chore: build

backend/gestion/db/db_address.go

@@ -3,19 +3,35 @@ package db
 import (
 	"fmt"
 	"gestion/models"
+	"gestion/utils"
+	"strings"
 )
 
 func (d *Database) CheckAddress(addressByUser *models.Command) error {
 	var correction models.Address
 	result := d.GDB.Where("invalid_address = ?", addressByUser.DeliveryAddress).First(&correction)
-	if result.Error != nil {
-		if isNotFound(result.Error) {
-			return nil
-		}
+	if result.Error == nil {
+		addressByUser.DeliveryAddress = correction.CorrectAddress
+		return fmt.Errorf("adresse invalide %s", correction.CorrectAddress)
+	}
+	if !isNotFound(result.Error) {
 		return fmt.Errorf("checkAddress: %w", result.Error)
 	}
-	addressByUser.DeliveryAddress = correction.CorrectAddress
-	return fmt.Errorf("Adresse invalide %s", correction.CorrectAddress)
+
+	// Pas de correspondance exacte — fallback sur une comparaison normalisée
+	// (accents/casse/espaces) pour rattraper les variantes mineures de saisie.
+	corrections, err := d.AllAddress()
+	if err != nil {
+		return nil
+	}
+	normalizedInput := utils.NormalizeAddress(addressByUser.DeliveryAddress)
+	for _, c := range corrections {
+		if strings.EqualFold(utils.NormalizeAddress(c.InvalidAddress), normalizedInput) {
+			addressByUser.DeliveryAddress = c.CorrectAddress
+			return fmt.Errorf("adresse invalide %s", c.CorrectAddress)
+		}
+	}
+	return nil
 }
 
 func (d *Database) AddAddress(CorrectAddressByAdmin string, InvalidAddressByAdmin string) error {

backend/gestion/db/db_alert.go

@@ -27,7 +27,7 @@ func (d *Database) GetAlertPolicy(id int) (models.AlertPolicy, error) {
 
 func (d *Database) GetAllAlerts() ([]models.AlertPolicy, error) {
 	var alerts []models.AlertPolicy
-	if err := d.GDB.Find(&alerts).Error; err != nil {
+	if err := d.GDB.Order("created_at DESC").Limit(500).Find(&alerts).Error; err != nil {
 		return nil, err
 	}
 	return alerts, nil
@@ -65,7 +65,7 @@ func (d *Database) ActivateAlert(id int) error {
 
 func (d *Database) GetActiveAlerts() ([]models.AlertPolicy, error) {
 	var alerts []models.AlertPolicy
-	if err := d.GDB.Where("status = 'true'").Order("created_at DESC").Find(&alerts).Error; err != nil {
+	if err := d.GDB.Where("status = 'true'").Order("created_at DESC").Limit(100).Find(&alerts).Error; err != nil {
 		return nil, err
 	}
 	return alerts, nil
@@ -73,7 +73,7 @@ func (d *Database) GetActiveAlerts() ([]models.AlertPolicy, error) {
 
 func (d *Database) GetAlertsByUsername(username string) ([]models.AlertPolicy, error) {
 	var alerts []models.AlertPolicy
-	if err := d.GDB.Where("username = ?", username).Order("created_at DESC").Find(&alerts).Error; err != nil {
+	if err := d.GDB.Where("username = ?", username).Order("created_at DESC").Limit(200).Find(&alerts).Error; err != nil {
 		return nil, err
 	}
 	return alerts, nil

backend/gestion/db/db_basket.go

@@ -7,7 +7,6 @@ import (
 	"gorm.io/gorm"
 )
 
-// GetProductPrice récupère le prix réel d'un produit pour une quantité donnée (legacy)
 func (d *Database) GetProductPrice(name, category string, quantity float64) (float64, error) {
 	var result struct {
 		Price float64 `gorm:"column:price"`
@@ -49,27 +48,9 @@ func (d *Database) GetAllProductsInBasket(username string) ([]models.Panier, err
 func (d *Database) AddRewardsToBasket(username string, items []models.RewardItem, poolKey string) ([]models.Panier, error) {
 	var baskets []models.Panier
 	err := d.GDB.Transaction(func(tx *gorm.DB) error {
-		// Supprimer tout article récompense existant (remplacement)
-		tx.Exec(`DELETE FROM baskets WHERE username = ? AND is_reward = true`, username)
-		for _, item := range items {
-			if item.ProductID <= 0 || item.Quantity <= 0 {
-				continue
-			}
-			var productName string
-			if err := tx.Raw(`SELECT name FROM products WHERE id = ?`, item.ProductID).Scan(&productName).Error; err != nil || productName == "" {
-				return fmt.Errorf("produit récompense introuvable (id=%d)", item.ProductID)
-			}
-			var basket models.Panier
-			if err := tx.Raw(`
-				INSERT INTO baskets (username, product_id, quantity, price, is_reward, reward_pool_key, created_at)
-				VALUES (?, ?, ?, 0, true, ?, CURRENT_TIMESTAMP)
-				RETURNING id, username, product_id, quantity, price, is_reward, reward_pool_key, created_at`,
-				username, item.ProductID, item.Quantity, poolKey).Scan(&basket).Error; err != nil {
-				return err
-			}
-			baskets = append(baskets, basket)
-		}
-		return nil
+		var err error
+		baskets, err = addRewardsToBasketTx(tx, username, items, poolKey)
+		return err
 	})
 	if err != nil {
 		return nil, err
@@ -77,6 +58,36 @@ func (d *Database) AddRewardsToBasket(username string, items []models.RewardItem
 	return baskets, nil
 }
 
+// addRewardsToBasketTx contient la logique de remplacement des articles
+// récompense, factorisée pour être appelée soit seule (AddRewardsToBasket),
+// soit dans la même transaction qu'une autre opération (voir
+// ClaimPoolRewardAndAddToBasket) afin de garantir qu'une récompense n'est
+// jamais consommée sans que son produit soit effectivement livré.
+func addRewardsToBasketTx(tx *gorm.DB, username string, items []models.RewardItem, poolKey string) ([]models.Panier, error) {
+	// Supprimer tout article récompense existant (remplacement)
+	tx.Exec(`DELETE FROM baskets WHERE username = ? AND is_reward = true`, username)
+	var baskets []models.Panier
+	for _, item := range items {
+		if item.ProductID <= 0 || item.Quantity <= 0 {
+			continue
+		}
+		var productName string
+		if err := tx.Raw(`SELECT name FROM products WHERE id = ?`, item.ProductID).Scan(&productName).Error; err != nil || productName == "" {
+			return nil, fmt.Errorf("produit récompense introuvable (id=%d)", item.ProductID)
+		}
+		var basket models.Panier
+		if err := tx.Raw(`
+			INSERT INTO baskets (username, product_id, quantity, price, is_reward, reward_pool_key, created_at)
+			VALUES (?, ?, ?, 0, true, ?, CURRENT_TIMESTAMP)
+			RETURNING id, username, product_id, quantity, price, is_reward, reward_pool_key, created_at`,
+			username, item.ProductID, item.Quantity, poolKey).Scan(&basket).Error; err != nil {
+			return nil, err
+		}
+		baskets = append(baskets, basket)
+	}
+	return baskets, nil
+}
+
 // HasOnlyRewardItems retourne true si le panier ne contient que des articles récompense.
 func (d *Database) HasOnlyRewardItems(username string) (bool, error) {
 	var counts struct {
@@ -164,35 +175,6 @@ func (d *Database) ClearBasket(username string) error {
 	return d.GDB.Exec(`DELETE FROM baskets WHERE username = ?`, username).Error
 }
 
-// ClearBasketOnCheckout décrémente le stock pour chaque article du panier puis vide le panier.
-// C'est ici que le stock est effectivement consommé, au moment de la validation de la commande.
-func (d *Database) ClearBasketOnCheckout(username string) error {
-	return d.GDB.Transaction(func(tx *gorm.DB) error {
-		var items []struct {
-			ProductID int     `gorm:"column:product_id"`
-			Quantity  float64 `gorm:"column:quantity"`
-		}
-		if err := tx.Raw(`SELECT product_id, quantity FROM baskets WHERE username = ? FOR UPDATE`, username).Scan(&items).Error; err != nil {
-			return fmt.Errorf("erreur lecture panier: %w", err)
-		}
-
-		for _, item := range items {
-			var currentStock float64
-			if err := tx.Raw(`SELECT stock FROM products WHERE id = ? FOR UPDATE`, item.ProductID).Scan(&currentStock).Error; err != nil {
-				return fmt.Errorf("erreur lecture stock produit %d: %w", item.ProductID, err)
-			}
-			if currentStock < item.Quantity {
-				return fmt.Errorf("stock insuffisant pour le produit %d", item.ProductID)
-			}
-			if err := tx.Exec(`UPDATE products SET stock = stock - ? WHERE id = ?`, item.Quantity, item.ProductID).Error; err != nil {
-				return fmt.Errorf("erreur décrémentation stock produit %d: %w", item.ProductID, err)
-			}
-		}
-
-		return tx.Exec(`DELETE FROM baskets WHERE username = ?`, username).Error
-	})
-}
-
 func (d *Database) GetBasketItemOwner(basketID int) (string, error) {
 	var username string
 	err := d.GDB.Raw(`SELECT username FROM baskets WHERE id = ?`, basketID).Scan(&username).Error

backend/gestion/db/db_cancel_command.go

@@ -78,9 +78,14 @@ func (d *Database) CancelCommandAtomic(commandID int, username, reason string, f
 
 		if err := tx.Exec(`
 			UPDATE products p
-			SET stock = stock + ci.quantite, updated_at = CURRENT_TIMESTAMP
-			FROM command_items ci
-			WHERE ci.command_id = ? AND ci.product_id = p.id`, commandID).Error; err != nil {
+			SET stock = stock + agg.total_qty, updated_at = CURRENT_TIMESTAMP
+			FROM (
+				SELECT product_id, SUM(quantite) AS total_qty
+				FROM command_items
+				WHERE command_id = ?
+				GROUP BY product_id
+			) agg
+			WHERE agg.product_id = p.id`, commandID).Error; err != nil {
 			return fmt.Errorf("erreur remboursement stock: %w", err)
 		}
 		log.Printf("✅ [CancelAtomic] Stock remboursé")
@@ -145,20 +150,18 @@ func (d *Database) CancelCommandAtomic(commandID int, username, reason string, f
 	return penalty, nil
 }
 
-// CheckCommandETAExistsAndValid vérifie si une ETA RÉELLE existe (> 0 minutes, non expirée)
 func (d *Database) CheckCommandETAExistsAndValid(commandID int) bool {
 	etaKey := fmt.Sprintf("command:eta:%d", commandID)
 
-	etaMinutesStr, err := Redis.Get(RedisCtx, etaKey).Result()
-	if err != nil {
+	etaData, err := Redis.HGetAll(RedisCtx, etaKey).Result()
+	if err != nil || len(etaData) == 0 {
 		log.Printf("⚠️ [CheckETA] Pas d'ETA trouvée pour cmd %d", commandID)
 		return false
 	}
 
 	var etaMinutes int
-	_, err = fmt.Sscanf(etaMinutesStr, "%d", &etaMinutes)
-	if err != nil || etaMinutes <= 0 {
-		log.Printf("⚠️ [CheckETA] ETA invalide pour cmd %d: %s", commandID, etaMinutesStr)
+	if _, err := fmt.Sscanf(etaData["eta_minutes"], "%d", &etaMinutes); err != nil || etaMinutes <= 0 {
+		log.Printf("⚠️ [CheckETA] ETA invalide pour cmd %d: %s", commandID, etaData["eta_minutes"])
 		return false
 	}
 
@@ -192,13 +195,18 @@ func (d *Database) DeleteCommandAtomic(commandID int, deletedBy, role string) er
 		log.Printf("📋 [DeleteAtomic] Trouvée - status=%s, client=%s", cmdResult.Status, cmdResult.Username)
 
 		// ✅ Ne restitue le stock QUE si pas déjà fait
-		stockAlreadyRestored := cmdResult.Status == "cancelled" || cmdResult.Status == "approved"
+		stockAlreadyRestored := cmdResult.Status == "cancelled" || cmdResult.Status == "approved" || cmdResult.Status == "livre"
 		if !stockAlreadyRestored {
 			if err := tx.Exec(`
                 UPDATE products p
-                SET stock = stock + ci.quantite, updated_at = CURRENT_TIMESTAMP
-                FROM command_items ci
-                WHERE ci.command_id = ? AND ci.product_id = p.id`, commandID).Error; err != nil {
+                SET stock = stock + agg.total_qty, updated_at = CURRENT_TIMESTAMP
+                FROM (
+                    SELECT product_id, SUM(quantite) AS total_qty
+                    FROM command_items
+                    WHERE command_id = ?
+                    GROUP BY product_id
+                ) agg
+                WHERE agg.product_id = p.id`, commandID).Error; err != nil {
 				log.Printf("⚠️ [DeleteAtomic] Erreur remboursement: %v", err)
 			} else {
 				log.Printf("✅ [DeleteAtomic] Stock remboursé (statut: %s)", cmdResult.Status)
@@ -316,12 +324,89 @@ func (d *Database) AddClientPenalty(username string, points int) error {
 	return nil
 }
 
-func (d *Database) RestoreCommandStock(commandID int) error {
+// CancelCommandByAdminAtomic transitionne une commande vers 'cancelled' depuis le
+// panel admin/cabine de façon atomique (verrou FOR UPDATE sur la commande) : le
+// remboursement de stock et le changement de statut se font dans la même
+// transaction, conditionnés à une lecture du statut précédent faite sous verrou.
+// Corrige un double remboursement possible sur double-tap/appel concurrent —
+// l'ancien code (RestoreCommandStock + UpdateCommandStatus appelés séparément
+// par le handler) lisait le statut puis restaurait le stock hors transaction,
+// laissant une fenêtre où deux requêtes concurrentes lisaient toutes les deux
+// "pas encore annulée" et remboursaient chacune le stock.
+func (d *Database) CancelCommandByAdminAtomic(commandID int) error {
 	return d.GDB.Transaction(func(tx *gorm.DB) error {
-		return tx.Exec(`
-			UPDATE products p
-			SET stock = stock + ci.quantite, updated_at = CURRENT_TIMESTAMP
-			FROM command_items ci
-			WHERE ci.command_id = ? AND ci.product_id = p.id`, commandID).Error
+		var prevStatus string
+		if err := tx.Raw(`SELECT status FROM commandes WHERE id = ? FOR UPDATE`, commandID).Scan(&prevStatus).Error; err != nil {
+			return err
+		}
+		if prevStatus == "" {
+			return fmt.Errorf("commande non trouvée")
+		}
+
+		noRestoreStatuses := []string{"cancelled", "approved", "livre"}
+		if !slices.Contains(noRestoreStatuses, prevStatus) {
+			if err := tx.Exec(`
+				UPDATE products p
+				SET stock = stock + agg.total_qty, updated_at = CURRENT_TIMESTAMP
+				FROM (
+					SELECT product_id, SUM(quantite) AS total_qty
+					FROM command_items
+					WHERE command_id = ?
+					GROUP BY product_id
+				) agg
+				WHERE agg.product_id = p.id`, commandID).Error; err != nil {
+				return fmt.Errorf("erreur remboursement stock: %w", err)
+			}
+		}
+
+		if err := tx.Exec(`UPDATE commandes SET status = 'cancelled', updated_at = CURRENT_TIMESTAMP WHERE id = ?`, commandID).Error; err != nil {
+			return fmt.Errorf("erreur mise à jour statut: %w", err)
+		}
+		return nil
 	})
 }
+
+// CancelDeliveryByLivreurAtomic annule une commande côté livreur et restaure le stock
+// de manière atomique (verrou FOR UPDATE + transition conditionnée à l'ancien statut).
+// Idempotent : si la commande est déjà annulée, ne touche pas au stock et renvoie
+// alreadyCancelled=true — évite un remboursement en double en cas de double appel
+// (double-tap, retry réseau, ou commande déjà annulée par un autre canal).
+func (d *Database) CancelDeliveryByLivreurAtomic(commandID int) (alreadyCancelled bool, prevStatus string, err error) {
+	err = d.GDB.Transaction(func(tx *gorm.DB) error {
+		if e := tx.Raw(`SELECT status FROM commandes WHERE id = ? FOR UPDATE`, commandID).Scan(&prevStatus).Error; e != nil {
+			return e
+		}
+		if prevStatus == "" {
+			return fmt.Errorf("commande non trouvée")
+		}
+		if prevStatus == "cancelled" {
+			alreadyCancelled = true
+			return nil
+		}
+
+		result := tx.Exec(`
+			UPDATE commandes SET status = 'cancelled', updated_at = CURRENT_TIMESTAMP
+			WHERE id = ? AND status = ?`, commandID, prevStatus)
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected == 0 {
+			return fmt.Errorf("commande déjà modifiée par une autre requête")
+		}
+
+		if e := tx.Exec(`
+			UPDATE products p
+			SET stock = stock + agg.total_qty, updated_at = CURRENT_TIMESTAMP
+			FROM (
+				SELECT product_id, SUM(quantite) AS total_qty
+				FROM command_items
+				WHERE command_id = ?
+				GROUP BY product_id
+			) agg
+			WHERE agg.product_id = p.id`, commandID).Error; e != nil {
+			return fmt.Errorf("erreur remboursement stock: %w", e)
+		}
+		return nil
+	})
+	return
+}

backend/gestion/db/db_categories.go

@@ -13,6 +13,7 @@ type Category struct {
 	Name         string    `json:"name"          gorm:"column:name"`
 	Color        string    `json:"color"         gorm:"column:color"`
 	IsComingSoon bool      `json:"is_coming_soon" gorm:"column:is_coming_soon"`
+	Position     int       `json:"position"      gorm:"column:position"`
 	CreatedAt    time.Time `json:"created_at"    gorm:"autoCreateTime"`
 }
 
@@ -30,7 +31,7 @@ func ValidateCategoryColor(color string) error {
 
 func (d *Database) GetAllCategories() ([]Category, error) {
 	var categories []Category
-	if err := d.GDB.Order("name ASC").Find(&categories).Error; err != nil {
+	if err := d.GDB.Order("position ASC, name ASC").Find(&categories).Error; err != nil {
 		return nil, err
 	}
 	if categories == nil {
@@ -43,7 +44,9 @@ func (d *Database) CreateCategory(name, color string, isComingSoon bool) (*Categ
 	if color == "" {
 		color = "#7c3aed"
 	}
-	c := Category{Name: name, Color: color, IsComingSoon: isComingSoon}
+	var maxPos int
+	d.GDB.Model(&Category{}).Select("COALESCE(MAX(position), 0)").Scan(&maxPos)
+	c := Category{Name: name, Color: color, IsComingSoon: isComingSoon, Position: maxPos + 1}
 	if err := d.GDB.Create(&c).Error; err != nil {
 		return nil, err
 	}
@@ -82,6 +85,18 @@ func (d *Database) DeleteCategory(id int) error {
 	return nil
 }
 
+// ReorderCategories met à jour les positions selon l'ordre du tableau d'IDs fourni.
+func (d *Database) ReorderCategories(ids []int) error {
+	tx := d.GDB.Begin()
+	for i, id := range ids {
+		if err := tx.Model(&Category{}).Where("id = ?", id).Update("position", i+1).Error; err != nil {
+			tx.Rollback()
+			return err
+		}
+	}
+	return tx.Commit().Error
+}
+
 func (d *Database) CategoryExists(name string) (bool, error) {
 	var count int64
 	err := d.GDB.Model(&Category{}).Where("name = ?", name).Count(&count).Error

backend/gestion/db/db_clients.go

@@ -32,6 +32,7 @@ func (d *Database) CreateClient(client *models.Client) error {
 	return nil
 }
 
+// GetClientByID récupère un client par son ID
 func (d *Database) GetClientByID(id int) (*models.Client, error) {
 	var row struct {
 		ID              int       `gorm:"column:id"`
@@ -75,6 +76,7 @@ func (d *Database) GetClientByID(id int) (*models.Client, error) {
 	return client, nil
 }
 
+// GetAllClients récupère tous les clients
 func (d *Database) GetAllClients() ([]*models.Client, error) {
 	var rows []struct {
 		ID                 int       `gorm:"column:id"`
@@ -290,6 +292,28 @@ func (d *Database) GetClientByTelephone(telephone string) (*models.Client, error
 }
 
 // GetClientByUsername récupère un client par son username
+// GetClientsByUsernames charge plusieurs clients en une seule requête.
+// Retourne map[username]*Client ; les usernames sans correspondance sont absents de la map.
+func (d *Database) GetClientsByUsernames(usernames []string) (map[string]*models.Client, error) {
+	result := make(map[string]*models.Client, len(usernames))
+	if len(usernames) == 0 {
+		return result, nil
+	}
+	var rows []struct {
+		ID       int    `gorm:"column:id"`
+		Username string `gorm:"column:username"`
+		Nom      string `gorm:"column:nom"`
+		Prenom   string `gorm:"column:prenom"`
+	}
+	if err := d.GDB.Raw(`SELECT id, username, nom, prenom FROM clients WHERE username IN ?`, usernames).Scan(&rows).Error; err != nil {
+		return nil, err
+	}
+	for _, r := range rows {
+		result[r.Username] = &models.Client{ID: r.ID, Username: r.Username, Nom: r.Nom, Prenom: r.Prenom}
+	}
+	return result, nil
+}
+
 func (d *Database) GetClientByUsername(username string) (*models.Client, error) {
 	var row struct {
 		ID                 int       `gorm:"column:id"`
@@ -713,52 +737,81 @@ func (d *Database) GetClientPointsAndRewards(username string) (pointsExtra map[s
 	return pointsExtra, pointsRedeemed, nil
 }
 
+// claimPoolRewardTx vérifie l'éligibilité et consomme une récompense pour un
+// pool donné, dans la transaction fournie — factorisée pour être appelée
+// seule (ClaimPoolReward) ou combinée avec la livraison du produit dans la
+// même transaction (ClaimPoolRewardAndAddToBasket), afin qu'une récompense
+// ne soit jamais consommée sans que son produit soit effectivement livré.
+func claimPoolRewardTx(tx *gorm.DB, username, poolKey string, threshold int) (remainingAvailable int, err error) {
+	var row struct {
+		Points   int `gorm:"column:pts"`
+		Redeemed int `gorm:"column:redeemed"`
+	}
+	if err := tx.Raw(`
+		SELECT
+			COALESCE((points_extra->>?)::int, 0) as pts,
+			COALESCE((points_redeemed->>?)::int, 0) as redeemed
+		FROM clients WHERE username = ? FOR UPDATE`,
+		poolKey, poolKey, username).Scan(&row).Error; err != nil {
+		return 0, fmt.Errorf("erreur lecture: %w", err)
+	}
+
+	earned := row.Points / threshold
+	available := earned - row.Redeemed
+	if available <= 0 {
+		return 0, fmt.Errorf("pas de récompense disponible pour ce pool")
+	}
+
+	if err := tx.Exec(`
+		UPDATE clients
+		SET points_redeemed = jsonb_set(
+			COALESCE(points_redeemed, '{}'::jsonb),
+			ARRAY[?],
+			to_jsonb(COALESCE((points_redeemed->>?)::int, 0) + 1)
+		), updated_at = CURRENT_TIMESTAMP
+		WHERE username = ?`,
+		poolKey, poolKey, username).Error; err != nil {
+		return 0, err
+	}
+
+	return earned - (row.Redeemed + 1), nil
+}
+
 // ClaimPoolReward réclame une récompense pour un pool donné si le client a assez de points.
 // Retourne le nombre de récompenses disponibles restantes après la réclamation.
 func (d *Database) ClaimPoolReward(username, poolKey string, threshold int) (remainingAvailable int, err error) {
-	var points, redeemed int
-
 	err = d.GDB.Transaction(func(tx *gorm.DB) error {
-		var row struct {
-			Points   int `gorm:"column:pts"`
-			Redeemed int `gorm:"column:redeemed"`
-		}
-		if err := tx.Raw(`
-			SELECT
-				COALESCE((points_extra->>?)::int, 0) as pts,
-				COALESCE((points_redeemed->>?)::int, 0) as redeemed
-			FROM clients WHERE username = ? FOR UPDATE`,
-			poolKey, poolKey, username).Scan(&row).Error; err != nil {
-			return fmt.Errorf("erreur lecture: %w", err)
-		}
-		points = row.Points
-		redeemed = row.Redeemed
-
-		earned := points / threshold
-		available := earned - redeemed
-		if available <= 0 {
-			return fmt.Errorf("pas de récompense disponible pour ce pool")
-		}
-
-		return tx.Exec(`
-			UPDATE clients
-			SET points_redeemed = jsonb_set(
-				COALESCE(points_redeemed, '{}'::jsonb),
-				ARRAY[?],
-				to_jsonb(COALESCE((points_redeemed->>?)::int, 0) + 1)
-			), updated_at = CURRENT_TIMESTAMP
-			WHERE username = ?`,
-			poolKey, poolKey, username).Error
+		var err error
+		remainingAvailable, err = claimPoolRewardTx(tx, username, poolKey, threshold)
+		return err
 	})
 	if err != nil {
 		return 0, err
 	}
-
-	earned := points / threshold
-	remainingAvailable = earned - (redeemed + 1)
 	return remainingAvailable, nil
 }
 
+func (d *Database) ClaimPoolRewardAndAddToBasket(username, poolKey string, threshold int, items []models.RewardItem) (remainingAvailable int, added []models.Panier, err error) {
+	err = d.GDB.Transaction(func(tx *gorm.DB) error {
+		var err error
+		remainingAvailable, err = claimPoolRewardTx(tx, username, poolKey, threshold)
+		if err != nil {
+			return err
+		}
+		if len(items) > 0 {
+			added, err = addRewardsToBasketTx(tx, username, items, poolKey)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return 0, nil, err
+	}
+	return remainingAvailable, added, nil
+}
+
 // ResetClientRedeemed remet à zéro les récompenses réclamées (admin).
 func (d *Database) ResetClientRedeemed(username, poolKey string) error {
 	if poolKey != "" {

backend/gestion/db/db_command_items.go

@@ -6,8 +6,37 @@ import (
 	"slices"
 	"strings"
 	"time"
+
+	"gorm.io/gorm"
 )
 
+// commandItemFull mappe toutes les colonnes de command_items pour les insertions batch avec infos client.
+type commandItemFull struct {
+	CommandID       int     `gorm:"column:command_id"`
+	Produit         string  `gorm:"column:produit"`
+	ProductID       int     `gorm:"column:product_id"`
+	Quantite        float64 `gorm:"column:quantite"`
+	Prix            float64 `gorm:"column:prix"`
+	IsReward        bool    `gorm:"column:is_reward"`
+	RewardPoolKey   string  `gorm:"column:reward_pool_key"`
+	ClientUsername  string  `gorm:"column:client_username"`
+	ClientNom       string  `gorm:"column:client_nom"`
+	ClientPrenom    string  `gorm:"column:client_prenom"`
+	ClientTelephone string  `gorm:"column:client_telephone"`
+	DeliveryAddress string  `gorm:"column:delivery_address"`
+	Status          string  `gorm:"column:status"`
+}
+
+func (commandItemFull) TableName() string { return "command_items" }
+
+// InsertCommandItemsBatch insère plusieurs items en une seule requête.
+func (d *Database) InsertCommandItemsBatch(items []commandItemFull) error {
+	if len(items) == 0 {
+		return nil
+	}
+	return d.GDB.Create(&items).Error
+}
+
 // ============================================
 // VALIDATION HELPERS
 // ============================================
@@ -308,6 +337,92 @@ func (d *Database) GetCommandItems(commandID int) ([]map[string]any, error) {
 	return items, nil
 }
 
+// GetCommandItemsBatch charge les items de plusieurs commandes en une seule requête.
+// Retourne map[commandID][]items, même structure que GetCommandItems.
+func (d *Database) GetCommandItemsBatch(commandIDs []int) (map[int][]map[string]any, error) {
+	result := make(map[int][]map[string]any, len(commandIDs))
+	if len(commandIDs) == 0 {
+		return result, nil
+	}
+
+	var rows []struct {
+		ID                int        `gorm:"column:id"`
+		CommandID         int        `gorm:"column:command_id"`
+		Produit           string     `gorm:"column:produit"`
+		ProductID         *int64     `gorm:"column:product_id"`
+		Quantite          float64    `gorm:"column:quantite"`
+		Prix              float64    `gorm:"column:prix"`
+		IsReward          bool       `gorm:"column:is_reward"`
+		RewardPoolKey     string     `gorm:"column:reward_pool_key"`
+		ClientUsername    string     `gorm:"column:client_username"`
+		ClientNom         string     `gorm:"column:client_nom"`
+		ClientPrenom      string     `gorm:"column:client_prenom"`
+		ClientTelephone   string     `gorm:"column:client_telephone"`
+		DeliveryAddress   *string    `gorm:"column:delivery_address"`
+		Status            *string    `gorm:"column:status"`
+		CreatedAt         time.Time  `gorm:"column:created_at"`
+		UpdatedAt         time.Time  `gorm:"column:updated_at"`
+		CommandStatus     *string    `gorm:"column:command_status"`
+		CommandAddress    *string    `gorm:"column:command_address"`
+		TotalPrix         float64    `gorm:"column:total_prix"`
+		ReferralUsed      float64    `gorm:"column:referral_used"`
+		LivreurAssign     *string    `gorm:"column:livreur_assign"`
+		CommandCreatedAt  *time.Time `gorm:"column:command_created_at"`
+		Category          string     `gorm:"column:category"`
+		Unit              string     `gorm:"column:unit"`
+		ClientOrderNumber int        `gorm:"column:client_order_number"`
+	}
+
+	err := d.GDB.Raw(`
+	SELECT
+		ci.id, ci.command_id, ci.produit, ci.product_id,
+		ci.quantite, ci.prix, ci.is_reward, ci.reward_pool_key,
+		ci.client_username, ci.client_nom, ci.client_prenom, ci.client_telephone,
+		ci.delivery_address, ci.status, ci.created_at, ci.updated_at,
+		c.status as command_status, c.adresse as command_address,
+		c.total_prix, c.referral_used, c.livreur_assign,
+		c.created_at as command_created_at,
+		COALESCE(p.category, '') as category,
+		COALESCE(p.unit, '') as unit,
+		c.client_order_id as client_order_number
+	FROM command_items ci
+	LEFT JOIN commandes c ON ci.command_id = c.id
+	LEFT JOIN products p ON ci.product_id = p.id
+	WHERE ci.command_id IN ?
+	ORDER BY ci.command_id ASC, ci.id ASC`, commandIDs).Scan(&rows).Error
+	if err != nil {
+		return nil, fmt.Errorf("erreur récupération items batch: %w", err)
+	}
+
+	for _, row := range rows {
+		productIDValue := 0
+		if row.ProductID != nil {
+			productIDValue = int(*row.ProductID)
+		}
+		var commandCreatedAt any
+		if row.CommandCreatedAt != nil {
+			commandCreatedAt = *row.CommandCreatedAt
+		}
+		item := map[string]any{
+			"id": row.ID, "command_id": row.CommandID,
+			"produit": row.Produit, "product_id": productIDValue,
+			"quantite": row.Quantite, "prix": row.Prix,
+			"is_reward": row.IsReward, "reward_pool_key": row.RewardPoolKey,
+			"client_username": row.ClientUsername, "client_nom": row.ClientNom,
+			"client_prenom": row.ClientPrenom, "client_telephone": row.ClientTelephone,
+			"delivery_address": ptrStr(row.DeliveryAddress), "status": ptrStr(row.Status),
+			"created_at": row.CreatedAt, "updated_at": row.UpdatedAt,
+			"command_status": ptrStr(row.CommandStatus), "command_address": ptrStr(row.CommandAddress),
+			"total_prix": row.TotalPrix, "referral_used": row.ReferralUsed,
+			"livreur_assign": ptrStr(row.LivreurAssign), "command_created_at": commandCreatedAt,
+			"category": row.Category, "unit": row.Unit,
+			"client_order_number": row.ClientOrderNumber,
+		}
+		result[row.CommandID] = append(result[row.CommandID], item)
+	}
+	return result, nil
+}
+
 // ptrStr retourne la valeur d'un *string ou "" si nil
 func ptrStr(s *string) string {
 	if s == nil {
@@ -316,6 +431,12 @@ func ptrStr(s *string) string {
 	return *s
 }
 
+// DeleteCommandItem supprime un item d'une commande et restaure son stock si
+// la commande n'est pas déjà dans un état terminal. Le statut de la commande
+// est verrouillé (FOR UPDATE) avant toute décision, dans la même transaction
+// que la suppression et le remboursement, pour éviter une course avec une
+// annulation concurrente de la commande entière (qui rembourserait déjà cet
+// item) — même classe de bug que celle corrigée sur UpdateCommandStatusAdmin.
 func (d *Database) DeleteCommandItem(commandID, itemID int) error {
 	log.Printf("🗑️ [DeleteCommandItem] START - commandID=%d, itemID=%d", commandID, itemID)
 
@@ -326,61 +447,55 @@ func (d *Database) DeleteCommandItem(commandID, itemID int) error {
 		return err
 	}
 
-	var result struct {
-		Prix      float64 `gorm:"column:prix"`
-		Quantite  float64 `gorm:"column:quantite"`
-		ProductID int     `gorm:"column:product_id"`
-	}
-	if err := d.GDB.Raw(`SELECT prix, quantite, product_id FROM command_items WHERE id = ? AND command_id = ?`, itemID, commandID).Scan(&result).Error; err != nil {
-		return fmt.Errorf("erreur vérification item: %w", err)
-	}
-	if result.Prix == 0 && result.Quantite == 0 {
-		return fmt.Errorf("item %d non trouvé dans la commande %d", itemID, commandID)
-	}
-
-	var cmdStatus string
-	d.GDB.Raw(`SELECT status FROM commandes WHERE id = ?`, commandID).Scan(&cmdStatus)
-
-	noRestoreStatuses := []string{"cancelled", "approved", "livre"}
-	restoreStock := result.ProductID != 0 && !slices.Contains(noRestoreStatuses, cmdStatus)
-
-	tx := d.GDB.Begin()
-	if tx.Error != nil {
-		return fmt.Errorf("erreur démarrage transaction: %w", tx.Error)
-	}
-
-	if err := tx.Exec(`DELETE FROM command_items WHERE id = ?`, itemID).Error; err != nil {
-		tx.Rollback()
-		log.Printf("❌ Erreur DELETE command_items: %v", err)
-		return fmt.Errorf("erreur suppression item: %w", err)
-	}
-
-	if err := tx.Exec(
-		`UPDATE commandes SET total_prix = GREATEST(0, total_prix - ?) WHERE id = ?`,
-		result.Prix*result.Quantite, commandID,
-	).Error; err != nil {
-		tx.Rollback()
-		log.Printf("❌ [DeleteCommandItem] Erreur maj total commande: %v", err)
-		return fmt.Errorf("erreur mise à jour total commande: %w", err)
-	}
-
-	if restoreStock {
-		if err := tx.Exec(
-			`UPDATE products SET stock = stock + ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?`,
-			result.Quantite, result.ProductID,
-		).Error; err != nil {
-			tx.Rollback()
-			log.Printf("❌ [DeleteCommandItem] Erreur restauration stock: %v", err)
-			return fmt.Errorf("erreur restauration stock: %w", err)
+	return d.GDB.Transaction(func(tx *gorm.DB) error {
+		var cmdStatus string
+		if err := tx.Raw(`SELECT status FROM commandes WHERE id = ? FOR UPDATE`, commandID).Scan(&cmdStatus).Error; err != nil {
+			return fmt.Errorf("erreur vérification commande: %w", err)
+		}
+		if cmdStatus == "" {
+			return fmt.Errorf("commande %d non trouvée", commandID)
 		}
-		log.Printf("✅ [DeleteCommandItem] Stock restauré: +%.3f pour produit %d", result.Quantite, result.ProductID)
-	}
 
-	if err := tx.Commit().Error; err != nil {
-		return fmt.Errorf("erreur commit transaction: %w", err)
-	}
+		var result struct {
+			Prix      float64 `gorm:"column:prix"`
+			Quantite  float64 `gorm:"column:quantite"`
+			ProductID int     `gorm:"column:product_id"`
+		}
+		if err := tx.Raw(`SELECT prix, quantite, product_id FROM command_items WHERE id = ? AND command_id = ?`, itemID, commandID).Scan(&result).Error; err != nil {
+			return fmt.Errorf("erreur vérification item: %w", err)
+		}
+		if result.Prix == 0 && result.Quantite == 0 {
+			return fmt.Errorf("item %d non trouvé dans la commande %d", itemID, commandID)
+		}
 
-	return nil
+		if err := tx.Exec(`DELETE FROM command_items WHERE id = ?`, itemID).Error; err != nil {
+			log.Printf("❌ Erreur DELETE command_items: %v", err)
+			return fmt.Errorf("erreur suppression item: %w", err)
+		}
+
+		if err := tx.Exec(
+			`UPDATE commandes SET total_prix = GREATEST(0, total_prix - ?) WHERE id = ?`,
+			result.Prix*result.Quantite, commandID,
+		).Error; err != nil {
+			log.Printf("❌ [DeleteCommandItem] Erreur maj total commande: %v", err)
+			return fmt.Errorf("erreur mise à jour total commande: %w", err)
+		}
+
+		noRestoreStatuses := []string{"cancelled", "approved", "livre"}
+		restoreStock := result.ProductID != 0 && !slices.Contains(noRestoreStatuses, cmdStatus)
+		if restoreStock {
+			if err := tx.Exec(
+				`UPDATE products SET stock = stock + ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?`,
+				result.Quantite, result.ProductID,
+			).Error; err != nil {
+				log.Printf("❌ [DeleteCommandItem] Erreur restauration stock: %v", err)
+				return fmt.Errorf("erreur restauration stock: %w", err)
+			}
+			log.Printf("✅ [DeleteCommandItem] Stock restauré: +%.3f pour produit %d", result.Quantite, result.ProductID)
+		}
+
+		return nil
+	})
 }
 
 func (d *Database) UpdateCommandItemStatus(itemID int, status string) error {

backend/gestion/db/db_commands.go

@@ -1,6 +1,8 @@
 package db
 
 import (
+	"encoding/json"
+	"errors"
 	"fmt"
 	"gestion/models"
 	"log"
@@ -11,6 +13,9 @@ import (
 	"gorm.io/gorm"
 )
 
+// errAlreadyApproved est retournée quand le client tente d'approuver une commande déjà approuvée.
+var errAlreadyApproved = errors.New("already_approved")
+
 func sanitizeString(s string) string {
 	sanitized := strings.Map(func(r rune) rune {
 		if r < 32 || r == 127 {
@@ -52,18 +57,6 @@ type basketItem struct {
 	RewardPoolKey string  `gorm:"column:reward_pool_key"`
 }
 
-func (d *Database) fetchBasketItems(username string) ([]basketItem, float64, error) {
-	var items []basketItem
-	if err := d.GDB.Table("baskets").Select("product_id, quantity, price, is_reward, reward_pool_key").Where("username = ?", username).Scan(&items).Error; err != nil {
-		return nil, 0, fmt.Errorf("erreur récupération panier: %w", err)
-	}
-	total := 0.0
-	for _, item := range items {
-		total += item.Price
-	}
-	return items, total, nil
-}
-
 // validateCommandStatus vérifie si le statut est valide
 func validateCommandStatus(status string) error {
 	validStatuses := map[string]bool{
@@ -84,74 +77,6 @@ func validateCommandStatus(status string) error {
 	return nil
 }
 
-func (d *Database) CreateCommand(username string) (*models.Command, error) {
-	adresse := "Adresse non spécifiée"
-	var clientCheck models.Client
-	if err := d.GDB.Select("username").Where("username = ?", username).First(&clientCheck).Error; err == nil && clientCheck.Username != "" {
-		adresse = clientCheck.Username
-	}
-
-	basketItems, totalPrix, err := d.fetchBasketItems(username)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(basketItems) == 0 {
-		return nil, fmt.Errorf("le panier est vide")
-	}
-
-	var cmdResult struct {
-		ID            int       `gorm:"column:id"`
-		ClientOrderID int       `gorm:"column:client_order_id"`
-		CreatedAt     time.Time `gorm:"column:created_at"`
-		UpdatedAt     time.Time `gorm:"column:updated_at"`
-	}
-	err = d.GDB.Raw(`
-		INSERT INTO commandes (username, status, adresse, total_prix, client_order_id, created_at, updated_at)
-		VALUES (?, ?, ?, ?, (SELECT COALESCE(MAX(client_order_id), 0) + 1 FROM commandes WHERE username = ?), CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
-		RETURNING id, client_order_id, created_at, updated_at`,
-		username, "pending", adresse, totalPrix, username).Scan(&cmdResult).Error
-	if err != nil {
-		return nil, fmt.Errorf("erreur lors de la création de la commande: %w", err)
-	}
-
-	commandID := cmdResult.ID
-
-	for _, item := range basketItems {
-		productName, err := d.GetProductNameByID(item.ProductID)
-		if err != nil {
-			productName = "Produit inconnu"
-		}
-
-		cmdItem := models.CommandItem{
-			CommandID:     commandID,
-			Produit:       productName,
-			ProductID:     item.ProductID,
-			Quantity:      item.Quantity,
-			Price:         item.Price,
-			IsReward:      item.IsReward,
-			RewardPoolKey: item.RewardPoolKey,
-		}
-		if err := d.GDB.Create(&cmdItem).Error; err != nil {
-			return nil, fmt.Errorf("erreur lors de l'insertion des items: %w", err)
-		}
-
-	}
-
-	if err := d.GDB.Exec(`DELETE FROM baskets WHERE username = ?`, username).Error; err != nil {
-		return nil, fmt.Errorf("erreur lors du vidage du panier: %w", err)
-	}
-
-	command := &models.Command{
-		ID:            commandID,
-		ClientOrderID: cmdResult.ClientOrderID,
-		Status:        "pending",
-		Total:         totalPrix,
-	}
-
-	return command, nil
-}
-
 func (d *Database) CreateCommandWithAddress(username, deliveryAddress string) (*models.Command, error) {
 	if err := validateUsername(username); err != nil {
 		return nil, err
@@ -175,92 +100,122 @@ func (d *Database) CreateCommandWithAddress(username, deliveryAddress string) (*
 		clientTelephone = sanitizeString(client.Telephone)
 	}
 
-	basketItems, totalPrix, err := d.fetchBasketItems(username)
+	var (
+		command   *models.Command
+		totalPrix float64
+	)
+	err = d.GDB.Transaction(func(tx *gorm.DB) error {
+		// Verrou sur le panier : un double-submit concurrent du même client se
+		// bloque ici puis échoue proprement ("panier vide") une fois le premier
+		// passage terminé, au lieu de créer une commande fantôme.
+		var basketItems []basketItem
+		if err := tx.Raw(`SELECT product_id, quantity, price, is_reward, reward_pool_key FROM baskets WHERE username = ? FOR UPDATE`, username).Scan(&basketItems).Error; err != nil {
+			return fmt.Errorf("erreur récupération panier: %w", err)
+		}
+		if len(basketItems) == 0 {
+			return fmt.Errorf("le panier est vide")
+		}
+
+		for _, item := range basketItems {
+			if item.ProductID <= 0 || item.Quantity <= 0 || item.Price < 0 {
+				return fmt.Errorf("données panier invalides")
+			}
+			totalPrix += item.Price
+		}
+
+		if totalPrix <= 0 || totalPrix > 100000 {
+			return fmt.Errorf("montant de commande invalide: %.2f€", totalPrix)
+		}
+
+		var cmdResult struct {
+			ID            int       `gorm:"column:id"`
+			ClientOrderID int       `gorm:"column:client_order_id"`
+			CreatedAt     time.Time `gorm:"column:created_at"`
+			UpdatedAt     time.Time `gorm:"column:updated_at"`
+		}
+		if err := tx.Raw(`
+			INSERT INTO commandes (username, status, adresse, total_prix, client_order_id, created_at, updated_at)
+			VALUES (?, ?, ?, ?, (SELECT COALESCE(MAX(client_order_id), 0) + 1 FROM commandes WHERE username = ?), CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+			RETURNING id, client_order_id, created_at, updated_at`,
+			username, "pending", deliveryAddress, totalPrix, username).Scan(&cmdResult).Error; err != nil {
+			return fmt.Errorf("erreur création commande: %w", err)
+		}
+		commandID := cmdResult.ID
+
+		productIDs2 := make([]int, 0, len(basketItems))
+		for _, item := range basketItems {
+			productIDs2 = append(productIDs2, item.ProductID)
+		}
+		productNames2, _ := d.GetProductNamesByIDs(productIDs2)
+
+		batchItems := make([]commandItemFull, 0, len(basketItems))
+		for _, item := range basketItems {
+			productName := productNames2[item.ProductID]
+			if productName == "" {
+				productName = fmt.Sprintf("Produit #%d", item.ProductID)
+			}
+			batchItems = append(batchItems, commandItemFull{
+				CommandID:       commandID,
+				Produit:         productName,
+				ProductID:       item.ProductID,
+				Quantite:        item.Quantity,
+				Prix:            item.Price,
+				IsReward:        item.IsReward,
+				RewardPoolKey:   item.RewardPoolKey,
+				ClientUsername:  username,
+				ClientNom:       clientNom,
+				ClientPrenom:    clientPrenom,
+				ClientTelephone: clientTelephone,
+				DeliveryAddress: deliveryAddress,
+				Status:          "pending",
+			})
+		}
+		if err := tx.Create(&batchItems).Error; err != nil {
+			return fmt.Errorf("erreur insertion items: %w", err)
+		}
+
+		// Les articles récompense (payés en points) restent des produits physiques
+		// réellement distribués : le stock doit être décrémenté comme pour un
+		// article payant.
+		for _, item := range basketItems {
+			var currentStock float64
+			if err := tx.Raw(`SELECT stock FROM products WHERE id = ? FOR UPDATE`, item.ProductID).Scan(&currentStock).Error; err != nil {
+				return fmt.Errorf("erreur lecture stock produit %d: %w", item.ProductID, err)
+			}
+			if currentStock < item.Quantity {
+				return fmt.Errorf("stock insuffisant pour le produit %d", item.ProductID)
+			}
+			if err := tx.Exec(`UPDATE products SET stock = stock - ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?`, item.Quantity, item.ProductID).Error; err != nil {
+				return fmt.Errorf("erreur décrémentation stock produit %d: %w", item.ProductID, err)
+			}
+		}
+		if err := tx.Exec(`DELETE FROM baskets WHERE username = ?`, username).Error; err != nil {
+			return err
+		}
+
+		command = &models.Command{
+			ID:              commandID,
+			ClientOrderID:   cmdResult.ClientOrderID,
+			Username:        username,
+			Status:          "pending",
+			Total:           totalPrix,
+			DeliveryAddress: deliveryAddress,
+			CreatedAt:       cmdResult.CreatedAt,
+			UpdatedAt:       cmdResult.UpdatedAt,
+		}
+		return nil
+	})
 	if err != nil {
-		log.Printf("❌ Erreur query basket: %v", err)
+		log.Printf("❌ Erreur création commande: %v", err)
 		return nil, err
 	}
 
-	if len(basketItems) == 0 {
-		return nil, fmt.Errorf("le panier est vide")
-	}
-
-	for _, item := range basketItems {
-		if item.ProductID <= 0 || item.Quantity <= 0 || item.Price < 0 {
-			return nil, fmt.Errorf("données panier invalides")
-		}
-	}
-
-	if totalPrix <= 0 || totalPrix > 100000 {
-		return nil, fmt.Errorf("montant de commande invalide: %.2f€", totalPrix)
-	}
-
-	var cmdResult struct {
-		ID            int       `gorm:"column:id"`
-		ClientOrderID int       `gorm:"column:client_order_id"`
-		CreatedAt     time.Time `gorm:"column:created_at"`
-		UpdatedAt     time.Time `gorm:"column:updated_at"`
-	}
-	err = d.GDB.Raw(`
-		INSERT INTO commandes (username, status, adresse, total_prix, client_order_id, created_at, updated_at)
-		VALUES (?, ?, ?, ?, (SELECT COALESCE(MAX(client_order_id), 0) + 1 FROM commandes WHERE username = ?), CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
-		RETURNING id, client_order_id, created_at, updated_at`,
-		username, "pending", deliveryAddress, totalPrix, username).Scan(&cmdResult).Error
-	if err != nil {
-		return nil, fmt.Errorf("erreur création commande: %w", err)
-	}
-
-	commandID := cmdResult.ID
-
-	for _, item := range basketItems {
-		productName, err := d.GetProductNameByID(item.ProductID)
-		if err != nil || productName == "" {
-			productName = fmt.Sprintf("Produit #%d", item.ProductID)
-		}
-
-		err = d.InsertCommandItemWithClientInfo(
-			commandID,
-			productName,
-			item.ProductID,
-			item.Quantity,
-			item.Price,
-			item.IsReward,
-			item.RewardPoolKey,
-			username,
-			clientNom,
-			clientPrenom,
-			clientTelephone,
-			deliveryAddress,
-		)
-		if err != nil {
-			log.Printf("❌ Erreur INSERT command_items: %v", err)
-			return nil, fmt.Errorf("erreur insertion items: %w", err)
-		}
-
-		// Stock déjà déduit à l'ajout au panier — ne pas déduire une seconde fois ici.
-	}
-
-	if err := d.GDB.Exec(`DELETE FROM baskets WHERE username = ?`, username).Error; err != nil {
-		log.Printf("⚠️ Erreur vidage panier: %v", err)
-	}
-
 	sanitizedAddress := sanitizeLogMessage(deliveryAddress)
-	d.AddCommandLog(commandID, "created",
+	d.AddCommandLog(command.ID, "created",
 		fmt.Sprintf("Commande créée - Adresse: %s - Total: %.2f€ - Client: %s %s",
 			sanitizedAddress, totalPrix, sanitizeLogMessage(clientNom), sanitizeLogMessage(clientPrenom)),
 		username)
 
-	command := &models.Command{
-		ID:              commandID,
-		ClientOrderID:   cmdResult.ClientOrderID,
-		Username:        username,
-		Status:          "pending",
-		Total:           totalPrix,
-		DeliveryAddress: deliveryAddress,
-		CreatedAt:       cmdResult.CreatedAt,
-		UpdatedAt:       cmdResult.UpdatedAt,
-	}
-
 	return command, nil
 }
 
@@ -424,9 +379,28 @@ func (d *Database) GetCommandByID(id int) (map[string]any, error) {
 	return command, nil
 }
 
+const lastDeliveryCoordsCacheTTL = 5 * time.Minute
+
+func lastDeliveryCoordsCacheKey(livreurUsername string) string {
+	return fmt.Sprintf("livreur:last_delivery_coords:%s", livreurUsername)
+}
+
 // GetLastDeliveryCoords retourne les coordonnées GPS de la dernière livraison terminée d'un livreur.
-// Utilisé comme fallback quand le GPS temps réel est indisponible.
+// Utilisé comme fallback quand le GPS temps réel est indisponible. Mis en cache quelques minutes
+// car appelé à chaque calcul d'ETA et la dernière livraison ne change pas souvent.
 func (d *Database) GetLastDeliveryCoords(livreurUsername string) (float64, float64, error) {
+	cacheKey := lastDeliveryCoordsCacheKey(livreurUsername)
+
+	if cached, err := Redis.Get(RedisCtx, cacheKey).Result(); err == nil {
+		var coords struct {
+			Lat float64 `json:"lat"`
+			Lon float64 `json:"lon"`
+		}
+		if jsonErr := json.Unmarshal([]byte(cached), &coords); jsonErr == nil {
+			return coords.Lat, coords.Lon, nil
+		}
+	}
+
 	var result struct {
 		DestLatitude  float64 `gorm:"column:dest_latitude"`
 		DestLongitude float64 `gorm:"column:dest_longitude"`
@@ -446,6 +420,10 @@ func (d *Database) GetLastDeliveryCoords(livreurUsername string) (float64, float
 		return 0, 0, fmt.Errorf("coordonnées introuvables pour dernière livraison de %s", livreurUsername)
 	}
 
+	if coordsJSON, err := json.Marshal(map[string]float64{"lat": result.DestLatitude, "lon": result.DestLongitude}); err == nil {
+		Redis.Set(RedisCtx, cacheKey, coordsJSON, lastDeliveryCoordsCacheTTL)
+	}
+
 	return result.DestLatitude, result.DestLongitude, nil
 }
 
@@ -772,6 +750,11 @@ func (d *Database) ApproveDeliveryAtomic(commandID int, username string) (int, s
 			return fmt.Errorf("cette commande ne vous appartient pas")
 		}
 
+		if cmd.Status == "approved" {
+			log.Printf("ℹ️  [ApproveAtomic] Commande %d déjà approuvée — réponse idempotente", commandID)
+			return errAlreadyApproved
+		}
+
 		if cmd.Status != "livre" {
 			log.Printf("❌ [ApproveAtomic] Statut invalide: %s (attendu: livre)", cmd.Status)
 			return fmt.Errorf("commande doit être en statut 'livre' (statut actuel: %s)", cmd.Status)
@@ -821,6 +804,9 @@ func (d *Database) ApproveDeliveryAtomic(commandID int, username string) (int, s
 	})
 
 	if err != nil {
+		if errors.Is(err, errAlreadyApproved) {
+			return 0, "", nil
+		}
 		return 0, "", err
 	}
 

backend/gestion/db/db_delivery.go

@@ -95,7 +95,6 @@ func (d *Database) AssignDeliveryPerson(commandID int, livreurUsername string) e
 	})
 }
 
-// GetDeliveryPersonCommands récupère les commandes assignées à un livreur
 func (d *Database) GetDeliveryPersonCommands(livreurUsername string, status string) ([]map[string]any, error) {
 	query := `SELECT id, username, status, adresse, total_prix::float8 as total_prix, livreur_assign, created_at, updated_at
 	          FROM commandes

backend/gestion/db/db_gps_link.go

@@ -25,20 +25,16 @@ func wazeAppLink(lat, lon float64) string {
 	return fmt.Sprintf("waze://?ll=%.6f,%.6f&navigate=yes", lat, lon)
 }
 
-// GenerateMapLinks génère tous les liens de cartes pour une position GPS
 func (d *Database) GenerateMapLinks(lat, lon float64, label string) MapLinks {
 	return MapLinks{
 		WazeApp: wazeAppLink(lat, lon),
 	}
 }
 
-// GenerateNavigationLink génère un lien de navigation vers une destination
-// fromLat/fromLon sont ignorés : Waze part toujours de la position GPS courante
 func (d *Database) GenerateNavigationLink(fromLat, fromLon, toLat, toLon float64, platform string) string {
 	return wazeAppLink(toLat, toLon)
 }
 
-// GenerateMapLinksForCommand génère les liens de navigation pour une commande
 func (d *Database) GenerateMapLinksForCommand(commandID int, deliverymanUsername string) (map[string]string, error) {
 	_, _, err := d.GetDeliveryPersonLocation(deliverymanUsername)
 	if err != nil {

backend/gestion/db/db_init.go

@@ -53,7 +53,7 @@ func InitDB() *Database {
 	// Configuration du pool de connexions
 	db.SetMaxOpenConns(50)
 	db.SetMaxIdleConns(10)
-	db.SetConnMaxLifetime(5 * time.Minute)
+	db.SetConnMaxLifetime(30 * time.Minute)
 
 	// Tester la connexion
 	if err = db.Ping(); err != nil {
@@ -66,7 +66,9 @@ func InitDB() *Database {
 	gormDB, err := gorm.Open(postgres.New(postgres.Config{
 		Conn: db,
 	}), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
+		SkipDefaultTransaction: true,
+		PrepareStmt:            true,
+		Logger:                 logger.Default.LogMode(logger.Silent),
 	})
 	if err != nil {
 		log.Fatalf("❌ Erreur initialisation GORM: %v", err)
@@ -165,6 +167,23 @@ func InitDB() *Database {
 		log.Fatalf("❌ Erreur migration categories.is_coming_soon: %v", err)
 	}
 
+	// Migration: position d'affichage des catégories
+	if _, err = database.Exec(`ALTER TABLE categories ADD COLUMN IF NOT EXISTS position INTEGER NOT NULL DEFAULT 0`); err != nil {
+		log.Fatalf("❌ Erreur migration categories.position: %v", err)
+	}
+	// Backfill: attribuer des positions aux catégories existantes (ordre alphabétique)
+	if _, err = database.Exec(`
+		UPDATE categories c
+		SET position = sub.rn
+		FROM (
+			SELECT id, ROW_NUMBER() OVER (ORDER BY name ASC) AS rn
+			FROM categories
+		) sub
+		WHERE c.id = sub.id AND c.position = 0
+	`); err != nil {
+		log.Fatalf("❌ Erreur backfill categories.position: %v", err)
+	}
+
 	// Migration: table paramètres globaux de l'application
 	if _, err = database.Exec(`CREATE TABLE IF NOT EXISTS app_settings (
 		key   VARCHAR(100) PRIMARY KEY,
@@ -277,6 +296,21 @@ func InitDB() *Database {
 		log.Fatalf("❌ Erreur migration contacts: %v", err)
 	}
 
+	// Migration: clé RustFS pour les médias (stockage objet)
+	if _, err = database.Exec(`ALTER TABLE media ADD COLUMN IF NOT EXISTS key TEXT NOT NULL DEFAULT ''`); err != nil {
+		log.Fatalf("❌ Erreur migration media.key: %v", err)
+	}
+
+	// Migration: colonne parrain sur les clients (système de parrainage)
+	if _, err = database.Exec(`ALTER TABLE clients ADD COLUMN IF NOT EXISTS parrain VARCHAR(255) DEFAULT NULL`); err != nil {
+		log.Fatalf("❌ Erreur migration clients.parrain: %v", err)
+	}
+
+	// Migration: index sur clients.parrain (lookups filleuls + stats parrainage)
+	if _, err = database.Exec(`CREATE INDEX IF NOT EXISTS idx_clients_parrain ON clients(parrain) WHERE parrain IS NOT NULL`); err != nil {
+		log.Fatalf("❌ Erreur migration idx_clients_parrain: %v", err)
+	}
+
 	// Lancer le nettoyage périodique des tokens expirés
 	go database.cleanExpiredTokensPeriodically()
 
@@ -321,6 +355,7 @@ func (db *Database) createTables() error {
 			cancellations_count INTEGER DEFAULT 0 NOT NULL,
 			last_penalty_reason TEXT DEFAULT NULL,
 			referral_balance NUMERIC(10,2) DEFAULT 0.0,
+			parrain VARCHAR(255) DEFAULT NULL,
 			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
 			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
 		);`,
@@ -382,6 +417,7 @@ func (db *Database) createTables() error {
 			product_id INTEGER NOT NULL REFERENCES products(id) ON DELETE CASCADE,
 			url TEXT NOT NULL,
 			type VARCHAR(50) NOT NULL,
+			key TEXT NOT NULL DEFAULT '',
 			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
 		);`,
 
@@ -513,6 +549,30 @@ func (db *Database) createTables() error {
 			id   SERIAL PRIMARY KEY,
 			name VARCHAR(255) NOT NULL
 		);`,
+
+		// ============================
+		// TABLE livreur_ratings
+		// ============================
+		`CREATE TABLE IF NOT EXISTS livreur_ratings (
+			id               SERIAL PRIMARY KEY,
+			order_id         INTEGER NOT NULL UNIQUE REFERENCES commandes(id) ON DELETE CASCADE,
+			livreur_username VARCHAR(255) NOT NULL,
+			client_username  VARCHAR(255) NOT NULL,
+			rating           SMALLINT NOT NULL CHECK (rating BETWEEN 1 AND 5),
+			comment          TEXT NOT NULL DEFAULT '',
+			created_at       TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);`,
+		`CREATE INDEX IF NOT EXISTS idx_ratings_livreur ON livreur_ratings(livreur_username);`,
+
+		// ============================
+		// TABLE login_history (livreur uniquement)
+		// ============================
+		`CREATE TABLE IF NOT EXISTS login_history (
+			id         SERIAL PRIMARY KEY,
+			username   VARCHAR(255) NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);`,
+		`CREATE INDEX IF NOT EXISTS idx_login_history_username ON login_history(username);`,
 	}
 
 	for _, query := range queries {

backend/gestion/db/db_livreur_rating.go

@@ -0,0 +1,62 @@
+package db
+
+import (
+	"time"
+)
+
+type LivreurRating struct {
+	ID              int       `json:"id"`
+	OrderID         int       `json:"order_id"`
+	LivreurUsername string    `json:"livreur_username"`
+	ClientUsername  string    `json:"client_username"`
+	Rating          int       `json:"rating"`
+	Comment         string    `json:"comment"`
+	CreatedAt       time.Time `json:"created_at"`
+}
+
+func (d *Database) SubmitLivreurRating(orderID int, livreurUsername, clientUsername string, rating int, comment string) error {
+	return d.GDB.Exec(`
+		INSERT INTO livreur_ratings (order_id, livreur_username, client_username, rating, comment, created_at)
+		VALUES (?, ?, ?, ?, ?, NOW())
+	`, orderID, livreurUsername, clientUsername, rating, comment).Error
+}
+
+func (d *Database) GetOrderRating(orderID int) (*LivreurRating, error) {
+	var r LivreurRating
+	err := d.GDB.Raw(`SELECT * FROM livreur_ratings WHERE order_id = ? LIMIT 1`, orderID).Scan(&r).Error
+	if err != nil {
+		return nil, err
+	}
+	if r.ID == 0 {
+		return nil, nil
+	}
+	return &r, nil
+}
+
+func (d *Database) GetLivreurRatings(livreurUsername string) ([]LivreurRating, float64, error) {
+	var ratings []LivreurRating
+	if err := d.GDB.Raw(`
+		SELECT * FROM livreur_ratings WHERE livreur_username = ? ORDER BY created_at DESC LIMIT 200
+	`, livreurUsername).Scan(&ratings).Error; err != nil {
+		return nil, 0, err
+	}
+
+	var avg float64
+	if len(ratings) > 0 {
+		d.GDB.Raw(`SELECT COALESCE(AVG(rating), 0) FROM livreur_ratings WHERE livreur_username = ?`, livreurUsername).Scan(&avg)
+	}
+	return ratings, avg, nil
+}
+
+// GetOrderForRating retourne l'username client et le livreur d'une commande approuvée
+func (d *Database) GetOrderForRating(orderID int) (clientUsername, livreurUsername string, err error) {
+	var row struct {
+		Username      string `gorm:"column:username"`
+		LivreurAssign string `gorm:"column:livreur_assign"`
+	}
+	err = d.GDB.Raw(`
+		SELECT username, COALESCE(livreur_assign, '') as livreur_assign
+		FROM commandes WHERE id = ? AND status = 'approved' LIMIT 1
+	`, orderID).Scan(&row).Error
+	return row.Username, row.LivreurAssign, err
+}

backend/gestion/db/db_login_history.go

@@ -0,0 +1,34 @@
+package db
+
+import (
+	"time"
+)
+
+type LoginHistoryEntry struct {
+	ID        int       `json:"id"`
+	Username  string    `json:"username"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// RecordLivreurLogin enregistre une connexion réussie d'un livreur (best-effort, non bloquant).
+func (d *Database) RecordLivreurLogin(username string) error {
+	return d.GDB.Exec(`
+		INSERT INTO login_history (username, created_at)
+		VALUES (?, NOW())
+	`, username).Error
+}
+
+// GetLivreurLoginHistoryByMonth retourne le détail des connexions d'un livreur pour un mois donné,
+// triées du plus récent au plus ancien (max 50 entrées).
+func (d *Database) GetLivreurLoginHistoryByMonth(username string, year, month int) ([]LoginHistoryEntry, error) {
+	var entries []LoginHistoryEntry
+	err := d.GDB.Raw(`
+		SELECT id, username, created_at FROM login_history
+		WHERE username = ?
+		AND EXTRACT(YEAR FROM created_at) = ?
+		AND EXTRACT(MONTH FROM created_at) = ?
+		ORDER BY created_at DESC
+		LIMIT 50
+	`, username, year, month).Scan(&entries).Error
+	return entries, err
+}

backend/gestion/db/db_media.go

@@ -59,8 +59,8 @@ func validateMediaURL(url string) error {
 	if strings.Contains(url, "..") || strings.Contains(url, "...") || strings.Contains(url, "..//") {
 		return fmt.Errorf("path traversal détecté dans l'URL")
 	}
-	if !strings.HasPrefix(url, "/uploads/") {
-		return fmt.Errorf("URL doit commencer par /uploads/")
+	if !strings.HasPrefix(url, "/uploads/") && !strings.HasPrefix(url, "/media/") {
+		return fmt.Errorf("URL doit commencer par /uploads/ ou /media/")
 	}
 	dangerousChars := []string{"<", ">", "\"", "'", ";", "|", "&", "$", "`", "\\"}
 	for _, char := range dangerousChars {
@@ -93,6 +93,11 @@ func (d *Database) CreateMedia(media any) error {
 	mediaType := m.GetType()
 	mediaURL := m.GetURL()
 
+	mediaKey := ""
+	if mediaPtr, isPtr := media.(*models.Media); isPtr {
+		mediaKey = mediaPtr.Key
+	}
+
 	if err := validateProductID(productID); err != nil {
 		log.Printf("❌ [CreateMedia] %v", err)
 		return err
@@ -106,14 +111,14 @@ func (d *Database) CreateMedia(media any) error {
 		return err
 	}
 
-	if err := d.InsertMedia(m, productID, mediaURL, mediaType); err != nil {
+	if err := d.InsertMedia(m, productID, mediaURL, mediaType, mediaKey); err != nil {
 		log.Printf("❌ [InsertMedia] %v", err)
 		return err
 	}
 	return nil
 }
 
-func (d *Database) InsertMedia(m any, productID int, mediaURL any, mediaType string) error {
+func (d *Database) InsertMedia(m any, productID int, mediaURL any, mediaType string, key string) error {
 	var exists bool
 	if err := d.GDB.Raw(`SELECT EXISTS(SELECT 1 FROM products WHERE id = ?)`, productID).Scan(&exists).Error; err != nil {
 		log.Printf("❌ [CreateMedia] Erreur vérification produit: %v", err)
@@ -128,9 +133,9 @@ func (d *Database) InsertMedia(m any, productID int, mediaURL any, mediaType str
 		ID int `gorm:"column:id"`
 	}
 	err := d.GDB.Raw(`
-		INSERT INTO media (product_id, url, type, created_at)
-		VALUES (?, ?, ?, ?) RETURNING id`,
-		productID, mediaURL, mediaType, time.Now(),
+		INSERT INTO media (product_id, url, type, key, created_at)
+		VALUES (?, ?, ?, ?, ?) RETURNING id`,
+		productID, mediaURL, mediaType, key, time.Now(),
 	).Scan(&result).Error
 	if err != nil {
 		log.Printf("❌ [CreateMedia] Erreur INSERT: %v", err)
@@ -154,7 +159,7 @@ func (d *Database) GetMediaByID(mediaID int) (*models.Media, error) {
 
 	var media models.Media
 	err := d.GDB.Raw(`
-		SELECT id, product_id, url, type, created_at
+		SELECT id, product_id, url, type, key, created_at
 		FROM media WHERE id = ?`, mediaID).Scan(&media).Error
 	if err != nil {
 		log.Printf("❌ [GetMediaByID] Erreur query: %v", err)
@@ -169,6 +174,20 @@ func (d *Database) GetMediaByID(mediaID int) (*models.Media, error) {
 	return &media, nil
 }
 
+// GetMediaBatch charge les médias de plusieurs produits en une seule requête.
+func (d *Database) GetMediaBatch(productIDs []int) map[int][]models.Media {
+	result := make(map[int][]models.Media, len(productIDs))
+	if len(productIDs) == 0 {
+		return result
+	}
+	var mediaList []models.Media
+	d.GDB.Raw(`SELECT id, product_id, url, type, key, created_at FROM media WHERE product_id IN ? ORDER BY product_id ASC, id ASC`, productIDs).Scan(&mediaList)
+	for _, m := range mediaList {
+		result[m.ProductID] = append(result[m.ProductID], m)
+	}
+	return result
+}
+
 func (d *Database) GetMediaByProductID(productID int) ([]models.Media, error) {
 	log.Printf("🖼️ [GetMediaByProductID] START - ProductID=%d", productID)
 
@@ -179,7 +198,7 @@ func (d *Database) GetMediaByProductID(productID int) ([]models.Media, error) {
 
 	var mediaList []models.Media
 	err := d.GDB.Raw(`
-		SELECT id, product_id, url, type, created_at
+		SELECT id, product_id, url, type, key, created_at
 		FROM media WHERE product_id = ?
 		ORDER BY id ASC`, productID).Scan(&mediaList).Error
 	if err != nil {

backend/gestion/db/db_notifications.go

@@ -36,7 +36,7 @@ func (d *Database) NotifyClient(username string, commandID int, notifType, messa
 	pipe := Redis.Pipeline()
 	pipe.LPush(RedisCtx, notifKey, notifJSON)
 	pipe.LTrim(RedisCtx, notifKey, 0, 199)
-	pipe.Expire(RedisCtx, notifKey, 7*24*time.Hour)
+	pipe.Expire(RedisCtx, notifKey, time.Hour)
 	pipe.Exec(RedisCtx) //nolint
 
 	if services.TelegramBot != nil && services.TelegramBot.IsNotificationsEnabled() {
@@ -54,7 +54,6 @@ func (d *Database) NotifyClient(username string, commandID int, notifType, messa
 	return nil
 }
 
-// NotifyLivreur envoie une notification in-app (Redis) à un livreur
 func (d *Database) NotifyLivreur(username string, commandID int, notifType, message string) error {
 	notifKey := fmt.Sprintf("notifications:%s", username)
 
@@ -70,7 +69,7 @@ func (d *Database) NotifyLivreur(username string, commandID int, notifType, mess
 	pipe2 := Redis.Pipeline()
 	pipe2.LPush(RedisCtx, notifKey, notifJSON)
 	pipe2.LTrim(RedisCtx, notifKey, 0, 199)
-	pipe2.Expire(RedisCtx, notifKey, 7*24*time.Hour)
+	pipe2.Expire(RedisCtx, notifKey, time.Hour)
 	pipe2.Exec(RedisCtx) //nolint
 
 	if services.TelegramBot != nil && services.TelegramBot.IsNotificationsEnabled() {
@@ -88,7 +87,6 @@ func (d *Database) NotifyLivreur(username string, commandID int, notifType, mess
 	return nil
 }
 
-// NotifyAllAdminCabine stocke une notification Redis pour tous les admins/cabines
 func (d *Database) NotifyAllAdminCabine(commandID int, clientUsername, deliveryAddr string) {
 	var users []struct {
 		Username string `gorm:"column:username"`
@@ -114,7 +112,7 @@ func (d *Database) NotifyAllAdminCabine(commandID int, clientUsername, deliveryA
 		notifKey := fmt.Sprintf("notifications:%s", u.Username)
 		pipe.LPush(RedisCtx, notifKey, notifJSON)
 		pipe.LTrim(RedisCtx, notifKey, 0, 199)
-		pipe.Expire(RedisCtx, notifKey, 7*24*time.Hour)
+		pipe.Expire(RedisCtx, notifKey, time.Hour)
 	}
 	pipe.Exec(RedisCtx) //nolint
 
@@ -130,7 +128,6 @@ func (d *Database) NotifyAllAdminCabine(commandID int, clientUsername, deliveryA
 	log.Printf("📬 [ADMIN_NOTIF] Notif Redis (%d users) pour commande #%d", count, commandID)
 }
 
-// NotifyAllAdminCabineAlert envoie une notification Redis à tous les admins/cabines lors d'une alerte
 func (d *Database) NotifyAllAdminCabineAlert(alertID int, livreurUsername, alertMessage string) {
 	var users []struct {
 		Username string `gorm:"column:username"`
@@ -156,7 +153,7 @@ func (d *Database) NotifyAllAdminCabineAlert(alertID int, livreurUsername, alert
 		notifKey := fmt.Sprintf("notifications:%s", u.Username)
 		pipe.LPush(RedisCtx, notifKey, notifJSON)
 		pipe.LTrim(RedisCtx, notifKey, 0, 199)
-		pipe.Expire(RedisCtx, notifKey, 7*24*time.Hour)
+		pipe.Expire(RedisCtx, notifKey, time.Hour)
 	}
 	pipe.Exec(RedisCtx) //nolint
 

backend/gestion/db/db_parrain.go

@@ -1,8 +1,11 @@
 package db
 
 import (
+	"database/sql"
 	"fmt"
 	"gestion/models"
+
+	"gorm.io/gorm"
 )
 
 func (d *Database) SetClientParrain(clientUsername, parrainUsername string) error {
@@ -18,13 +21,44 @@ func (d *Database) SetClientParrain(clientUsername, parrainUsername string) erro
 	return nil
 }
 
+// SetClientParrainAndCredit assigne un parrain à un client et crédite le parrain
+// dans une seule transaction, pour éviter un lien parrain enregistré sans le crédit associé.
+func (d *Database) SetClientParrainAndCredit(clientUsername, parrainUsername string, creditAmount float64) error {
+	return d.GDB.Transaction(func(tx *gorm.DB) error {
+		result := tx.Model(&models.Client{}).
+			Where("username = ? AND (parrain IS NULL OR parrain = '')", clientUsername).
+			Update("parrain", parrainUsername)
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected == 0 {
+			return fmt.Errorf("client introuvable ou parrain déjà défini")
+		}
+
+		if creditAmount > 0 {
+			result = tx.Model(&models.Client{}).Where("username = ?", parrainUsername).
+				Updates(map[string]any{"referral_balance": gorm.Expr("referral_balance + ?", creditAmount)})
+			if result.Error != nil {
+				return result.Error
+			}
+			if result.RowsAffected == 0 {
+				return fmt.Errorf("parrain non trouvé")
+			}
+		}
+		return nil
+	})
+}
+
 func (d *Database) GetClientParrain(clientUsername string) (string, error) {
-	var parrain string
+	var parrain sql.NullString
 	err := d.GDB.Table("clients").
 		Select("parrain").
 		Where("username = ?", clientUsername).
 		Scan(&parrain).Error
-	return parrain, err
+	if err != nil {
+		return "", err
+	}
+	return parrain.String, nil
 }
 
 func (d *Database) GetClientsByParrain(parrainUsername string) ([]models.Client, error) {

backend/gestion/db/db_product.go

@@ -73,14 +73,21 @@ func (d *Database) CreateProduct(product any) error {
 	p.SetCreatedAt(result.CreatedAt)
 	p.SetUpdatedAt(result.UpdatedAt)
 
-	for i, price := range p.GetPrices() {
-		err := d.GDB.Exec(`INSERT INTO product_prices (product_id, quantity, price, active_price) VALUES (?, ?, ?, ?)`,
-			result.ID, price.Quantity, price.Price, price.ActivePrice).Error
-		if err != nil {
-			log.Printf("❌ [DB CreateProduct] Erreur insertion prix[%d]: %v", i, err)
+	if rawPrices := p.GetPrices(); len(rawPrices) > 0 {
+		priceRows := make([]models.ProductPrice, len(rawPrices))
+		for i, price := range rawPrices {
+			priceRows[i] = models.ProductPrice{
+				ProductID:   result.ID,
+				Quantity:    price.Quantity,
+				Price:       price.Price,
+				ActivePrice: price.ActivePrice,
+			}
+		}
+		if err := d.GDB.Create(&priceRows).Error; err != nil {
+			log.Printf("❌ [DB CreateProduct] Erreur insertion prix batch: %v", err)
 			return fmt.Errorf("erreur insertion prix: %v", err)
 		}
-		log.Printf("✅ [DB CreateProduct] Prix[%d] inséré: quantity=%g, price=%.2f", i, price.Quantity, price.Price)
+		log.Printf("✅ [DB CreateProduct] %d prix insérés", len(priceRows))
 	}
 
 	log.Printf("🎉 [DB CreateProduct] Produit créé avec succès! ID=%d", result.ID)
@@ -136,6 +143,27 @@ func (d *Database) GetProductNamesByIDs(ids []int) (map[int]string, error) {
 	return result, nil
 }
 
+// GetProductCategoriesByIDs retourne un map id→category pour une liste d'IDs.
+func (d *Database) GetProductCategoriesByIDs(ids []int) (map[int]string, error) {
+	result := make(map[int]string, len(ids))
+	if len(ids) == 0 {
+		return result, nil
+	}
+	rows, err := d.GDB.Raw(`SELECT id, category FROM products WHERE id IN ?`, ids).Rows()
+	if err != nil {
+		return result, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var id int
+		var category string
+		if err := rows.Scan(&id, &category); err == nil {
+			result[id] = category
+		}
+	}
+	return result, nil
+}
+
 func (d *Database) GetAllProducts() ([]models.Product, error) {
 	log.Println("📦 [GetAllProducts] START")
 
@@ -149,23 +177,22 @@ func (d *Database) GetAllProducts() ([]models.Product, error) {
 		return nil, err
 	}
 
+	productIDs := make([]int, len(products))
+	for i, p := range products {
+		productIDs[i] = p.ID
+	}
+	allPrices := d.GetProductPricesBatch(productIDs)
+	allMedia := d.GetMediaBatch(productIDs)
 	for i := range products {
-		prices, err := d.GetProductPrices(products[i].ID)
-		if err != nil {
-			log.Printf("⚠️ [GetAllProducts] Erreur loading prices for product %d: %v", products[i].ID, err)
-			products[i].Prices = []models.ProductPrice{}
-		} else {
+		if prices, ok := allPrices[products[i].ID]; ok {
 			products[i].Prices = prices
-			log.Printf("✅ [GetAllProducts] Loaded %d prices for product %d", len(prices), products[i].ID)
-		}
-
-		media, err := d.GetMediaByProductID(products[i].ID)
-		if err != nil {
-			log.Printf("⚠️ [GetAllProducts] Erreur loading media for product %d: %v", products[i].ID, err)
-			products[i].Media = []models.Media{}
 		} else {
+			products[i].Prices = []models.ProductPrice{}
+		}
+		if media, ok := allMedia[products[i].ID]; ok {
 			products[i].Media = media
-			log.Printf("✅ [GetAllProducts] Loaded %d media for product %d", len(media), products[i].ID)
+		} else {
+			products[i].Media = []models.Media{}
 		}
 	}
 
@@ -188,14 +215,16 @@ func (d *Database) GetProductsByCategory(category string) ([]models.Product, err
 		return nil, fmt.Errorf("erreur lors de la récupération des produits: %w", err)
 	}
 
+	catProductIDs := make([]int, len(products))
+	for i, p := range products {
+		catProductIDs[i] = p.ID
+	}
+	catPrices := d.GetProductPricesBatch(catProductIDs)
 	for i := range products {
-		prices, err := d.GetProductPrices(products[i].ID)
-		if err != nil {
-			log.Printf("⚠️ [GetProductsByCategory] Erreur loading prices for product %d: %v", products[i].ID, err)
-			products[i].Prices = []models.ProductPrice{}
-		} else {
+		if prices, ok := catPrices[products[i].ID]; ok {
 			products[i].Prices = prices
-			log.Printf("✅ [GetProductsByCategory] Loaded %d prices for product %d", len(prices), products[i].ID)
+		} else {
+			products[i].Prices = []models.ProductPrice{}
 		}
 	}
 
@@ -215,9 +244,17 @@ func (d *Database) UpdateProduct(productID int, name, category, description, uni
 
 	d.GDB.Exec(`DELETE FROM product_prices WHERE product_id = ?`, productID)
 
-	for _, price := range prices {
-		if err := d.GDB.Exec(`INSERT INTO product_prices (product_id, quantity, price, active_price) VALUES (?, ?, ?, ?)`,
-			productID, price.Quantity, price.Price, price.ActivePrice).Error; err != nil {
+	if len(prices) > 0 {
+		priceRows := make([]models.ProductPrice, len(prices))
+		for i, price := range prices {
+			priceRows[i] = models.ProductPrice{
+				ProductID:   productID,
+				Quantity:    price.Quantity,
+				Price:       price.Price,
+				ActivePrice: price.ActivePrice,
+			}
+		}
+		if err := d.GDB.Create(&priceRows).Error; err != nil {
 			return fmt.Errorf("erreur insertion prix: %w", err)
 		}
 	}

backend/gestion/db/db_product_price.go

@@ -13,6 +13,20 @@ func (d *Database) GetProductPrices(productID int) ([]models.ProductPrice, error
 	return prices, nil
 }
 
+// GetProductPricesBatch charge les prix de plusieurs produits en une seule requête.
+func (d *Database) GetProductPricesBatch(productIDs []int) map[int][]models.ProductPrice {
+	result := make(map[int][]models.ProductPrice, len(productIDs))
+	if len(productIDs) == 0 {
+		return result
+	}
+	var prices []models.ProductPrice
+	d.GDB.Where("product_id IN ?", productIDs).Order("product_id ASC, quantity ASC").Find(&prices)
+	for _, p := range prices {
+		result[p.ProductID] = append(result[p.ProductID], p)
+	}
+	return result
+}
+
 func (d *Database) AddActivePrice(priceID int) error {
 	result := d.GDB.Model(&models.ProductPrice{}).
 		Where("id = ?", priceID).

backend/gestion/db/db_queue_auto_next.go

@@ -189,7 +189,7 @@ func (d *Database) RemoveCommandFromAllQueues(commandID int, deliveryman string)
 	}
 
 	// 4. Vérifier toutes les autres queues de livreurs (au cas où)
-	keys, _ := Redis.Keys(RedisCtx, "queue:deliveryman:*").Result()
+	keys, _ := scanRedisKeys("queue:deliveryman:*")
 	for _, key := range keys {
 		if len(key) > 6 && key[len(key)-6:] == ":count" {
 			continue

backend/gestion/db/db_sanction_client.go

@@ -27,25 +27,6 @@ func (d *Database) GetClientCancellationsCount(username string) (int, error) {
 	return result.Count, nil
 }
 
-// IncrementClientCancellationsCount incrémente le compteur d'annulations
-func (d *Database) IncrementClientCancellationsCount(username string) error {
-	result := d.GDB.Model(&models.Client{}).Where("username = ?", username).Updates(map[string]any{
-		"cancellations_count": gorm.Expr("COALESCE(cancellations_count, 0) + 1"),
-	})
-	if result.Error != nil {
-		log.Printf("❌ [IncrementCancellations] Erreur: %v", result.Error)
-		return fmt.Errorf("erreur incrémentation: %w", result.Error)
-	}
-	if result.RowsAffected == 0 {
-		return fmt.Errorf("client non trouvé")
-	}
-
-	cacheKey := fmt.Sprintf("client:%s", username)
-	Redis.Del(RedisCtx, cacheKey)
-
-	return nil
-}
-
 // penaltyForCount retourne le montant du palier applicable pour un nombre d'annulations donné
 func penaltyForCount(count int, tiers []models.PenaltyTier) int {
 	if len(tiers) == 0 {
@@ -64,6 +45,16 @@ func penaltyForCount(count int, tiers []models.PenaltyTier) int {
 	return sorted[len(sorted)-1].Amount
 }
 
+// penaltyTiers charge le barème de pénalités configuré, avec repli sur le barème par défaut si les settings sont indisponibles
+func (d *Database) penaltyTiers(logCtx string) []models.PenaltyTier {
+	settings, err := d.GetSettings()
+	if err != nil {
+		log.Printf("⚠️ [%s] Impossible de charger les settings, barème par défaut: %v", logCtx, err)
+		settings = DefaultSettings()
+	}
+	return settings.PenaltyTiers
+}
+
 // CalculateCancellationPenalty calcule la pénalité selon l'historique et le barème configuré
 func (d *Database) CalculateCancellationPenalty(username string) (int, error) {
 	count, err := d.GetClientCancellationsCount(username)
@@ -71,13 +62,7 @@ func (d *Database) CalculateCancellationPenalty(username string) (int, error) {
 		return 0, err
 	}
 
-	settings, err := d.GetSettings()
-	if err != nil {
-		log.Printf("⚠️ [CalculatePenalty] Impossible de charger les settings, barème par défaut: %v", err)
-		settings = DefaultSettings()
-	}
-
-	penalty := penaltyForCount(count, settings.PenaltyTiers)
+	penalty := penaltyForCount(count, d.penaltyTiers("CalculatePenalty"))
 
 	log.Printf("💰 [CalculatePenalty] Client %s - Annulations: %d → Pénalité: %d points",
 		username, count, penalty)
@@ -85,30 +70,48 @@ func (d *Database) CalculateCancellationPenalty(username string) (int, error) {
 	return penalty, nil
 }
 
-// ApplyCancellationPenalty applique une pénalité et incrémente le compteur d'annulations
+// ApplyCancellationPenalty applique une pénalité (cumulative) et incrémente le compteur d'annulations.
+// Verrouillée via FOR UPDATE pour éviter qu'un appel concurrent (même client, deux livraisons en parallèle)
+// calcule la pénalité sur un compteur pas encore à jour, et l'amende s'additionne au lieu d'écraser
+// le solde existant (cohérent avec CancelCommandAtomic pour l'annulation côté client).
 func (d *Database) ApplyCancellationPenalty(username string) (int, error) {
-	penalty, err := d.CalculateCancellationPenalty(username)
+	tiers := d.penaltyTiers("ApplyCancellationPenalty")
+
+	var penalty int
+
+	err := d.GDB.Transaction(func(tx *gorm.DB) error {
+		var count int
+		if err := tx.Raw(`
+			SELECT COALESCE(cancellations_count, 0) FROM clients
+			WHERE username = ? FOR UPDATE`, username).Scan(&count).Error; err != nil {
+			return fmt.Errorf("erreur récupération compteur: %w", err)
+		}
+
+		penalty = penaltyForCount(count, tiers)
+
+		log.Printf("⚠️  [ApplyCancellationPenalty] Client %s - Pénalité calculée: %d points", username, penalty)
+
+		result := tx.Exec(`
+			UPDATE clients
+			SET cancellations_count = COALESCE(cancellations_count, 0) + 1,
+			    amende = amende + ?,
+			    updated_at = CURRENT_TIMESTAMP
+			WHERE username = ?`, penalty, username)
+		if result.Error != nil {
+			log.Printf("❌ [ApplyCancellationPenalty] Erreur UPDATE: %v", result.Error)
+			return fmt.Errorf("erreur application pénalité: %w", result.Error)
+		}
+		if result.RowsAffected == 0 {
+			return fmt.Errorf("client non trouvé")
+		}
+
+		log.Printf("✅ [ApplyCancellationPenalty] Amende %d appliquée à %s", penalty, username)
+		return nil
+	})
 	if err != nil {
 		return 0, err
 	}
 
-	log.Printf("⚠️  [ApplyCancellationPenalty] Client %s - Pénalité calculée: %d points", username, penalty)
-
-	if err := d.IncrementClientCancellationsCount(username); err != nil {
-		return 0, err
-	}
-
-	result := d.GDB.Model(&models.Client{}).Where("username = ?", username).Update("amende", float64(penalty))
-	if result.Error != nil {
-		log.Printf("❌ [ApplyCancellationPenalty] Erreur UPDATE: %v", result.Error)
-		return 0, fmt.Errorf("erreur application pénalité: %w", result.Error)
-	}
-	if result.RowsAffected == 0 {
-		return 0, fmt.Errorf("client non trouvé")
-	}
-
-	log.Printf("✅ [ApplyCancellationPenalty] Amende %d appliquée à %s", penalty, username)
-
 	cacheKey := fmt.Sprintf("client:%s", username)
 	Redis.Del(RedisCtx, cacheKey)
 

backend/gestion/db/db_settings.go

@@ -72,6 +72,18 @@ func DefaultSettings() models.AppSettings {
 			Mode:           "single",
 			CategoryRoutes: []models.CategoryRoute{},
 		},
+		AdminColorPrimary:    "#7c3aed",
+		AdminColorSecondary:  "#000000",
+		AdminColorSuccess:    "#4ade80",
+		AdminColorDanger:     "#ef4444",
+		AdminColorWarning:    "#f59e0b",
+		ClientColorPrimary:   "#7c3aed",
+		ClientColorSecondary: "#000000",
+		ClientColorSuccess:   "#4ade80",
+		ClientColorDanger:    "#ef4444",
+		ClientColorWarning:   "#f59e0b",
+		ClientTitleGradientFrom: "#a78bfa",
+		ClientTitleGradientTo:   "#22d3ee",
 		DeliverySchedule: DefaultDeliverySchedule(),
 		PostalZones: []models.PostalZone{
 			{Name: "Zone 30€", MinAmount: 30, Codes: []string{"44000", "44100", "44200", "44300"}},
@@ -163,6 +175,30 @@ func (d *Database) GetSettings() (models.AppSettings, error) {
 			settings.Telegram2FAEnabled = row.Value == "true"
 		case "shop_name":
 			settings.ShopName = row.Value
+		case "admin_color_primary":
+			settings.AdminColorPrimary = row.Value
+		case "admin_color_secondary":
+			settings.AdminColorSecondary = row.Value
+		case "admin_color_success":
+			settings.AdminColorSuccess = row.Value
+		case "admin_color_danger":
+			settings.AdminColorDanger = row.Value
+		case "admin_color_warning":
+			settings.AdminColorWarning = row.Value
+		case "client_color_primary":
+			settings.ClientColorPrimary = row.Value
+		case "client_color_secondary":
+			settings.ClientColorSecondary = row.Value
+		case "client_color_success":
+			settings.ClientColorSuccess = row.Value
+		case "client_color_danger":
+			settings.ClientColorDanger = row.Value
+		case "client_color_warning":
+			settings.ClientColorWarning = row.Value
+		case "client_title_gradient_from":
+			settings.ClientTitleGradientFrom = row.Value
+		case "client_title_gradient_to":
+			settings.ClientTitleGradientTo = row.Value
 		}
 	}
 	return settings, nil
@@ -253,6 +289,18 @@ func (d *Database) UpdateSettings(s models.AppSettings) error {
 		{"delivery_mode", string(deliveryModeJSON)},
 		{"shop_name", s.ShopName},
 		{"contact_telegram", s.ContactTelegram},
+		{"admin_color_primary", s.AdminColorPrimary},
+		{"admin_color_secondary", s.AdminColorSecondary},
+		{"admin_color_success", s.AdminColorSuccess},
+		{"admin_color_danger", s.AdminColorDanger},
+		{"admin_color_warning", s.AdminColorWarning},
+		{"client_color_primary", s.ClientColorPrimary},
+		{"client_color_secondary", s.ClientColorSecondary},
+		{"client_color_success", s.ClientColorSuccess},
+		{"client_color_danger", s.ClientColorDanger},
+		{"client_color_warning", s.ClientColorWarning},
+		{"client_title_gradient_from", s.ClientTitleGradientFrom},
+		{"client_title_gradient_to", s.ClientTitleGradientTo},
 	}
 
 	upsert := `INSERT INTO app_settings (key, value) VALUES (?, ?)

backend/gestion/db/db_stat.go

@@ -0,0 +1,449 @@
+package db
+
+import (
+	"gestion/models"
+	"time"
+)
+
+// ── Reset des sections de stats ─────────────────────────────────────────────
+
+// ResetAdminStat enregistre (ou met à jour) la date de reset pour une section.
+func (d *Database) ResetAdminStat(section string) error {
+	now := time.Now().UTC().Format(time.RFC3339)
+	upsert := `INSERT INTO app_settings (key, value) VALUES (?, ?)
+	           ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value`
+	return d.GDB.Exec(upsert, section, now).Error
+}
+
+// ReadResetAt lit la date de reset stockée pour une clé donnée (zero value si absente).
+func (d *Database) ReadResetAt(key string) time.Time {
+	var row struct {
+		Value string
+	}
+	err := d.GDB.Table("app_settings").
+		Select("value").
+		Where("key = ?", key).
+		Scan(&row).Error
+	if err != nil {
+		return time.Time{}
+	}
+	if row.Value != "" {
+		if t, err := time.Parse(time.RFC3339, row.Value); err == nil {
+			return t
+		}
+	}
+	return time.Time{}
+}
+
+// ── Construction des clauses WHERE (filtrage par reset) ────────────────────
+
+// statusFilterClause construit "<baseStatus> [AND created_at >= ?]" et renvoie
+// la clause ainsi que les arguments à binder, dans l'ordre.
+func statusFilterClause(baseStatus string, resetAt time.Time) (string, []interface{}) {
+	if !resetAt.IsZero() {
+		return baseStatus + " AND created_at >= ?", []interface{}{resetAt.Format(time.RFC3339)}
+	}
+	return baseStatus, nil
+}
+
+// AdminStatsFilters regroupe les dates de reset pour chaque section, lues une
+// seule fois puis transmises aux différentes requêtes.
+type AdminStatsFilters struct {
+	ResetCommandes time.Time
+	ResetRevenus   time.Time
+	ResetProduits  time.Time
+	ResetHeures    time.Time
+	ResetJours     time.Time
+	ResetDoses     time.Time
+}
+
+// LoadAdminStatsFilters lit toutes les dates de reset en une seule requête.
+func (d *Database) LoadAdminStatsFilters() AdminStatsFilters {
+	keys := []string{
+		"stats_reset_commandes_at",
+		"stats_reset_revenus_at",
+		"stats_reset_produits_at",
+		"stats_reset_heures_at",
+		"stats_reset_jours_at",
+		"stats_reset_doses_at",
+	}
+	var rows []struct {
+		Key   string `gorm:"column:key"`
+		Value string `gorm:"column:value"`
+	}
+	d.GDB.Table("app_settings").Select("key, value").Where("key IN ?", keys).Scan(&rows)
+
+	m := make(map[string]time.Time, len(keys))
+	for _, r := range rows {
+		if t, err := time.Parse(time.RFC3339, r.Value); err == nil {
+			m[r.Key] = t
+		}
+	}
+	return AdminStatsFilters{
+		ResetCommandes: m["stats_reset_commandes_at"],
+		ResetRevenus:   m["stats_reset_revenus_at"],
+		ResetProduits:  m["stats_reset_produits_at"],
+		ResetHeures:    m["stats_reset_heures_at"],
+		ResetJours:     m["stats_reset_jours_at"],
+		ResetDoses:     m["stats_reset_doses_at"],
+	}
+}
+
+// ── Commandes par jour de la semaine (non annulées) ─────────────────────────
+
+func (d *Database) OrderPerDaysPerWeeks(wdRows *[]models.WeekdayRow, resetAt time.Time) error {
+	where, args := statusFilterClause("status != 'cancelled'", resetAt)
+	query := `
+		SELECT EXTRACT(DOW FROM created_at)::int AS dow, COUNT(*) AS count
+		FROM commandes
+		WHERE ` + where + `
+		GROUP BY dow
+		ORDER BY dow
+	`
+	return d.GDB.Raw(query, args...).Scan(wdRows).Error
+}
+
+// ── Commandes par jour sur 30 jours ──────────────────────────────────────────
+
+func (d *Database) OrdersByDayLast30(dayRows *[]models.DayRow, resetAt time.Time) error {
+	where, args := statusFilterClause("status != 'cancelled'", resetAt)
+	query := `
+		SELECT DATE(created_at) AS day, COUNT(*) AS count
+		FROM commandes
+		WHERE created_at >= NOW() - INTERVAL '30 days'
+		  AND ` + where + `
+		GROUP BY DATE(created_at)
+		ORDER BY day
+	`
+	return d.GDB.Raw(query, args...).Scan(dayRows).Error
+}
+
+// ── Revenus par jour sur 30 jours (commandes approuvées) ─────────────────────
+
+func (d *Database) RevenueByDayLast30(dayRevRows *[]models.DayRevenueRow, resetAt time.Time) error {
+	where, args := statusFilterClause("status = 'approved'", resetAt)
+	query := `
+		SELECT DATE(created_at) AS day, COALESCE(SUM(total_prix - COALESCE(referral_used, 0)), 0) AS revenue
+		FROM commandes
+		WHERE created_at >= NOW() - INTERVAL '30 days'
+		  AND ` + where + `
+		GROUP BY DATE(created_at)
+		ORDER BY day
+	`
+	return d.GDB.Raw(query, args...).Scan(dayRevRows).Error
+}
+
+// ── Commandes par jour sur un mois calendaire complet ────────────────────────
+
+type DailyMonthStatRow struct {
+	Day      time.Time
+	Count    int
+	Revenue  float64
+	Quantity float64
+}
+
+func (d *Database) StatsByDayForMonth(rows *[]DailyMonthStatRow, monthStart time.Time, resetAt time.Time) error {
+	start := time.Date(monthStart.Year(), monthStart.Month(), 1, 0, 0, 0, 0, monthStart.Location())
+	end := start.AddDate(0, 1, 0)
+
+	where, whereArgs := statusFilterClause("status != 'cancelled'", resetAt)
+
+	query := `
+		SELECT
+			d.day,
+			COALESCE(d.count, 0)     AS count,
+			COALESCE(rv.revenue, 0)  AS revenue,
+			COALESCE(qt.quantity, 0) AS quantity
+		FROM (
+			SELECT DATE(created_at) AS day, COUNT(*) AS count
+			FROM commandes
+			WHERE created_at >= ? AND created_at < ?
+			  AND ` + where + `
+			GROUP BY DATE(created_at)
+		) d
+		LEFT JOIN (
+			SELECT DATE(created_at) AS day,
+			       COALESCE(SUM(total_prix - COALESCE(referral_used, 0)), 0) AS revenue
+			FROM commandes
+			WHERE created_at >= ? AND created_at < ?
+			  AND status = 'approved'
+			GROUP BY DATE(created_at)
+		) rv ON rv.day = d.day
+		LEFT JOIN (
+			SELECT DATE(c.created_at) AS day, SUM(ci.quantite) AS quantity
+			FROM commandes c
+			JOIN command_items ci ON ci.command_id = c.id
+			WHERE c.created_at >= ? AND c.created_at < ?
+			  AND c.status != 'cancelled'
+			GROUP BY DATE(c.created_at)
+		) qt ON qt.day = d.day
+		ORDER BY d.day
+	`
+
+	// Ordre des "?" dans la requête : (start, end, [reset]) pour le bloc "d",
+	// puis (start, end) pour "rv", puis (start, end) pour "qt".
+	args := []interface{}{start, end}
+	args = append(args, whereArgs...)
+	args = append(args, start, end)
+	args = append(args, start, end)
+
+	return d.GDB.Raw(query, args...).Scan(rows).Error
+}
+
+// OrdersAndRevenueByHour renvoie, par heure, le nombre de commandes non annulées
+// (volume d'activité) et le revenu confirmé (commandes approuvées uniquement —
+// cohérent avec TotalRevenue/RevenueByDayLast30, pour ne pas compter comme
+// "revenu" une commande encore en cours qui pourrait être annulée).
+func (d *Database) OrdersAndRevenueByHour(hourRows *[]models.HourRow, resetAt time.Time) error {
+	where, args := statusFilterClause("status != 'cancelled'", resetAt)
+	query := `
+		SELECT
+			EXTRACT(HOUR FROM created_at)::int AS hour,
+			COUNT(*)                           AS count,
+			COALESCE(SUM(CASE WHEN status = 'approved' THEN total_prix - COALESCE(referral_used, 0) ELSE 0 END), 0) AS revenue
+		FROM commandes
+		WHERE ` + where + `
+		GROUP BY hour
+		ORDER BY hour
+	`
+	return d.GDB.Raw(query, args...).Scan(hourRows).Error
+}
+
+// ── Top produits (quantité vendue) ───────────────────────────────────────────
+
+// TopProducts renvoie les produits les plus commandés. La quantité/le nombre de
+// commandes reflètent l'activité (non annulées), le revenu ne compte que les
+// commandes approuvées (revenu confirmé, cohérent avec le résumé global).
+func (d *Database) TopProducts(prodRows *[]models.ProductRow, resetAt time.Time, limit int) error {
+	where, args := statusFilterClause("c.status != 'cancelled'", resetAt)
+	args = append(args, limit)
+	query := `
+		SELECT
+			ci.product_id,
+			ci.produit                              AS name,
+			SUM(ci.quantite)                        AS total_quantity,
+			COUNT(DISTINCT ci.command_id)           AS order_count,
+			SUM(CASE WHEN c.status = 'approved'
+			    THEN ci.prix * (c.total_prix - COALESCE(c.referral_used, 0)) / NULLIF(c.total_prix, 0)
+			    ELSE 0 END) AS revenue,
+			COALESCE(p.category, '')                AS category,
+			COALESCE(cat.color, '#7c3aed')          AS category_color
+		FROM command_items ci
+		JOIN commandes c ON c.id = ci.command_id
+		LEFT JOIN products p   ON p.id = ci.product_id
+		LEFT JOIN categories cat ON cat.name = p.category
+		WHERE ` + where + `
+		GROUP BY ci.product_id, ci.produit, p.category, cat.color
+		ORDER BY total_quantity DESC
+		LIMIT ?
+	`
+	return d.GDB.Raw(query, args...).Scan(prodRows).Error
+}
+
+// ── Répartition des doses/quantités par produit ──────────────────────────────
+
+// QuantityBreakdown : quantité/nombre de commandes reflètent l'activité (non
+// annulées), le revenu ne compte que les commandes approuvées (revenu confirmé).
+func (d *Database) QuantityBreakdown(qtyRows *[]models.QuantityBreakdownRow, resetAt time.Time) error {
+	where, args := statusFilterClause("c.status != 'cancelled'", resetAt)
+	query := `
+		SELECT
+			ci.product_id,
+			ci.produit                           AS product_name,
+			ci.quantite                          AS quantity,
+			COUNT(DISTINCT ci.command_id)        AS order_count,
+			SUM(ci.quantite)                     AS total_sold,
+			SUM(CASE WHEN c.status = 'approved'
+			    THEN ci.prix * (c.total_prix - COALESCE(c.referral_used, 0)) / NULLIF(c.total_prix, 0)
+			    ELSE 0 END) AS revenue,
+			COALESCE(cat.color, '#7c3aed')       AS category_color
+		FROM command_items ci
+		JOIN commandes c ON c.id = ci.command_id
+		LEFT JOIN products p   ON p.id = ci.product_id
+		LEFT JOIN categories cat ON cat.name = p.category
+		WHERE ` + where + `
+		GROUP BY ci.product_id, ci.produit, ci.quantite, cat.color
+		ORDER BY ci.product_id, COUNT(DISTINCT ci.command_id) DESC
+	`
+	return d.GDB.Raw(query, args...).Scan(qtyRows).Error
+}
+
+// ── Détail du jour (catégorie → produits) ────────────────────────────────────
+
+// DailyProductDetail : quantité/nombre de commandes reflètent l'activité (non
+// annulées), le revenu ne compte que les commandes approuvées (revenu confirmé).
+func (d *Database) DailyProductDetail(dailyRows *[]models.DailyProductRow) error {
+	query := `
+		SELECT
+			ci.product_id,
+			ci.produit                              AS product_name,
+			COALESCE(p.category, 'Sans catégorie') AS category,
+			COALESCE(cat.color, '#7c3aed')         AS category_color,
+			SUM(ci.quantite)                        AS total_quantity,
+			COUNT(DISTINCT ci.command_id)           AS order_count,
+			SUM(CASE WHEN c.status = 'approved'
+			    THEN ci.prix * (c.total_prix - COALESCE(c.referral_used, 0)) / NULLIF(c.total_prix, 0)
+			    ELSE 0 END) AS revenue
+		FROM command_items ci
+		JOIN commandes c ON c.id = ci.command_id
+		LEFT JOIN products p   ON p.id = ci.product_id
+		LEFT JOIN categories cat ON cat.name = p.category
+		WHERE DATE(c.created_at) = CURRENT_DATE
+		  AND c.status != 'cancelled'
+		GROUP BY ci.product_id, ci.produit, p.category, cat.color
+		ORDER BY p.category, SUM(ci.quantite) DESC
+	`
+	return d.GDB.Raw(query).Scan(dailyRows).Error
+}
+
+func (d *Database) DailyProductDetailForDate(dailyRows *[]models.DailyProductRow, date time.Time) error {
+	start := time.Date(date.Year(), date.Month(), date.Day(), 0, 0, 0, 0, date.Location())
+	end := start.AddDate(0, 0, 1)
+
+	query := `
+		SELECT
+			ci.product_id,
+			ci.produit                              AS product_name,
+			COALESCE(p.category, 'Sans catégorie') AS category,
+			COALESCE(cat.color, '#7c3aed')         AS category_color,
+			SUM(ci.quantite)                        AS total_quantity,
+			COUNT(DISTINCT ci.command_id)           AS order_count,
+			SUM(CASE WHEN c.status = 'approved'
+			    THEN ci.prix * (c.total_prix - COALESCE(c.referral_used, 0)) / NULLIF(c.total_prix, 0)
+			    ELSE 0 END) AS revenue
+		FROM command_items ci
+		JOIN commandes c ON c.id = ci.command_id
+		LEFT JOIN products p   ON p.id = ci.product_id
+		LEFT JOIN categories cat ON cat.name = p.category
+		WHERE c.created_at >= ? AND c.created_at < ?
+		  AND c.status != 'cancelled'
+		GROUP BY ci.product_id, ci.produit, p.category, cat.color
+		ORDER BY p.category, SUM(ci.quantite) DESC
+	`
+	return d.GDB.Raw(query, start, end).Scan(dailyRows).Error
+}
+
+// DailyOrdersCountForDate renvoie le nombre de commandes (non annulées) pour
+// une date précise.
+func (d *Database) DailyOrdersCountForDate(date time.Time) (int64, error) {
+	start := time.Date(date.Year(), date.Month(), date.Day(), 0, 0, 0, 0, date.Location())
+	end := start.AddDate(0, 0, 1)
+
+	var count int64
+	err := d.GDB.Raw(`
+		SELECT COUNT(DISTINCT id) FROM commandes
+		WHERE created_at >= ? AND created_at < ? AND status != 'cancelled'
+	`, start, end).Scan(&count).Error
+	return count, err
+}
+
+// DailyOrdersCount renvoie le nombre de commandes (non annulées) du jour.
+func (d *Database) DailyOrdersCount() (int64, error) {
+	var count int64
+	err := d.GDB.Raw(`
+		SELECT COUNT(DISTINCT id) FROM commandes
+		WHERE DATE(created_at) = CURRENT_DATE AND status != 'cancelled'
+	`).Scan(&count).Error
+	return count, err
+}
+
+// ── Résumé global ────────────────────────────────────────────────────────────
+
+// TotalOrders renvoie le nombre total de commandes filtré par le reset "commandes".
+func (d *Database) TotalOrders(resetAt time.Time) (int64, error) {
+	where, args := statusFilterClause("status != 'cancelled'", resetAt)
+	var total int64
+	err := d.GDB.Raw(`SELECT COUNT(*) FROM commandes WHERE `+where, args...).Scan(&total).Error
+	return total, err
+}
+
+// TotalRevenue renvoie le revenu total (commandes approuvées) filtré par le reset "revenus".
+func (d *Database) TotalRevenue(resetAt time.Time) (float64, error) {
+	where, args := statusFilterClause("status = 'approved'", resetAt)
+	var total float64
+	err := d.GDB.Raw(`SELECT COALESCE(SUM(total_prix - COALESCE(referral_used, 0)), 0) FROM commandes WHERE `+where, args...).
+		Scan(&total).Error
+	return total, err
+}
+
+// ActiveDaysLast30 renvoie le nombre de jours distincts ayant eu au moins une commande sur 30 jours.
+func (d *Database) ActiveDaysLast30(resetAt time.Time) (int64, error) {
+	where, args := statusFilterClause("status != 'cancelled'", resetAt)
+	var activeDays int64
+	query := `
+		SELECT COUNT(DISTINCT DATE(created_at))
+		FROM commandes
+		WHERE created_at >= NOW() - INTERVAL '30 days' AND ` + where
+	err := d.GDB.Raw(query, args...).Scan(&activeDays).Error
+	return activeDays, err
+}
+
+// OrdersCountLast30 renvoie le nombre de commandes sur les 30 derniers jours.
+func (d *Database) OrdersCountLast30(resetAt time.Time) (int64, error) {
+	where, args := statusFilterClause("status != 'cancelled'", resetAt)
+	var count int64
+	query := `
+		SELECT COUNT(*) FROM commandes
+		WHERE created_at >= NOW() - INTERVAL '30 days' AND ` + where
+	err := d.GDB.Raw(query, args...).Scan(&count).Error
+	return count, err
+}
+
+func (d *Database) GetMyDeliveryStatsPerDay(statsRows *[]models.DayRowWithResult, username string) error {
+	query := `
+		SELECT DATE(updated_at) AS day,
+		       COUNT(*) AS count,
+		       COALESCE(SUM(total_prix - COALESCE(referral_used, 0)), 0) AS revenue
+		FROM commandes
+		WHERE livreur_assign = ?
+		  AND status IN ('livre', 'approved')
+		  AND updated_at >= NOW() - INTERVAL '30 days'
+		GROUP BY DATE(updated_at)
+		ORDER BY day
+	`
+	return d.GDB.Raw(query, username).Scan(statsRows).Error
+}
+
+func (d *Database) GetMyDeliveryStatsPerWeek(statsRow *[]models.WeekRow, username string) error {
+	query := `
+		SELECT EXTRACT(WEEK FROM updated_at)::int AS week_num,
+		       EXTRACT(YEAR FROM updated_at)::int AS year,
+		       COUNT(*) AS count,
+		       COALESCE(SUM(total_prix - COALESCE(referral_used, 0)), 0) AS revenue
+		FROM commandes
+		WHERE livreur_assign = ?
+		  AND status IN ('livre', 'approved')
+		  AND updated_at >= NOW() - INTERVAL '12 weeks'
+		GROUP BY week_num, year
+		ORDER BY year, week_num
+	`
+	return d.GDB.Raw(query, username).Scan(statsRow).Error
+}
+
+func (d *Database) GetMyDeliveryStatsPerMonth(statsRow *[]models.MonthRow, username string) error {
+	query := `
+		SELECT EXTRACT(MONTH FROM updated_at)::int AS month_num,
+		       EXTRACT(YEAR FROM updated_at)::int AS year,
+		       COUNT(*) AS count,
+		       COALESCE(SUM(total_prix - COALESCE(referral_used, 0)), 0) AS revenue
+		FROM commandes
+		WHERE livreur_assign = ?
+		  AND status IN ('livre', 'approved')
+		  AND updated_at >= NOW() - INTERVAL '12 months'
+		GROUP BY month_num, year
+		ORDER BY year, month_num
+	`
+	return d.GDB.Raw(query, username).Scan(statsRow).Error
+}
+
+func (d *Database) GetMyDeliveryStatsToday(statsRow *models.TodayRow, username string) error {
+	query := `
+		SELECT COUNT(*) AS count,
+		       COALESCE(SUM(total_prix - COALESCE(referral_used, 0)), 0) AS revenue
+		FROM commandes
+		WHERE livreur_assign = ?
+		  AND status IN ('livre', 'approved')
+		  AND DATE(updated_at) = CURRENT_DATE
+	`
+	return d.GDB.Raw(query, username).Scan(statsRow).Error
+}

backend/gestion/db/db_telegram.go

@@ -43,7 +43,7 @@ func GenerateLinkToken(username, role string) (string, error) {
 
 	key := fmt.Sprintf("telegram:link:%s", token)
 	if err := Redis.Set(RedisCtx, key, val, linkTokenTTL).Err(); err != nil {
-		return "", fmt.Errorf("Redis SET: %w", err)
+		return "", fmt.Errorf("redis set: %w", err)
 	}
 	return token, nil
 }

backend/gestion/db/db_users.go

@@ -15,7 +15,7 @@ func (d *Database) CreateUser(user *models.User) error {
 
 func (d *Database) GetAllUsers() ([]*models.User, error) {
 	var users []*models.User
-	if err := d.GDB.Order("created_at DESC").Find(&users).Error; err != nil {
+	if err := d.GDB.Order("created_at DESC").Limit(500).Find(&users).Error; err != nil {
 		return nil, fmt.Errorf("erreur lors de la récupération des utilisateurs: %w", err)
 	}
 	return users, nil
@@ -23,7 +23,7 @@ func (d *Database) GetAllUsers() ([]*models.User, error) {
 
 func (d *Database) GetAllDeliveryMen() ([]*models.User, error) {
 	var users []*models.User
-	if err := d.GDB.Where("role = ?", "livreur").Find(&users).Error; err != nil {
+	if err := d.GDB.Where("role = ?", "livreur").Limit(100).Find(&users).Error; err != nil {
 		return nil, fmt.Errorf("erreur lors de la récupération des livreurs: %w", err)
 	}
 	return users, nil

backend/gestion/db/redis_deliveryman_assignment.go

@@ -10,7 +10,7 @@ import (
 
 // FindLeastLoadedDeliveryman trouve le livreur avec le moins de commandes ET qui peut accepter
 func (d *Database) FindLeastLoadedDeliveryman() (string, error) {
-	keys, err := Redis.Keys(RedisCtx, "delivery:status:*").Result()
+	keys, err := scanRedisKeys("delivery:status:*")
 	if err != nil || len(keys) == 0 {
 		return "", fmt.Errorf("aucun livreur trouvé")
 	}

backend/gestion/db/redis_eta_management.go

@@ -165,6 +165,7 @@ func (d *Database) SetCommandETAWithDetails(commandID, totalETA, queuePosition i
 	eta := map[string]any{
 		"command_id":        commandID,
 		"total_eta_minutes": totalETA,
+		"eta_minutes":       totalETA,
 		"queue_position":    queuePosition,
 		"updated_at":        now.Unix(),
 		"arrival_time":      arrivalTime.Unix(),

backend/gestion/db/redis_queue_clean_up.go

@@ -9,7 +9,6 @@ import (
 	"time"
 )
 
-// CleanupInvalidQueueCommands supprime toutes les commandes avec des données manquantes
 func (d *Database) CleanupInvalidQueueCommands() (int, error) {
 	log.Println("🧹 [CLEANUP] Démarrage du nettoyage des commandes invalides...")
 
@@ -82,7 +81,6 @@ func (d *Database) CleanupInvalidQueueCommands() (int, error) {
 	return removedCount, nil
 }
 
-// removeInvalidCommand supprime une commande invalide de toutes les queues
 func (d *Database) removeInvalidCommand(key string, commandID int, reason string) {
 	commandIDStr := fmt.Sprintf("%d", commandID)
 

backend/gestion/db/redis_queue_info.go

@@ -91,7 +91,6 @@ func (d *Database) GetAllQueuesOverview() (map[string]any, error) {
 	return overview, nil
 }
 
-// GetQueueStats - Statistiques détaillées
 func (d *Database) GetQueueStats() (map[string]any, error) {
 	normalCount, _ := Redis.ZCard(RedisCtx, "queue:pending:sorted").Result()
 	priorityCount, _ := Redis.ZCard(RedisCtx, "queue:priority:sorted").Result()

backend/gestion/db/redis_queue_management.go

@@ -142,7 +142,6 @@ func (d *Database) AddToGeneralQueue(queueItem models.CommandQueue) error {
 	return nil
 }
 
-// RemoveCommandFromQueue - VERSION AMÉLIORÉE avec auto-update du statut
 func (d *Database) RemoveCommandFromQueue(commandID int) error {
 	key := fmt.Sprintf("queue:pending:%d", commandID)
 	commandIDStr := strconv.Itoa(commandID)
@@ -321,7 +320,6 @@ func (d *Database) iterDeliveryStatuses(fn func(models.DeliveryPersonStatus)) er
 	return nil
 }
 
-// scanRedisKeys remplace KEYS * par SCAN pour ne pas bloquer Redis.
 func scanRedisKeys(pattern string) ([]string, error) {
 	var all []string
 	cursor := uint64(0)