Jalon 1: Sécurité & GDPR 🔒

Number:

6

State:

open

Due Date:

No due date

Open Issues:

3

Closed Issues:

31

Total Issues:

34

URL:

View on GitHub

Description

Débloque: 50-100 copropriétés (beta publique possible)

Issues critiques: #39 (LUKS), #40 (Backups GPG), #42 (GDPR Art 15/17), #48 (Auth forte itsme®), #43 (Hardening)

Livrables: 🔐 Données chiffrées au repos (LUKS) 💾 Backups quotidiens automatisés (GPG + S3) 📜 Conformité GDPR Articles 15 & 17 (export + effacement) 🔑 Authentification multi-facteur (itsme®) 🛡️ Security hardening (fail2ban, WAF, IDS)

Conformité légale: 40%

Conditions de déblocage: Tous les tests sécurité + GDPR passent

Effort estimé: Solo dev (10-20h/sem) = 2-3 mois | Duo (40-60h/sem) = 6-8 semaines

Issues (34)

✅ Issue #32: Rewrite E2E tests for unit_owner endpoints

State:

CLOSED

Link:

#32

✅ Issue #39: feat(infra): Implement encryption at rest (LUKS) for VPS

State:

CLOSED

Link:

#39

✅ Issue #40: feat(infra): Implement encrypted backups (GPG + S3 SSE)

State:

CLOSED

Link:

#40

✅ Issue #41: feat(infra): Deploy monitoring stack (Prometheus + Grafana + Loki)

State:

CLOSED

Link:

#41

✅ Issue #42: feat: Implement GDPR data export & deletion (Right to be forgotten)

State:

CLOSED

Link:

#42

✅ Issue #43: feat(infra): Advanced security hardening (fail2ban, WAF, IDS)

State:

CLOSED

Link:

#43

✅ Issue #55: Automate MinIO/S3 bucket bootstrap

State:

CLOSED

Link:

#55

✅ Issue #66: E2E: Admin login timeouts after user logout in GDPR tests

State:

CLOSED

Link:

#66

✅ Issue #69: Add Playwright E2E tests for unit management and document features

State:

CLOSED

Link:

#69

✅ Issue #78: feat: Security Hardening for Production (Rate limiting, 2FA, audit logs)

State:

CLOSED

Link:

#78

✅ Issue #90: feat: GDPR Complementary Articles (16, 18, 21)

State:

CLOSED

Link:

#90

✅ Issue #158: E2E tests have 200+ compilation errors after API changes

State:

CLOSED

Link:

#158

✅ Issue #207: Release 0.5.0 - Test Pyramid & Documentation Umbrella

State:

CLOSED

Link:

#207

✅ Issue #208: feat(tests): BDD step definitions for 24 new feature files (279 scenarios)

State:

CLOSED

Link:

#208

✅ Issue #209: feat(tests): Playwright expansion - 7 new frontend E2E spec files

State:

CLOSED

Link:

#209

✅ Issue #210: docs: Create missing feature documentation (6 docs + 2 READMEs)

State:

CLOSED

Link:

#210

✅ Issue #301: [Bug] Permissions rôles : boutons admin visibles pour le syndic

State:

CLOSED

Link:

#301

✅ Issue #302: [Bug] CRITIQUE : Isolation multi-tenant — données non filtrées par organization_id

State:

CLOSED

Link:

#302

✅ Issue #315: [RGPD] Art. 13-14 : Publier politique de confidentialité

State:

CLOSED

Link:

#315

✅ Issue #316: [RGPD] Art. 28 : DPA avec sous-traitants (Stripe, AWS S3, email)

State:

CLOSED

Link:

#316

✅ Issue #317: [RGPD] Art. 33 : Procédure notification violation de données (72h)

State:

CLOSED

Link:

#317

✅ Issue #326: feat(gdpr): Gestion du consentement utilisateur (GDPR Art. 7)

State:

CLOSED

Link:

#326

✅ Issue #327: feat(security): Gestion des incidents de sécurité (GDPR Art. 33 registre)

State:

CLOSED

Link:

#327

✅ Issue #328: feat(security): Gestion des clés API (API Keys CRUD + hashing SHA-256)

State:

CLOSED

Link:

#328

✅ Issue #329: feat(gdpr): Registre des traitements GDPR Art. 30

State:

CLOSED

Link:

#329

🔵 Issue #331: test(playwright): 48 fichiers E2E Playwright frontend couvrant tous les modules

State:

OPEN

Link:

#331

✅ Issue #340: fix: RBAC manquant sur 9 endpoints gamification (TODO: Check admin role)

State:

CLOSED

Link:

#340

✅ Issue #351: docs: harmoniser documentation avec état réel du code (mars 2026)

State:

CLOSED

Link:

#351

🔵 Issue #354: refactor(infra): Tests IaC manquants — terraform validate, ansible-lint, molecule, conftest ISO 27001

State:

OPEN

Link:

#354

🔵 Issue #355: refactor(infra): Restructuration IaC — repo séparé, tests, policy-as-code

State:

OPEN

Link:

#355