Étape 7 : authentification par lien magique + JWT + rôles

- app/auth/ : jetons (lien magique aléatoire haché SHA-256, JWT HS256),
  dépendances get_current_account / current_account_in_edition / require_roles
  + require_coordinator / require_staff, et ensure_can_write_position/_shift
- Endpoints app/api/auth.py : POST .../auth/magic-link (202 constant, pas de
  divulgation), POST .../auth/verify (JWT, jeton à usage unique), GET /auth/me
- Envoi d'email stubé : le lien est journalisé (logger app.auth, identifiants
  seulement, aucune donnée nominative)
- app/api/accounts.py : CRUD des comptes réservé à la COORDINATION
- Rôles appliqués sur toute l'API :
  COORDINATION accès complet ; RÉFÉRENT lecture globale + écriture sur ses
  seuls postes/créneaux/affectations ; BÉNÉVOLE sa fiche et ses affectations,
  aucune écriture
- imports.py aligné sur la dépendance get_edition (404 avant 403)
- Secret JWT porté à >= 32 octets (config, .env.example, docker-compose)
- seed : crée un compte VOLUNTEER pour chaque bénévole avec email (104 comptes)
- conftest : fixtures make_account / coordinator / as_account / raw_client ;
  la suite existante s'exécute en COORDINATION
- 13 tests d'authentification + de rôles ; 119 tests au total ; alembic check
  toujours vert (Account / MagicLinkToken déjà dans la migration 0001)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uUsRg7XzopkCPWimwg9ZM

backend/app/api/shifts.py

@@ -8,8 +8,21 @@ from sqlmodel import Session, select
 from app.api._common import owned_or_404, replace_links, resolve_skills
 from app.api.deps import get_edition
 from app.api.schemas import ShiftCreate, ShiftRead, ShiftUpdate
+from app.auth.deps import (
+    current_account_in_edition,
+    ensure_can_write_position,
+    ensure_can_write_shift,
+    require_staff,
+)
 from app.db import get_session
-from app.models import Edition, Position, Shift, ShiftRequiredSkill, Skill
+from app.models import (
+    Account,
+    Edition,
+    Position,
+    Shift,
+    ShiftRequiredSkill,
+    Skill,
+)
 
 router = APIRouter(prefix="/editions/{edition_id}/shifts", tags=["shifts"])
 
@@ -65,10 +78,12 @@ def _require_position(
 def create_shift(
     payload: ShiftCreate,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> ShiftRead:
     _check_range(payload.starts_at, payload.ends_at)
-    _require_position(session, payload.position_id, edition.id)
+    position = _require_position(session, payload.position_id, edition.id)
+    ensure_can_write_position(account, position)
     shift = Shift(
         edition_id=edition.id,
         **payload.model_dump(exclude={"required_skill_codes"}),
@@ -85,6 +100,7 @@ def create_shift(
 def list_shifts(
     position_id: uuid.UUID | None = None,
     edition: Edition = Depends(get_edition),
+    _guard: Account = Depends(require_staff),
     session: Session = Depends(get_session),
 ) -> list[ShiftRead]:
     stmt = (
@@ -101,6 +117,7 @@ def list_shifts(
 def get_shift(
     shift_id: uuid.UUID,
     edition: Edition = Depends(get_edition),
+    _guard: Account = Depends(require_staff),
     session: Session = Depends(get_session),
 ) -> ShiftRead:
     shift = owned_or_404(session.get(Shift, shift_id), edition.id)
@@ -112,13 +129,16 @@ def update_shift(
     shift_id: uuid.UUID,
     payload: ShiftUpdate,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> ShiftRead:
     shift = owned_or_404(session.get(Shift, shift_id), edition.id)
+    ensure_can_write_shift(account, session, shift)
     changes = payload.model_dump(exclude_unset=True)
     skill_codes = changes.pop("required_skill_codes", None)
     if "position_id" in changes:
-        _require_position(session, changes["position_id"], edition.id)
+        target = _require_position(session, changes["position_id"], edition.id)
+        ensure_can_write_position(account, target)
     for field, value in changes.items():
         setattr(shift, field, value)
     _check_range(shift.starts_at, shift.ends_at)
@@ -133,9 +153,11 @@ def update_shift(
 def delete_shift(
     shift_id: uuid.UUID,
     edition: Edition = Depends(get_edition),
+    account: Account = Depends(current_account_in_edition),
     session: Session = Depends(get_session),
 ) -> Response:
     shift = owned_or_404(session.get(Shift, shift_id), edition.id)
+    ensure_can_write_shift(account, session, shift)
     session.delete(shift)
     session.commit()
     return Response(status_code=status.HTTP_204_NO_CONTENT)