Étape 5 : API CRUD, matrice et validation branchée

- CRUD complet, scopé par édition, sur Position, Shift, Volunteer, Assignment
  (routers app/api/*, schémas Pydantic, dépendance get_edition partagée)
- Volunteer : gestion des compétences par codes (création à la volée),
  suppression = effacement complet en cascade (RGPD)
- Shift : contrôle fin > début, poste de la même édition, compétences requises
- Assignment : toute écriture active passe par le moteur de validation ;
  violation bloquante -> 422 error.validation_failed, avertissements renvoyés
  dans la réponse. Endpoint POST .../assignments/validate en simulation.
  app/validation/loader.py construit la ValidationInput depuis la base.
- GET /editions/{id}/matrix : postes -> créneaux -> {min, ideal, confirmed,
  proposed}, source de l'écran principal
- 30 tests d'API (CRUD, 404/409/422, cascade, blocage, avertissements, matrice,
  loader) ; 104 tests au total ; alembic check toujours vert
- Clés de traduction shift.* / assignment.* / volunteer.* ajoutées

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uUsRg7XzopkCPWimwg9ZM

backend/tests/test_api_volunteers.py

@@ -0,0 +1,130 @@
+import datetime as dt
+
+from sqlmodel import select
+
+from app.models import Assignment, Availability, AvailabilityStatus, Volunteer
+from tests.factories import (
+    dt_at,
+    make_availability,
+    make_position,
+    make_shift,
+    make_volunteer,
+)
+
+
+def _url(edition, suffix=""):
+    return f"/editions/{edition.id}/volunteers{suffix}"
+
+
+def test_create_volunteer_with_skills(client, edition):
+    resp = client.post(
+        _url(edition),
+        json={
+            "first_name": "Alex",
+            "last_name": "Martin",
+            "email": "alex@ex.fr",
+            "tshirt_size": "M",
+            "skill_codes": ["SST", "PERMIS_B", "SST"],
+        },
+    )
+    assert resp.status_code == 201
+    body = resp.json()
+    assert body["skill_codes"] == ["PERMIS_B", "SST"]
+    assert body["tshirt_size"] == "M"
+    assert body["edition_id"] == str(edition.id)
+
+
+def test_create_duplicate_email_conflicts(client, edition):
+    payload = {"first_name": "A", "last_name": "A", "email": "dup@ex.fr"}
+    assert client.post(_url(edition), json=payload).status_code == 201
+    resp = client.post(_url(edition), json={**payload, "first_name": "B"})
+    assert resp.status_code == 409
+    assert resp.json()["detail"]["code"] == "volunteer.duplicate_email"
+
+
+def test_volunteers_without_email_are_allowed(client, edition):
+    for name in ("Un", "Deux"):
+        r = client.post(
+            _url(edition), json={"first_name": name, "last_name": "SansMail"}
+        )
+        assert r.status_code == 201
+
+
+def test_list_is_ordered_by_name(client, edition, session):
+    make_volunteer(session, edition, first_name="Bob", last_name="Zoe")
+    make_volunteer(session, edition, first_name="Ana", last_name="Ada")
+    names = [v["last_name"] for v in client.get(_url(edition)).json()]
+    assert names == ["Ada", "Zoe"]
+
+
+def test_get_unknown_id_is_404(client, edition):
+    import uuid
+
+    assert client.get(_url(edition, f"/{uuid.uuid4()}")).status_code == 404
+
+
+def test_get_volunteer_of_another_edition_is_404(client, edition, session):
+    from app.models import Edition
+
+    other = Edition(
+        year=2027,
+        start_date=dt.date(2027, 7, 1),
+        end_date=dt.date(2027, 7, 4),
+    )
+    session.add(other)
+    session.commit()
+    session.refresh(other)
+    stranger = make_volunteer(session, other, email="x@ex.fr")
+
+    assert client.get(_url(edition, f"/{stranger.id}")).status_code == 404
+
+
+def test_patch_replaces_skills_and_can_clear(client, edition, session):
+    volunteer = make_volunteer(session, edition, email="p@ex.fr")
+    r1 = client.patch(
+        _url(edition, f"/{volunteer.id}"),
+        json={"first_name": "Neo", "skill_codes": ["SST"]},
+    )
+    assert r1.status_code == 200
+    assert r1.json()["first_name"] == "Neo"
+    assert r1.json()["skill_codes"] == ["SST"]
+
+    r2 = client.patch(
+        _url(edition, f"/{volunteer.id}"), json={"skill_codes": []}
+    )
+    assert r2.json()["skill_codes"] == []
+
+
+def test_delete_is_a_full_cascade(client, edition, session, day_parts):
+    volunteer = make_volunteer(session, edition, email="gone@ex.fr")
+    position = make_position(session, edition)
+    shift = make_shift(
+        session, edition, position, start=dt_at(10, 9), end=dt_at(10, 12)
+    )
+    make_availability(
+        session,
+        edition,
+        volunteer,
+        day_parts["MORNING"],
+        date=dt.date(2026, 7, 10),
+        status=AvailabilityStatus.AVAILABLE,
+    )
+    session.add(
+        Assignment(
+            edition_id=edition.id,
+            volunteer_id=volunteer.id,
+            shift_id=shift.id,
+        )
+    )
+    session.commit()
+
+    resp = client.delete(_url(edition, f"/{volunteer.id}"))
+    assert resp.status_code == 204
+    assert client.get(_url(edition, f"/{volunteer.id}")).status_code == 404
+    assert session.exec(select(Volunteer)).all() == []
+    assert session.exec(select(Assignment)).all() == []
+    assert session.exec(select(Availability)).all() == []
+    # Le créneau subsiste.
+    from app.models import Shift
+
+    assert session.get(Shift, shift.id) is not None