Étape 7 : authentification par lien magique + JWT + rôles

- app/auth/ : jetons (lien magique aléatoire haché SHA-256, JWT HS256),
  dépendances get_current_account / current_account_in_edition / require_roles
  + require_coordinator / require_staff, et ensure_can_write_position/_shift
- Endpoints app/api/auth.py : POST .../auth/magic-link (202 constant, pas de
  divulgation), POST .../auth/verify (JWT, jeton à usage unique), GET /auth/me
- Envoi d'email stubé : le lien est journalisé (logger app.auth, identifiants
  seulement, aucune donnée nominative)
- app/api/accounts.py : CRUD des comptes réservé à la COORDINATION
- Rôles appliqués sur toute l'API :
  COORDINATION accès complet ; RÉFÉRENT lecture globale + écriture sur ses
  seuls postes/créneaux/affectations ; BÉNÉVOLE sa fiche et ses affectations,
  aucune écriture
- imports.py aligné sur la dépendance get_edition (404 avant 403)
- Secret JWT porté à >= 32 octets (config, .env.example, docker-compose)
- seed : crée un compte VOLUNTEER pour chaque bénévole avec email (104 comptes)
- conftest : fixtures make_account / coordinator / as_account / raw_client ;
  la suite existante s'exécute en COORDINATION
- 13 tests d'authentification + de rôles ; 119 tests au total ; alembic check
  toujours vert (Account / MagicLinkToken déjà dans la migration 0001)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uUsRg7XzopkCPWimwg9ZM

backend/app/api/assignments.py

@@ -17,11 +17,18 @@ from app.api.schemas import (
     AssignmentValidateResult,
     AssignmentWriteResult,
 )
+from app.auth.deps import (
+    current_account_in_edition,
+    ensure_can_write_shift,
+    require_staff,
+)
 from app.db import get_session
 from app.models import (
     ACTIVE_ASSIGNMENT_STATUSES,
+    Account,
     Assignment,
     Edition,
+    Role,
     Shift,
     Volunteer,
 )
@@ -50,12 +57,25 @@ def _pair_or_422(
     return volunteer, shift
 
 
+def _forbidden() -> HTTPException:
+    return HTTPException(status_code=403, detail={"code": "error.forbidden"})
+
+
+def _ensure_can_read(account: Account, volunteer_id: uuid.UUID) -> None:
+    if account.role in (Role.COORDINATOR, Role.LEAD):
+        return
+    if account.volunteer_id == volunteer_id:
+        return
+    raise _forbidden()
+
+
 @router.post(
     "/validate", response_model=AssignmentValidateResult, tags=["assignments"]
 )
 def validate_assignment(
     payload: AssignmentValidateRequest,
     edition: Edition = Depends(get_edition),
+    _guard: Account = Depends(require_staff),
     session: Session = Depends(get_session),
 ) -> AssignmentValidateResult:
     volunteer, shift = _pair_or_422(
@@ -77,11 +97,13 @@ def validate_assignment(
 def create_assignment(
     payload: AssignmentCreate,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> AssignmentWriteResult:
     volunteer, shift = _pair_or_422(
         session, edition.id, payload.volunteer_id, payload.shift_id
     )
+    ensure_can_write_shift(account, session, shift)
     existing = session.exec(
         select(Assignment)
         .where(Assignment.volunteer_id == volunteer.id)
@@ -132,8 +154,14 @@ def list_assignments(
     volunteer_id: uuid.UUID | None = None,
     shift_id: uuid.UUID | None = None,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> list[Assignment]:
+    if account.role is Role.VOLUNTEER:
+        # Un bénévole ne voit que ses propres affectations.
+        if volunteer_id not in (None, account.volunteer_id):
+            raise _forbidden()
+        volunteer_id = account.volunteer_id
     stmt = select(Assignment).where(Assignment.edition_id == edition.id)
     if volunteer_id is not None:
         stmt = stmt.where(Assignment.volunteer_id == volunteer_id)
@@ -146,9 +174,14 @@ def list_assignments(
 def get_assignment(
     assignment_id: uuid.UUID,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> Assignment:
-    return owned_or_404(session.get(Assignment, assignment_id), edition.id)
+    assignment = owned_or_404(
+        session.get(Assignment, assignment_id), edition.id
+    )
+    _ensure_can_read(account, assignment.volunteer_id)
+    return assignment
 
 
 @router.patch("/{assignment_id}", response_model=AssignmentWriteResult)
@@ -156,11 +189,15 @@ def update_assignment(
     assignment_id: uuid.UUID,
     payload: AssignmentUpdate,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> AssignmentWriteResult:
     assignment = owned_or_404(
         session.get(Assignment, assignment_id), edition.id
     )
+    ensure_can_write_shift(
+        account, session, session.get(Shift, assignment.shift_id)
+    )
     changes = payload.model_dump(exclude_unset=True)
     for field, value in changes.items():
         setattr(assignment, field, value)
@@ -197,11 +234,15 @@ def update_assignment(
 def delete_assignment(
     assignment_id: uuid.UUID,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> Response:
     assignment = owned_or_404(
         session.get(Assignment, assignment_id), edition.id
     )
+    ensure_can_write_shift(
+        account, session, session.get(Shift, assignment.shift_id)
+    )
     session.delete(assignment)
     session.commit()
     return Response(status_code=status.HTTP_204_NO_CONTENT)