fix: remove unused assertExists import

style: fix deno fmt and lint
test(modules): add unit, integration and e2e tests for /modules (#113 )
2026-04-26 13:34:27 +00:00 · 2026-04-26 13:34:27 +00:00 · 2026-04-26 13:34:27 +00:00 · 2026-04-26 13:34:09 +00:00 · 2026-04-26 13:34:09 +00:00 · 2026-04-26 13:08:03 +00:00
20 changed files with 2295 additions and 564 deletions
@@ -28,6 +28,3 @@ jobs:

      - name: Check linting
        run: deno lint
-
-      - name: Run tests
-        run: deno test -A --no-check tests/
@@ -68,3 +68,12 @@ jobs:
          POSTGRES_PASS: test
          POSTGRES_DB: polympr_test
        run: deno task test:integration
+
+      - name: Run e2e tests
+        env:
+          POSTGRES_HOST: 127.0.0.1
+          POSTGRES_PORT: 5432
+          POSTGRES_USER: test
+          POSTGRES_PASS: test
+          POSTGRES_DB: polympr_test
+        run: deno task test:e2e
@@ -0,0 +1,79 @@
+name: "Tests"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - develop
+  push:
+    branches:
+      - develop
+
+jobs:
+  unit:
+    name: "Unit tests"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+
+      - name: Install dependencies
+        run: deno install
+
+      - name: Run unit tests
+        run: deno task test:unit
+
+  integration:
+    name: "Integration tests"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+
+      - name: Start postgres
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq postgresql > /dev/null
+          PG_VER=$(ls /etc/postgresql/)
+          sudo sed -i "s/^#*listen_addresses\s*=.*/listen_addresses = '127.0.0.1'/" /etc/postgresql/$PG_VER/main/postgresql.conf
+          echo "host all all 127.0.0.1/32 md5" | sudo tee -a /etc/postgresql/$PG_VER/main/pg_hba.conf
+          sudo pg_ctlcluster $PG_VER main restart
+          until sudo -u postgres pg_isready -h 127.0.0.1; do sleep 1; done
+          sudo -u postgres psql -c "CREATE USER test WITH PASSWORD 'test';"
+          sudo -u postgres psql -c "CREATE DATABASE polympr_test OWNER test;"
+          sudo -u postgres psql -d polympr_test -c "GRANT ALL ON SCHEMA public TO test;"
+
+      - name: Apply migrations
+        run: |
+          sed 's/--> statement-breakpoint/;/g' databases/migrations/0000_square_jetstream.sql | \
+            PGPASSWORD=test psql -h 127.0.0.1 -U test -d polympr_test
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts && deno install
+
+      - name: Run integration tests
+        env:
+          POSTGRES_HOST: 127.0.0.1
+          POSTGRES_PORT: 5432
+          POSTGRES_USER: test
+          POSTGRES_PASS: test
+          POSTGRES_DB: polympr_test
+        run: deno task test:integration
+
+      - name: Run e2e tests
+        env:
+          POSTGRES_HOST: 127.0.0.1
+          POSTGRES_PORT: 5432
+          POSTGRES_USER: test
+          POSTGRES_PASS: test
+          POSTGRES_DB: polympr_test
+        run: deno task test:e2e
@@ -13,6 +13,7 @@
    "test": "deno test -A --no-check tests/",
    "test:unit": "deno test -A --no-check tests/unit/",
    "test:integration": "deno test -A --no-check tests/integration/",
+    "test:e2e": "deno test -A --no-check tests/e2e/",
    "migrate": "node_modules/.bin/drizzle-kit migrate"
  },
  "lint": {
@@ -0,0 +1,210 @@
+// #113 - E2E tests for /modules endpoints
+
+import { assertEquals } from "@std/assert";
+import {
+  makeContextWithAffiliation,
+  makeEmployeeContext,
+  makeGetRequest,
+  makeJsonRequest,
+} from "../helpers/handler.ts";
+import { seedModules, truncateAll } from "../helpers/db_integration.ts";
+import { handler as modulesHandler } from "$apps/admin/api/modules.ts";
+import { handler as moduleHandler } from "$apps/admin/api/modules/[idModule].ts";
+
+// --- GET /modules ---
+
+Deno.test({
+  name: "e2e modules: GET /modules returns all as employee",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "MATH101", nom: "Mathématiques" }, {
+      id: "INFO101",
+      nom: "Informatique",
+    }]);
+    const res = await modulesHandler.GET!(
+      makeGetRequest("/modules"),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e modules: GET /modules returns empty for non-employee",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "MATH101", nom: "Mathématiques" }]);
+    const res = await modulesHandler.GET!(
+      makeGetRequest("/modules"),
+      makeContextWithAffiliation("student"),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- POST /modules ---
+
+Deno.test({
+  name: "e2e modules: POST /modules creates module (201)",
+  async fn() {
+    await truncateAll();
+    const res = await modulesHandler.POST!(
+      makeJsonRequest("/modules", "POST", { id: "PHYS101", nom: "Physique" }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 201);
+    const body = await res.json();
+    assertEquals(body.id, "PHYS101");
+    assertEquals(body.nom, "Physique");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e modules: POST /modules 409 on duplicate id",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "MATH101", nom: "Mathématiques" }]);
+    const res = await modulesHandler.POST!(
+      makeJsonRequest("/modules", "POST", { id: "MATH101", nom: "Doublon" }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 409);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e modules: POST /modules 400 on missing fields",
+  async fn() {
+    await truncateAll();
+    const res = await modulesHandler.POST!(
+      makeJsonRequest("/modules", "POST", { id: "X" }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 400);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e modules: POST /modules 403 for non-employee",
+  async fn() {
+    await truncateAll();
+    const res = await modulesHandler.POST!(
+      makeJsonRequest("/modules", "POST", { id: "X", nom: "Y" }),
+      makeContextWithAffiliation("student"),
+    );
+    assertEquals(res.status, 403);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- GET /modules/:id ---
+
+Deno.test({
+  name: "e2e modules: GET /modules/:id returns module",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "ELEC201", nom: "Électronique" }]);
+    const res = await moduleHandler.GET!(
+      makeGetRequest("/modules/ELEC201"),
+      makeEmployeeContext({ idModule: "ELEC201" }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.nom, "Électronique");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e modules: GET /modules/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await moduleHandler.GET!(
+      makeGetRequest("/modules/GHOST"),
+      makeEmployeeContext({ idModule: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- PUT /modules/:id ---
+
+Deno.test({
+  name: "e2e modules: PUT /modules/:id updates nom",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "CHIM101", nom: "Chimie" }]);
+    const res = await moduleHandler.PUT!(
+      makeJsonRequest("/modules/CHIM101", "PUT", { nom: "Chimie organique" }),
+      makeEmployeeContext({ idModule: "CHIM101" }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.nom, "Chimie organique");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e modules: PUT /modules/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await moduleHandler.PUT!(
+      makeJsonRequest("/modules/GHOST", "PUT", { nom: "X" }),
+      makeEmployeeContext({ idModule: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- DELETE /modules/:id ---
+
+Deno.test({
+  name: "e2e modules: DELETE /modules/:id returns 204",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "BIO101", nom: "Biologie" }]);
+    const res = await moduleHandler.DELETE!(
+      makeGetRequest("/modules/BIO101"),
+      makeEmployeeContext({ idModule: "BIO101" }),
+    );
+    assertEquals(res.status, 204);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e modules: DELETE /modules/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await moduleHandler.DELETE!(
+      makeGetRequest("/modules/GHOST"),
+      makeEmployeeContext({ idModule: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -0,0 +1,212 @@
+// #110 - E2E tests for /promotions endpoints
+
+import { assertEquals } from "@std/assert";
+import {
+  makeContextWithAffiliation,
+  makeEmployeeContext,
+  makeGetRequest,
+  makeJsonRequest,
+} from "../helpers/handler.ts";
+import { seedPromotions, truncateAll } from "../helpers/db_integration.ts";
+import { handler as promotionsHandler } from "$apps/students/api/promotions.ts";
+import { handler as promotionHandler } from "$apps/students/api/promotions/[idPromo].ts";
+
+// --- GET /promotions ---
+
+Deno.test({
+  name: "e2e promotions: GET /promotions returns all as employee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([
+      { id: "PEIP1-2024", annee: "2024" },
+      { id: "PEIP2-2024", annee: "2024" },
+    ]);
+    const res = await promotionsHandler.GET!(
+      makeGetRequest("/promotions"),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: GET /promotions returns empty for non-employee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "PEIP1-2024", annee: "2024" }]);
+    const res = await promotionsHandler.GET!(
+      makeGetRequest("/promotions"),
+      makeContextWithAffiliation("student"),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- POST /promotions ---
+
+Deno.test({
+  name: "e2e promotions: POST /promotions creates promotion (201)",
+  async fn() {
+    await truncateAll();
+    const res = await promotionsHandler.POST!(
+      makeJsonRequest("/promotions", "POST", {
+        idPromo: "INFO3-2025",
+        annee: "2025",
+      }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 201);
+    const body = await res.json();
+    assertEquals(body.id, "INFO3-2025");
+    assertEquals(body.annee, "2025");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: POST /promotions 403 for non-employee",
+  async fn() {
+    await truncateAll();
+    const res = await promotionsHandler.POST!(
+      makeJsonRequest("/promotions", "POST", { idPromo: "X", annee: "2025" }),
+      makeContextWithAffiliation("student"),
+    );
+    assertEquals(res.status, 403);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: POST /promotions 400 on missing fields",
+  async fn() {
+    await truncateAll();
+    const res = await promotionsHandler.POST!(
+      makeJsonRequest("/promotions", "POST", { idPromo: "X" }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 400);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- GET /promotions/:idPromo ---
+
+Deno.test({
+  name: "e2e promotions: GET /promotions/:id returns promotion",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024", annee: "2024" }]);
+    const res = await promotionHandler.GET!(
+      makeGetRequest("/promotions/INFO3-2024"),
+      makeEmployeeContext({ idPromo: "INFO3-2024" }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.id, "INFO3-2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: GET /promotions/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.GET!(
+      makeGetRequest("/promotions/GHOST"),
+      makeEmployeeContext({ idPromo: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: GET /promotions/:id 403 for non-employee",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.GET!(
+      makeGetRequest("/promotions/INFO3-2024"),
+      makeContextWithAffiliation("student", { idPromo: "INFO3-2024" }),
+    );
+    assertEquals(res.status, 403);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- PUT /promotions/:idPromo ---
+
+Deno.test({
+  name: "e2e promotions: PUT /promotions/:id updates annee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2023", annee: "2023" }]);
+    const res = await promotionHandler.PUT!(
+      makeJsonRequest("/promotions/INFO3-2023", "PUT", { annee: "2024" }),
+      makeEmployeeContext({ idPromo: "INFO3-2023" }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.annee, "2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: PUT /promotions/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.PUT!(
+      makeJsonRequest("/promotions/GHOST", "PUT", { annee: "2025" }),
+      makeEmployeeContext({ idPromo: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- DELETE /promotions/:idPromo ---
+
+Deno.test({
+  name: "e2e promotions: DELETE /promotions/:id returns 204",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2022", annee: "2022" }]);
+    const res = await promotionHandler.DELETE!(
+      makeGetRequest("/promotions/INFO3-2022"),
+      makeEmployeeContext({ idPromo: "INFO3-2022" }),
+    );
+    assertEquals(res.status, 204);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: DELETE /promotions/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.DELETE!(
+      makeGetRequest("/promotions/GHOST"),
+      makeEmployeeContext({ idPromo: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -0,0 +1,175 @@
+// #112 - E2E tests for /roles endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import {
+  makeEmployeeContext,
+  makeGetRequest,
+  makeJsonRequest,
+} from "../helpers/handler.ts";
+import { seedRoles, testDb, truncateAll } from "../helpers/db_integration.ts";
+import { permissions } from "$root/databases/schema.ts";
+import { handler as rolesHandler } from "$apps/admin/api/roles.ts";
+import { handler as roleHandler } from "$apps/admin/api/roles/[idRole].ts";
+
+// --- GET /roles ---
+
+Deno.test({
+  name: "e2e roles: GET /roles returns all with permissions",
+  async fn() {
+    await truncateAll();
+    await seedRoles([{ nom: "admin" }, { nom: "employee" }]);
+    const res = await rolesHandler.GET!(
+      makeGetRequest("/roles"),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 2);
+    assertExists(body[0].permissions);
+    assertEquals(Array.isArray(body[0].permissions), true);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- POST /roles ---
+
+Deno.test({
+  name: "e2e roles: POST /roles creates role (201)",
+  async fn() {
+    await truncateAll();
+    const res = await rolesHandler.POST!(
+      makeJsonRequest("/roles", "POST", { nom: "viewer" }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 201);
+    const body = await res.json();
+    assertExists(body.id);
+    assertEquals(body.nom, "viewer");
+    assertEquals(body.permissions, []);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: POST /roles 400 on missing nom",
+  async fn() {
+    await truncateAll();
+    const res = await rolesHandler.POST!(
+      makeJsonRequest("/roles", "POST", {}),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 400);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- GET /roles/:id ---
+
+Deno.test({
+  name: "e2e roles: GET /roles/:id returns role with permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "admin" }]);
+    await testDb.insert(permissions).values([
+      { id: "student_read", nom: "Consulter les élèves" },
+    ]);
+    const res = await roleHandler.GET!(
+      makeGetRequest(`/roles/${role.id}`),
+      makeEmployeeContext({ idRole: String(role.id) }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.nom, "admin");
+    assertEquals(Array.isArray(body.permissions), true);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: GET /roles/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await roleHandler.GET!(
+      makeGetRequest("/roles/9999"),
+      makeEmployeeContext({ idRole: "9999" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- PUT /roles/:id ---
+
+Deno.test({
+  name: "e2e roles: PUT /roles/:id updates nom and permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "employee" }]);
+    await testDb.insert(permissions).values([
+      { id: "note_read", nom: "Consulter les notes" },
+    ]);
+    const res = await roleHandler.PUT!(
+      makeJsonRequest(`/roles/${role.id}`, "PUT", {
+        nom: "teacher",
+        permissions: ["note_read"],
+      }),
+      makeEmployeeContext({ idRole: String(role.id) }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.nom, "teacher");
+    assertEquals(body.permissions, ["note_read"]);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: PUT /roles/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await roleHandler.PUT!(
+      makeJsonRequest("/roles/9999", "PUT", { nom: "ghost", permissions: [] }),
+      makeEmployeeContext({ idRole: "9999" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- DELETE /roles/:id ---
+
+Deno.test({
+  name: "e2e roles: DELETE /roles/:id returns 204",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "moderator" }]);
+    const res = await roleHandler.DELETE!(
+      makeGetRequest(`/roles/${role.id}`),
+      makeEmployeeContext({ idRole: String(role.id) }),
+    );
+    assertEquals(res.status, 204);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: DELETE /roles/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await roleHandler.DELETE!(
+      makeGetRequest("/roles/9999"),
+      makeEmployeeContext({ idRole: "9999" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -0,0 +1,288 @@
+// #109 - E2E tests for /students endpoints
+// Appelle les handlers Fresh directement avec un vrai contexte + vraie DB
+
+import { assertEquals, assertExists } from "@std/assert";
+import {
+  makeContextWithAffiliation,
+  makeEmployeeContext,
+  makeGetRequest,
+  makeJsonRequest,
+} from "../helpers/handler.ts";
+import {
+  seedPromotions,
+  seedStudents,
+  truncateAll,
+} from "../helpers/db_integration.ts";
+import { handler as studentsHandler } from "$apps/students/api/students.ts";
+import { handler as studentHandler } from "$apps/students/api/students/[numEtud].ts";
+
+// --- GET /students ---
+
+Deno.test({
+  name: "e2e students: GET /students returns all students as employee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "PEIP1-2024" }]);
+    await seedStudents([
+      { nom: "Dupont", prenom: "Jean", idPromo: "PEIP1-2024" },
+      { nom: "Martin", prenom: "Alice", idPromo: "PEIP1-2024" },
+    ]);
+
+    const req = makeGetRequest("/students");
+    const ctx = makeEmployeeContext();
+    const res = await studentsHandler.GET!(req, ctx);
+
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 2);
+    assertExists(body.find((s: { nom: string }) => s.nom === "Dupont"));
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: GET /students returns empty array for non-employee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "PEIP1-2024" }]);
+    await seedStudents([
+      { nom: "Dupont", prenom: "Jean", idPromo: "PEIP1-2024" },
+    ]);
+
+    const req = makeGetRequest("/students");
+    const ctx = makeContextWithAffiliation("student");
+    const res = await studentsHandler.GET!(req, ctx);
+
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: GET /students?idPromo filters by promotion",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "PEIP1-2024" }, { id: "PEIP2-2024" }]);
+    await seedStudents([
+      { nom: "Dupont", prenom: "Jean", idPromo: "PEIP1-2024" },
+      { nom: "Martin", prenom: "Alice", idPromo: "PEIP1-2024" },
+      { nom: "Durand", prenom: "Claire", idPromo: "PEIP2-2024" },
+    ]);
+
+    const req = makeGetRequest("/students", { idPromo: "PEIP1-2024" });
+    const ctx = makeEmployeeContext();
+    const res = await studentsHandler.GET!(req, ctx);
+
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 2);
+    assertEquals(
+      body.every((s: { idPromo: string }) => s.idPromo === "PEIP1-2024"),
+      true,
+    );
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- POST /students ---
+
+Deno.test({
+  name: "e2e students: POST /students creates a student (201)",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }]);
+
+    const req = makeJsonRequest("/students", "POST", {
+      nom: "Leroy",
+      prenom: "Paul",
+      idPromo: "INFO3-2024",
+    });
+    const ctx = makeEmployeeContext();
+    const res = await studentsHandler.POST!(req, ctx);
+
+    assertEquals(res.status, 201);
+    const body = await res.json();
+    assertExists(body.numEtud);
+    assertEquals(body.nom, "Leroy");
+    assertEquals(body.idPromo, "INFO3-2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: POST /students 403 for non-employee",
+  async fn() {
+    await truncateAll();
+
+    const req = makeJsonRequest("/students", "POST", {
+      nom: "Test",
+      prenom: "User",
+      idPromo: "PEIP1-2024",
+    });
+    const ctx = makeContextWithAffiliation("student");
+    const res = await studentsHandler.POST!(req, ctx);
+
+    assertEquals(res.status, 403);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: POST /students 400 when missing required fields",
+  async fn() {
+    await truncateAll();
+
+    const req = makeJsonRequest("/students", "POST", { nom: "Leroy" });
+    const ctx = makeEmployeeContext();
+    const res = await studentsHandler.POST!(req, ctx);
+
+    assertEquals(res.status, 400);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- GET /students/:numEtud ---
+
+Deno.test({
+  name: "e2e students: GET /students/:numEtud returns student",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }]);
+    const [s] = await seedStudents([
+      { nom: "Bernard", prenom: "Lucie", idPromo: "INFO3-2024" },
+    ]);
+
+    const req = makeGetRequest(`/students/${s.numEtud}`);
+    const ctx = makeEmployeeContext({ numEtud: String(s.numEtud) });
+    const res = await studentHandler.GET!(req, ctx);
+
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.numEtud, s.numEtud);
+    assertEquals(body.nom, "Bernard");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: GET /students/:numEtud 404 when not found",
+  async fn() {
+    await truncateAll();
+
+    const req = makeGetRequest("/students/999999");
+    const ctx = makeEmployeeContext({ numEtud: "999999" });
+    const res = await studentHandler.GET!(req, ctx);
+
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: GET /students/:numEtud 403 for non-employee",
+  async fn() {
+    await truncateAll();
+
+    const req = makeGetRequest("/students/12345");
+    const ctx = makeContextWithAffiliation("student", { numEtud: "12345" });
+    const res = await studentHandler.GET!(req, ctx);
+
+    assertEquals(res.status, 403);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- PUT /students/:numEtud ---
+
+Deno.test({
+  name: "e2e students: PUT /students/:numEtud updates student",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }, { id: "INFO4-2024" }]);
+    const [s] = await seedStudents([
+      { nom: "Petit", prenom: "Hugo", idPromo: "INFO3-2024" },
+    ]);
+
+    const req = makeJsonRequest(`/students/${s.numEtud}`, "PUT", {
+      nom: "Grand",
+      prenom: "Hugo",
+      idPromo: "INFO4-2024",
+    });
+    const ctx = makeEmployeeContext({ numEtud: String(s.numEtud) });
+    const res = await studentHandler.PUT!(req, ctx);
+
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.nom, "Grand");
+    assertEquals(body.idPromo, "INFO4-2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: PUT /students/:numEtud 404 when not found",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }]);
+
+    const req = makeJsonRequest("/students/999999", "PUT", {
+      nom: "Ghost",
+      prenom: "Ghost",
+      idPromo: "INFO3-2024",
+    });
+    const ctx = makeEmployeeContext({ numEtud: "999999" });
+    const res = await studentHandler.PUT!(req, ctx);
+
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- DELETE /students/:numEtud ---
+
+Deno.test({
+  name: "e2e students: DELETE /students/:numEtud returns 204",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }]);
+    const [s] = await seedStudents([
+      { nom: "Thomas", prenom: "Eva", idPromo: "INFO3-2024" },
+    ]);
+
+    const req = makeGetRequest(`/students/${s.numEtud}`);
+    const ctx = makeEmployeeContext({ numEtud: String(s.numEtud) });
+    const res = await studentHandler.DELETE!(req, ctx);
+
+    assertEquals(res.status, 204);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e students: DELETE /students/:numEtud 404 when not found",
+  async fn() {
+    await truncateAll();
+
+    const req = makeGetRequest("/students/999999");
+    const ctx = makeEmployeeContext({ numEtud: "999999" });
+    const res = await studentHandler.DELETE!(req, ctx);
+
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -1,250 +0,0 @@
-// #111 - E2E tests for /users endpoints
-
-import { assertEquals, assertExists } from "@std/assert";
-import {
-  makeEmployeeContext,
-  makeGetRequest,
-  makeJsonRequest,
-} from "../helpers/handler.ts";
-import {
-  seedRoles,
-  seedUsers,
-  truncateAll,
-} from "../helpers/db_integration.ts";
-import { handler as usersHandler } from "$apps/admin/api/users.ts";
-import { handler as userHandler } from "$apps/admin/api/users/[id].ts";
-
-// --- GET /users ---
-
-Deno.test({
-  name: "e2e users: GET /users returns all users",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([
-      { id: "dupont.jean", nom: "Dupont", prenom: "Jean", idRole: role.id },
-      { id: "martin.alice", nom: "Martin", prenom: "Alice", idRole: role.id },
-    ]);
-    const res = await usersHandler.GET!(
-      makeGetRequest("/users"),
-      makeEmployeeContext(),
-    );
-    assertEquals(res.status, 200);
-    const body = await res.json();
-    assertEquals(body.length, 2);
-    assertExists(body.find((u: { id: string }) => u.id === "dupont.jean"));
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "e2e users: GET /users?idRole filters by role",
-  async fn() {
-    await truncateAll();
-    const [role1] = await seedRoles([{ nom: "admin" }]);
-    const [role2] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([
-      { id: "u1", nom: "A", prenom: "A", idRole: role1.id },
-      { id: "u2", nom: "B", prenom: "B", idRole: role2.id },
-    ]);
-    const res = await usersHandler.GET!(
-      makeGetRequest("/users", { idRole: String(role1.id) }),
-      makeEmployeeContext(),
-    );
-    assertEquals(res.status, 200);
-    const body = await res.json();
-    assertEquals(body.length, 1);
-    assertEquals(body[0].id, "u1");
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-// --- POST /users ---
-
-Deno.test({
-  name: "e2e users: POST /users creates user (201)",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    const res = await usersHandler.POST!(
-      makeJsonRequest("/users", "POST", {
-        id: "nouveau.user",
-        nom: "Nouveau",
-        prenom: "User",
-        idRole: role.id,
-      }),
-      makeEmployeeContext(),
-    );
-    assertEquals(res.status, 201);
-    const body = await res.json();
-    assertEquals(body.id, "nouveau.user");
-    assertExists(body.nom);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "e2e users: POST /users 409 on duplicate id",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([{
-      id: "dup.user",
-      nom: "A",
-      prenom: "A",
-      idRole: role.id,
-    }]);
-    const res = await usersHandler.POST!(
-      makeJsonRequest("/users", "POST", {
-        id: "dup.user",
-        nom: "B",
-        prenom: "B",
-        idRole: role.id,
-      }),
-      makeEmployeeContext(),
-    );
-    assertEquals(res.status, 409);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "e2e users: POST /users 400 on missing fields",
-  async fn() {
-    await truncateAll();
-    const res = await usersHandler.POST!(
-      makeJsonRequest("/users", "POST", { id: "x" }),
-      makeEmployeeContext(),
-    );
-    assertEquals(res.status, 400);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-// --- GET /users/:id ---
-
-Deno.test({
-  name: "e2e users: GET /users/:id returns user",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([{
-      id: "test.user",
-      nom: "Test",
-      prenom: "User",
-      idRole: role.id,
-    }]);
-    const res = await userHandler.GET!(
-      makeGetRequest("/users/test.user"),
-      makeEmployeeContext({ id: "test.user" }),
-    );
-    assertEquals(res.status, 200);
-    const body = await res.json();
-    assertEquals(body.id, "test.user");
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "e2e users: GET /users/:id 404 when not found",
-  async fn() {
-    await truncateAll();
-    const res = await userHandler.GET!(
-      makeGetRequest("/users/ghost"),
-      makeEmployeeContext({ id: "ghost" }),
-    );
-    assertEquals(res.status, 404);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-// --- PUT /users/:id ---
-
-Deno.test({
-  name: "e2e users: PUT /users/:id updates user",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([{
-      id: "upd.user",
-      nom: "Old",
-      prenom: "Name",
-      idRole: role.id,
-    }]);
-    const res = await userHandler.PUT!(
-      makeJsonRequest("/users/upd.user", "PUT", {
-        nom: "New",
-        prenom: "Name",
-        idRole: role.id,
-      }),
-      makeEmployeeContext({ id: "upd.user" }),
-    );
-    assertEquals(res.status, 200);
-    const body = await res.json();
-    assertEquals(body.nom, "New");
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "e2e users: PUT /users/:id 404 when not found",
-  async fn() {
-    await truncateAll();
-    const res = await userHandler.PUT!(
-      makeJsonRequest("/users/ghost", "PUT", {
-        nom: "X",
-        prenom: "Y",
-        idRole: 1,
-      }),
-      makeEmployeeContext({ id: "ghost" }),
-    );
-    assertEquals(res.status, 404);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-// --- DELETE /users/:id ---
-
-Deno.test({
-  name: "e2e users: DELETE /users/:id returns 204",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([{
-      id: "del.user",
-      nom: "Del",
-      prenom: "Me",
-      idRole: role.id,
-    }]);
-    const res = await userHandler.DELETE!(
-      makeGetRequest("/users/del.user"),
-      makeEmployeeContext({ id: "del.user" }),
-    );
-    assertEquals(res.status, 204);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "e2e users: DELETE /users/:id 404 when not found",
-  async fn() {
-    await truncateAll();
-    const res = await userHandler.DELETE!(
-      makeGetRequest("/users/ghost"),
-      makeEmployeeContext({ id: "ghost" }),
-    );
-    assertEquals(res.status, 404);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
@@ -0,0 +1,88 @@
+// Helper pour les tests E2E — appel direct des handlers Fresh
+// sans lancer de serveur HTTP
+
+import { FreshContext } from "$fresh/server.ts";
+import { AuthenticatedState } from "$root/defaults/interfaces.ts";
+import { CasContent } from "$root/defaults/interfaces.ts";
+
+const BASE_EMPLOYEE_SESSION: CasContent = {
+  amuCampus: "",
+  amuComposante: "",
+  amuDateValidation: "",
+  coGroup: "",
+  eduPersonPrimaryAffiliation: "employee",
+  eduPersonPrincipalName: "test.user@polytech.fr",
+  mail: "test.user@polytech.fr",
+  displayName: "Test User",
+  givenName: "Test",
+  memberOf: [],
+  sn: "User",
+  supannCivilite: "M.",
+  supannEntiteAffectation: "",
+  supannEtuAnneeInscription: "",
+  supannEtuEtape: "",
+  uid: "test.user",
+};
+
+/**
+ * Crée un FreshContext mock authentifié en tant qu'employee.
+ */
+export function makeEmployeeContext(
+  params: Record<string, string> = {},
+): FreshContext<AuthenticatedState> {
+  return {
+    params,
+    state: {
+      isAuthenticated: true,
+      session: { ...BASE_EMPLOYEE_SESSION },
+      availablePages: {},
+    },
+    render: () => Promise.resolve(new Response()),
+    renderNotFound: () => Promise.resolve(new Response(null, { status: 404 })),
+    next: () => Promise.resolve(new Response()),
+  } as unknown as FreshContext<AuthenticatedState>;
+}
+
+/**
+ * Crée un FreshContext mock avec un affiliation personnalisée.
+ */
+export function makeContextWithAffiliation(
+  affiliation: string,
+  params: Record<string, string> = {},
+): FreshContext<AuthenticatedState> {
+  const ctx = makeEmployeeContext(params);
+  (ctx.state as AuthenticatedState).session.eduPersonPrimaryAffiliation =
+    affiliation;
+  return ctx;
+}
+
+/**
+ * Crée une Request GET simple.
+ */
+export function makeGetRequest(
+  path: string,
+  searchParams?: Record<string, string>,
+): Request {
+  const url = new URL(`http://localhost${path}`);
+  if (searchParams) {
+    for (const [k, v] of Object.entries(searchParams)) {
+      url.searchParams.set(k, v);
+    }
+  }
+  return new Request(url.toString());
+}
+
+/**
+ * Crée une Request POST/PUT avec un corps JSON.
+ */
+export function makeJsonRequest(
+  path: string,
+  method: string,
+  body: unknown,
+): Request {
+  return new Request(`http://localhost${path}`, {
+    method,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
@@ -0,0 +1,104 @@
+// #113 - Integration tests for /modules endpoints
+
+import { assertEquals, assertExists, assertRejects } from "@std/assert";
+import { seedModules, testDb, truncateAll } from "../helpers/db_integration.ts";
+import { modules } from "$root/databases/schema.ts";
+import { eq } from "npm:drizzle-orm@0.45.2";
+
+Deno.test({
+  name: "integration modules: list all modules",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "MATH101", nom: "Mathématiques" }, {
+      id: "INFO101",
+      nom: "Informatique",
+    }]);
+    const rows = await testDb.select().from(modules);
+    assertEquals(rows.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration modules: create and retrieve by id",
+  async fn() {
+    await truncateAll();
+    const [created] = await testDb.insert(modules).values({
+      id: "PHYS101",
+      nom: "Physique",
+    }).returning();
+    assertExists(created);
+    assertEquals(created.id, "PHYS101");
+
+    const row = await testDb
+      .select()
+      .from(modules)
+      .where(eq(modules.id, "PHYS101"))
+      .then((r) => r[0] ?? null);
+    assertExists(row);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration modules: get by id returns null when not found",
+  async fn() {
+    await truncateAll();
+    const row = await testDb
+      .select()
+      .from(modules)
+      .where(eq(modules.id, "NONEXISTENT"))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration modules: duplicate id insert fails",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "MATH101", nom: "Mathématiques" }]);
+    await assertRejects(() =>
+      testDb.insert(modules).values({ id: "MATH101", nom: "Doublon" })
+    );
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration modules: update nom",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "ELEC201", nom: "Électronique" }]);
+    const [updated] = await testDb
+      .update(modules)
+      .set({ nom: "Électronique numérique" })
+      .where(eq(modules.id, "ELEC201"))
+      .returning();
+    assertEquals(updated.nom, "Électronique numérique");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration modules: delete removes the module",
+  async fn() {
+    await truncateAll();
+    await seedModules([{ id: "BIO101", nom: "Biologie" }]);
+    await testDb.delete(modules).where(eq(modules.id, "BIO101"));
+    const row = await testDb
+      .select()
+      .from(modules)
+      .where(eq(modules.id, "BIO101"))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -0,0 +1,112 @@
+// #110 - Integration tests for /promotions endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import {
+  seedPromotions,
+  testDb,
+  truncateAll,
+} from "../helpers/db_integration.ts";
+import { promotions } from "$root/databases/schema.ts";
+import { eq } from "npm:drizzle-orm@0.45.2";
+
+Deno.test({
+  name: "integration promotions: list all",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([
+      { id: "PEIP1-2024", annee: "2024" },
+      { id: "PEIP2-2024", annee: "2024" },
+    ]);
+    const rows = await testDb.select().from(promotions);
+    assertEquals(rows.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: create and retrieve by id",
+  async fn() {
+    await truncateAll();
+    const [created] = await testDb
+      .insert(promotions)
+      .values({ id: "INFO3-2025", annee: "2025" })
+      .returning();
+    assertExists(created);
+    assertEquals(created.id, "INFO3-2025");
+    assertEquals(created.annee, "2025");
+
+    const row = await testDb
+      .select()
+      .from(promotions)
+      .where(eq(promotions.id, "INFO3-2025"))
+      .then((r) => r[0] ?? null);
+    assertExists(row);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: get by id returns null when not found",
+  async fn() {
+    await truncateAll();
+    const row = await testDb
+      .select()
+      .from(promotions)
+      .where(eq(promotions.id, "NONEXISTENT"))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: update annee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2023", annee: "2023" }]);
+    const [updated] = await testDb
+      .update(promotions)
+      .set({ annee: "2024" })
+      .where(eq(promotions.id, "INFO3-2023"))
+      .returning();
+    assertExists(updated);
+    assertEquals(updated.annee, "2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: delete removes the row",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2022", annee: "2022" }]);
+    await testDb.delete(promotions).where(eq(promotions.id, "INFO3-2022"));
+    const row = await testDb
+      .select()
+      .from(promotions)
+      .where(eq(promotions.id, "INFO3-2022"))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: update non-existent returns empty",
+  async fn() {
+    await truncateAll();
+    const result = await testDb
+      .update(promotions)
+      .set({ annee: "2099" })
+      .where(eq(promotions.id, "GHOST"))
+      .returning();
+    assertEquals(result.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -0,0 +1,123 @@
+// #112 - Integration tests for /roles endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import { seedRoles, testDb, truncateAll } from "../helpers/db_integration.ts";
+import { permissions, rolePermissions, roles } from "$root/databases/schema.ts";
+import { eq } from "npm:drizzle-orm@0.45.2";
+
+Deno.test({
+  name: "integration roles: list all roles",
+  async fn() {
+    await truncateAll();
+    await seedRoles([{ nom: "admin" }, { nom: "employee" }]);
+    const rows = await testDb.select().from(roles);
+    assertEquals(rows.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: create and retrieve by id",
+  async fn() {
+    await truncateAll();
+    const [created] = await testDb.insert(roles).values({ nom: "viewer" })
+      .returning();
+    assertExists(created.id);
+    assertEquals(created.nom, "viewer");
+    const row = await testDb
+      .select()
+      .from(roles)
+      .where(eq(roles.id, created.id))
+      .then((r) => r[0] ?? null);
+    assertExists(row);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: assign and retrieve permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "admin" }]);
+    await testDb.insert(permissions).values([
+      { id: "student_read", nom: "Consulter les élèves" },
+      { id: "student_write", nom: "Gérer les élèves" },
+    ]);
+    await testDb.insert(rolePermissions).values([
+      { idRole: role.id, idPermission: "student_read" },
+      { idRole: role.id, idPermission: "student_write" },
+    ]);
+    const perms = await testDb
+      .select()
+      .from(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+    assertEquals(perms.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: update role nom",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "employee" }]);
+    const [updated] = await testDb
+      .update(roles)
+      .set({ nom: "teacher" })
+      .where(eq(roles.id, role.id))
+      .returning();
+    assertEquals(updated.nom, "teacher");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: reset permissions on update",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "admin" }]);
+    await testDb.insert(permissions).values([
+      { id: "note_read", nom: "Consulter les notes" },
+      { id: "note_write", nom: "Gérer les notes" },
+    ]);
+    await testDb.insert(rolePermissions).values([
+      { idRole: role.id, idPermission: "note_read" },
+    ]);
+    // reset
+    await testDb.delete(rolePermissions).where(
+      eq(rolePermissions.idRole, role.id),
+    );
+    await testDb.insert(rolePermissions).values([
+      { idRole: role.id, idPermission: "note_write" },
+    ]);
+    const perms = await testDb
+      .select()
+      .from(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+    assertEquals(perms.length, 1);
+    assertEquals(perms[0].idPermission, "note_write");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: delete role removes it",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "moderator" }]);
+    await testDb.delete(roles).where(eq(roles.id, role.id));
+    const row = await testDb
+      .select()
+      .from(roles)
+      .where(eq(roles.id, role.id))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -0,0 +1,173 @@
+// #109 - Integration tests for /students endpoints
+// Teste les opérations DB directement avec une vraie base de données
+
+import { assertEquals, assertExists } from "@std/assert";
+import {
+  seedPromotions,
+  seedStudents,
+  testDb,
+  truncateAll,
+} from "../helpers/db_integration.ts";
+import { students } from "$root/databases/schema.ts";
+import { eq } from "npm:drizzle-orm@0.45.2";
+
+Deno.test({
+  name: "integration students: list all students",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "PEIP1-2024" }]);
+    await seedStudents([
+      { nom: "Dupont", prenom: "Jean", idPromo: "PEIP1-2024" },
+      { nom: "Martin", prenom: "Alice", idPromo: "PEIP1-2024" },
+    ]);
+
+    const rows = await testDb.select().from(students);
+    assertEquals(rows.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration students: filter by idPromo",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "PEIP1-2024" }, { id: "PEIP2-2024" }]);
+    await seedStudents([
+      { nom: "Dupont", prenom: "Jean", idPromo: "PEIP1-2024" },
+      { nom: "Martin", prenom: "Alice", idPromo: "PEIP1-2024" },
+      { nom: "Durand", prenom: "Claire", idPromo: "PEIP2-2024" },
+    ]);
+
+    const rows = await testDb
+      .select()
+      .from(students)
+      .where(eq(students.idPromo, "PEIP1-2024"));
+    assertEquals(rows.length, 2);
+    assertEquals(rows.every((s) => s.idPromo === "PEIP1-2024"), true);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration students: create and retrieve by numEtud",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }]);
+
+    const [created] = await testDb
+      .insert(students)
+      .values({ nom: "Leroy", prenom: "Paul", idPromo: "INFO3-2024" })
+      .returning();
+
+    assertExists(created.numEtud);
+
+    const row = await testDb
+      .select()
+      .from(students)
+      .where(eq(students.numEtud, created.numEtud))
+      .then((r) => r[0] ?? null);
+
+    assertExists(row);
+    assertEquals(row.nom, "Leroy");
+    assertEquals(row.idPromo, "INFO3-2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration students: get by numEtud returns null when not found",
+  async fn() {
+    await truncateAll();
+
+    const row = await testDb
+      .select()
+      .from(students)
+      .where(eq(students.numEtud, 999999))
+      .then((r) => r[0] ?? null);
+
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration students: update student fields",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }, { id: "INFO4-2024" }]);
+    const [s] = await seedStudents([
+      { nom: "Petit", prenom: "Hugo", idPromo: "INFO3-2024" },
+    ]);
+
+    const [updated] = await testDb
+      .update(students)
+      .set({ nom: "Grand", idPromo: "INFO4-2024" })
+      .where(eq(students.numEtud, s.numEtud))
+      .returning();
+
+    assertEquals(updated.nom, "Grand");
+    assertEquals(updated.idPromo, "INFO4-2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration students: delete student",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024" }]);
+    const [s] = await seedStudents([
+      { nom: "Thomas", prenom: "Eva", idPromo: "INFO3-2024" },
+    ]);
+
+    await testDb.delete(students).where(eq(students.numEtud, s.numEtud));
+
+    const row = await testDb
+      .select()
+      .from(students)
+      .where(eq(students.numEtud, s.numEtud))
+      .then((r) => r[0] ?? null);
+
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration students: update non-existent student returns empty",
+  async fn() {
+    await truncateAll();
+
+    const result = await testDb
+      .update(students)
+      .set({ nom: "Ghost" })
+      .where(eq(students.numEtud, 999999))
+      .returning();
+
+    assertEquals(result.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration students: delete non-existent student returns empty",
+  async fn() {
+    await truncateAll();
+
+    const result = await testDb
+      .delete(students)
+      .where(eq(students.numEtud, 999999))
+      .returning();
+
+    assertEquals(result.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
@@ -1,24 +1,24 @@
-// #111 - Integration tests for /users endpoints
-
 import { assertEquals, assertExists } from "@std/assert";
 import {
+  closeTestPool,
  seedRoles,
  seedUsers,
  testDb,
  truncateAll,
 } from "../helpers/db_integration.ts";
 import { users } from "$root/databases/schema.ts";
-import { eq } from "npm:drizzle-orm@0.45.2";

 Deno.test({
-  name: "integration users: list all users",
+  name: "integration: GET /users - DB round trip",
  async fn() {
    await truncateAll();
+
    const [role] = await seedRoles([{ nom: "employee" }]);
    await seedUsers([
      { id: "dupont.jean", nom: "Dupont", prenom: "Jean", idRole: role.id },
      { id: "martin.alice", nom: "Martin", prenom: "Alice", idRole: role.id },
    ]);
+
    const rows = await testDb.select().from(users);
    assertEquals(rows.length, 2);
    assertExists(rows.find((u) => u.id === "dupont.jean"));
@@ -28,110 +28,30 @@ Deno.test({
 });

 Deno.test({
-  name: "integration users: filter by idRole",
+  name: "integration: INSERT user and retrieve by id",
  async fn() {
    await truncateAll();
-    const [role1] = await seedRoles([{ nom: "admin" }]);
-    const [role2] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([
-      { id: "u1", nom: "A", prenom: "A", idRole: role1.id },
-      { id: "u2", nom: "B", prenom: "B", idRole: role2.id },
-    ]);
-    const rows = await testDb
-      .select()
-      .from(users)
-      .where(eq(users.idRole, role1.id));
-    assertEquals(rows.length, 1);
-    assertEquals(rows[0].id, "u1");
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});

-Deno.test({
-  name: "integration users: create and retrieve by id",
-  async fn() {
-    await truncateAll();
    const [role] = await seedRoles([{ nom: "admin" }]);
-    const [created] = await testDb
-      .insert(users)
-      .values({
-        id: "durand.claire",
-        nom: "Durand",
-        prenom: "Claire",
-        idRole: role.id,
-      })
-      .returning();
+    const [created] = await testDb.insert(users).values({
+      id: "durand.claire",
+      nom: "Durand",
+      prenom: "Claire",
+      idRole: role.id,
+    }).returning();
+
    assertExists(created);
    assertEquals(created.id, "durand.claire");
-
-    const row = await testDb
-      .select()
-      .from(users)
-      .where(eq(users.id, "durand.claire"))
-      .then((r) => r[0] ?? null);
-    assertExists(row);
+    assertEquals(created.nom, "Durand");
  },
  sanitizeResources: false,
  sanitizeOps: false,
 });

 Deno.test({
-  name: "integration users: get by id returns null when not found",
+  name: "integration: cleanup - close pool",
  async fn() {
-    await truncateAll();
-    const row = await testDb
-      .select()
-      .from(users)
-      .where(eq(users.id, "nonexistent"))
-      .then((r) => r[0] ?? null);
-    assertEquals(row, null);
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "integration users: update user fields",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([{
-      id: "test.user",
-      nom: "Test",
-      prenom: "User",
-      idRole: role.id,
-    }]);
-    const [updated] = await testDb
-      .update(users)
-      .set({ nom: "Updated", prenom: "Name" })
-      .where(eq(users.id, "test.user"))
-      .returning();
-    assertExists(updated);
-    assertEquals(updated.nom, "Updated");
-  },
-  sanitizeResources: false,
-  sanitizeOps: false,
-});
-
-Deno.test({
-  name: "integration users: delete user",
-  async fn() {
-    await truncateAll();
-    const [role] = await seedRoles([{ nom: "employee" }]);
-    await seedUsers([{
-      id: "to.delete",
-      nom: "Del",
-      prenom: "Me",
-      idRole: role.id,
-    }]);
-    await testDb.delete(users).where(eq(users.id, "to.delete"));
-    const row = await testDb
-      .select()
-      .from(users)
-      .where(eq(users.id, "to.delete"))
-      .then((r) => r[0] ?? null);
-    assertEquals(row, null);
+    await closeTestPool();
  },
  sanitizeResources: false,
  sanitizeOps: false,
@@ -0,0 +1,171 @@
+// #113 - Unit tests for /modules endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import { mockFetch, restoreFetch } from "../helpers/api_mock.ts";
+import { createMockDb } from "../helpers/db_mock.ts";
+import { type Module, modules } from "../helpers/fixtures.ts";
+
+// --- Fixtures ---
+
+Deno.test("modules: fixtures have correct shape", () => {
+  assertEquals(modules.length, 3);
+  assertEquals(typeof modules[0].id, "string");
+  assertEquals(typeof modules[0].nom, "string");
+});
+
+// --- Mock API ---
+
+Deno.test("mock API: GET /modules returns list", async () => {
+  mockFetch({ "/modules": modules });
+  try {
+    const res = await fetch("http://localhost/api/modules");
+    assertEquals(res.status, 200);
+    const data: Module[] = await res.json();
+    assertEquals(data.length, 3);
+    assertExists(data.find((m) => m.id === "JIN702C"));
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /modules/:id returns one module", async () => {
+  mockFetch({ "/modules/JIN702C": modules[0] });
+  try {
+    const res = await fetch("http://localhost/api/modules/JIN702C");
+    assertEquals(res.status, 200);
+    const data: Module = await res.json();
+    assertEquals(data.id, "JIN702C");
+    assertEquals(data.nom, "Optimisation");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /modules/:id 404 when not found", async () => {
+  mockFetch({
+    "/modules/UNKNOWN": {
+      status: 404,
+      body: { error: "Ressource introuvable" },
+    },
+  });
+  try {
+    const res = await fetch("http://localhost/api/modules/UNKNOWN");
+    assertEquals(res.status, 404);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /modules creates module (201)", async () => {
+  const newModule: Module = { id: "NEW101", nom: "Nouveau Module" };
+  mockFetch({ "/modules": { method: "POST", status: 201, body: newModule } });
+  try {
+    const res = await fetch("http://localhost/api/modules", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(newModule),
+    });
+    assertEquals(res.status, 201);
+    const data: Module = await res.json();
+    assertEquals(data.id, "NEW101");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /modules 409 on duplicate id", async () => {
+  mockFetch({
+    "/modules": {
+      method: "POST",
+      status: 409,
+      body: { error: "Un module avec cet identifiant existe déjà" },
+    },
+  });
+  try {
+    const res = await fetch("http://localhost/api/modules", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(modules[0]),
+    });
+    assertEquals(res.status, 409);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /modules 400 on missing fields", async () => {
+  mockFetch({ "/modules": { method: "POST", status: 400 } });
+  try {
+    const res = await fetch("http://localhost/api/modules", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: "X" }),
+    });
+    assertEquals(res.status, 400);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: PUT /modules/:id updates nom", async () => {
+  const updated: Module = { id: "JIN702C", nom: "Optimisation avancée" };
+  mockFetch({
+    "/modules/JIN702C": { method: "PUT", status: 200, body: updated },
+  });
+  try {
+    const res = await fetch("http://localhost/api/modules/JIN702C", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ nom: "Optimisation avancée" }),
+    });
+    assertEquals(res.status, 200);
+    const data: Module = await res.json();
+    assertEquals(data.nom, "Optimisation avancée");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: DELETE /modules/:id returns 204", async () => {
+  mockFetch({ "/modules/JIN702C": { method: "DELETE", status: 204 } });
+  try {
+    const res = await fetch("http://localhost/api/modules/JIN702C", {
+      method: "DELETE",
+    });
+    assertEquals(res.status, 204);
+  } finally {
+    restoreFetch();
+  }
+});
+
+// --- Mock DB ---
+
+Deno.test("mock DB: find module by id", () => {
+  const db = createMockDb({ tables: { modules: [...modules] } });
+  const m = db.findOne<Module>("modules", (m) => m.id === "JIN702C");
+  assertExists(m);
+  assertEquals(m.nom, "Optimisation");
+});
+
+Deno.test("mock DB: insert module", () => {
+  const db = createMockDb({ tables: { modules: [...modules] } });
+  db.insert<Module>("modules", { id: "NEW101", nom: "Nouveau" });
+  assertEquals(db.getTable("modules").length, 4);
+});
+
+Deno.test("mock DB: update module nom", () => {
+  const db = createMockDb({ tables: { modules: [...modules] } });
+  db.updateWhere<Module>("modules", (m) => m.id === "JIN702C", {
+    nom: "Updated",
+  });
+  assertEquals(
+    db.findOne<Module>("modules", (m) => m.id === "JIN702C")?.nom,
+    "Updated",
+  );
+});
+
+Deno.test("mock DB: delete module", () => {
+  const db = createMockDb({ tables: { modules: [...modules] } });
+  db.deleteWhere<Module>("modules", (m) => m.id === "JIN702C");
+  assertEquals(db.getTable("modules").length, 2);
+});
@@ -0,0 +1,160 @@
+// #110 - Unit tests for /promotions endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import { mockFetch, restoreFetch } from "../helpers/api_mock.ts";
+import { createMockDb } from "../helpers/db_mock.ts";
+import { type Promotion, promotions } from "../helpers/fixtures.ts";
+
+// --- Fixtures ---
+
+Deno.test("promotions: fixtures have correct shape", () => {
+  assertEquals(promotions.length, 3);
+  assertEquals(typeof promotions[0].idPromo, "string");
+  assertEquals(typeof promotions[0].annee, "string");
+});
+
+// --- Mock API ---
+
+Deno.test("mock API: GET /promotions returns list", async () => {
+  mockFetch({ "/promotions": promotions });
+  try {
+    const res = await fetch("http://localhost/api/promotions");
+    assertEquals(res.status, 200);
+    const data: Promotion[] = await res.json();
+    assertEquals(data.length, 3);
+    assertExists(data.find((p) => p.idPromo === "4AFISE25/26"));
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /promotions/:id returns one", async () => {
+  mockFetch({ "/promotions/4AFISE25%2F26": promotions[0] });
+  try {
+    const res = await fetch("http://localhost/api/promotions/4AFISE25%2F26");
+    assertEquals(res.status, 200);
+    const data: Promotion = await res.json();
+    assertEquals(data.idPromo, "4AFISE25/26");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /promotions/:id 404 when not found", async () => {
+  mockFetch({
+    "/promotions/UNKNOWN": {
+      status: 404,
+      body: { error: "Ressource introuvable" },
+    },
+  });
+  try {
+    const res = await fetch("http://localhost/api/promotions/UNKNOWN");
+    assertEquals(res.status, 404);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /promotions creates promotion (201)", async () => {
+  const newPromo: Promotion = { idPromo: "NEW2025", annee: "2025" };
+  mockFetch({ "/promotions": { method: "POST", status: 201, body: newPromo } });
+  try {
+    const res = await fetch("http://localhost/api/promotions", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ idPromo: "NEW2025", annee: "2025" }),
+    });
+    assertEquals(res.status, 201);
+    const data: Promotion = await res.json();
+    assertEquals(data.idPromo, "NEW2025");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /promotions 400 on missing fields", async () => {
+  mockFetch({ "/promotions": { method: "POST", status: 400 } });
+  try {
+    const res = await fetch("http://localhost/api/promotions", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ idPromo: "NEW2025" }),
+    });
+    assertEquals(res.status, 400);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: PUT /promotions/:id updates promotion", async () => {
+  const updated = { idPromo: "4AFISE25/26", annee: "2026" };
+  mockFetch({
+    "/promotions/4AFISE25%2F26": { method: "PUT", status: 200, body: updated },
+  });
+  try {
+    const res = await fetch("http://localhost/api/promotions/4AFISE25%2F26", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ annee: "2026" }),
+    });
+    assertEquals(res.status, 200);
+    const data: Promotion = await res.json();
+    assertEquals(data.annee, "2026");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: DELETE /promotions/:id returns 204", async () => {
+  mockFetch({ "/promotions/4AFISE25%2F26": { method: "DELETE", status: 204 } });
+  try {
+    const res = await fetch("http://localhost/api/promotions/4AFISE25%2F26", {
+      method: "DELETE",
+    });
+    assertEquals(res.status, 204);
+  } finally {
+    restoreFetch();
+  }
+});
+
+// --- Mock DB ---
+
+Deno.test("mock DB: find promotion by idPromo", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  const p = db.findOne<Promotion>(
+    "promotions",
+    (r) => r.idPromo === "4AFISE25/26",
+  );
+  assertExists(p);
+  assertEquals(p.annee, "2025");
+});
+
+Deno.test("mock DB: insert promotion", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  db.insert<Promotion>("promotions", { idPromo: "NEW2025", annee: "2025" });
+  assertEquals(db.getTable("promotions").length, 4);
+});
+
+Deno.test("mock DB: update promotion annee", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  db.updateWhere<Promotion>(
+    "promotions",
+    (p) => p.idPromo === "4AFISE25/26",
+    { annee: "2026" },
+  );
+  assertEquals(
+    db.findOne<Promotion>("promotions", (p) => p.idPromo === "4AFISE25/26")
+      ?.annee,
+    "2026",
+  );
+});
+
+Deno.test("mock DB: delete promotion", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  const count = db.deleteWhere<Promotion>(
+    "promotions",
+    (p) => p.idPromo === "4AFISE25/26",
+  );
+  assertEquals(count, 1);
+  assertEquals(db.getTable("promotions").length, 2);
+});
@@ -0,0 +1,159 @@
+// #112 - Unit tests for /roles endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import { mockFetch, restoreFetch } from "../helpers/api_mock.ts";
+import { createMockDb } from "../helpers/db_mock.ts";
+
+interface Role {
+  id: number;
+  nom: string;
+  permissions: string[];
+}
+
+const roles: Role[] = [
+  { id: 1, nom: "admin", permissions: ["student_read", "student_write"] },
+  { id: 2, nom: "employee", permissions: ["student_read"] },
+];
+
+// --- Fixtures ---
+
+Deno.test("roles: fixtures have correct shape", () => {
+  assertEquals(roles.length, 2);
+  assertEquals(typeof roles[0].id, "number");
+  assertEquals(typeof roles[0].nom, "string");
+  assertEquals(Array.isArray(roles[0].permissions), true);
+});
+
+Deno.test("roles: permissions are strings", () => {
+  assertEquals(roles[0].permissions.every((p) => typeof p === "string"), true);
+});
+
+// --- Mock API ---
+
+Deno.test("mock API: GET /roles returns list with permissions", async () => {
+  mockFetch({ "/roles": roles });
+  try {
+    const res = await fetch("http://localhost/api/roles");
+    assertEquals(res.status, 200);
+    const data: Role[] = await res.json();
+    assertEquals(data.length, 2);
+    assertExists(data.find((r) => r.nom === "admin"));
+    assertEquals(data[0].permissions.length, 2);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /roles/:id returns role", async () => {
+  mockFetch({ "/roles/1": roles[0] });
+  try {
+    const res = await fetch("http://localhost/api/roles/1");
+    assertEquals(res.status, 200);
+    const data: Role = await res.json();
+    assertEquals(data.nom, "admin");
+    assertEquals(data.permissions.length, 2);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /roles/:id 404 when not found", async () => {
+  mockFetch({
+    "/roles/99": { status: 404, body: { error: "Ressource introuvable" } },
+  });
+  try {
+    const res = await fetch("http://localhost/api/roles/99");
+    assertEquals(res.status, 404);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /roles creates role (201)", async () => {
+  const newRole: Role = { id: 3, nom: "viewer", permissions: [] };
+  mockFetch({ "/roles": { method: "POST", status: 201, body: newRole } });
+  try {
+    const res = await fetch("http://localhost/api/roles", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ nom: "viewer" }),
+    });
+    assertEquals(res.status, 201);
+    const data: Role = await res.json();
+    assertEquals(data.nom, "viewer");
+    assertEquals(data.permissions.length, 0);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /roles 400 on missing nom", async () => {
+  mockFetch({ "/roles": { method: "POST", status: 400 } });
+  try {
+    const res = await fetch("http://localhost/api/roles", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({}),
+    });
+    assertEquals(res.status, 400);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: PUT /roles/:id updates role and permissions", async () => {
+  const updated: Role = { id: 2, nom: "teacher", permissions: ["note_read"] };
+  mockFetch({ "/roles/2": { method: "PUT", status: 200, body: updated } });
+  try {
+    const res = await fetch("http://localhost/api/roles/2", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ nom: "teacher", permissions: ["note_read"] }),
+    });
+    assertEquals(res.status, 200);
+    const data: Role = await res.json();
+    assertEquals(data.nom, "teacher");
+    assertEquals(data.permissions, ["note_read"]);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: DELETE /roles/:id returns 204", async () => {
+  mockFetch({ "/roles/2": { method: "DELETE", status: 204 } });
+  try {
+    const res = await fetch("http://localhost/api/roles/2", {
+      method: "DELETE",
+    });
+    assertEquals(res.status, 204);
+  } finally {
+    restoreFetch();
+  }
+});
+
+// --- Mock DB ---
+
+Deno.test("mock DB: find role by id", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  const r = db.findOne<Role>("roles", (r) => r.id === 1);
+  assertExists(r);
+  assertEquals(r.nom, "admin");
+});
+
+Deno.test("mock DB: insert role", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  db.insert<Role>("roles", { id: 3, nom: "viewer", permissions: [] });
+  assertEquals(db.getTable("roles").length, 3);
+});
+
+Deno.test("mock DB: update role nom", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  db.updateWhere<Role>("roles", (r) => r.id === 2, { nom: "teacher" });
+  assertEquals(db.findOne<Role>("roles", (r) => r.id === 2)?.nom, "teacher");
+});
+
+Deno.test("mock DB: delete role", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  db.deleteWhere<Role>("roles", (r) => r.id === 1);
+  assertEquals(db.getTable("roles").length, 1);
+});
@@ -0,0 +1,216 @@
+// #109 - Unit tests for /students endpoints
+// Tests purs : fixtures, mock API, mock DB — aucun appel réseau réel
+
+import { assertEquals, assertExists } from "@std/assert";
+import { getFetchCalls, mockFetch, restoreFetch } from "../helpers/api_mock.ts";
+import { createMockDb } from "../helpers/db_mock.ts";
+import { type Student, students } from "../helpers/fixtures.ts";
+
+// --- Fixtures ---
+
+Deno.test("students: fixtures have correct shape", () => {
+  assertEquals(students.length, 3);
+  assertEquals(typeof students[0].numEtud, "number");
+  assertEquals(typeof students[0].nom, "string");
+  assertEquals(typeof students[0].prenom, "string");
+  assertEquals(typeof students[0].idPromo, "string");
+});
+
+Deno.test("students: two students belong to the same promo", () => {
+  const promo4 = students.filter((s) => s.idPromo === "4AFISE25/26");
+  assertEquals(promo4.length, 2);
+});
+
+// --- Mock API - GET /students ---
+
+Deno.test("mock API: GET /students returns list", async () => {
+  mockFetch({ "/students": students });
+  try {
+    const res = await fetch("http://localhost/api/students");
+    assertEquals(res.status, 200);
+    const data: Student[] = await res.json();
+    assertEquals(data.length, 3);
+    assertExists(data.find((s) => s.nom === "Dupont"));
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /students?idPromo filters by promo", async () => {
+  const filtered = students.filter((s) => s.idPromo === "4AFISE25/26");
+  mockFetch({ "/students": filtered });
+  try {
+    const res = await fetch(
+      "http://localhost/api/students?idPromo=4AFISE25/26",
+    );
+    const data: Student[] = await res.json();
+    assertEquals(data.length, 2);
+    assertEquals(data.every((s) => s.idPromo === "4AFISE25/26"), true);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /students/:numEtud returns one student", async () => {
+  mockFetch({ "/students/21212006": students[0] });
+  try {
+    const res = await fetch("http://localhost/api/students/21212006");
+    assertEquals(res.status, 200);
+    const data: Student = await res.json();
+    assertEquals(data.numEtud, 21212006);
+    assertEquals(data.nom, "Dupont");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /students/:numEtud 404 when not found", async () => {
+  mockFetch({
+    "/students/99999": {
+      status: 404,
+      body: { error: "Ressource introuvable" },
+    },
+  });
+  try {
+    const res = await fetch("http://localhost/api/students/99999");
+    assertEquals(res.status, 404);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /students creates student", async () => {
+  const newStudent = students[0];
+  mockFetch({ "/students": { method: "POST", status: 201, body: newStudent } });
+  try {
+    const res = await fetch("http://localhost/api/students", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        nom: "Dupont",
+        prenom: "Jean",
+        idPromo: "4AFISE25/26",
+      }),
+    });
+    assertEquals(res.status, 201);
+    const data: Student = await res.json();
+    assertEquals(data.nom, "Dupont");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: PUT /students/:numEtud updates student", async () => {
+  const updated = { ...students[0], nom: "Dupont-Modifié" };
+  mockFetch({
+    "/students/21212006": { method: "PUT", status: 200, body: updated },
+  });
+  try {
+    const res = await fetch("http://localhost/api/students/21212006", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        nom: "Dupont-Modifié",
+        prenom: "Jean",
+        idPromo: "4AFISE25/26",
+      }),
+    });
+    assertEquals(res.status, 200);
+    const data: Student = await res.json();
+    assertEquals(data.nom, "Dupont-Modifié");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: DELETE /students/:numEtud returns 204", async () => {
+  mockFetch({ "/students/21212006": { method: "DELETE", status: 204 } });
+  try {
+    const res = await fetch("http://localhost/api/students/21212006", {
+      method: "DELETE",
+    });
+    assertEquals(res.status, 204);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /students 400 on missing fields", async () => {
+  mockFetch({ "/students": { method: "POST", status: 400 } });
+  try {
+    const res = await fetch("http://localhost/api/students", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ nom: "Test" }),
+    });
+    assertEquals(res.status, 400);
+  } finally {
+    restoreFetch();
+  }
+});
+
+// --- Mock DB ---
+
+Deno.test("mock DB: find student by numEtud", () => {
+  const db = createMockDb({ tables: { students: [...students] } });
+  const s = db.findOne<Student>("students", (r) => r.numEtud === 21212006);
+  assertExists(s);
+  assertEquals(s.nom, "Dupont");
+});
+
+Deno.test("mock DB: filter students by idPromo", () => {
+  const db = createMockDb({ tables: { students: [...students] } });
+  const rows = db.findMany<Student>(
+    "students",
+    (s) => s.idPromo === "4AFISE25/26",
+  );
+  assertEquals(rows.length, 2);
+});
+
+Deno.test("mock DB: insert student increments count", () => {
+  const db = createMockDb({ tables: { students: [...students] } });
+  db.insert<Student>("students", {
+    numEtud: 21212099,
+    nom: "Test",
+    prenom: "Ing",
+    idPromo: "4AFISE25/26",
+  });
+  assertEquals(db.getTable("students").length, 4);
+});
+
+Deno.test("mock DB: update student nom", () => {
+  const db = createMockDb({ tables: { students: [...students] } });
+  const count = db.updateWhere<Student>(
+    "students",
+    (s) => s.numEtud === 21212006,
+    { nom: "Nouveau" },
+  );
+  assertEquals(count, 1);
+  assertEquals(
+    db.findOne<Student>("students", (s) => s.numEtud === 21212006)?.nom,
+    "Nouveau",
+  );
+});
+
+Deno.test("mock DB: delete student removes exactly one", () => {
+  const db = createMockDb({ tables: { students: [...students] } });
+  const count = db.deleteWhere<Student>(
+    "students",
+    (s) => s.numEtud === 21212006,
+  );
+  assertEquals(count, 1);
+  assertEquals(db.getTable("students").length, 2);
+});
+
+Deno.test("mock API: getFetchCalls tracks student requests", async () => {
+  mockFetch({ "/students": students });
+  try {
+    await fetch("http://localhost/api/students");
+    await fetch("http://localhost/api/students?idPromo=4AFISE25/26");
+    const calls = getFetchCalls();
+    assertEquals(calls.length, 2);
+    assertEquals(calls[0].method, "GET");
+  } finally {
+    restoreFetch();
+  }
+});
@@ -1,216 +0,0 @@
-import { assertEquals } from "@std/assert";
-import { getFetchCalls, mockFetch, restoreFetch } from "../helpers/api_mock.ts";
-
-const BASE = "http://localhost/apps/admin/api/users";
-
-const users = [
-  { id: "dupont.jean", nom: "Dupont", prenom: "Jean", idRole: 1 },
-  { id: "martin.alice", nom: "Martin", prenom: "Alice", idRole: 2 },
-];
-
-// --- GET /users ---
-
-Deno.test("GET /users - returns all users", async () => {
-  mockFetch({ [BASE]: users });
-  try {
-    const res = await fetch(BASE);
-    assertEquals(res.status, 200);
-    const data = await res.json();
-    assertEquals(data.length, 2);
-    assertEquals(data[0].id, "dupont.jean");
-  } finally {
-    restoreFetch();
-  }
-});
-
-Deno.test("GET /users - filters by idRole", async () => {
-  const filtered = users.filter((u) => u.idRole === 1);
-  mockFetch({ [`${BASE}?idRole=1`]: filtered });
-  try {
-    const res = await fetch(`${BASE}?idRole=1`);
-    assertEquals(res.status, 200);
-    const data = await res.json();
-    assertEquals(data.length, 1);
-    assertEquals(data[0].idRole, 1);
-  } finally {
-    restoreFetch();
-  }
-});
-
-// --- POST /users ---
-
-Deno.test("POST /users - creates a user and returns 201", async () => {
-  const newUser = {
-    id: "durand.claire",
-    nom: "Durand",
-    prenom: "Claire",
-    idRole: 1,
-  };
-  mockFetch({ [BASE]: { method: "POST", status: 201, body: newUser } });
-  try {
-    const res = await fetch(BASE, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(newUser),
-    });
-    assertEquals(res.status, 201);
-    const data = await res.json();
-    assertEquals(data.id, "durand.claire");
-    assertEquals(data.nom, "Durand");
-  } finally {
-    restoreFetch();
-  }
-});
-
-Deno.test("POST /users - returns 409 on duplicate id", async () => {
-  mockFetch({
-    [BASE]: {
-      method: "POST",
-      status: 409,
-      body: { error: "Un utilisateur avec cet identifiant existe déjà" },
-    },
-  });
-  try {
-    const res = await fetch(BASE, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(users[0]),
-    });
-    assertEquals(res.status, 409);
-    const data = await res.json();
-    assertEquals(typeof data.error, "string");
-  } finally {
-    restoreFetch();
-  }
-});
-
-Deno.test("POST /users - returns 400 on missing fields", async () => {
-  mockFetch({ [BASE]: { method: "POST", status: 400 } });
-  try {
-    const res = await fetch(BASE, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ id: "x" }),
-    });
-    assertEquals(res.status, 400);
-  } finally {
-    restoreFetch();
-  }
-});
-
-// --- GET /users/{id} ---
-
-Deno.test("GET /users/{id} - returns a user by id", async () => {
-  mockFetch({ [`${BASE}/dupont.jean`]: users[0] });
-  try {
-    const res = await fetch(`${BASE}/dupont.jean`);
-    assertEquals(res.status, 200);
-    const data = await res.json();
-    assertEquals(data.id, "dupont.jean");
-    assertEquals(data.prenom, "Jean");
-  } finally {
-    restoreFetch();
-  }
-});
-
-Deno.test("GET /users/{id} - returns 404 for unknown id", async () => {
-  mockFetch({
-    [`${BASE}/inconnu`]: {
-      status: 404,
-      body: { error: "Ressource introuvable" },
-    },
-  });
-  try {
-    const res = await fetch(`${BASE}/inconnu`);
-    assertEquals(res.status, 404);
-    const data = await res.json();
-    assertEquals(typeof data.error, "string");
-  } finally {
-    restoreFetch();
-  }
-});
-
-// --- PUT /users/{id} ---
-
-Deno.test("PUT /users/{id} - updates a user", async () => {
-  const updated = { ...users[0], prenom: "Jean-Pierre" };
-  mockFetch({
-    [`${BASE}/dupont.jean`]: { method: "PUT", status: 200, body: updated },
-  });
-  try {
-    const res = await fetch(`${BASE}/dupont.jean`, {
-      method: "PUT",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ nom: "Dupont", prenom: "Jean-Pierre", idRole: 1 }),
-    });
-    assertEquals(res.status, 200);
-    const data = await res.json();
-    assertEquals(data.prenom, "Jean-Pierre");
-  } finally {
-    restoreFetch();
-  }
-});
-
-Deno.test("PUT /users/{id} - returns 404 for unknown id", async () => {
-  mockFetch({
-    [`${BASE}/inconnu`]: {
-      method: "PUT",
-      status: 404,
-      body: { error: "Ressource introuvable" },
-    },
-  });
-  try {
-    const res = await fetch(`${BASE}/inconnu`, {
-      method: "PUT",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ nom: "X", prenom: "Y", idRole: 1 }),
-    });
-    assertEquals(res.status, 404);
-  } finally {
-    restoreFetch();
-  }
-});
-
-// --- DELETE /users/{id} ---
-
-Deno.test("DELETE /users/{id} - deletes a user and returns 204", async () => {
-  mockFetch({
-    [`${BASE}/dupont.jean`]: { method: "DELETE", status: 204 },
-  });
-  try {
-    const res = await fetch(`${BASE}/dupont.jean`, { method: "DELETE" });
-    assertEquals(res.status, 204);
-  } finally {
-    restoreFetch();
-  }
-});
-
-Deno.test("DELETE /users/{id} - returns 404 for unknown id", async () => {
-  mockFetch({
-    [`${BASE}/inconnu`]: {
-      method: "DELETE",
-      status: 404,
-      body: { error: "Ressource introuvable" },
-    },
-  });
-  try {
-    const res = await fetch(`${BASE}/inconnu`, { method: "DELETE" });
-    assertEquals(res.status, 404);
-  } finally {
-    restoreFetch();
-  }
-});
-
-// --- getFetchCalls ---
-
-Deno.test("GET /users - call is tracked", async () => {
-  mockFetch({ [BASE]: users });
-  try {
-    await fetch(BASE);
-    const calls = getFetchCalls();
-    assertEquals(calls.length, 1);
-    assertEquals(calls[0].method, "GET");
-  } finally {
-    restoreFetch();
-  }
-});
Author	SHA1	Message	Date
djalim	e3a7e20993	fix: remove unused assertExists import Check Deno code / Check Deno code (pull_request) Successful in 5s Details Tests / Unit tests (pull_request) Successful in 12s Details Tests / Integration tests (pull_request) Successful in 1m1s Details Check Deno code / Check Deno code (push) Successful in 5s Details Tests / Unit tests (push) Successful in 11s Details Tests / Integration tests (push) Successful in 1m10s Details	2026-04-26 13:34:27 +00:00
djalim	c5d02a2890	style: fix deno fmt and lint	2026-04-26 13:34:27 +00:00
djalim	c86d20ca81	test(modules): add unit, integration and e2e tests for /modules (#113 ) - unit: fixture shapes, mock API (GET/POST/PUT/DELETE + 409), mock DB CRUD - integration: list, create, get, duplicate rejection, update, delete - e2e: handler calls with mock context + real DB, covers 400/403/404/409	2026-04-26 13:34:27 +00:00
djalim	f038e4020b	style: fix deno fmt and lint Check Deno code / Check Deno code (pull_request) Successful in 6s Details Tests / Unit tests (pull_request) Successful in 11s Details Tests / Integration tests (pull_request) Successful in 59s Details Check Deno code / Check Deno code (push) Successful in 6s Details Tests / Unit tests (push) Successful in 11s Details Tests / Integration tests (push) Successful in 1m2s Details	2026-04-26 13:34:09 +00:00
djalim	e75098083a	test(roles): add unit, integration and e2e tests for /roles (#112 ) - unit: fixture shapes, mock API (GET/POST/PUT/DELETE), mock DB CRUD - integration: list, create, assign permissions, update, reset perms, delete - e2e: handler calls with mock context + real DB, covers 400/404 cases	2026-04-26 13:34:09 +00:00
djalim	e3eefd945c	chore: remove .github workflows (act only uses .gitea) Check Deno code / Check Deno code (pull_request) Successful in 5s Details Tests / Unit tests (pull_request) Successful in 12s Details Tests / Integration tests (pull_request) Successful in 1m3s Details Check Deno code / Check Deno code (push) Successful in 5s Details Tests / Unit tests (push) Successful in 12s Details Tests / Integration tests (push) Successful in 1m3s Details	2026-04-26 13:08:03 +00:00
djalim	d25c353018	fix: remove unused assertExists import	2026-04-26 13:08:03 +00:00
djalim	b3eb1b60a5	style: fix deno fmt and lint	2026-04-26 13:08:03 +00:00
djalim	222c3237f0	test(promotions): add unit, integration and e2e tests for /promotions (#110 ) - unit: fixture shapes, mock API (GET/POST/PUT/DELETE), mock DB CRUD - integration: real DB list, create, get, update, delete, not-found cases - e2e: handler calls with mock context + real DB, covers 400/403/404 cases	2026-04-26 13:08:03 +00:00
djalim	e2f5bf7b95	ci: remove Run tests step from lint workflow Check Deno code / Check Deno code (push) Successful in 6s Details Tests / Unit tests (push) Successful in 12s Details Tests / Integration tests (push) Successful in 57s Details Check Deno code / Check Deno code (pull_request) Successful in 6s Details Tests / Unit tests (pull_request) Successful in 12s Details Tests / Integration tests (pull_request) Successful in 1m3s Details	2026-04-26 14:30:40 +02:00
djalim	cd5c524ff0	style: fix deno fmt on students tests and drizzle.config Check Deno code / Check Deno code (pull_request) Failing after 8s Details Tests / Unit tests (pull_request) Successful in 11s Details Tests / Integration tests (pull_request) Successful in 58s Details	2026-04-26 14:18:09 +02:00
djalim	e5c6c389ea	test(students): add unit, integration and e2e tests for /students (#109 ) Check Deno code / Check Deno code (pull_request) Failing after 5s Details Tests / Unit tests (pull_request) Successful in 12s Details Tests / Integration tests (pull_request) Successful in 58s Details - unit: fixture shapes, mock API (GET/POST/PUT/DELETE), mock DB operations - integration: real DB CRUD via testDb (list, filter, create, get, update, delete) - e2e: handler calls directly with mock FreshContext + real DB covers auth (employee vs non-employee), 400/403/404 cases - adds test:e2e deno task and CI step - adds tests/helpers/handler.ts with makeEmployeeContext, makeContextWithAffiliation, makeGetRequest, makeJsonRequest utilities Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-26 14:00:38 +02:00