Release: promote develop to main (catch up 101 commits, last release 2026-07-02)

.claude/shared-rules.md

@@ -0,0 +1,44 @@
+# Shared project rules
+
+These rules apply to **all three repos** (`be`, `fe`, `sdk`). This file is synced from the
+org `.github` repo — do not edit it inside a downstream repo; change it at the source and let
+the sync open a PR. Repo-specific rules live below the import in each repo's own `CLAUDE.md`.
+
+## API changes go through the SDK contract first
+
+The `sdk` is the single source of truth for the API contract. Any change to the API surface
+(endpoints, request/response shapes, types, error codes) **MUST** follow this order:
+
+1. Define or update the contract in the `sdk` repo first.
+2. Publish the new SDK version to npm.
+3. Only then update `be` and `fe` to consume the change.
+
+**IMPORTANT:** `be` and `fe` MUST depend on the SDK as published on **npmjs.com** — never on the
+local `sdk` checkout or a sibling folder. Do not use `file:../sdk`, `npm link`, workspace or
+`link:` references, or any other local linking for the SDK dependency. Pin to a version that is
+actually published. If the version you need isn't on npmjs.com yet, the work is **not ready** to
+land in `be`/`fe` — finish and publish the SDK first.
+
+Do not implement or "stub" an API change in `be` or `fe` ahead of the contract. If the contract is
+missing, wrong, or incomplete, fix it in `sdk` and publish — never work around it locally.
+
+Allways make sure all API related issues are based on the latest dependency "need4deed-sdk".
+
+## Reuse before you create
+
+Before adding any new util, helper, hook, component, or shared function, **first search** the
+codebase (and the SDK) for something that already does the job. Prefer reusing or extending
+existing code over writing a near-duplicate. If nothing fits and you must add a new one, state
+briefly why the existing options didn't work.
+
+## Be conservative with database schema changes
+
+Before altering the database schema:
+
+- Confirm the change is **absolutely necessary** and cannot reasonably be solved without touching
+  the schema.
+- Confirm it is **semantically correct** — names and structure must match existing modeling
+  conventions and clearly express what the data represents.
+
+Surface the proposed change and your reasoning *before* writing a migration. Schema changes are
+deliberate decisions, not incidental side effects of a feature.

.env.example

@@ -1,13 +1,36 @@
-# Transactional email via Brevo. EMAIL_FROM is the from address and must be a
-# verified sender/domain in Brevo.
+# Verification emails (email-verification, password-reset) — Infomaniak SMTP account #1.
 EMAIL_FROM=no-reply@need4deed.org
-BREVO_API_KEY=fake-string
+SMTP_HOST=mail.infomaniak.com
+SMTP_PORT=587
+SMTP_USER=no-reply@need4deed.org
+SMTP_PASS=fake-string
+
+# Notification emails (cron scans, status-change triggers) — Infomaniak SMTP account #2.
+# Infomaniak does not allow multiple senders on one SMTP account, hence the split.
+EMAIL_FROM_NOTIFY=coordinators@need4deed.org
+SMTP_NOTIFY_HOST=mail.infomaniak.com
+SMTP_NOTIFY_PORT=587
+SMTP_NOTIFY_USER=coordinators@need4deed.org
+SMTP_NOTIFY_PASS=fake-string
+
 # Verification email content is read from a per-locale CDN manifest
 # (${CDN_BASE_URL}emails/verification.json), cached in-memory; falls back to
 # built-in copy. Optional tuning:
 EMAIL_TEMPLATE_TTL_MS=600000
 EMAIL_TEMPLATE_FETCH_TIMEOUT_MS=5000
 
+# Sender addresses for outbound notification emails (fall back to these defaults if unset).
+# EMAIL_FROM_NOTIFY is the SMTP account used as `from` on all 8 notification triggers.
+EMAIL_FROM_NOTIFY=coordinators@need4deed.org
+EMAIL_FROM_VOLUNTEER=volunteer@need4deed.org
+EMAIL_FROM_CONTACT=contact@need4deed.org
+EMAIL_FROM_ACCOMPANYING=accompanying@need4deed.org
+
+# Notification controls (default: dry-run on in non-prod, cron active)
+# NOTIFY_DRY_RUN=true        — redirect all emails to test@need4deed.org with [TO: <original>] subject prefix
+# NOTIFY_EMAIL_DRY_RUN=true  — same, email-only override
+# NOTIFY_CRON_MUTED=true     — suppress cron-triggered email scans entirely
+
 CORS_ORIGINS=http://localhost:3000,http://localhost:3100,http://localhost:3200
 CORS_CREDENTIALS=true
 

.github/workflows/build-bootstrap.yaml

@@ -0,0 +1,32 @@
+name: build-bootstrap
+
+on:
+  push:
+    branches: [develop]
+    paths:
+      - data-bootstrap/**
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push bootstrap image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: data-bootstrap/Dockerfile
+          push: true
+          tags: ghcr.io/need4deed-org/bootstrap:latest

.github/workflows/deploy-aits.yaml

@@ -0,0 +1,37 @@
+name: deploy-aits
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/need4deed-org/be:develop
+
+      - name: Roll out new image on AITS
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.AITS_HOST }}
+          username: ubuntu
+          key: ${{ secrets.AITS_SSH_KEY }}
+          script: kubectl rollout restart deployment/be -n n4d-dev

.gitignore

@@ -1,3 +1,6 @@
+# raw database dump — contains real PII, never commit
+data-bootstrap/dev.dump.sql
+
 .idea/
 .vscode/
 node_modules/

CLAUDE.md

@@ -1,3 +1,5 @@
+@.claude/shared-rules.md
+
 # CLAUDE.md
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
@@ -163,7 +165,8 @@ Copy `.env.example` to `.env` and fill in real values. Key variables:
 - `JWT_SECRET` — required; server refuses to start without it
 - `NODE_ENV` — `development` | `test` | `production`
 - `RUN_MIGRATIONS` — when truthy, auto-run pending migrations on server startup (always on in prod regardless of this flag); see Commands section
-- `EMAIL_FROM`, `BREVO_API_KEY` — transactional email via Brevo (verified sender + API key)
+- `EMAIL_FROM`, `SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASS` — Infomaniak SMTP account for verification emails (email-verification, password-reset)
+- `EMAIL_FROM_NOTIFY`, `SMTP_NOTIFY_HOST`, `SMTP_NOTIFY_PORT`, `SMTP_NOTIFY_USER`, `SMTP_NOTIFY_PASS` — Infomaniak SMTP account for notification emails (cron scans, status-change triggers); separate account because Infomaniak does not allow multiple senders on one SMTP account
 - `EMAIL_TEMPLATE_TTL_MS`, `EMAIL_TEMPLATE_FETCH_TIMEOUT_MS` — optional; cache TTL + fetch timeout for the verification-email CDN manifest (`${CDN_BASE_URL}emails/verification.json`); falls back to built-in copy
 - `CORS_ORIGINS` — comma-separated list of allowed origins
 

Dockerfile

@@ -9,16 +9,22 @@
 
 # Note: JWT_SECRET should be provided at runtime via secrets management
 # not as build args for security reasons
 ARG NODE_ENV=${NODE_ENV:-production}
 ARG CDN_BASE_URL
 ARG NIDS_TOKEN
 ARG RUN_MIGRATIONS=${RUN_MIGRATIONS:-true}
+ARG GIT_COMMIT_SHA=${GIT_COMMIT_SHA:-unknown}
+ARG NOTIFY_EMAIL_DRY_RUN=false
+ARG NOTIFY_SLACK_DRY_RUN=false
 
 ENV NODE_ENV=${NODE_ENV}
 ENV PORT=8000
 ENV CDN_BASE_URL=${CDN_BASE_URL}
 ENV NIDS_TOKEN=${NIDS_TOKEN}
 ENV RUN_MIGRATIONS=${RUN_MIGRATIONS}
+ENV GIT_COMMIT_SHA=${GIT_COMMIT_SHA}
+ENV NOTIFY_EMAIL_DRY_RUN=${NOTIFY_EMAIL_DRY_RUN}
+ENV NOTIFY_SLACK_DRY_RUN=${NOTIFY_SLACK_DRY_RUN}
 WORKDIR /app
 
 RUN apk update && apk add --no-cache curl dumb-init

data-bootstrap/Dockerfile

@@ -1,22 +1,15 @@
-FROM postgres:17.2
-
-# Install postgresql-client for pg_restore/psql commands
-
-# Set environment variables for external database connection
-ENV PGHOST=localhost
-ENV PGPORT=5432
-ENV PGDATABASE=mydb
-ENV PGUSER=postgres
-ENV PGPASSWORD=password
-
-# Copy the SQL files
-COPY *.sql /app/
-
-# Create script to restore dump to external database
-COPY bootstrap.sh /app/
-RUN chmod +x /app/bootstrap.sh
-
+FROM node:22-alpine AS builder
 WORKDIR /app
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile --production=false
+COPY . .
+RUN yarn build
 
-# Run the restore script
-CMD ["/app/bootstrap.sh"]
+FROM node:22-alpine
+WORKDIR /app
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile --production=true && yarn cache clean
+COPY --from=builder /app/build ./build
+COPY public ./build/public
+COPY src/data/seeds/fixtures ./build/src/data/seeds/fixtures
+CMD ["node", "build/src/data/seeds/run.js"]

docker-compose.yaml

@@ -14,15 +14,19 @@ services:
     environment:
       - NODE_ENV=${NODE_ENV}
       - RUN_MIGRATIONS=${RUN_MIGRATIONS:-true}
-      - PORT=5000
+      - PORT=8000
+      - NOTIFY_EMAIL_DRY_RUN=true
+      - NOTIFY_SLACK_DRY_RUN=true
       - DB_HOST=db
       - DB_PORT=5432
       - DB_USERNAME=postgres
       - DB_PASSWORD=postgres
       - DB_NAME=postgres
       - DB_SCHEMA=public
     ports:
-      - 5000:5000
+      - ${BE_PORT:-5000}:${PORT:-8000}
+    networks:
+      - n4d-net
     volumes:
       - ./:/app
     command: ["yarn", "dev"]
@@ -33,8 +37,13 @@ services:
       db:
         condition: service_healthy
     build:
-      context: ./data-bootstrap
+      context: .
+      dockerfile: data-bootstrap/Dockerfile
+    networks:
+      - n4d-net
     environment:
+      - NODE_ENV=development
+      - RUN_MIGRATIONS=true
       - DB_HOST=db
       - DB_PORT=5432
       - DB_USER=postgres
@@ -44,7 +53,7 @@ services:
 
   db:
     container_name: db
-    image: postgres:17.2
+    image: postgres:17.9
     ports:
       - 5432:5432
     environment:
@@ -56,18 +65,14 @@ services:
       POSTGRES_DB: postgres
     volumes:
       - be_database:/var/lib/postgresql
+    networks:
+      - n4d-net
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres"]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 40s
-  localstack:
-    image: localstack/localstack
-    ports:
-      - "4566:4566"
-    environment:
-      - SERVICES=ses
 
 volumes:
   be_database:

package.json

@@ -11,6 +11,8 @@
     "@swc/core": "^1.15.10",
     "@swc/helpers": "^0.5.18",
     "@types/node": "^24.9.1",
+    "@types/node-cron": "^3.0.11",
+    "@types/nodemailer": "^8.0.1",
     "@typescript-eslint/eslint-plugin": "^8.46.2",
     "@typescript-eslint/parser": "^8.46.2",
     "@typescript-eslint/utils": "^8.46.2",
@@ -41,7 +43,9 @@
     "class-validator": "^0.14.2",
     "fastify": "^5.3.3",
     "fastify-plugin": "^5.0.1",
-    "need4deed-sdk": "0.0.110",
+    "need4deed-sdk": "0.0.125",
+    "node-cron": "^4.5.0",
+    "nodemailer": "^9.0.3",
     "pg": "^8.14.1",
     "pino": "^10.3.1",
     "pino-pretty": "^13.0.0",
@@ -51,6 +55,7 @@
   },
   "scripts": {
     "start": "ts-node src/index.ts",
+    "seed": "ts-node src/data/seeds/run.ts",
     "dev": "nodemon",
     "typeorm": "typeorm-ts-node-commonjs -d src/data/data-source.ts",
     "migration:generate": "yarn typeorm migration:generate",
@@ -68,6 +73,7 @@
     "test:watch": "yarn test --watch",
     "test:coverage": "yarn test --coverage",
     "test:ui": "yarn test --ui",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "prepare": "husky",
     "what": "./get-json-field-value.sh package.json"
   },