feat: add 2FA and change title

backend/gestion/handlers/auth.go

@@ -1,8 +1,11 @@
 package handlers
 
 import (
+	"crypto/rand"
+	"fmt"
 	"gestion/db"
 	"gestion/models"
+	"gestion/services"
 	"gestion/utils"
 	"log"
 	"net/http"
@@ -76,7 +79,7 @@ func RegisterClient(c *gin.Context) {
 	if err := c.ShouldBindJSON(&req); err != nil {
 		log.Printf("❌ [REGISTER_CLIENT] Erreur binding: %v", err)
 		c.JSON(http.StatusBadRequest, gin.H{
-			"error":   "Données invalides",
+			"error": "Données invalides",
 		})
 		return
 	}
@@ -242,8 +245,16 @@ func AdminCreateClient(c *gin.Context) {
 	})
 }
 
+func cryptoRandInt() int {
+	b := make([]byte, 4)
+	rand.Read(b)
+	return int(b[0])<<24 | int(b[1])<<16 | int(b[2])<<8 | int(b[3])
+}
+
 // LoginClient authentifie un client
 func LoginClient(c *gin.Context) {
+	database := c.MustGet("database").(*db.Database)
+
 	var req models.LoginRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		log.Printf("❌ [LOGIN_CLIENT] Erreur binding: %v", err)
@@ -251,8 +262,6 @@ func LoginClient(c *gin.Context) {
 		return
 	}
 
-	database := c.MustGet("database").(*db.Database)
-
 	client, err := database.GetClientByUsername(req.Username)
 	if err != nil || client == nil {
 		log.Printf("❌ [LOGIN_CLIENT] Client non trouvé: %s", req.Username)
@@ -266,6 +275,30 @@ func LoginClient(c *gin.Context) {
 		return
 	}
 
+	settings, err := database.GetSettings()
+	if err != nil {
+		log.Printf("❌ [LOGIN_CLIENT] Erreur récupération des paramètres: %v", err)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Erreur interne"})
+		return
+	}
+
+	if settings.Telegram2FAEnabled && client.TwoFAEnabled {
+		chatID, linked, _ := database.GetClientTelegramChatID(client.Username)
+		if linked {
+			code := fmt.Sprintf("%06d", cryptoRandInt()%1000000)
+			sessionToken := uuid.New().String()
+			if err := db.Store2FASession(sessionToken, client.Username, code); err == nil {
+				msg := fmt.Sprintf("🔐 Code de vérification : <b>%s</b>\n\nValable 5 minutes.", code)
+				services.TelegramBot.SendMessage(chatID, msg)
+				c.JSON(http.StatusOK, gin.H{
+					"requires_2fa":  true,
+					"session_token": sessionToken,
+				})
+				return
+			}
+		}
+	}
+
 	token, err := generateClientToken(client)
 	if err != nil {
 		log.Printf("❌ [LOGIN_CLIENT] Erreur génération token: %v", err)
@@ -280,7 +313,6 @@ func LoginClient(c *gin.Context) {
 		return
 	}
 
-	// Créer la session Redis
 	sessionID := uuid.New().String()
 	if err := database.CreateClientSession(client.ID, client.Username, sessionID); err != nil {
 		log.Printf("⚠️  [LOGIN_CLIENT] Erreur session Redis: %v", err)
@@ -303,6 +335,125 @@ func LoginClient(c *gin.Context) {
 	})
 }
 
+func Verify2FAClient(c *gin.Context) {
+	database := c.MustGet("database").(*db.Database)
+
+	var req struct {
+		SessionToken string `json:"session_token" binding:"required"`
+		Code         string `json:"code" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Données invalides"})
+		return
+	}
+
+	username, err := db.Verify2FASession(req.SessionToken, req.Code)
+	if err != nil {
+		log.Printf("❌ [2FA] Échec vérification: %v", err)
+		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		return
+	}
+
+	client, err := database.GetClientByUsername(username)
+	if err != nil || client == nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Erreur interne"})
+		return
+	}
+
+	token, err := generateClientToken(client)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Erreur génération token"})
+		return
+	}
+
+	expiresAt := time.Now().Add(clientTokenDuration)
+	if err := database.SaveToken(client.ID, "client", token, expiresAt); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Erreur enregistrement token"})
+		return
+	}
+
+	sessionID := uuid.New().String()
+	if err := database.CreateClientSession(client.ID, client.Username, sessionID); err != nil {
+		log.Printf("⚠️  [2FA] Erreur session Redis: %v", err)
+	}
+
+	c.JSON(http.StatusOK, models.LoginResponse{
+		AccessToken: token,
+		TokenType:   "Bearer",
+		ExpiresIn:   int(clientTokenDuration.Seconds()),
+		User: gin.H{
+			"id":                   client.ID,
+			"username":             client.Username,
+			"nom":                  client.Nom,
+			"prenom":               client.Prenom,
+			"telephone":            client.Telephone,
+			"role":                 "client",
+			"session_id":           sessionID,
+			"must_change_password": client.MustChangePassword,
+		},
+	})
+}
+
+func GetClient2FAStatus(c *gin.Context) {
+	clientID := c.GetInt("client_id")
+	database := c.MustGet("database").(*db.Database)
+
+	client, err := database.GetClientByID(clientID)
+	if err != nil || client == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Client non trouvé"})
+		return
+	}
+
+	_, tgLinked, _ := database.GetClientTelegramChatID(client.Username)
+
+	settings, _ := database.GetSettings()
+
+	c.JSON(http.StatusOK, gin.H{
+		"two_fa_enabled":       client.TwoFAEnabled,
+		"telegram_linked":      tgLinked,
+		"admin_2fa_enabled":    settings.Telegram2FAEnabled,
+	})
+}
+
+func ToggleClient2FA(c *gin.Context) {
+	clientID := c.GetInt("client_id")
+	database := c.MustGet("database").(*db.Database)
+
+	var req struct {
+		Enabled bool `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Données invalides"})
+		return
+	}
+
+	client, err := database.GetClientByID(clientID)
+	if err != nil || client == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Client non trouvé"})
+		return
+	}
+
+	if req.Enabled {
+		_, linked, _ := database.GetClientTelegramChatID(client.Username)
+		if !linked {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "Telegram non lié — impossible d'activer la 2FA"})
+			return
+		}
+		settings, _ := database.GetSettings()
+		if !settings.Telegram2FAEnabled {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "La 2FA n'est pas activée par l'administrateur"})
+			return
+		}
+	}
+
+	if err := database.SetClientTwoFAEnabled(clientID, req.Enabled); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Erreur mise à jour"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"success": true, "two_fa_enabled": req.Enabled})
+}
+
 // ChangePassword permet à un client de changer son mot de passe
 func ChangePassword(c *gin.Context) {
 	var req struct {