished: false,
   });
   const [saving, setSaving] = useState(false);
@@ -94,7 +107,7 @@ function VideosTab() {
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    apiFetch<{ success: boolean; data: { videos: Video[] } }>('/admin/videos')
+    apiFetch<{ success: boolean; data: { videos: Video[] } }>('/admin/videos?limit=100')
       .then((r) => setVideos(r.data.videos))
       .catch(() => setFetchError('Impossible de charger les vidéos.'))
       .finally(() => setLoading(false));
@@ -132,7 +145,7 @@ function VideosTab() {
         { method: 'POST', body: JSON.stringify(form) }
       );
       setVideos((v) => [r.data.video, ...v]);
-      setForm({ title: '', storageType: 'youtube', storageKey: '', requiredLevel: 0, isPublished: false });
+      setForm({ title: '', description: '', thumbnailUrl: '', storageType: 'youtube', storageKey: '', requiredLevel: 0, isPublished: false });
     } catch {
       setError('Erreur lors de la création.');
     }
@@ -166,7 +179,6 @@ function VideosTab() {
   return (
     <div className="flex flex-col gap-6">
 
-      {/* Formulaire création */}
       <form onSubmit={handleCreate} className="flex flex-col gap-3 rounded border border-od-border bg-od-surface p-4">
         <p className="font-mono text-xs text-od-muted uppercase tracking-widest">Nouvelle vidéo</p>
 
@@ -178,6 +190,21 @@ function VideosTab() {
           className="rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent"
         />
 
+        <textarea
+          value={form.description}
+          onChange={(e) => setForm((f) => ({ ...f, description: e.target.value }))}
+          placeholder="Description (optionnel)"
+          rows={2}
+          className="rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent resize-none"
+        />
+
+        <input
+          value={form.thumbnailUrl}
+          onChange={(e) => setForm((f) => ({ ...f, thumbnailUrl: e.target.value }))}
+          placeholder="URL thumbnail (optionnel)"
+          className="rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent"
+        />
+
         <div className="flex gap-2">
           <select
             value={form.storageType}
@@ -219,8 +246,7 @@ function VideosTab() {
           <label className="flex items-center gap-2 text-sm text-od-muted">
             Niveau requis
             <input
-              type="number"
+              type="number" min={0}
-              min={0}
               value={form.requiredLevel}
               onChange={(e) => setForm((f) => ({ ...f, requiredLevel: parseInt(e.target.value) || 0 }))}
               className="w-16 rounded border border-od-border bg-od-bg px-2 py-1 text-sm text-od-text outline-none focus:border-od-accent"
@@ -246,7 +272,6 @@ function VideosTab() {
         </button>
       </form>
 
-      {/* Liste */}
       {loading ? (
         <div className="flex flex-col gap-2">
           {[...Array(3)].map((_, i) => <div key={i} className="h-12 rounded border border-od-border animate-pulse" />)}
@@ -289,7 +314,7 @@ function VideosTab() {
 
 // ── Users tab ────────────────────────────────────────────────────────────────
 
-function UsersTab() {
+function UsersTab({ isSuperAdmin }: { isSuperAdmin: boolean }) {
   const [users, setUsers] = useState<AdminUser[]>([]);
   const [plans, setPlans] = useState<Plan[]>([]);
   const [loading, setLoading] = useState(true);
@@ -299,10 +324,11 @@ function UsersTab() {
   const [selectedPlan, setSelectedPlan] = useState<Record<string, string>>({});
   const [assigningRole, setAssigningRole] = useState<string | null>(null);
   const [selectedRole, setSelectedRole] = useState<Record<string, string>>({});
+  const [togglingBan, setTogglingBan] = useState<string | null>(null);
 
   useEffect(() => {
     Promise.all([
-      apiFetch<{ success: boolean; data: { users: AdminUser[] } }>('/admin/users'),
+      apiFetch<{ success: boolean; data: { users: AdminUser[] } }>('/admin/users?limit=100'),
       apiFetch<{ success: boolean; data: { plans: Plan[] } }>('/admin/plans'),
     ])
       .then(([ur, pr]) => {
@@ -323,8 +349,9 @@ function UsersTab() {
         method: 'POST',
         body: JSON.stringify({ planId }),
       });
-      const r = await apiFetch<{ success: boolean; data: { users: AdminUser[] } }>('/admin/users');
+      const r = await apiFetch<{ success: boolean; data: { users: AdminUser[] } }>('/admin/users?limit=100');
       setUsers(r.data.users);
+      setSelectedPlan((s) => { const n = { ...s }; delete n[userId]; return n; });
     } catch {
       setActionError('Impossible d\'assigner le plan.');
     }
@@ -341,14 +368,30 @@ function UsersTab() {
         method: 'PATCH',
         body: JSON.stringify({ roles: [role] }),
       });
-      const r = await apiFetch<{ success: boolean; data: { users: AdminUser[] } }>('/admin/users');
+      const r = await apiFetch<{ success: boolean; data: { users: AdminUser[] } }>('/admin/users?limit=100');
       setUsers(r.data.users);
+      setSelectedRole((s) => { const n = { ...s }; delete n[userId]; return n; });
     } catch {
       setActionError('Impossible d\'assigner le rôle.');
     }
     setAssigningRole(null);
   }
 
+  async function toggleBan(u: AdminUser) {
+    setTogglingBan(u.id);
+    setActionError(null);
+    try {
+      await apiFetch(`/admin/users/${u.id}`, {
+        method: 'PATCH',
+        body: JSON.stringify({ isActive: !u.isActive }),
+      });
+      setUsers((prev) => prev.map((x) => x.id === u.id ? { ...x, isActive: !u.isActive } : x));
+    } catch {
+      setActionError('Impossible de modifier le statut.');
+    }
+    setTogglingBan(null);
+  }
+
   if (loading) return (
     <div className="flex flex-col gap-2">
       {[...Array(3)].map((_, i) => <div key={i} className="h-20 rounded border border-od-border animate-pulse" />)}
@@ -357,14 +400,29 @@ function UsersTab() {
 
   if (error) return <p className="text-sm text-od-crit">{error}</p>;
 
+  // Rôles assignables selon le niveau du current user
+  const assignableRoles = isSuperAdmin
+    ? ['user', 'moderator', 'admin', 'super_admin']
+    : ['user', 'moderator'];
+
   return (
     <div className="flex flex-col gap-2">
       {actionError && <p className="text-xs text-od-crit">{actionError}</p>}
       {users.map((u) => (
-        <div key={u.id} className="flex flex-col gap-2 rounded border border-od-border bg-od-surface px-4 py-3">
+        <div
+          key={u.id}
+          className={`flex flex-col gap-2 rounded border bg-od-surface px-4 py-3 ${
+            u.isActive ? 'border-od-border' : 'border-od-crit/40 opacity-60'
+          }`}
+        >
           <div className="flex items-start justify-between gap-2">
             <div>
-              <p className="text-sm font-medium text-od-text">{u.nickname}</p>
+              <p className="text-sm font-medium text-od-text">
+                {u.nickname}
+                {!u.isActive && (
+                  <span className="ml-2 font-mono text-xs text-od-crit">banni</span>
+                )}
+              </p>
               <p className="font-mono text-xs text-od-muted">{u.email ?? '—'}</p>
             </div>
             <div className="flex flex-col items-end gap-1">
@@ -382,11 +440,11 @@ function UsersTab() {
             </div>
           </div>
 
-          <div className="flex items-center gap-2">
+          <div className="flex flex-wrap items-center gap-2">
             <select
               value={selectedPlan[u.id] ?? ''}
               onChange={(e) => setSelectedPlan((s) => ({ ...s, [u.id]: e.target.value }))}
-              className="flex-1 rounded border border-od-border bg-od-bg px-2 py-1 text-xs text-od-text outline-none focus:border-od-accent"
+              className="flex-1 min-w-0 rounded border border-od-border bg-od-bg px-2 py-1 text-xs text-od-text outline-none focus:border-od-accent"
             >
               <option value="">— Plan —</option>
               {plans.filter((p) => p.isActive).map((p) => (
@@ -406,9 +464,7 @@ function UsersTab() {
               className="rounded border border-od-border bg-od-bg px-2 py-1 text-xs text-od-text outline-none focus:border-od-accent"
             >
               <option value="">— Rôle —</option>
-              <option value="user">user</option>
+              {assignableRoles.map((r) => <option key={r} value={r}>{r}</option>)}
-              <option value="admin">admin</option>
-              <option value="super_admin">super_admin</option>
             </select>
             <button
               disabled={!selectedRole[u.id] || assigningRole === u.id}
@@ -417,6 +473,17 @@ function UsersTab() {
             >
               {assigningRole === u.id ? '…' : 'Rôle'}
             </button>
+            <button
+              disabled={togglingBan === u.id}
+              onClick={() => toggleBan(u)}
+              className={`rounded border px-3 py-1 font-mono text-xs transition-colors disabled:opacity-40 ${
+                u.isActive
+                  ? 'border-od-border text-od-muted hover:border-od-crit hover:text-od-crit'
+                  : 'border-od-crit text-od-crit hover:bg-od-crit hover:text-od-bg'
+              }`}
+            >
+              {togglingBan === u.id ? '…' : u.isActive ? 'Bannir' : 'Débannir'}
+            </button>
           </div>
         </div>
       ))}
@@ -559,3 +626,51 @@ function PlansTab() {
     </div>
   );
 }
+
+// ── System tab (super_admin only) ─────────────────────────────────────────────
+
+function SystemTab() {
+  const [stats, setStats] = useState<Stats | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(false);
+
+  useEffect(() => {
+    apiFetch<{ success: boolean; data: Stats }>('/admin/stats')
+      .then((r) => setStats(r.data))
+      .catch(() => setError(true))
+      .finally(() => setLoading(false));
+  }, []);
+
+  return (
+    <div className="flex flex-col gap-6">
+      <p className="font-mono text-xs text-od-muted uppercase tracking-widest">Métriques plateforme</p>
+
+      {loading && (
+        <div className="grid gap-4 sm:grid-cols-3">
+          {[...Array(3)].map((_, i) => (
+            <div key={i} className="h-20 rounded border border-od-border animate-pulse" />
+          ))}
+        </div>
+      )}
+
+      {error && <p className="text-sm text-od-crit">Impossible de charger les stats.</p>}
+
+      {stats && (
+        <div className="grid gap-4 sm:grid-cols-3">
+          <StatCard label="Utilisateurs" value={stats.totalUsers} />
+          <StatCard label="Vidéos publiées" value={stats.totalVideos} />
+          <StatCard label="Abonnements actifs" value={stats.activeSubscriptions} />
+        </div>
+      )}
+    </div>
+  );
+}
+
+function StatCard({ label, value }: { label: string; value: number }) {
+  return (
+    <div className="flex flex-col gap-1 rounded border border-od-border bg-od-surface p-4">
+      <p className="font-mono text-xs text-od-muted uppercase tracking-widest">{label}</p>
+      <p className="text-2xl font-semibold text-od-accent">{value}</p>
+    </div>
+  );
+}

frontend/src/pages/CallbackPage.tsx

@@ -1,30 +1,139 @@
 import { useEffect, useState } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { apiFetch } from '../lib/api';
+import { exchangeCode, loadVerifier } from '../lib/oauth';
+import { useAuthContext } from '../context/AuthContext';
+import type { User } from '../context/AuthContext';
+
+interface SessionResponse {
+  success: boolean;
+  data: { user: User };
+}
+
+type PendingState =
+  | { kind: 'verification_pending'; email: string }
+  | { kind: 'merge_pending'; email: string; provider: string };
 
 export default function CallbackPage() {
   const navigate = useNavigate();
+  const { setUser } = useAuthContext();
   const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<PendingState | null>(null);
 
   useEffect(() => {
     const params = new URLSearchParams(window.location.search);
-    const token = params.get('token');
 
-    // Pas de token dans l'URL → retour silencieux
+    // --- Erreur OAuth explicite ---
-    if (!token) {
+    const oauthError = params.get('error');
-      navigate('/', { replace: true });
+    if (oauthError) {
+      const desc = params.get('error_description') ?? oauthError;
+      setError(`Erreur OAuth : ${desc}`);
       return;
     }
 
-    // Envoie le token au backend → backend valide + pose le cookie httpOnly
+    // --- Pending states (verification / merge) ---
-    apiFetch<void>('/auth/session', {
+    const status = params.get('status');
-      method: 'POST',
+    if (status === 'verification_pending') {
-      body: JSON.stringify({ token }),
+      setPending({ kind: 'verification_pending', email: params.get('email') ?? '' });
-    })
+      return;
-      .then(() => navigate('/', { replace: true }))
+    }
-      .catch(() => setError("Échec de l'authentification. Réessaie."));
+    if (status === 'merge_pending') {
-  }, [navigate]);
+      setPending({
+        kind: 'merge_pending',
+        email: params.get('email') ?? '',
+        provider: params.get('provider') ?? '',
+      });
+      return;
+    }
 
+    // --- Flow PKCE : ?code= présent ---
+    const code = params.get('code');
+    if (code) {
+      const verifier = loadVerifier();
+      if (!verifier) {
+        setError('Session PKCE expirée. Recommence la connexion.');
+        return;
+      }
+      const redirectUri = `${window.location.origin}/callback`;
+
+      exchangeCode(code, verifier, redirectUri)
+        .then((tokens) => {
+          return apiFetch<SessionResponse>('/auth/session', {
+            method: 'POST',
+            body: JSON.stringify({
+              token: tokens.access_token,
+              refreshToken: tokens.refresh_token,
+            }),
+          });
+        })
+        .then((res) => {
+          setUser(res.data.user);
+          navigate('/', { replace: true });
+        })
+        .catch(() => setError("Échec de l'échange de code OAuth. Réessaie."));
+      return;
+    }
+
+    // --- Flow session (token JWT en query param) ---
+    const token = params.get('token');
+    if (token) {
+      apiFetch<SessionResponse>('/auth/session', {
+        method: 'POST',
+        body: JSON.stringify({ token }),
+      })
+        .then((res) => {
+          setUser(res.data.user);
+          navigate('/', { replace: true });
+        })
+        .catch(() => setError("Échec de l'authentification. Réessaie."));
+      return;
+    }
+
+    // Aucun paramètre reconnu → retour accueil
+    navigate('/', { replace: true });
+  }, [navigate, setUser]);
+
+  // --- Pending UI ---
+  if (pending) {
+    return (
+      <div className="flex flex-col items-center gap-6 pt-20 max-w-md mx-auto text-center">
+        {pending.kind === 'verification_pending' ? (
+          <>
+            <div className="text-4xl">📧</div>
+            <h2 className="text-lg font-semibold text-od-text">Vérifie ton email</h2>
+            <p className="text-sm text-od-muted">
+              Un email de vérification a été envoyé à{' '}
+              <span className="text-od-text font-mono">{pending.email}</span>.
+              <br />
+              Clique sur le lien pour activer ton compte.
+            </p>
+          </>
+        ) : (
+          <>
+            <div className="text-4xl">🔗</div>
+            <h2 className="text-lg font-semibold text-od-text">Fusion de compte</h2>
+            <p className="text-sm text-od-muted">
+              Un compte existe déjà avec l'email{' '}
+              <span className="text-od-text font-mono">{pending.email}</span>.
+              <br />
+              Un email a été envoyé pour fusionner ton compte{' '}
+              <span className="text-od-accent capitalize">{pending.provider}</span>.
+              <br />
+              Clique sur le lien dans l'email pour confirmer.
+            </p>
+          </>
+        )}
+        <a
+          href="/login"
+          className="font-mono text-xs text-od-muted hover:text-od-text transition-colors"
+        >
+          ← Retour à la connexion
+        </a>
+      </div>
+    );
+  }
+
+  // --- Error UI ---
   if (error) {
     return (
       <div className="flex flex-col items-center gap-4 pt-20">

frontend/src/pages/HomePage.tsx

@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useMemo } from 'react';
 import { Link } from 'react-router-dom';
 import { apiFetch } from '../lib/api';
 
@@ -19,16 +19,26 @@ interface VideosResponse {
 export default function HomePage() {
   const [videos, setVideos] = useState<Video[]>([]);
   const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(false);
+  const [query, setQuery] = useState('');
 
   useEffect(() => {
     apiFetch<VideosResponse>('/videos')
       .then((res) => setVideos(res.data.videos))
-      .catch(() => setVideos([]))
+      .catch(() => setError(true))
       .finally(() => setLoading(false));
   }, []);
 
-  const free    = videos.filter((v) => !v.locked);
+  const filtered = useMemo(() => {
-  const premium = videos.filter((v) => v.locked);
+    const q = query.trim().toLowerCase();
+    if (!q) return videos;
+    return videos.filter(
+      (v) => v.title.toLowerCase().includes(q) || v.description?.toLowerCase().includes(q),
+    );
+  }, [videos, query]);
+
+  const free    = filtered.filter((v) => !v.locked);
+  const premium = filtered.filter((v) => v.locked);
 
   return (
     <div className="flex flex-col gap-10">
@@ -39,6 +49,13 @@ export default function HomePage() {
         <p className="mt-2 text-sm text-od-muted">
           Contenu libre et premium — connecte-toi pour accéder aux formations complètes.
         </p>
+        <input
+          type="search"
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          placeholder="Rechercher…"
+          className="mt-4 w-full max-w-sm rounded border border-od-border bg-od-surface px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent"
+        />
       </section>
 
       {loading && (
@@ -47,7 +64,11 @@ export default function HomePage() {
         </div>
       )}
 
-      {!loading && (
+      {error && (
+        <p className="text-sm text-od-crit">Impossible de charger les vidéos. Réessaie plus tard.</p>
+      )}
+
+      {!loading && !error && (
         <>
           {free.length > 0 && (
             <section>
@@ -74,6 +95,9 @@ export default function HomePage() {
           {videos.length === 0 && (
             <p className="text-sm text-od-muted">Aucune vidéo disponible pour l'instant.</p>
           )}
+          {videos.length > 0 && filtered.length === 0 && (
+            <p className="text-sm text-od-muted">Aucun résultat pour « {query} ».</p>
+          )}
         </>
       )}
 

frontend/src/pages/LandingPage.tsx

@@ -0,0 +1,120 @@
+import { Link } from 'react-router-dom';
+
+export default function LandingPage() {
+  return (
+    <div className="flex flex-col gap-24 pb-16">
+
+      {/* ── Hero ──────────────────────────────────────────────────────────── */}
+      <section className="pt-16 flex flex-col gap-6 max-w-3xl">
+
+        {/* Badge */}
+        <div className="inline-flex w-fit items-center gap-2 rounded border border-od-border bg-od-surface px-3 py-1">
+          <span className="h-1.5 w-1.5 rounded-full bg-od-accent" />
+          <span className="font-mono text-2xs text-od-muted tracking-widest uppercase">
+            Vidéos · Playlists · Communauté
+          </span>
+        </div>
+
+        {/* Headline */}
+        <h1 className="font-display text-5xl font-bold leading-[1.1] tracking-tight text-od-text">
+          Partagez vos vidéos.{' '}
+          <span className="text-od-accent">Construisez votre audience.</span>
+        </h1>
+
+        {/* Sous-titre */}
+        <p className="text-base text-od-muted leading-relaxed max-w-xl">
+          OriginsDigital est une plateforme de partage vidéo pensée pour les créateurs.
+          Organisez votre contenu en playlists, proposez du contenu libre ou premium,
+          et faites grandir votre communauté.
+        </p>
+
+        {/* CTAs */}
+        <div className="flex items-center gap-4 pt-2">
+          <Link
+            to="/app"
+            className="inline-flex items-center gap-2 rounded border border-od-accent bg-od-accent px-6 py-2.5 font-mono text-sm font-semibold text-od-bg transition-all duration-150 hover:bg-od-accent-dim hover:border-od-accent-dim"
+          >
+            Explorer les vidéos
+          </Link>
+          <Link
+            to="/login"
+            className="inline-flex items-center gap-2 rounded border border-od-border px-6 py-2.5 font-mono text-sm text-od-muted transition-all duration-150 hover:border-od-border-hi hover:text-od-text"
+          >
+            Se connecter
+          </Link>
+        </div>
+
+      </section>
+
+      {/* ── Features ──────────────────────────────────────────────────────── */}
+      <section className="grid grid-cols-1 sm:grid-cols-3 gap-4">
+        {[
+          {
+            label: 'Playlists organisées',
+            desc: 'Regroupez vos vidéos par thème, série ou parcours. Vos spectateurs retrouvent facilement ce qui les intéresse.',
+          },
+          {
+            label: 'Contenu libre & premium',
+            desc: 'Proposez du contenu en accès libre pour attirer, et du contenu premium pour fidéliser. Vous décidez.',
+          },
+          {
+            label: 'Fait pour les créateurs',
+            desc: 'Interface épurée, recherche rapide, profil personnalisé. Le contenu au centre, pas la distraction.',
+          },
+        ].map(({ label, desc }) => (
+          <div
+            key={label}
+            className="flex flex-col gap-3 rounded border border-od-border bg-od-surface p-5 transition-colors duration-150 hover:border-od-border-hi"
+          >
+            <div className="h-px w-8 bg-od-accent" />
+            <p className="text-sm font-semibold text-od-text">{label}</p>
+            <p className="text-xs text-od-muted leading-relaxed">{desc}</p>
+          </div>
+        ))}
+      </section>
+
+      {/* ── Comment ça marche ─────────────────────────────────────────────── */}
+      <section className="flex flex-col gap-8">
+        <div className="flex flex-col gap-2">
+          <span className="font-mono text-2xs uppercase tracking-widest text-od-muted">Comment ça marche</span>
+          <h2 className="font-display text-3xl font-bold text-od-text tracking-tight">
+            Simple et direct.
+          </h2>
+        </div>
+
+        <div className="grid grid-cols-1 sm:grid-cols-3 gap-6">
+          {[
+            { step: '01', title: 'Connectez-vous', desc: 'Via Discord, GitHub, Google ou Twitch. Un clic, pas de formulaire.' },
+            { step: '02', title: 'Explorez', desc: 'Parcourez les vidéos libres, cherchez par thème, découvrez les playlists.' },
+            { step: '03', title: 'Accédez au premium', desc: 'Débloquez les formations complètes et le contenu exclusif.' },
+          ].map(({ step, title, desc }) => (
+            <div key={step} className="flex flex-col gap-2">
+              <span className="font-mono text-lg font-bold text-od-accent">{step}</span>
+              <p className="text-sm font-semibold text-od-text">{title}</p>
+              <p className="text-xs text-od-muted leading-relaxed">{desc}</p>
+            </div>
+          ))}
+        </div>
+      </section>
+
+      {/* ── CTA final ─────────────────────────────────────────────────────── */}
+      <section className="flex flex-col items-center gap-4 rounded border border-od-border bg-od-surface px-8 py-10 text-center">
+        <h2 className="font-display text-2xl font-bold text-od-text">
+          Prêt à découvrir ?
+        </h2>
+        <p className="text-sm text-od-muted max-w-md">
+          Pas besoin de compte pour explorer. Connectez-vous quand vous êtes prêt.
+        </p>
+        <div className="flex items-center gap-4 pt-2">
+          <Link
+            to="/app"
+            className="inline-flex items-center gap-2 rounded border border-od-accent bg-od-accent px-6 py-2.5 font-mono text-sm font-semibold text-od-bg transition-all duration-150 hover:bg-od-accent-dim hover:border-od-accent-dim"
+          >
+            Explorer les vidéos
+          </Link>
+        </div>
+      </section>
+
+    </div>
+  );
+}

frontend/src/pages/LoginPage.tsx

@@ -1,6 +1,8 @@
 import { useState } from 'react';
 import { Link, useNavigate, useLocation } from 'react-router-dom';
 import { apiFetch } from '../lib/api';
+import { useAuthContext, type User } from '../context/AuthContext';
+import { buildAuthUrl, saveVerifier } from '../lib/oauth';
 
 const PROVIDERS = [
   { id: 'discord', label: 'Discord' },
@@ -12,14 +14,28 @@ const PROVIDERS = [
 export default function LoginPage() {
   const navigate = useNavigate();
   const location = useLocation();
+  const { setUser } = useAuthContext();
   const from = (location.state as { from?: Location })?.from?.pathname ?? '/';
-  const base = import.meta.env.VITE_SUPEROAUTH_URL;
-  const redirectUrl = encodeURIComponent(window.location.origin + '/callback');
 
-  const [email, setEmail]       = useState('');
+  const [email, setEmail]         = useState('');
-  const [password, setPassword] = useState('');
+  const [password, setPassword]   = useState('');
-  const [loading, setLoading]   = useState(false);
+  const [loading, setLoading]     = useState(false);
-  const [error, setError]       = useState<string | null>(null);
+  const [error, setError]         = useState<string | null>(null);
+  const [oauthLoading, setOauthLoading] = useState<string | null>(null);
+
+  async function handleOAuth(providerId: string) {
+    if (oauthLoading) return;
+    setOauthLoading(providerId);
+    try {
+      const redirectUri = `${window.location.origin}/callback`;
+      const { url, verifier } = await buildAuthUrl(redirectUri, providerId);
+      saveVerifier(verifier);
+      window.location.href = url;
+    } catch {
+      setOauthLoading(null);
+      setError('Impossible de démarrer la connexion OAuth.');
+    }
+  }
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault();
@@ -27,10 +43,11 @@ export default function LoginPage() {
     setLoading(true);
     setError(null);
     try {
-      await apiFetch('/auth/login', {
+      const res = await apiFetch<{ success: boolean; data: { user: User } }>('/auth/login', {
         method: 'POST',
         body: JSON.stringify({ email, password }),
       });
+      setUser(res.data.user);
       navigate(from, { replace: true });
     } catch {
       setError('Email ou mot de passe incorrect.');
@@ -86,13 +103,14 @@ export default function LoginPage() {
         {/* OAuth providers */}
         <div className="flex flex-col gap-2">
           {PROVIDERS.map(({ id, label }) => (
-            <a
+            <button
               key={id}
-              href={`${base}/api/v1/auth/oauth/${id}?redirectUrl=${redirectUrl}`}
+              onClick={() => handleOAuth(id)}
-              className="flex items-center justify-center rounded border border-od-border bg-od-surface px-4 py-2.5 text-sm text-od-muted transition-colors hover:border-od-accent hover:text-od-accent"
+              disabled={oauthLoading === id}
+              className="flex items-center justify-center rounded border border-od-border bg-od-surface px-4 py-2.5 text-sm text-od-muted transition-colors hover:border-od-accent hover:text-od-accent disabled:opacity-40"
             >
-              {label}
+              {oauthLoading === id ? '…' : label}
-            </a>
+            </button>
           ))}
         </div>
 

frontend/src/pages/PlaylistPage.tsx

@@ -1,6 +1,6 @@
 import { useState, useEffect } from 'react';
-import { useParams, Link } from 'react-router-dom';
+import { useParams, Link, useNavigate } from 'react-router-dom';
-import { apiFetch } from '../lib/api';
+import { apiFetch, ApiError } from '../lib/api';
 
 interface Video {
   id: string;
@@ -27,21 +27,104 @@ interface PlaylistResponse {
 
 export default function PlaylistPage() {
   const { id } = useParams<{ id: string }>();
+  const navigate = useNavigate();
   const [data, setData] = useState<PlaylistResponse['data'] | null>(null);
   const [error, setError] = useState<'forbidden' | 'not_found' | null>(null);
   const [loading, setLoading] = useState(true);
+  const [actionError, setActionError] = useState<string | null>(null);
+
+  // Edit inline form
+  const [editOpen, setEditOpen] = useState(false);
+  const [editTitle, setEditTitle] = useState('');
+  const [editVisibility, setEditVisibility] = useState<'private' | 'shared' | 'public'>('private');
+  const [saving, setSaving] = useState(false);
+
+  // Share modal
+  const [shareOpen, setShareOpen] = useState(false);
+  const [shareUserId, setShareUserId] = useState('');
+  const [sharePermission, setSharePermission] = useState<'view' | 'edit'>('view');
+  const [sharing, setSharing] = useState(false);
+  const [shareError, setShareError] = useState<string | null>(null);
+  const [shareOk, setShareOk] = useState(false);
 
   useEffect(() => {
     if (!id) return;
     apiFetch<PlaylistResponse>(`/playlists/${id}`)
       .then((res) => setData(res.data))
-      .catch((err: Error) => {
+      .catch((err: unknown) => {
-        if (err.message.includes('403')) setError('forbidden');
+        if (err instanceof ApiError && err.status === 403) setError('forbidden');
         else setError('not_found');
       })
       .finally(() => setLoading(false));
   }, [id]);
 
+  function openEdit() {
+    if (!data) return;
+    setEditTitle(data.playlist.title);
+    setEditVisibility(data.playlist.visibility);
+    setEditOpen(true);
+    setActionError(null);
+  }
+
+  async function handleEdit(e: React.FormEvent) {
+    e.preventDefault();
+    if (!id || saving) return;
+    setSaving(true);
+    setActionError(null);
+    try {
+      const res = await apiFetch<{ success: boolean; data: { playlist: Playlist } }>(
+        `/playlists/${id}`,
+        { method: 'PATCH', body: JSON.stringify({ title: editTitle.trim(), visibility: editVisibility }) }
+      );
+      setData((prev) => prev ? { ...prev, playlist: res.data.playlist } : prev);
+      setEditOpen(false);
+    } catch {
+      setActionError('Impossible de modifier la playlist.');
+    }
+    setSaving(false);
+  }
+
+  async function handleDelete() {
+    if (!id || !confirm('Supprimer cette playlist ?')) return;
+    setActionError(null);
+    try {
+      await apiFetch(`/playlists/${id}`, { method: 'DELETE' });
+      navigate('/playlists');
+    } catch {
+      setActionError('Impossible de supprimer la playlist.');
+    }
+  }
+
+  async function handleRemoveVideo(videoId: string) {
+    if (!id || !confirm('Retirer cette vidéo de la playlist ?')) return;
+    setActionError(null);
+    try {
+      await apiFetch(`/playlists/${id}/videos/${videoId}`, { method: 'DELETE' });
+      setData((prev) => prev ? { ...prev, videos: prev.videos.filter((v) => v.id !== videoId) } : prev);
+    } catch {
+      setActionError('Impossible de retirer la vidéo.');
+    }
+  }
+
+  async function handleShare(e: React.FormEvent) {
+    e.preventDefault();
+    if (!id || !shareUserId.trim() || sharing) return;
+    setSharing(true);
+    setShareError(null);
+    setShareOk(false);
+    try {
+      await apiFetch(`/playlists/${id}/share`, {
+        method: 'POST',
+        body: JSON.stringify({ userId: shareUserId.trim(), permission: sharePermission }),
+      });
+      setShareOk(true);
+      setShareUserId('');
+    } catch {
+      setShareError("Impossible d'envoyer l'invitation.");
+    }
+    setSharing(false);
+  }
+
   if (loading) {
     return (
       <div className="flex flex-col gap-3">
@@ -77,41 +160,162 @@ export default function PlaylistPage() {
   }
 
   const { playlist, videos, permission } = data;
+  const isOwner = permission === 'owner';
 
   return (
     <div className="flex flex-col gap-6">
 
-      <div className="flex flex-col gap-1 border-b border-od-border pb-6">
+      {/* Header */}
-        <div className="flex items-center gap-3">
+      <div className="flex flex-col gap-3 border-b border-od-border pb-6">
-          <h1 className="text-xl font-semibold text-od-text">{playlist.title}</h1>
+        {editOpen ? (
-          <span className="font-mono text-xs text-od-muted">{permission}</span>
+          <form onSubmit={handleEdit} className="flex flex-col gap-3 rounded border border-od-border bg-od-surface p-4">
-        </div>
+            <p className="font-mono text-xs text-od-muted uppercase tracking-widest">Modifier</p>
-        {playlist.description && (
+            <input
-          <p className="text-sm text-od-muted">{playlist.description}</p>
+              value={editTitle}
+              onChange={(e) => setEditTitle(e.target.value)}
+              required
+              className="rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent"
+            />
+            <select
+              value={editVisibility}
+              onChange={(e) => setEditVisibility(e.target.value as 'private' | 'shared' | 'public')}
+              className="rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text outline-none focus:border-od-accent"
+            >
+              <option value="private">Privée</option>
+              <option value="shared">Partagée</option>
+              <option value="public">Publique</option>
+            </select>
+            <div className="flex gap-2">
+              <button
+                type="submit"
+                disabled={saving}
+                className="rounded border border-od-accent px-4 py-1.5 font-mono text-xs text-od-accent hover:bg-od-accent hover:text-od-bg transition-colors disabled:opacity-40"
+              >
+                {saving ? '…' : 'Enregistrer'}
+              </button>
+              <button
+                type="button"
+                onClick={() => setEditOpen(false)}
+                className="rounded border border-od-border px-4 py-1.5 font-mono text-xs text-od-muted hover:text-od-text transition-colors"
+              >
+                Annuler
+              </button>
+            </div>
+          </form>
+        ) : (
+          <>
+            <div className="flex items-center gap-3">
+              <h1 className="text-xl font-semibold text-od-text">{playlist.title}</h1>
+              <span className="font-mono text-xs text-od-muted">{permission}</span>
+            </div>
+            {playlist.description && (
+              <p className="text-sm text-od-muted">{playlist.description}</p>
+            )}
+            {isOwner && (
+              <div className="flex gap-2">
+                <button
+                  onClick={openEdit}
+                  className="rounded border border-od-border px-3 py-1 font-mono text-xs text-od-muted hover:border-od-accent hover:text-od-accent transition-colors"
+                >
+                  Éditer
+                </button>
+                <button
+                  onClick={() => { setShareOpen(true); setShareError(null); setShareOk(false); }}
+                  className="rounded border border-od-border px-3 py-1 font-mono text-xs text-od-muted hover:border-od-accent hover:text-od-accent transition-colors"
+                >
+                  Partager
+                </button>
+                <button
+                  onClick={handleDelete}
+                  className="rounded border border-od-border px-3 py-1 font-mono text-xs text-od-muted hover:border-od-crit hover:text-od-crit transition-colors"
+                >
+                  Supprimer
+                </button>
+              </div>
+            )}
+          </>
         )}
+        {actionError && <p className="font-mono text-xs text-od-crit">{actionError}</p>}
       </div>
 
+      {/* Share modal */}
+      {shareOpen && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-od-bg/80">
+          <div className="w-full max-w-sm rounded border border-od-border bg-od-surface p-6 flex flex-col gap-4">
+            <p className="font-mono text-xs text-od-muted uppercase tracking-widest">Partager</p>
+            <form onSubmit={handleShare} className="flex flex-col gap-3">
+              <input
+                value={shareUserId}
+                onChange={(e) => setShareUserId(e.target.value)}
+                placeholder="ID utilisateur"
+                required
+                className="rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent"
+              />
+              <select
+                value={sharePermission}
+                onChange={(e) => setSharePermission(e.target.value as 'view' | 'edit')}
+                className="rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text outline-none focus:border-od-accent"
+              >
+                <option value="view">Lecture seule</option>
+                <option value="edit">Édition</option>
+              </select>
+              {shareError && <p className="font-mono text-xs text-od-crit">{shareError}</p>}
+              {shareOk && <p className="font-mono text-xs text-od-ok">Invitation envoyée.</p>}
+              <div className="flex gap-2">
+                <button
+                  type="submit"
+                  disabled={sharing || !shareUserId.trim()}
+                  className="rounded border border-od-accent px-4 py-1.5 font-mono text-xs text-od-accent hover:bg-od-accent hover:text-od-bg transition-colors disabled:opacity-40"
+                >
+                  {sharing ? '…' : 'Inviter'}
+                </button>
+                <button
+                  type="button"
+                  onClick={() => setShareOpen(false)}
+                  className="rounded border border-od-border px-4 py-1.5 font-mono text-xs text-od-muted hover:text-od-text transition-colors"
+                >
+                  Fermer
+                </button>
+              </div>
+            </form>
+          </div>
+        </div>
+      )}
+
+      {/* Videos */}
       {videos.length === 0 ? (
         <p className="text-sm text-od-muted">Aucune vidéo dans cette playlist.</p>
       ) : (
         <div className="flex flex-col gap-2">
           {videos.map((v, i) => (
-            <Link
+            <div
               key={v.id}
-              to={`/video/${v.id}`}
+              className="flex items-center gap-4 rounded border border-od-border bg-od-surface px-4 py-3"
-              className="flex items-center gap-4 rounded border border-od-border bg-od-surface px-4 py-3 hover:border-od-accent/40 transition-colors"
             >
               <span className="font-mono text-xs text-od-muted w-5 shrink-0">{i + 1}</span>
-              {v.thumbnailUrl && (
+              <Link
-                <img src={v.thumbnailUrl} alt="" className="h-10 w-16 rounded object-cover shrink-0" />
+                to={`/video/${v.id}`}
+                className="flex flex-1 items-center gap-4 hover:opacity-80 transition-opacity min-w-0"
+              >
+                {v.thumbnailUrl && (
+                  <img src={v.thumbnailUrl} alt="" className="h-10 w-16 rounded object-cover shrink-0" />
+                )}
+                <span className="flex-1 text-sm text-od-text truncate">{v.title}</span>
+                {v.duration && (
+                  <span className="font-mono text-xs text-od-muted shrink-0">
+                    {Math.floor(v.duration / 60)}:{String(v.duration % 60).padStart(2, '0')}
+                  </span>
+                )}
+              </Link>
+              {isOwner && (
+                <button
+                  onClick={() => handleRemoveVideo(v.id)}
+                  className="font-mono text-xs text-od-muted hover:text-od-crit transition-colors shrink-0"
+                >
+                  ✕
+                </button>
               )}
-              <span className="flex-1 text-sm text-od-text">{v.title}</span>
+            </div>
-              {v.duration && (
-                <span className="font-mono text-xs text-od-muted shrink-0">
-                  {Math.floor(v.duration / 60)}:{String(v.duration % 60).padStart(2, '0')}
-                </span>
-              )}
-            </Link>
           ))}
         </div>
       )}

frontend/src/pages/PlaylistsPage.tsx

@@ -9,28 +9,42 @@ interface Playlist {
   visibility: 'private' | 'shared' | 'public';
 }
 
+interface Invitation {
+  shareId: string;
+  playlistId: string;
+  playlistTitle: string;
+  permission: 'view' | 'edit';
+}
+
 interface PlaylistsResponse {
   success: boolean;
   data: {
     owned: Playlist[];
     shared: (Playlist & { permission: 'view' | 'edit' })[];
+    invitations?: Invitation[];
   };
 }
 
 export default function PlaylistsPage() {
   const [owned, setOwned] = useState<Playlist[]>([]);
   const [shared, setShared] = useState<(Playlist & { permission: 'view' | 'edit' })[]>([]);
+  const [invitations, setInvitations] = useState<Invitation[]>([]);
   const [loading, setLoading] = useState(true);
+  const [fetchError, setFetchError] = useState<string | null>(null);
   const [createTitle, setCreateTitle] = useState('');
   const [creating, setCreating] = useState(false);
+  const [createError, setCreateError] = useState<string | null>(null);
+  const [inviteError, setInviteError] = useState<string | null>(null);
+  const [respondingId, setRespondingId] = useState<string | null>(null);
 
   useEffect(() => {
     apiFetch<PlaylistsResponse>('/playlists')
       .then((res) => {
         setOwned(res.data.owned);
         setShared(res.data.shared);
+        setInvitations(res.data.invitations ?? []);
       })
-      .catch(() => {})
+      .catch(() => setFetchError('Impossible de charger les playlists.'))
       .finally(() => setLoading(false));
   }, []);
 
@@ -38,6 +52,7 @@ export default function PlaylistsPage() {
     e.preventDefault();
     if (!createTitle.trim() || creating) return;
     setCreating(true);
+    setCreateError(null);
     try {
       const res = await apiFetch<{ success: boolean; data: { playlist: Playlist } }>(
         '/playlists',
@@ -45,10 +60,34 @@ export default function PlaylistsPage() {
       );
       setOwned((prev) => [res.data.playlist, ...prev]);
       setCreateTitle('');
-    } catch {}
+    } catch {
+      setCreateError('Impossible de créer la playlist.');
+    }
     setCreating(false);
   }
 
+  async function respondInvitation(inv: Invitation, status: 'accepted' | 'revoked') {
+    if (respondingId) return;
+    setRespondingId(inv.shareId);
+    setInviteError(null);
+    try {
+      await apiFetch(`/playlists/${inv.playlistId}/share/${inv.shareId}`, {
+        method: 'PATCH',
+        body: JSON.stringify({ status }),
+      });
+      setInvitations((prev) => prev.filter((i) => i.shareId !== inv.shareId));
+      if (status === 'accepted') {
+        const res = await apiFetch<PlaylistsResponse>('/playlists');
+        setOwned(res.data.owned);
+        setShared(res.data.shared);
+        setInvitations(res.data.invitations ?? []);
+      }
+    } catch {
+      setInviteError("Impossible de répondre à l'invitation.");
+    }
+    setRespondingId(null);
+  }
+
   if (loading) {
     return (
       <div className="flex flex-col gap-3">
@@ -59,6 +98,10 @@ export default function PlaylistsPage() {
     );
   }
 
+  if (fetchError) {
+    return <p className="text-sm text-od-crit">{fetchError}</p>;
+  }
+
   return (
     <div className="flex flex-col gap-10">
 
@@ -67,22 +110,60 @@ export default function PlaylistsPage() {
       </section>
 
       {/* Créer */}
-      <form onSubmit={handleCreate} className="flex gap-2">
+      <div className="flex flex-col gap-1">
-        <input
+        <form onSubmit={handleCreate} className="flex gap-2">
-          type="text"
+          <input
-          value={createTitle}
+            type="text"
-          onChange={(e) => setCreateTitle(e.target.value)}
+            value={createTitle}
-          placeholder="Nouvelle playlist…"
+            onChange={(e) => setCreateTitle(e.target.value)}
-          className="flex-1 rounded border border-od-border bg-od-surface px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent"
+            placeholder="Nouvelle playlist…"
-        />
+            className="flex-1 rounded border border-od-border bg-od-surface px-3 py-2 text-sm text-od-text placeholder-od-muted outline-none focus:border-od-accent"
-        <button
+          />
-          type="submit"
+          <button
-          disabled={!createTitle.trim() || creating}
+            type="submit"
-          className="rounded border border-od-border px-4 py-2 font-mono text-xs text-od-muted hover:border-od-accent hover:text-od-accent transition-colors disabled:opacity-40"
+            disabled={!createTitle.trim() || creating}
-        >
+            className="rounded border border-od-border px-4 py-2 font-mono text-xs text-od-muted hover:border-od-accent hover:text-od-accent transition-colors disabled:opacity-40"
-          +
+          >
-        </button>
+            +
-      </form>
+          </button>
+        </form>
+        {createError && <p className="font-mono text-xs text-od-crit">{createError}</p>}
+      </div>
+
+      {/* Invitations reçues */}
+      {invitations.length > 0 && (
+        <section className="flex flex-col gap-2">
+          <h2 className="font-mono text-xs uppercase tracking-widest text-od-muted">Invitations</h2>
+          {inviteError && <p className="font-mono text-xs text-od-crit">{inviteError}</p>}
+          {invitations.map((inv) => (
+            <div
+              key={inv.shareId}
+              className="flex items-center justify-between gap-4 rounded border border-od-border bg-od-surface px-4 py-3"
+            >
+              <div className="flex flex-col gap-0.5 min-w-0">
+                <span className="text-sm text-od-text truncate">{inv.playlistTitle}</span>
+                <span className="font-mono text-xs text-od-muted">{inv.permission}</span>
+              </div>
+              <div className="flex gap-2 shrink-0">
+                <button
+                  disabled={respondingId === inv.shareId}
+                  onClick={() => respondInvitation(inv, 'accepted')}
+                  className="rounded border border-od-ok px-3 py-1 font-mono text-xs text-od-ok hover:bg-od-ok hover:text-od-bg transition-colors disabled:opacity-40"
+                >
+                  {respondingId === inv.shareId ? '…' : 'Accepter'}
+                </button>
+                <button
+                  disabled={respondingId === inv.shareId}
+                  onClick={() => respondInvitation(inv, 'revoked')}
+                  className="rounded border border-od-border px-3 py-1 font-mono text-xs text-od-muted hover:border-od-crit hover:text-od-crit transition-colors disabled:opacity-40"
+                >
+                  Refuser
+                </button>
+              </div>
+            </div>
+          ))}
+        </section>
+      )}
 
       {/* Mes playlists */}
       {owned.length > 0 && (
@@ -100,7 +181,7 @@ export default function PlaylistsPage() {
         </section>
       )}
 
-      {owned.length === 0 && shared.length === 0 && (
+      {owned.length === 0 && shared.length === 0 && invitations.length === 0 && (
         <p className="text-sm text-od-muted">Aucune playlist pour l'instant.</p>
       )}
 

frontend/src/pages/ProfilePage.tsx

@@ -0,0 +1,187 @@
+import { useState } from 'react';
+import { apiFetch, ApiError } from '../lib/api';
+import { useAuthContext } from '../context/AuthContext';
+import type { User } from '../context/AuthContext';
+
+interface MeResponse {
+  success: boolean;
+  data: { user: User };
+}
+
+export default function ProfilePage() {
+  const { user, setUser } = useAuthContext();
+
+  const [editingNickname, setEditingNickname] = useState(false);
+  const [draftNickname, setDraftNickname] = useState(user?.nickname ?? '');
+  const [editingAvatar, setEditingAvatar] = useState(false);
+  const [draftAvatar, setDraftAvatar] = useState(user?.avatar ?? '');
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  if (!user) return null;
+
+  function startEditNickname() {
+    setDraftNickname(user!.nickname);
+    setError(null);
+    setEditingNickname(true);
+  }
+
+  function startEditAvatar() {
+    setDraftAvatar(user!.avatar ?? '');
+    setError(null);
+    setEditingAvatar(true);
+  }
+
+  function cancel() {
+    setEditingNickname(false);
+    setEditingAvatar(false);
+    setError(null);
+  }
+
+  async function save(patch: { nickname?: string; avatar?: string | null }) {
+    setSaving(true);
+    setError(null);
+    try {
+      await apiFetch('/users/me', { method: 'PATCH', body: JSON.stringify(patch) });
+      const res = await apiFetch<MeResponse>('/auth/me');
+      setUser(res.data.user);
+      setEditingNickname(false);
+      setEditingAvatar(false);
+    } catch (e) {
+      setError(e instanceof ApiError ? `Erreur ${e.status}` : 'Erreur réseau');
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function handleSaveNickname() {
+    const trimmed = draftNickname.trim();
+    if (!trimmed || trimmed === user!.nickname) { cancel(); return; }
+    await save({ nickname: trimmed });
+  }
+
+  async function handleSaveAvatar() {
+    const trimmed = draftAvatar.trim();
+    const val = trimmed === '' ? null : trimmed;
+    if (val === (user!.avatar ?? null)) { cancel(); return; }
+    await save({ avatar: val });
+  }
+
+  const planLabel = user.plan?.name ?? 'Free';
+  const planSlug  = user.plan?.slug ?? 'free';
+
+  return (
+    <div className="max-w-lg space-y-8">
+      <h1 className="font-mono text-sm text-od-accent">Profil</h1>
+
+      {/* Compte */}
+      <section className="space-y-4">
+        <h2 className="text-xs font-semibold text-od-muted uppercase tracking-widest">Compte</h2>
+
+        <div className="rounded border border-od-border bg-od-surface divide-y divide-od-border">
+
+          {/* Avatar */}
+          <div className="flex items-center justify-between px-4 py-3 gap-4">
+            <span className="text-xs text-od-muted shrink-0">Avatar</span>
+            {editingAvatar ? (
+              <div className="flex flex-col items-end gap-2 flex-1 min-w-0">
+                <div className="flex items-center gap-2 w-full">
+                  <input
+                    value={draftAvatar}
+                    onChange={(e) => setDraftAvatar(e.target.value)}
+                    onKeyDown={(e) => { if (e.key === 'Enter') handleSaveAvatar(); if (e.key === 'Escape') cancel(); }}
+                    placeholder="URL https://…  (vide = supprimer)"
+                    disabled={saving}
+                    className="flex-1 min-w-0 rounded border border-od-border bg-od-bg px-2 py-0.5 font-mono text-xs text-od-text focus:border-od-accent focus:outline-none disabled:opacity-50 placeholder-od-muted"
+                    autoFocus
+                  />
+                  <button onClick={handleSaveAvatar} disabled={saving}
+                    className="font-mono text-xs text-od-accent hover:opacity-80 transition-opacity disabled:opacity-40">
+                    {saving ? '…' : '✓'}
+                  </button>
+                  <button onClick={cancel} disabled={saving}
+                    className="font-mono text-xs text-od-muted hover:text-od-crit transition-colors disabled:opacity-40">
+                    ✕
+                  </button>
+                </div>
+                {draftAvatar && (
+                  <img src={draftAvatar} alt="preview" className="h-10 w-10 rounded-full object-cover border border-od-border" />
+                )}
+                {error && <span className="font-mono text-[10px] text-od-crit">{error}</span>}
+              </div>
+            ) : (
+              <div className="flex items-center gap-3">
+                {user.avatar ? (
+                  <img src={user.avatar} alt={user.nickname} className="h-8 w-8 rounded-full object-cover border border-od-border" />
+                ) : (
+                  <span className="flex h-8 w-8 items-center justify-center rounded-full bg-od-surface-hi border border-od-border font-mono text-sm text-od-accent">
+                    {user.nickname[0].toUpperCase()}
+                  </span>
+                )}
+                <button onClick={startEditAvatar}
+                  className="font-mono text-xs text-od-muted hover:text-od-accent transition-colors">
+                  modifier
+                </button>
+              </div>
+            )}
+          </div>
+
+          {/* Email */}
+          <div className="flex items-center justify-between px-4 py-3">
+            <span className="text-xs text-od-muted">Email</span>
+            <span className="font-mono text-xs text-od-text">{user.email ?? '—'}</span>
+          </div>
+
+          {/* Nickname */}
+          <div className="flex items-center justify-between px-4 py-3">
+            <span className="text-xs text-od-muted">Pseudo</span>
+            {editingNickname ? (
+              <div className="flex flex-col items-end gap-1">
+                <div className="flex items-center gap-2">
+                  <input
+                    value={draftNickname}
+                    onChange={(e) => setDraftNickname(e.target.value)}
+                    onKeyDown={(e) => { if (e.key === 'Enter') handleSaveNickname(); if (e.key === 'Escape') cancel(); }}
+                    maxLength={100}
+                    disabled={saving}
+                    className="w-36 rounded border border-od-border bg-od-bg px-2 py-0.5 font-mono text-xs text-od-text focus:border-od-accent focus:outline-none disabled:opacity-50"
+                    autoFocus
+                  />
+                  <button onClick={handleSaveNickname} disabled={saving}
+                    className="font-mono text-xs text-od-accent hover:opacity-80 transition-opacity disabled:opacity-40">
+                    {saving ? '…' : '✓'}
+                  </button>
+                  <button onClick={cancel} disabled={saving}
+                    className="font-mono text-xs text-od-muted hover:text-od-crit transition-colors disabled:opacity-40">
+                    ✕
+                  </button>
+                </div>
+                {error && <span className="font-mono text-[10px] text-od-crit">{error}</span>}
+              </div>
+            ) : (
+              <div className="flex items-center gap-3">
+                <span className="font-mono text-xs text-od-text">{user.nickname}</span>
+                <button onClick={startEditNickname}
+                  className="font-mono text-xs text-od-muted hover:text-od-accent transition-colors">
+                  modifier
+                </button>
+              </div>
+            )}
+          </div>
+
+        </div>
+      </section>
+
+      {/* Plan */}
+      <section className="space-y-4">
+        <h2 className="text-xs font-semibold text-od-muted uppercase tracking-widest">Abonnement</h2>
+        <div className="rounded border border-od-border bg-od-surface px-4 py-3 flex items-center justify-between">
+          <p className="text-xs text-od-text">{planLabel}</p>
+          <span className="font-mono text-[10px] px-1.5 py-0.5 rounded border border-od-border text-od-muted">
+            {planSlug}
+          </span>
+        </div>
+      </section>
+    </div>
+  );
+}

frontend/src/pages/VideoPage.tsx

@@ -1,6 +1,7 @@
 import { useState, useEffect } from 'react';
 import { useParams, Link } from 'react-router-dom';
-import { apiFetch } from '../lib/api';
+import { apiFetch, ApiError } from '../lib/api';
+import { useAuthContext } from '../context/AuthContext';
 import VideoPlayer from '../components/VideoPlayer';
 
 interface Video {
@@ -20,8 +21,14 @@ interface VideoResponse {
   data: { video: Video };
 }
 
+interface Playlist {
+  id: string;
+  title: string;
+}
+
 export default function VideoPage() {
   const { id } = useParams<{ id: string }>();
+  const { user } = useAuthContext();
   const [video, setVideo]     = useState<Video | null>(null);
   const [error, setError]     = useState<'forbidden' | 'not_found' | 'unknown' | null>(null);
   const [loading, setLoading] = useState(true);
@@ -30,9 +37,9 @@ export default function VideoPage() {
     if (!id) return;
     apiFetch<VideoResponse>(`/videos/${id}`)
       .then((res) => setVideo(res.data.video))
-      .catch((err: Error) => {
+      .catch((err: unknown) => {
-        if (err.message.includes('403')) setError('forbidden');
+        if (err instanceof ApiError && err.status === 403) setError('forbidden');
-        else if (err.message.includes('404')) setError('not_found');
+        else if (err instanceof ApiError && err.status === 404) setError('not_found');
         else setError('unknown');
       })
       .finally(() => setLoading(false));
@@ -106,6 +113,8 @@ export default function VideoPage() {
         </div>
       </div>
 
+      {user && <AddToPlaylist videoId={video.id} />}
+
       <Link to="/" className="self-start font-mono text-xs text-od-muted hover:text-od-text transition-colors">
         ← Retour aux vidéos
       </Link>
@@ -113,3 +122,70 @@ export default function VideoPage() {
     </div>
   );
 }
+
+// ── Ajouter à une playlist ────────────────────────────────────────────────────
+
+function AddToPlaylist({ videoId }: { videoId: string }) {
+  const [playlists, setPlaylists] = useState<Playlist[]>([]);
+  const [selected, setSelected]  = useState('');
+  const [adding, setAdding]      = useState(false);
+  const [status, setStatus]      = useState<'idle' | 'ok' | 'already' | 'error'>('idle');
+
+  useEffect(() => {
+    apiFetch<{ success: boolean; data: { owned: Playlist[]; shared: (Playlist & { permission: string })[] } }>(
+      '/playlists'
+    ).then((res) => {
+      const editable = [
+        ...res.data.owned,
+        ...res.data.shared.filter((p) => p.permission === 'edit'),
+      ];
+      setPlaylists(editable);
+      if (editable.length > 0) setSelected(editable[0].id);
+    }).catch(() => {});
+  }, []);
+
+  async function handleAdd() {
+    if (!selected || adding) return;
+    setAdding(true);
+    setStatus('idle');
+    try {
+      await apiFetch(`/playlists/${selected}/videos`, {
+        method: 'POST',
+        body: JSON.stringify({ videoId }),
+      });
+      setStatus('ok');
+    } catch (e) {
+      setStatus(e instanceof ApiError && e.status === 409 ? 'already' : 'error');
+    }
+    setAdding(false);
+  }
+
+  if (playlists.length === 0) return null;
+
+  return (
+    <div className="flex flex-col gap-2 rounded border border-od-border bg-od-surface p-4">
+      <p className="font-mono text-xs text-od-muted uppercase tracking-widest">Ajouter à une playlist</p>
+      <div className="flex items-center gap-2">
+        <select
+          value={selected}
+          onChange={(e) => { setSelected(e.target.value); setStatus('idle'); }}
+          className="flex-1 rounded border border-od-border bg-od-bg px-3 py-2 text-sm text-od-text outline-none focus:border-od-accent"
+        >
+          {playlists.map((p) => (
+            <option key={p.id} value={p.id}>{p.title}</option>
+          ))}
+        </select>
+        <button
+          onClick={handleAdd}
+          disabled={adding}
+          className="rounded border border-od-accent px-4 py-2 font-mono text-xs text-od-accent hover:bg-od-accent hover:text-od-bg transition-colors disabled:opacity-40"
+        >
+          {adding ? '…' : '+ Ajouter'}
+        </button>
+      </div>
+      {status === 'ok'     && <p className="font-mono text-xs text-od-ok">Vidéo ajoutée.</p>}
+      {status === 'already'&& <p className="font-mono text-xs text-od-muted">Déjà dans cette playlist.</p>}
+      {status === 'error'  && <p className="font-mono text-xs text-od-crit">Erreur — réessaie.</p>}
+    </div>
+  );
+}

frontend/src/styles/index.css

@@ -2,39 +2,31 @@
 @tailwind components;
 @tailwind utilities;
 
-/* ─── Void Dark (défaut) ─────────────────────────────────────────────────── */
+/* ─── Void Dark — dark only V1 ──────────────────────────────────────────── */
-:root,
+:root {
-[data-theme="dark"] {
+  --od-bg:           #0a0a0a;   /* fond principal — validated */
-  --od-bg:           #0a0a0d;   /* fond principal — quasi-noir cool */
+  --od-surface:      #111111;   /* panneaux, cartes */
-  --od-surface:      #111115;   /* panneaux, cartes */
+  --od-surface-hi:   #1a1a1a;   /* survol, éléments élevés */
-  --od-surface-hi:   #191920;   /* survol, éléments élevés */
+  --od-border:       #222222;   /* séparateurs subtils */
-  --od-border:       #222228;   /* séparateurs subtils */
+  --od-border-hi:    #2e2e2e;   /* bordures hover */
-  --od-text:         #dddde8;   /* texte principal */
+  --od-text:         #e8e8e8;   /* texte principal */
-  --od-muted:        #62626e;   /* texte secondaire, labels */
+  --od-muted:        #5a5a5a;   /* texte secondaire, labels */
-  --od-accent:       #d4a853;   /* or chaud — premium */
+  --od-accent:       #c9a84c;   /* or mat — validated */
-  --od-accent-dim:   #a07830;   /* survol accent */
+  --od-accent-dim:   #a08038;   /* survol accent */
+  --od-accent-glow:  rgba(201,168,76,0.12); /* glow subtil */
   --od-crit:         #d95f5f;   /* erreurs */
   --od-ok:           #5fc875;   /* succès */
 }
 
-/* ─── Void Light ─────────────────────────────────────────────────────────── */
+/* ─── Base ───────────────────────────────────────────────────────────────── */
-[data-theme="light"] {
+html {
-  --od-bg:           #f2f2f5;
+  color-scheme: dark;
-  --od-surface:      #ffffff;
-  --od-surface-hi:   #e8e8ee;
-  --od-border:       #d0d0da;
-  --od-text:         #14141a;
-  --od-muted:        #6a6a78;
-  --od-accent:       #a07830;
-  --od-accent-dim:   #7a5c20;
-  --od-crit:         #c04040;
-  --od-ok:           #3aa855;
 }
 
-/* ─── Base ───────────────────────────────────────────────────────────────── */
 body {
   background-color: var(--od-bg);
   color: var(--od-text);
-  font-family: 'Inter', ui-sans-serif, system-ui, sans-serif;
+  font-family: 'Geist', 'Inter', ui-sans-serif, system-ui, sans-serif;
   -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
 }

frontend/tailwind.config.ts

@@ -1,8 +1,8 @@
 import type { Config } from 'tailwindcss';
 
-// Design system "Void" — palette custom OriginsDigital
+// Design system "Void Dark" — OriginsDigital V1
-// Les couleurs sont définies comme variables CSS dans src/styles/index.css
+// Palette validée Step 1 : fond #0a0a0a, surface #111, accent #c9a84c (or mat)
-// → thème sombre/clair géré via data-theme="dark|light" sur <html>
+// Dark only — pas de toggle en V1
 export default {
   content: ['./index.html', './src/**/*.{ts,tsx}'],
   theme: {
@@ -13,17 +13,46 @@ export default {
           surface:      'var(--od-surface)',
           'surface-hi': 'var(--od-surface-hi)',
           border:       'var(--od-border)',
+          'border-hi':  'var(--od-border-hi)',
           text:         'var(--od-text)',
           muted:        'var(--od-muted)',
           accent:       'var(--od-accent)',
           'accent-dim': 'var(--od-accent-dim)',
+          'accent-glow':'var(--od-accent-glow)',
           crit:         'var(--od-crit)',
           ok:           'var(--od-ok)',
         },
       },
       fontFamily: {
-        sans: ['Inter', 'ui-sans-serif', 'system-ui', 'sans-serif'],
+        // display : Geist — headlines H1, titres premium
-        mono: ['"JetBrains Mono"', '"Fira Code"', 'ui-monospace', 'monospace'],
+        display: ['Geist', 'Inter', 'ui-sans-serif', 'system-ui', 'sans-serif'],
+        sans:    ['Geist', 'Inter', 'ui-sans-serif', 'system-ui', 'sans-serif'],
+        mono:    ['"JetBrains Mono"', '"Fira Code"', 'ui-monospace', 'monospace'],
+      },
+      fontSize: {
+        // Densité élevée — chaque pixel justifié
+        '2xs': ['0.625rem', { lineHeight: '1rem' }],
+      },
+      borderRadius: {
+        sm: '0.25rem',
+        DEFAULT: '0.375rem',
+        md: '0.5rem',
+        lg: '0.75rem',
+      },
+      transitionDuration: {
+        DEFAULT: '150ms',
+      },
+      boxShadow: {
+        'accent-glow': '0 0 0 1px var(--od-accent-glow), 0 4px 20px var(--od-accent-glow)',
+      },
+      keyframes: {
+        'fade-in': {
+          from: { opacity: '0', transform: 'translateY(4px)' },
+          to:   { opacity: '1', transform: 'translateY(0)' },
+        },
+      },
+      animation: {
+        'fade-in': 'fade-in 150ms ease-out',
       },
     },
   },