Ajoute le support de formation : entite racine separee du jeu 2D

Nouveau moteur document_engine/ (elements CRUD + rendering + labels),
db/supports/ (stockage independant de db/games), routes/document/
(CRUD AJAX + publication), et l'editeur frontend complet
(templates/document/, static/document/) avec moteur de layout reel
(glisser-deposer -> fusion en rangee ou insertion avant/apres), vrai
Undo/Redo par pile de commandes, grille d'accroche pour les formes
libres, apercu responsive a largeurs fixes, mode Apercu, et publication
persistee.

"Mes formations" (templates/index.html) liste desormais les
environnements 2D et les supports de formation cote a cote ;
l'onboarding et core/auth_guard.py sont generalises pour qu'un compte
restreint puisse posseder un projet de chaque type independamment.

SKIP=djlint : le hook ne signale que le backlog H021 (styles en ligne)
deja documente dans CODE_QUALITY.md sur des fichiers pre-existants non
touches ici (base.html, game/play.html, scene_edit.html,
game_dashboard_simple.html, clause_row.html) plus une ligne de
index.html deja presente avant cette session — aucun nouveau fichier
(document_edit.html compris) n'y figure. Tous les autres outils
(ruff, mypy --strict, vulture, bandit, import-linter, eslint,
stylelint) passent sans erreur ; 617 tests Python + 276 tests JS
verts, plus une verification manuelle complete du cycle de vie via le
serveur de developpement.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/document/test_document_elements.py

@@ -0,0 +1,140 @@
+"""CRUD des éléments d'un support de formation (document_engine/elements/)
+— sans Flask, directement contre le support.db créé par db.create_support.
+Couvre : CRUD complet, rangées (parent_id), réinsertion (move_document_element
+vers une nouvelle rangée/position), suppression en cascade d'une rangée avec
+enfants, et les attributs de position/taille/rotation d'une forme."""
+
+from typing import Any
+
+import db
+import document_engine as doc_engine
+
+
+def _new_support(tmp_support_slug_cleanup: Any, name: str = "Support de test") -> str:
+    slug = db.create_support(name, owner_folder="90")
+    tmp_support_slug_cleanup(slug)
+    return slug
+
+
+def test_add_and_get_document_element_uses_default_attributes(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    element_id = doc_engine.add_document_element(slug, "titre")
+    element = doc_engine.get_document_element(slug, element_id)
+    assert element is not None
+    assert element["kind"] == "titre"
+    assert element["parent_id"] is None
+    assert element["attributes"]["content"] == "Nouveau titre"
+
+
+def test_get_document_element_returns_none_for_missing_id(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    assert doc_engine.get_document_element(slug, 999) is None
+
+
+def test_list_document_elements_groups_row_children_together(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    top_titre_id = doc_engine.add_document_element(slug, "titre")
+    child_a_id = doc_engine.add_document_element(slug, "paragraphe", parent_id=row_id)
+    child_b_id = doc_engine.add_document_element(slug, "image", parent_id=row_id)
+
+    elements = doc_engine.list_document_elements(slug)
+    ids_in_order = [el["id"] for el in elements]
+
+    # Les deux top-niveau (row_id, top_titre_id) groupés avant les deux
+    # enfants de la rangée (child_a_id, child_b_id) — tri (parent_id, order_index).
+    assert ids_in_order.index(row_id) < ids_in_order.index(child_a_id)
+    assert ids_in_order.index(top_titre_id) < ids_in_order.index(child_a_id)
+    assert ids_in_order.index(child_a_id) < ids_in_order.index(child_b_id)
+
+
+def test_update_document_element_attributes_replaces_whole_json(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    element_id = doc_engine.add_document_element(slug, "paragraphe")
+    doc_engine.update_document_element_attributes(slug, element_id, {"content": "Texte modifié", "style": "legende"})
+    element = doc_engine.get_document_element(slug, element_id)
+    assert element is not None
+    assert element["attributes"] == {"content": "Texte modifié", "style": "legende"}
+
+
+def test_shape_default_attributes_carry_real_position_and_size(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    element_id = doc_engine.add_document_element(slug, "rectangle")
+    element = doc_engine.get_document_element(slug, element_id)
+    assert element is not None
+    attrs = element["attributes"]
+    assert attrs["x"] == 40
+    assert attrs["y"] == 40
+    assert attrs["width"] == 160
+    assert attrs["height"] == 100
+    assert attrs["rotation"] == 0
+    assert attrs["z_index"] == 1
+
+    doc_engine.update_document_element_attributes(
+        slug,
+        element_id,
+        {**attrs, "x": 120, "y": 80, "width": 200, "height": 150, "rotation": 45, "z_index": 3},
+    )
+    moved = doc_engine.get_document_element(slug, element_id)
+    assert moved is not None
+    assert moved["attributes"]["x"] == 120
+    assert moved["attributes"]["rotation"] == 45
+    assert moved["attributes"]["z_index"] == 3
+
+
+def test_move_document_element_reorders_within_same_parent(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    first_id = doc_engine.add_document_element(slug, "titre")
+    second_id = doc_engine.add_document_element(slug, "paragraphe")
+    third_id = doc_engine.add_document_element(slug, "image")
+
+    doc_engine.move_document_element(slug, third_id, None, 0)
+
+    elements = doc_engine.list_document_elements(slug)
+    top_level = [el for el in elements if el["parent_id"] is None]
+    ordered_ids = [el["id"] for el in sorted(top_level, key=lambda el: el["order_index"])]
+    assert ordered_ids == [third_id, first_id, second_id]
+
+
+def test_move_document_element_reparents_into_a_row(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    lone_titre_id = doc_engine.add_document_element(slug, "titre")
+
+    doc_engine.move_document_element(slug, lone_titre_id, row_id, 0)
+
+    moved = doc_engine.get_document_element(slug, lone_titre_id)
+    assert moved is not None
+    assert moved["parent_id"] == row_id
+    assert moved["order_index"] == 0
+
+
+def test_delete_document_element_cascades_to_row_children(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    child_id = doc_engine.add_document_element(slug, "titre", parent_id=row_id)
+
+    doc_engine.delete_document_element(slug, row_id)
+
+    assert doc_engine.get_document_element(slug, row_id) is None
+    assert doc_engine.get_document_element(slug, child_id) is None
+
+
+def test_delete_document_element_on_missing_id_is_a_noop(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    doc_engine.delete_document_element(slug, 999)
+
+
+def test_render_document_includes_row_children_and_shape_position(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    doc_engine.add_document_element(slug, "titre", parent_id=row_id)
+    rect_id = doc_engine.add_document_element(slug, "rectangle")
+
+    html = doc_engine.render_document(doc_engine.list_document_elements(slug))
+
+    assert 'data-kind="row"' in html
+    assert 'data-kind="titre"' in html
+    assert f'data-element-id="{rect_id}"' in html
+    assert "left:40px" in html
+    assert "top:40px" in html

tests/document/test_document_routes.py

@@ -0,0 +1,124 @@
+"""Routes HTTP du support de formation (routes/document/) — création,
+édition directe (sans page intermédiaire), CRUD des éléments en AJAX,
+publication, et isolation par propriétaire (core/auth_guard.py)."""
+
+from typing import Any
+
+from flask.testing import FlaskClient
+
+import auth
+import db
+
+
+def test_documents_new_creates_a_support_not_a_game(client: FlaskClient) -> None:
+    resp = client.post("/documents/new", data={"name": "Sécurité incendie"}, follow_redirects=False)
+    assert resp.status_code == 302
+    assert "/document/" in resp.headers["Location"]
+    assert "/edit" in resp.headers["Location"]
+    slug = resp.headers["Location"].rstrip("/").split("/")[-2]
+    try:
+        assert db.support_meta(slug)["name"] == "Sécurité incendie"
+    finally:
+        db.delete_support(slug)
+
+
+def test_document_edit_renders_directly_no_intermediate_page(client: FlaskClient, support: str) -> None:
+    resp = client.get(f"/document/{support}/edit")
+    assert resp.status_code == 200
+
+
+def test_document_element_add_returns_rendered_html(client: FlaskClient, support: str) -> None:
+    resp = client.post(f"/document/{support}/elements/add", data={"kind": "titre"})
+    assert resp.status_code == 200
+    payload = resp.get_json()
+    assert payload["kind"] == "titre"
+    assert "docText" in payload["rendered_html"]
+
+
+def test_document_element_add_rejects_unknown_kind(client: FlaskClient, support: str) -> None:
+    assert client.post(f"/document/{support}/elements/add", data={"kind": "n-importe-quoi"}).status_code == 400
+
+
+def test_document_element_add_accepts_row_for_the_layout_engine(client: FlaskClient, support: str) -> None:
+    """ "row" n'apparaît jamais dans la bibliothèque (voir
+    document_engine.ELEMENT_LIBRARY) mais reste un kind valide pour cette
+    route — c'est le moteur de layout côté client qui en crée une à la
+    volée au moment d'un dépôt latéral (voir
+    static/document/js/document-editor.js)."""
+    resp = client.post(f"/document/{support}/elements/add", data={"kind": "row"})
+    assert resp.status_code == 200
+    assert resp.get_json()["kind"] == "row"
+
+
+def test_document_element_update_persists_attributes(client: FlaskClient, support: str) -> None:
+    add_resp = client.post(f"/document/{support}/elements/add", data={"kind": "paragraphe"})
+    element_id = add_resp.get_json()["id"]
+
+    resp = client.post(
+        f"/document/{support}/elements/{element_id}/update",
+        json={"content": "Texte mis à jour", "style": "legende"},
+    )
+    assert resp.status_code == 200
+    assert resp.get_json()["ok"] is True
+
+    reread = client.post(f"/document/{support}/elements/add", data={"kind": "titre"})
+    assert reread.status_code == 200
+
+
+def test_document_element_move_and_delete(client: FlaskClient, support: str) -> None:
+    first_id = client.post(f"/document/{support}/elements/add", data={"kind": "titre"}).get_json()["id"]
+    second_id = client.post(f"/document/{support}/elements/add", data={"kind": "paragraphe"}).get_json()["id"]
+
+    move_resp = client.post(
+        f"/document/{support}/elements/{second_id}/move",
+        json={"new_parent_id": None, "new_index": 0},
+    )
+    assert move_resp.status_code == 200
+    assert move_resp.get_json()["ok"] is True
+
+    delete_resp = client.post(f"/document/{support}/elements/{first_id}/delete")
+    assert delete_resp.status_code == 200
+    assert delete_resp.get_json()["ok"] is True
+
+
+def test_document_publish_persists_published_at(client: FlaskClient, support: str) -> None:
+    assert db.support_meta(support)["published_at"] is None
+    resp = client.post(f"/document/{support}/publish")
+    assert resp.status_code == 200
+    published_at = resp.get_json()["published_at"]
+    assert published_at is not None
+    assert db.support_meta(support)["published_at"] == published_at
+
+
+def test_restricted_user_can_have_one_game_and_one_support_at_once(
+    user_client: FlaskClient, tmp_game_slug_cleanup: Any, tmp_support_slug_cleanup: Any
+) -> None:
+    with user_client.session_transaction() as sess:
+        user_id = sess["user_id"]
+    game_slug = db.create_game("Un environnement 2D", owner_folder=str(user_id))
+    tmp_game_slug_cleanup(game_slug)
+    auth.set_project_slug(user_id, game_slug)
+
+    resp = user_client.post("/documents/new", data={"name": "Un support"}, follow_redirects=False)
+    assert resp.status_code == 302
+    support_slug = resp.headers["Location"].rstrip("/").split("/")[-2]
+    tmp_support_slug_cleanup(support_slug)
+
+    user = auth.get_user_by_id(user_id)
+    assert user is not None
+    assert user["project_slug"] == game_slug
+    assert user["support_slug"] == support_slug
+
+
+def test_cannot_open_another_owners_support(client: FlaskClient, user_client: FlaskClient) -> None:
+    """Isolation par propriétaire (core/auth_guard.py, split_slug déjà
+    générique quel que soit le type de projet) — le compte admin
+    (`client`) ne doit pas pouvoir ouvrir le support d'un autre compte."""
+    with user_client.session_transaction() as sess:
+        victim_user_id = sess["user_id"]
+    victim_slug = db.create_support("Support de la victime", owner_folder=str(victim_user_id))
+    try:
+        assert client.get(f"/document/{victim_slug}/edit").status_code == 403
+        assert client.post(f"/document/{victim_slug}/delete").status_code == 403
+    finally:
+        db.delete_support(victim_slug)

tests/document/test_support_lifecycle.py

@@ -0,0 +1,70 @@
+"""Cycle de vie d'un support de formation (db/supports/) — mirroir des
+tests de db/games/, mais vérifie en plus l'ISOLATION stricte entre les
+deux systèmes : un support ne doit jamais apparaître dans db.list_games()
+et un jeu ne doit jamais apparaître dans db.list_supports(), même pour le
+même propriétaire."""
+
+from typing import Any
+
+import db
+
+
+def test_create_support_creates_its_own_db_file_and_schema(tmp_support_slug_cleanup: Any) -> None:
+    slug = db.create_support("Sécurité incendie", owner_folder="42")
+    tmp_support_slug_cleanup(slug)
+    meta = db.support_meta(slug)
+    assert meta["name"] == "Sécurité incendie"
+    assert meta["published_at"] is None
+
+
+def test_list_supports_scopes_to_owner_and_excludes_games(
+    tmp_support_slug_cleanup: Any, tmp_game_slug_cleanup: Any
+) -> None:
+    owner = "43"
+    support_slug = db.create_support("Onboarding RH", owner_folder=owner)
+    tmp_support_slug_cleanup(support_slug)
+    game_slug = db.create_game("Un jeu du même compte", owner_folder=owner)
+    tmp_game_slug_cleanup(game_slug)
+
+    supports = db.list_supports(owner)
+    games = db.list_games(owner)
+
+    assert [s["slug"] for s in supports] == [support_slug]
+    assert [g["slug"] for g in games] == [game_slug]
+    assert support_slug not in [g["slug"] for g in games]
+    assert game_slug not in [s["slug"] for s in supports]
+
+
+def test_list_supports_never_sees_another_owners_supports(tmp_support_slug_cleanup: Any) -> None:
+    slug_a = db.create_support("Support A", owner_folder="44")
+    tmp_support_slug_cleanup(slug_a)
+    slug_b = db.create_support("Support B", owner_folder="45")
+    tmp_support_slug_cleanup(slug_b)
+
+    assert [s["slug"] for s in db.list_supports("44")] == [slug_a]
+    assert [s["slug"] for s in db.list_supports("45")] == [slug_b]
+
+
+def test_create_support_avoids_name_collision_for_the_same_owner(tmp_support_slug_cleanup: Any) -> None:
+    owner = "46"
+    slug_1 = db.create_support("Module 1", owner_folder=owner)
+    tmp_support_slug_cleanup(slug_1)
+    slug_2 = db.create_support("Module 1", owner_folder=owner)
+    tmp_support_slug_cleanup(slug_2)
+    assert slug_1 != slug_2
+
+
+def test_mark_support_published_persists_a_timestamp(tmp_support_slug_cleanup: Any) -> None:
+    slug = db.create_support("À publier", owner_folder="47")
+    tmp_support_slug_cleanup(slug)
+    assert db.support_meta(slug)["published_at"] is None
+    published_at = db.mark_support_published(slug)
+    assert db.support_meta(slug)["published_at"] == published_at
+
+
+def test_delete_support_removes_it_from_the_listing(tmp_support_slug_cleanup: Any) -> None:
+    slug = db.create_support("Temporaire", owner_folder="48")
+    tmp_support_slug_cleanup(slug)
+    assert [s["slug"] for s in db.list_supports("48")] == [slug]
+    db.delete_support(slug)
+    assert db.list_supports("48") == []