koprogo_api/application/use_cases/

auth_use_cases.rs

use crate::application::dto::{
    Claims, LoginRequest, LoginResponse, RefreshTokenRequest, RegisterRequest, UserResponse,
    UserRoleSummary,
};
use crate::application::error::AppError;
use crate::application::ports::{RefreshTokenRepository, UserRepository, UserRoleRepository};
use crate::domain::entities::{RefreshToken, User, UserRole, UserRoleAssignment};
use crate::infrastructure::audit::{log_audit_event, AuditEventType};
use bcrypt::{hash, verify, DEFAULT_COST};
use chrono::Utc;
use jsonwebtoken::{encode, EncodingKey, Header};
use std::sync::Arc;
use uuid::Uuid;

// ── bcrypt est du CPU bloquant, et il ne doit pas tenir un worker (#718) ───
//
// `hash` et `verify` coûtent ~1,7 s de CPU à `DEFAULT_COST` sur l'hôte
// `ecosolva` — mesuré le 2026-09-13 sur 722 appels : médiane 1,69 s,
// p90 2,02 s, max 3,84 s.
//
// Appelés SYNCHRONEMENT dans un `async fn`, ils ne rendent la main à rien
// pendant ce temps : ni à une autre requête du même worker, ni à la boucle
// d'événements. Avec `ACTIX_WORKERS` à 2, deux inscriptions simultanées
// consomment toute la capacité d'accueil pendant deux secondes ; la
// troisième requête attend, Traefik n'obtient pas de réponse, et rend 502.
//
// C'est le mécanisme de #718, et il est pire en production : la démo tourne
// avec `ACTIX_WORKERS: 1`. UNE connexion y bloque toute l'API.
//
// ── Ce que ce correctif ne fait PAS ────────────────────────────────────────
//
// Il ne baisse pas le coût bcrypt. La lenteur de bcrypt n'est pas le défaut,
// c'est sa raison d'être : elle est ce qui protège les empreintes stockées.
// Le défaut est de la subir sur un thread qui doit rester disponible.
//
// Il ne remplace pas non plus la révision d'`ACTIX_WORKERS: 1`, qui reste
// indéfendable une fois ce blocage retiré — il déplaçait seulement le seuil.
//
// L'idiome est déjà employé dans ce dépôt : `infrastructure/email.rs:248`
// enveloppe l'envoi SMTP de la même façon. Il n'avait pas été appliqué à
// l'endroit où il compte le plus.

/// Hache un mot de passe hors des threads de travail Actix (#718).
async fn hacher_hors_worker(mot_de_passe: String) -> Result<String, String> {
    tokio::task::spawn_blocking(move || hash(&mot_de_passe, DEFAULT_COST))
        .await
        .map_err(|e| format!("Hachage interrompu : {e}"))?
        .map_err(|e| format!("Failed to hash password: {e}"))
}

/// Vérifie un mot de passe hors des threads de travail Actix (#718).
///
/// Rend `AppError` et non `BcryptError` à dessein. Un `spawn_blocking`
/// interrompu n'est PAS une empreinte invalide, et `BcryptError` n'a aucune
/// variante pour le dire — sa seule variante à message porte un
/// `&'static str`. Le forcer dans `InvalidHash` ferait rendre « identifiants
/// invalides » sur un incident de runtime, et enverrait l'utilisateur
/// chercher un défaut de mot de passe qui n'existe pas.
async fn verifier_hors_worker(mot_de_passe: String, empreinte: String) -> Result<bool, AppError> {
    tokio::task::spawn_blocking(move || verify(&mot_de_passe, &empreinte))
        .await
        .map_err(|e| AppError::Internal(format!("Vérification du mot de passe interrompue : {e}")))?
        .map_err(AppError::from)
}

pub struct AuthUseCases {
    user_repo: Arc<dyn UserRepository>,
    refresh_token_repo: Arc<dyn RefreshTokenRepository>,
    user_role_repo: Arc<dyn UserRoleRepository>,
    jwt_secret: String,
}

impl AuthUseCases {
    pub fn new(
        user_repo: Arc<dyn UserRepository>,
        refresh_token_repo: Arc<dyn RefreshTokenRepository>,
        user_role_repo: Arc<dyn UserRoleRepository>,
        jwt_secret: String,
    ) -> Self {
        Self {
            user_repo,
            refresh_token_repo,
            user_role_repo,
            jwt_secret,
        }
    }

    pub async fn login(&self, request: LoginRequest) -> Result<LoginResponse, AppError> {
        // Emails sont stockés normalisés (lowercase, cf. `User::new`) — la
        // recherche doit l'être aussi, sinon un login avec une casse
        // différente de celle saisie à l'inscription échoue à tort en
        // "Invalid credentials" (trouvé en investiguant #617 C4).
        let normalized_email = request.email.trim().to_lowercase();
        let user = self
            .user_repo
            .find_by_email(&normalized_email)
            .await?
            .ok_or_else(|| {
                // Audit failed login attempt
                tokio::spawn(async move {
                    log_audit_event(
                        AuditEventType::AuthenticationFailed,
                        None,
                        None,
                        Some(format!("Failed login attempt for email: {}", request.email)),
                        None,
                    )
                    .await;
                });
                // Uniform InvalidCredentials prevents username enumeration.
                AppError::InvalidCredentials
            })?;

        if !user.is_active {
            // Audit login attempt on deactivated account
            let user_id = user.id;
            tokio::spawn(async move {
                log_audit_event(
                    AuditEventType::AuthenticationFailed,
                    Some(user_id),
                    None,
                    Some("Login attempt on deactivated account".to_string()),
                    None,
                )
                .await;
            });
            return Err(AppError::AccountDeactivated);
        }

        // Hors worker : bcrypt bloque ~1,7 s (#718).
        let is_valid =
            verifier_hors_worker(request.password.clone(), user.password_hash.clone()).await?;

        if !is_valid {
            // Audit failed password verification
            let user_id = user.id;
            tokio::spawn(async move {
                log_audit_event(
                    AuditEventType::AuthenticationFailed,
                    Some(user_id),
                    None,
                    Some("Invalid password".to_string()),
                    None,
                )
                .await;
            });
            return Err(AppError::InvalidCredentials);
        }

        let (roles, active_role) = self.ensure_role_assignments(&user).await?;
        let user_for_token = self.apply_active_role_metadata(&user, &active_role).await?;
        let token = self.generate_token(&user_for_token, &active_role)?;

        let refresh_token_string = self.generate_refresh_token_string(&user_for_token);
        let refresh_token = RefreshToken::new(user_for_token.id, refresh_token_string.clone());
        self.refresh_token_repo.create(&refresh_token).await?;

        // Audit successful login
        let user_id = user_for_token.id;
        let organization_id = active_role.organization_id;
        tokio::spawn(async move {
            log_audit_event(
                AuditEventType::UserLogin,
                Some(user_id),
                organization_id,
                Some("Successful login".to_string()),
                None,
            )
            .await;
        });

        Ok(LoginResponse {
            token,
            refresh_token: refresh_token_string,
            user: self.build_user_response(&user_for_token, &roles, &active_role),
        })
    }

    pub async fn register(&self, request: RegisterRequest) -> Result<LoginResponse, String> {
        // Même normalisation que `User::new` (stockage lowercase) — sinon un
        // doublon de casse ("Test@x.com" après "test@x.com") échappe au
        // check applicatif et remonte comme erreur DB brute au lieu d'un
        // "Email already exists" propre (trouvé en investiguant #617 C4).
        let normalized_email = request.email.trim().to_lowercase();
        if (self.user_repo.find_by_email(&normalized_email).await?).is_some() {
            return Err("Email already exists".to_string());
        }

        let role: UserRole = request
            .role
            .parse()
            .map_err(|e| format!("Invalid role: {}", e))?;

        // Hors worker : bcrypt bloque ~1,7 s (#718).
        let password_hash = hacher_hors_worker(request.password.clone()).await?;

        let user = User::new(
            request.email,
            password_hash,
            request.first_name,
            request.last_name,
            role.clone(),
            request.organization_id,
        )?;

        let created_user = self.user_repo.create(&user).await?;

        // Create primary role assignment
        let primary_assignment = self
            .user_role_repo
            .create(&UserRoleAssignment::new(
                created_user.id,
                role,
                created_user.organization_id,
                true,
            ))
            .await?;
        let roles = vec![primary_assignment.clone()];
        let user_for_token = self
            .apply_active_role_metadata(&created_user, &primary_assignment)
            .await?;

        let token = self.generate_token(&user_for_token, &primary_assignment)?;
        let refresh_token_string = self.generate_refresh_token_string(&user_for_token);
        let refresh_token = RefreshToken::new(user_for_token.id, refresh_token_string.clone());
        self.refresh_token_repo.create(&refresh_token).await?;

        // Audit successful registration
        let user_id = created_user.id;
        let organization_id = created_user.organization_id;
        let email = created_user.email.clone();
        tokio::spawn(async move {
            log_audit_event(
                AuditEventType::UserRegistration,
                Some(user_id),
                organization_id,
                Some(format!("New user registered: {}", email)),
                None,
            )
            .await;
        });

        Ok(LoginResponse {
            token,
            refresh_token: refresh_token_string,
            user: self.build_user_response(&user_for_token, &roles, &primary_assignment),
        })
    }

    pub async fn switch_active_role(
        &self,
        user_id: Uuid,
        role_id: Uuid,
    ) -> Result<LoginResponse, String> {
        let user = self
            .user_repo
            .find_by_id(user_id)
            .await?
            .ok_or("User not found")?;

        if !user.is_active {
            return Err("User account is deactivated".to_string());
        }

        let target_role = self
            .user_role_repo
            .find_by_id(role_id)
            .await?
            .ok_or("Role assignment not found")?;

        if target_role.user_id != user.id {
            return Err("Role assignment does not belong to user".to_string());
        }

        let updated_primary = self
            .user_role_repo
            .set_primary_role(user.id, role_id)
            .await?;

        let roles = self.user_role_repo.list_for_user(user.id).await?;
        let active_role = roles
            .iter()
            .find(|assignment| assignment.is_primary)
            .cloned()
            .unwrap_or(updated_primary.clone());

        let updated_user = self.apply_active_role_metadata(&user, &active_role).await?;

        let token = self.generate_token(&updated_user, &active_role)?;
        let refresh_token_string = self.generate_refresh_token_string(&updated_user);
        let refresh_token = RefreshToken::new(updated_user.id, refresh_token_string.clone());
        self.refresh_token_repo.create(&refresh_token).await?;

        Ok(LoginResponse {
            token,
            refresh_token: refresh_token_string,
            user: self.build_user_response(&updated_user, &roles, &active_role),
        })
    }

    pub async fn get_user_by_id(&self, user_id: uuid::Uuid) -> Result<UserResponse, AppError> {
        let user = self
            .user_repo
            .find_by_id(user_id)
            .await?
            .ok_or_else(|| AppError::NotFound(format!("user {}", user_id)))?;

        let (roles, active_role) = self.ensure_role_assignments(&user).await?;
        Ok(self.build_user_response(&user, &roles, &active_role))
    }

    pub fn verify_token(&self, token: &str) -> Result<Claims, AppError> {
        use jsonwebtoken::{decode, DecodingKey, Validation};

        let token_data = decode::<Claims>(
            token,
            &DecodingKey::from_secret(self.jwt_secret.as_bytes()),
            &Validation::default(),
        )?;

        Ok(token_data.claims)
    }

    pub async fn refresh_token(
        &self,
        request: RefreshTokenRequest,
    ) -> Result<LoginResponse, AppError> {
        let refresh_token = self
            .refresh_token_repo
            .find_by_token(&request.refresh_token)
            .await?
            .ok_or_else(|| {
                // Audit invalid refresh token attempt
                tokio::spawn(async {
                    log_audit_event(
                        AuditEventType::InvalidToken,
                        None,
                        None,
                        Some("Invalid refresh token attempted".to_string()),
                        None,
                    )
                    .await;
                });
                AppError::TokenError("invalid refresh token".to_string())
            })?;

        if !refresh_token.is_valid() {
            // Audit expired/revoked token attempt
            let user_id = refresh_token.user_id;
            let reason = if refresh_token.is_expired() {
                "Expired refresh token"
            } else {
                "Revoked refresh token"
            };
            tokio::spawn(async move {
                log_audit_event(
                    AuditEventType::InvalidToken,
                    Some(user_id),
                    None,
                    Some(format!("{} attempted", reason)),
                    None,
                )
                .await;
            });
            return Err(AppError::TokenError(
                "refresh token expired or revoked".to_string(),
            ));
        }

        let user = self
            .user_repo
            .find_by_id(refresh_token.user_id)
            .await?
            .ok_or_else(|| AppError::NotFound("user for refresh token".to_string()))?;

        if !user.is_active {
            // Audit refresh attempt on deactivated account
            let user_id = user.id;
            tokio::spawn(async move {
                log_audit_event(
                    AuditEventType::AuthenticationFailed,
                    Some(user_id),
                    None,
                    Some("Refresh token attempt on deactivated account".to_string()),
                    None,
                )
                .await;
            });
            return Err(AppError::AccountDeactivated);
        }

        let (roles, active_role) = self.ensure_role_assignments(&user).await?;
        let user_for_token = self.apply_active_role_metadata(&user, &active_role).await?;
        let token = self.generate_token(&user_for_token, &active_role)?;

        // Revoke old token (refresh token rotation)
        self.refresh_token_repo
            .revoke(&request.refresh_token)
            .await?;

        let new_refresh_token_string = self.generate_refresh_token_string(&user_for_token);
        let new_refresh_token =
            RefreshToken::new(user_for_token.id, new_refresh_token_string.clone());
        self.refresh_token_repo.create(&new_refresh_token).await?;

        // Audit successful token refresh
        let user_id = user_for_token.id;
        let organization_id = active_role.organization_id;
        tokio::spawn(async move {
            log_audit_event(
                AuditEventType::TokenRefresh,
                Some(user_id),
                organization_id,
                Some("Refresh token successfully exchanged".to_string()),
                None,
            )
            .await;
        });

        Ok(LoginResponse {
            token,
            refresh_token: new_refresh_token_string,
            user: self.build_user_response(&user_for_token, &roles, &active_role),
        })
    }

    pub async fn revoke_all_refresh_tokens(&self, user_id: Uuid) -> Result<u64, String> {
        self.refresh_token_repo.revoke_all_for_user(user_id).await
    }

    fn build_user_response(
        &self,
        user: &User,
        roles: &[UserRoleAssignment],
        active_role: &UserRoleAssignment,
    ) -> UserResponse {
        UserResponse {
            id: user.id,
            email: user.email.clone(),
            first_name: user.first_name.clone(),
            last_name: user.last_name.clone(),
            role: active_role.role.to_string(),
            organization_id: active_role.organization_id,
            is_active: user.is_active,
            created_at: user.created_at,
            roles: roles.iter().map(Self::summarize_role).collect(),
            active_role: Some(Self::summarize_role(active_role)),
        }
    }

    async fn ensure_role_assignments(
        &self,
        user: &User,
    ) -> Result<(Vec<UserRoleAssignment>, UserRoleAssignment), String> {
        let mut assignments = self.user_role_repo.list_for_user(user.id).await?;

        if assignments.is_empty() {
            let assignment = self
                .user_role_repo
                .create(&UserRoleAssignment::new(
                    user.id,
                    user.role.clone(),
                    user.organization_id,
                    true,
                ))
                .await?;
            assignments.push(assignment.clone());
        }

        if !assignments.iter().any(|assignment| assignment.is_primary) {
            let first = assignments[0].id;
            self.user_role_repo.set_primary_role(user.id, first).await?;
            assignments = self.user_role_repo.list_for_user(user.id).await?;
        }

        let active = assignments
            .iter()
            .find(|assignment| assignment.is_primary)
            .cloned()
            .unwrap_or_else(|| assignments[0].clone());

        Ok((assignments, active))
    }

    async fn apply_active_role_metadata(
        &self,
        user: &User,
        active_role: &UserRoleAssignment,
    ) -> Result<User, String> {
        let mut updated_user = user.clone();
        let mut requires_update = false;

        if updated_user.role != active_role.role {
            updated_user.role = active_role.role.clone();
            requires_update = true;
        }

        if updated_user.organization_id != active_role.organization_id {
            updated_user.organization_id = active_role.organization_id;
            requires_update = true;
        }

        if requires_update {
            updated_user.updated_at = Utc::now();
            return self.user_repo.update(&updated_user).await;
        }

        Ok(updated_user)
    }

    fn summarize_role(assignment: &UserRoleAssignment) -> UserRoleSummary {
        UserRoleSummary {
            id: assignment.id,
            role: assignment.role.to_string(),
            organization_id: assignment.organization_id,
            is_primary: assignment.is_primary,
        }
    }

    fn generate_token(
        &self,
        user: &User,
        active_role: &UserRoleAssignment,
    ) -> Result<String, String> {
        let now = Utc::now().timestamp();
        let expiration = now + (15 * 60);

        let claims = Claims {
            sub: user.id.to_string(),
            email: user.email.clone(),
            role: active_role.role.to_string(),
            organization_id: active_role.organization_id,
            role_id: Some(active_role.id),
            exp: expiration,
            iat: now,
        };

        encode(
            &Header::default(),
            &claims,
            &EncodingKey::from_secret(self.jwt_secret.as_bytes()),
        )
        .map_err(|e| format!("Failed to generate token: {}", e))
    }

    fn generate_refresh_token_string(&self, user: &User) -> String {
        let now = Utc::now().timestamp();
        format!("{}:{}:{}", user.id, now, uuid::Uuid::new_v4())
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::application::ports::{RefreshTokenRepository, UserRoleRepository};
    use crate::domain::entities::{RefreshToken, User, UserRole, UserRoleAssignment};
    use async_trait::async_trait;
    use mockall::mock;
    use std::sync::Arc;

    // Re-use the existing MockUserRepo from the user_repository port
    use crate::application::ports::user_repository::MockUserRepo;

    // Create mock for RefreshTokenRepository (not defined elsewhere)
    mock! {
        pub RefreshTokenRepo {}

        #[async_trait]
        impl RefreshTokenRepository for RefreshTokenRepo {
            async fn create(&self, refresh_token: &RefreshToken) -> Result<RefreshToken, String>;
            async fn find_by_token(&self, token: &str) -> Result<Option<RefreshToken>, String>;
            async fn find_by_user_id(&self, user_id: Uuid) -> Result<Vec<RefreshToken>, String>;
            async fn revoke(&self, token: &str) -> Result<bool, String>;
            async fn revoke_all_for_user(&self, user_id: Uuid) -> Result<u64, String>;
            async fn delete_expired(&self) -> Result<u64, String>;
        }
    }

    // Create mock for UserRoleRepository (not defined elsewhere)
    mock! {
        pub UserRoleRepo {}

        #[async_trait]
        impl UserRoleRepository for UserRoleRepo {
            async fn create(&self, assignment: &UserRoleAssignment) -> Result<UserRoleAssignment, String>;
            async fn list_for_user(&self, user_id: Uuid) -> Result<Vec<UserRoleAssignment>, String>;
            async fn list_for_users(&self, user_ids: &[Uuid]) -> Result<std::collections::HashMap<Uuid, Vec<UserRoleAssignment>>, String>;
            async fn replace_all(&self, user_id: Uuid, assignments: &[UserRoleAssignment]) -> Result<(), String>;
            async fn find_by_id(&self, id: Uuid) -> Result<Option<UserRoleAssignment>, String>;
            async fn set_primary_role(&self, user_id: Uuid, role_id: Uuid) -> Result<UserRoleAssignment, String>;
            async fn delete_by_id(&self, id: Uuid) -> Result<bool, String>;
        }
    }

    const TEST_JWT_SECRET: &str = "test-secret-key-that-is-long-enough-for-jwt";

    /// Helper: create a valid active User with a bcrypt-hashed password.
    fn make_user(email: &str, password: &str, org_id: Option<Uuid>) -> User {
        let hash = bcrypt::hash(password, 4).expect("bcrypt hash");
        User::new(
            email.to_string(),
            hash,
            "Test".to_string(),
            "User".to_string(),
            UserRole::Syndic,
            org_id,
        )
        .expect("valid user")
    }

    /// Helper: create a UserRoleAssignment marked as primary for a given user.
    fn make_primary_role(user_id: Uuid, org_id: Option<Uuid>) -> UserRoleAssignment {
        UserRoleAssignment::new(user_id, UserRole::Syndic, org_id, true)
    }

    /// Build an AuthUseCases from the three mocks.
    fn build_use_cases(
        user_repo: MockUserRepo,
        refresh_repo: MockRefreshTokenRepo,
        role_repo: MockUserRoleRepo,
    ) -> AuthUseCases {
        AuthUseCases::new(
            Arc::new(user_repo),
            Arc::new(refresh_repo),
            Arc::new(role_repo),
            TEST_JWT_SECRET.to_string(),
        )
    }

    // ── 1. login success ────────────────────────────────────────────────

    #[tokio::test]
    async fn test_login_success() {
        let org_id = Some(Uuid::new_v4());
        let user = make_user("login@example.com", "password123", org_id);
        let user_clone = user.clone();
        let _user_for_update = user.clone();
        let role = make_primary_role(user.id, org_id);
        let role_clone = role.clone();

        let mut user_repo = MockUserRepo::new();
        user_repo
            .expect_find_by_email()
            .withf(|e| e == "login@example.com")
            .returning(move |_| Ok(Some(user_clone.clone())));
        user_repo.expect_update().returning(move |u| Ok(u.clone()));

        let mut refresh_repo = MockRefreshTokenRepo::new();
        refresh_repo.expect_create().returning(|rt| Ok(rt.clone()));

        let mut role_repo = MockUserRoleRepo::new();
        role_repo
            .expect_list_for_user()
            .returning(move |_| Ok(vec![role_clone.clone()]));

        let uc = build_use_cases(user_repo, refresh_repo, role_repo);

        let result = uc
            .login(LoginRequest {
                email: "login@example.com".to_string(),
                password: "password123".to_string(),
            })
            .await;

        assert!(result.is_ok(), "login should succeed: {:?}", result.err());
        let response = result.unwrap();
        assert!(!response.token.is_empty());
        assert!(!response.refresh_token.is_empty());
        assert_eq!(response.user.email, "login@example.com");
        assert!(response.user.is_active);
    }

    // ── 2. login — user not found ───────────────────────────────────────

    #[tokio::test]
    async fn test_login_invalid_email() {
        let mut user_repo = MockUserRepo::new();
        user_repo.expect_find_by_email().returning(|_| Ok(None));

        let uc = build_use_cases(
            user_repo,
            MockRefreshTokenRepo::new(),
            MockUserRoleRepo::new(),
        );

        let result = uc
            .login(LoginRequest {
                email: "nonexistent@example.com".to_string(),
                password: "whatever".to_string(),
            })
            .await;

        // @security : doit être InvalidCredentials (uniforme avec wrong password
        // pour ne pas leaker l'existence du compte).
        assert!(
            matches!(result, Err(AppError::InvalidCredentials)),
            "expected AppError::InvalidCredentials, got {:?}",
            result
        );
    }

    // ── 3. login — wrong password ───────────────────────────────────────

    #[tokio::test]
    async fn test_login_invalid_password() {
        let user = make_user("user@example.com", "correct_password", None);
        let user_clone = user.clone();

        let mut user_repo = MockUserRepo::new();
        user_repo
            .expect_find_by_email()
            .returning(move |_| Ok(Some(user_clone.clone())));

        let uc = build_use_cases(
            user_repo,
            MockRefreshTokenRepo::new(),
            MockUserRoleRepo::new(),
        );

        let result = uc
            .login(LoginRequest {
                email: "user@example.com".to_string(),
                password: "wrong_password".to_string(),
            })
            .await;

        // @security : InvalidCredentials uniforme (anti-énumération).
        assert!(
            matches!(result, Err(AppError::InvalidCredentials)),
            "expected AppError::InvalidCredentials, got {:?}",
            result
        );
    }

    // ── 4. login — deactivated account ──────────────────────────────────

    #[tokio::test]
    async fn test_login_deactivated_account() {
        let mut user = make_user("deactivated@example.com", "password123", None);
        user.deactivate();
        let user_clone = user.clone();

        let mut user_repo = MockUserRepo::new();
        user_repo
            .expect_find_by_email()
            .returning(move |_| Ok(Some(user_clone.clone())));

        let uc = build_use_cases(
            user_repo,
            MockRefreshTokenRepo::new(),
            MockUserRoleRepo::new(),
        );

        let result = uc
            .login(LoginRequest {
                email: "deactivated@example.com".to_string(),
                password: "password123".to_string(),
            })
            .await;

        // @security : AccountDeactivated → 403 Forbidden (cf. AppError::status_code).
        // Note: déballer cette info VS uniforme InvalidCredentials est un trade-off
        // sécurité (énumération potentielle). À reconsidérer en RFC dédié.
        assert!(
            matches!(result, Err(AppError::AccountDeactivated)),
            "expected AppError::AccountDeactivated, got {:?}",
            result
        );
    }

    // ── 5. register success ─────────────────────────────────────────────

    #[tokio::test]
    async fn test_register_success() {
        let mut user_repo = MockUserRepo::new();
        user_repo.expect_find_by_email().returning(|_| Ok(None)); // email not taken
        user_repo.expect_create().returning(|u| Ok(u.clone()));
        user_repo.expect_update().returning(|u| Ok(u.clone()));

        let mut refresh_repo = MockRefreshTokenRepo::new();
        refresh_repo.expect_create().returning(|rt| Ok(rt.clone()));

        let mut role_repo = MockUserRoleRepo::new();
        role_repo.expect_create().returning(|a| Ok(a.clone()));

        let uc = build_use_cases(user_repo, refresh_repo, role_repo);

        let result = uc
            .register(RegisterRequest {
                email: "new@example.com".to_string(),
                password: "password123".to_string(),
                first_name: "Alice".to_string(),
                last_name: "Dupont".to_string(),
                role: "syndic".to_string(),
                organization_id: None,
            })
            .await;

        assert!(
            result.is_ok(),
            "register should succeed: {:?}",
            result.err()
        );
        let response = result.unwrap();
        assert!(!response.token.is_empty());
        assert_eq!(response.user.email, "new@example.com");
        assert_eq!(response.user.first_name, "Alice");
    }

    // ── 6. register — duplicate email ───────────────────────────────────

    #[tokio::test]
    async fn test_register_duplicate_email() {
        let existing = make_user("taken@example.com", "pw123456", None);
        let existing_clone = existing.clone();

        let mut user_repo = MockUserRepo::new();
        user_repo
            .expect_find_by_email()
            .returning(move |_| Ok(Some(existing_clone.clone())));

        let uc = build_use_cases(
            user_repo,
            MockRefreshTokenRepo::new(),
            MockUserRoleRepo::new(),
        );

        let result = uc
            .register(RegisterRequest {
                email: "taken@example.com".to_string(),
                password: "password123".to_string(),
                first_name: "Bob".to_string(),
                last_name: "Martin".to_string(),
                role: "owner".to_string(),
                organization_id: None,
            })
            .await;

        assert!(result.is_err());
        assert_eq!(result.unwrap_err(), "Email already exists");
    }

    // ── 7. switch_active_role success ───────────────────────────────────

    #[tokio::test]
    async fn test_switch_role_success() {
        let org_id = Some(Uuid::new_v4());
        let user = make_user("multi@example.com", "password123", org_id);
        let user_clone = user.clone();

        // The target role that we want to switch to
        let target_role = UserRoleAssignment::new(user.id, UserRole::Accountant, org_id, false);
        let target_role_id = target_role.id;
        let target_clone = target_role.clone();

        // After switching, the target role becomes primary
        let mut switched_role = target_role.clone();
        switched_role.is_primary = true;
        let switched_clone = switched_role.clone();
        let switched_for_list = switched_role.clone();

        let mut user_repo = MockUserRepo::new();
        user_repo
            .expect_find_by_id()
            .returning(move |_| Ok(Some(user_clone.clone())));
        user_repo.expect_update().returning(|u| Ok(u.clone()));

        let mut refresh_repo = MockRefreshTokenRepo::new();
        refresh_repo.expect_create().returning(|rt| Ok(rt.clone()));

        let mut role_repo = MockUserRoleRepo::new();
        role_repo
            .expect_find_by_id()
            .returning(move |_| Ok(Some(target_clone.clone())));
        role_repo
            .expect_set_primary_role()
            .returning(move |_, _| Ok(switched_clone.clone()));
        role_repo
            .expect_list_for_user()
            .returning(move |_| Ok(vec![switched_for_list.clone()]));

        let uc = build_use_cases(user_repo, refresh_repo, role_repo);

        let result = uc.switch_active_role(user.id, target_role_id).await;

        assert!(
            result.is_ok(),
            "switch_role should succeed: {:?}",
            result.err()
        );
        let response = result.unwrap();
        assert!(!response.token.is_empty());
        assert_eq!(response.user.role, "accountant");
    }

    // ── 8. switch_active_role — role not found ──────────────────────────

    #[tokio::test]
    async fn test_switch_role_not_found() {
        let user = make_user("user@example.com", "password123", None);
        let user_clone = user.clone();

        let mut user_repo = MockUserRepo::new();
        user_repo
            .expect_find_by_id()
            .returning(move |_| Ok(Some(user_clone.clone())));

        let mut role_repo = MockUserRoleRepo::new();
        role_repo.expect_find_by_id().returning(|_| Ok(None)); // role not found

        let uc = build_use_cases(user_repo, MockRefreshTokenRepo::new(), role_repo);

        let result = uc.switch_active_role(user.id, Uuid::new_v4()).await;

        assert!(result.is_err());
        assert_eq!(result.unwrap_err(), "Role assignment not found");
    }

    // ── 9. verify_token — valid token ───────────────────────────────────

    #[tokio::test]
    async fn test_verify_token_valid() {
        let org_id = Some(Uuid::new_v4());
        let user = make_user("verify@example.com", "password123", org_id);
        let role = make_primary_role(user.id, org_id);

        let uc = build_use_cases(
            MockUserRepo::new(),
            MockRefreshTokenRepo::new(),
            MockUserRoleRepo::new(),
        );

        // Generate a token using the same secret
        let token = uc.generate_token(&user, &role).expect("token generation");

        let claims = uc.verify_token(&token);
        assert!(claims.is_ok(), "verify should succeed: {:?}", claims.err());
        let claims = claims.unwrap();
        assert_eq!(claims.sub, user.id.to_string());
        assert_eq!(claims.email, "verify@example.com");
        assert_eq!(claims.role, "syndic");
        assert_eq!(claims.organization_id, org_id);
    }

    // ── 10. verify_token — invalid token ────────────────────────────────

    #[tokio::test]
    async fn test_verify_token_invalid() {
        let uc = build_use_cases(
            MockUserRepo::new(),
            MockRefreshTokenRepo::new(),
            MockUserRoleRepo::new(),
        );

        let result = uc.verify_token("this.is.not.a.valid.jwt");
        // @negative : token invalide → AppError::TokenError (mappé 401 par ResponseError).
        assert!(
            matches!(result, Err(AppError::TokenError(_))),
            "expected AppError::TokenError, got {:?}",
            result
        );
    }

    // ── 11. revoke_all_refresh_tokens ───────────────────────────────────

    #[tokio::test]
    async fn test_revoke_all_refresh_tokens() {
        let user_id = Uuid::new_v4();

        let mut refresh_repo = MockRefreshTokenRepo::new();
        refresh_repo
            .expect_revoke_all_for_user()
            .withf(move |id| *id == user_id)
            .returning(|_| Ok(3));

        let uc = build_use_cases(MockUserRepo::new(), refresh_repo, MockUserRoleRepo::new());

        let result = uc.revoke_all_refresh_tokens(user_id).await;
        assert!(result.is_ok());
        assert_eq!(result.unwrap(), 3);
    }
    // ── 12. bcrypt ne tient pas un thread de travail (#718) ──────────────

    /// Témoin de rougeur pour #718, et il est DÉTERMINISTE.
    ///
    /// ── Pourquoi pas un chronomètre ───────────────────────────────────────
    ///
    /// La tentation était de mesurer que N hachages concurrents durent moins
    /// que N fois un hachage seul. Sur un hôte qui porte trente conteneurs,
    /// une telle assertion clignote, et un test qui clignote finit désactivé
    /// — c'est ainsi que le blocage a survécu jusqu'ici.
    ///
    /// ── Ce que ce test exploite ───────────────────────────────────────────
    ///
    /// Un runtime `current_thread` n'a QU'UN seul thread pour les tâches
    /// asynchrones. Une tâche témoin qui rend la main (`yield_now`) ne
    /// progresse donc que si le hachage libère ce thread.
    ///
    /// - `hash()` appelé directement : le thread est tenu pendant ~1,7 s, la
    ///   témoin n'est jamais replanifiée, le compteur reste à **0**.
    /// - `hacher_hors_worker()` : le hachage part sur le pool bloquant, le
    ///   `.await` rend la main, la témoin tourne, le compteur est **> 0**.
    ///
    /// Aucune durée n'est assertée. Le test dit « la boucle a-t-elle
    /// avancé », pas « a-t-elle avancé assez vite ».
    #[tokio::test(flavor = "current_thread")]
    async fn le_hachage_ne_retient_pas_la_boucle_devenements() {
        use std::sync::atomic::{AtomicUsize, Ordering};
        use std::sync::Arc as StdArc;

        let tours = StdArc::new(AtomicUsize::new(0));
        let compteur = tours.clone();

        let temoin = tokio::spawn(async move {
            // Borne haute : sans elle, un correctif régressé ferait pendre le
            // test au lieu de le faire échouer, et un test pendu se lit comme
            // une lenteur d'infrastructure.
            for _ in 0..100_000 {
                compteur.fetch_add(1, Ordering::Relaxed);
                tokio::task::yield_now().await;
            }
        });

        let empreinte = hacher_hors_worker("mot-de-passe-temoin".to_string())
            .await
            .expect("le hachage doit réussir");

        let avances = tours.load(Ordering::Relaxed);
        temoin.abort();

        assert!(
            avances > 0,
            "La tâche témoin n'a pas avancé d'un seul tour pendant le hachage : \
             bcrypt tient le thread de travail (#718). Sur un runtime à un \
             thread, c'est exactement ce qui fait rendre 502 à Traefik quand \
             une deuxième requête arrive."
        );

        // Et la vérification aussi, par le même chemin.
        let compteur2 = StdArc::new(AtomicUsize::new(0));
        let c2 = compteur2.clone();
        let temoin2 = tokio::spawn(async move {
            for _ in 0..100_000 {
                c2.fetch_add(1, Ordering::Relaxed);
                tokio::task::yield_now().await;
            }
        });

        let valide = verifier_hors_worker("mot-de-passe-temoin".to_string(), empreinte)
            .await
            .expect("la vérification doit réussir");
        let avances2 = compteur2.load(Ordering::Relaxed);
        temoin2.abort();

        assert!(valide, "l'empreinte fraîchement produite doit se vérifier");
        assert!(
            avances2 > 0,
            "La tâche témoin n'a pas avancé pendant la vérification : \
             `verify` tient le thread de travail (#718). Le login est le \
             chemin le plus chaud du produit."
        );
    }
}