feat: Provisionner automatiquement un nouvel établissement

Lorsqu'un super-admin crée un établissement via l'interface, le système doit automatiquement créer la base tenant, exécuter les migrations, créer le premier utilisateur admin et envoyer l'invitation — le tout de manière asynchrone pour ne pas bloquer la réponse HTTP. Ce mécanisme rend chaque établissement opérationnel dès sa création sans intervention manuelle sur l'infrastructure.
2026-04-08 13:55:41 +02:00
parent bec211ebf0
commit dc2be898d5
171 changed files with 11703 additions and 700 deletions
--- a/backend/tests/Functional/Administration/Api/PasswordResetEndpointsTest.php
+++ b/backend/tests/Functional/Administration/Api/PasswordResetEndpointsTest.php
@@ -36,11 +36,9 @@ final class PasswordResetEndpointsTest extends ApiTestCase

        // Should NOT return 401 Unauthorized
        // It should return 200 (success) or 429 (rate limited), but never 401
-        self::assertNotEquals(401, $response->getStatusCode(), 'Password forgot endpoint should be accessible without JWT');
-
-        // The endpoint always returns success to prevent email enumeration
-        // Even for non-existent emails
-        self::assertResponseIsSuccessful();
+        $status = $response->getStatusCode();
+        self::assertNotEquals(401, $status, 'Password forgot endpoint should be accessible without JWT');
+        self::assertContains($status, [200, 201, 429], 'Expected 200/201 (success) or 429 (rate limited)');
    }

    #[Test]
--- a/backend/tests/Functional/Scolarite/Api/ParentGradeEndpointsTest.php
+++ b/backend/tests/Functional/Scolarite/Api/ParentGradeEndpointsTest.php
@@ -99,7 +99,7 @@ final class ParentGradeEndpointsTest extends ApiTestCase
    }

    #[Test]
-    public function getChildGradesReturns404ForUnlinkedChild(): void
+    public function getChildGradesReturns403ForUnlinkedChild(): void
    {
        $unlinkedChildId = '99990001-0001-0001-0001-000000000099';
        $client = $this->createAuthenticatedClient(self::PARENT_ID, ['ROLE_PARENT']);
@@ -107,7 +107,7 @@ final class ParentGradeEndpointsTest extends ApiTestCase
            'headers' => ['Accept' => 'application/json'],
        ]);

-        self::assertResponseStatusCodeSame(404);
+        self::assertResponseStatusCodeSame(403);
    }

    // =========================================================================
@@ -177,7 +177,7 @@ final class ParentGradeEndpointsTest extends ApiTestCase
    }

    #[Test]
-    public function getChildGradesBySubjectReturns404ForUnlinkedChild(): void
+    public function getChildGradesBySubjectReturns403ForUnlinkedChild(): void
    {
        $unlinkedChildId = '99990001-0001-0001-0001-000000000099';
        $client = $this->createAuthenticatedClient(self::PARENT_ID, ['ROLE_PARENT']);
@@ -185,7 +185,7 @@ final class ParentGradeEndpointsTest extends ApiTestCase
            'headers' => ['Accept' => 'application/json'],
        ]);

-        self::assertResponseStatusCodeSame(404);
+        self::assertResponseStatusCodeSame(403);
    }

    // =========================================================================
--- a/backend/tests/Functional/Scolarite/Api/TeacherStatisticsEndpointsTest.php
+++ b/backend/tests/Functional/Scolarite/Api/TeacherStatisticsEndpointsTest.php
@@ -0,0 +1,527 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Functional\Scolarite\Api;
+
+use ApiPlatform\Symfony\Bundle\Test\ApiTestCase;
+use App\Administration\Domain\Model\SchoolClass\ClassId;
+use App\Administration\Domain\Model\Subject\SubjectId;
+use App\Administration\Domain\Model\User\UserId;
+use App\Administration\Infrastructure\Security\SecurityUser;
+use App\Scolarite\Domain\Model\Evaluation\Coefficient;
+use App\Scolarite\Domain\Model\Evaluation\Evaluation;
+use App\Scolarite\Domain\Model\Evaluation\GradeScale;
+use App\Scolarite\Domain\Model\Grade\Grade;
+use App\Scolarite\Domain\Model\Grade\GradeStatus;
+use App\Scolarite\Domain\Model\Grade\GradeValue;
+use App\Scolarite\Domain\Repository\EvaluationRepository;
+use App\Scolarite\Domain\Repository\GradeRepository;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use Doctrine\DBAL\Connection;
+
+use const JSON_THROW_ON_ERROR;
+
+use PHPUnit\Framework\Attributes\Test;
+
+final class TeacherStatisticsEndpointsTest extends ApiTestCase
+{
+    protected static ?bool $alwaysBootKernel = true;
+
+    private const string TENANT_ID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
+    private const string TEACHER_ID = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
+    private const string STUDENT_ID = 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb';
+    private const string STUDENT2_ID = 'cccccccc-cccc-cccc-cccc-cccccccccccc';
+    private const string CLASS_ID = 'dddddddd-dddd-dddd-dddd-dddddddddddd';
+    private const string SUBJECT_ID = 'eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee';
+    private const string PERIOD_ID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';
+    private const string BASE_URL = 'http://ecole-alpha.classeo.local/api';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->seedFixtures();
+    }
+
+    protected function tearDown(): void
+    {
+        /** @var Connection $connection */
+        $connection = static::getContainer()->get(Connection::class);
+        $connection->executeStatement('DELETE FROM evaluation_statistics WHERE evaluation_id IN (SELECT id FROM evaluations WHERE tenant_id = :tid AND teacher_id = :teach)', ['tid' => self::TENANT_ID, 'teach' => self::TEACHER_ID]);
+        $connection->executeStatement('DELETE FROM student_averages WHERE tenant_id = :tid', ['tid' => self::TENANT_ID]);
+        $connection->executeStatement('DELETE FROM student_general_averages WHERE tenant_id = :tid', ['tid' => self::TENANT_ID]);
+        $connection->executeStatement('DELETE FROM grade_events WHERE grade_id IN (SELECT id FROM grades WHERE tenant_id = :tid AND created_by = :teach)', ['tid' => self::TENANT_ID, 'teach' => self::TEACHER_ID]);
+        $connection->executeStatement('DELETE FROM grades WHERE tenant_id = :tid AND created_by = :teach', ['tid' => self::TENANT_ID, 'teach' => self::TEACHER_ID]);
+        $connection->executeStatement('DELETE FROM evaluations WHERE tenant_id = :tid AND teacher_id = :teach', ['tid' => self::TENANT_ID, 'teach' => self::TEACHER_ID]);
+        $connection->executeStatement('DELETE FROM teacher_assignments WHERE tenant_id = :tid AND teacher_id = :teach', ['tid' => self::TENANT_ID, 'teach' => self::TEACHER_ID]);
+        $connection->executeStatement('DELETE FROM class_assignments WHERE tenant_id = :tid AND school_class_id = :class', ['tid' => self::TENANT_ID, 'class' => self::CLASS_ID]);
+        $connection->executeStatement('DELETE FROM academic_periods WHERE id = :id', ['id' => self::PERIOD_ID]);
+        $connection->executeStatement('DELETE FROM users WHERE id = :id', ['id' => self::TEACHER_ID]);
+        $connection->executeStatement('DELETE FROM users WHERE id = :id', ['id' => self::STUDENT_ID]);
+        $connection->executeStatement('DELETE FROM users WHERE id = :id', ['id' => self::STUDENT2_ID]);
+
+        parent::tearDown();
+    }
+
+    // =========================================================================
+    // GET /me/statistics — Auth & Access
+    // =========================================================================
+
+    #[Test]
+    public function overviewReturns401WithoutAuthentication(): void
+    {
+        $client = static::createClient();
+        $client->request('GET', self::BASE_URL . '/me/statistics', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(401);
+    }
+
+    #[Test]
+    public function overviewReturns403ForStudent(): void
+    {
+        $client = $this->createAuthenticatedClient(self::STUDENT_ID, ['ROLE_ELEVE']);
+        $client->request('GET', self::BASE_URL . '/me/statistics', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    #[Test]
+    public function overviewReturns403ForParent(): void
+    {
+        $parentId = '99999999-9999-9999-9999-999999999999';
+        $client = $this->createAuthenticatedClient($parentId, ['ROLE_PARENT']);
+        $client->request('GET', self::BASE_URL . '/me/statistics', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    // =========================================================================
+    // GET /me/statistics — Happy path
+    // =========================================================================
+
+    #[Test]
+    public function overviewReturnsClassSummaryForTeacher(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseIsSuccessful();
+
+        /** @var string $content */
+        $content = $client->getResponse()->getContent();
+        /** @var array<string, mixed> $data */
+        $data = json_decode($content, true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertArrayHasKey('teacherId', $data);
+        self::assertSame(self::TEACHER_ID, $data['teacherId']);
+        self::assertArrayHasKey('classes', $data);
+        self::assertNotEmpty($data['classes']);
+
+        $class = $data['classes'][0];
+        self::assertSame(self::CLASS_ID, $class['classId']);
+        self::assertSame(self::SUBJECT_ID, $class['subjectId']);
+        self::assertArrayHasKey('evaluationCount', $class);
+        self::assertArrayHasKey('studentCount', $class);
+        self::assertArrayHasKey('average', $class);
+        self::assertArrayHasKey('successRate', $class);
+    }
+
+    // =========================================================================
+    // GET /me/statistics/classes/{classId} — Auth & Validation
+    // =========================================================================
+
+    #[Test]
+    public function classDetailReturns401WithoutAuthentication(): void
+    {
+        $client = static::createClient();
+        $client->request('GET', self::BASE_URL . '/me/statistics/classes/' . self::CLASS_ID . '?subjectId=' . self::SUBJECT_ID, [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(401);
+    }
+
+    #[Test]
+    public function classDetailReturns403ForStudent(): void
+    {
+        $client = $this->createAuthenticatedClient(self::STUDENT_ID, ['ROLE_ELEVE']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/classes/' . self::CLASS_ID . '?subjectId=' . self::SUBJECT_ID, [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    #[Test]
+    public function classDetailReturns400WithoutSubjectId(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/classes/' . self::CLASS_ID, [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(400);
+    }
+
+    #[Test]
+    public function classDetailReturns400WithInvalidThreshold(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/classes/' . self::CLASS_ID . '?subjectId=' . self::SUBJECT_ID . '&threshold=25', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(400);
+    }
+
+    // =========================================================================
+    // GET /me/statistics/classes/{classId} — Happy path
+    // =========================================================================
+
+    #[Test]
+    public function classDetailReturnsStatisticsForTeacher(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/classes/' . self::CLASS_ID . '?subjectId=' . self::SUBJECT_ID, [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseIsSuccessful();
+
+        /** @var string $content */
+        $content = $client->getResponse()->getContent();
+        /** @var array<string, mixed> $data */
+        $data = json_decode($content, true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertSame(self::CLASS_ID, $data['classId']);
+        self::assertSame(self::SUBJECT_ID, $data['subjectId']);
+        self::assertArrayHasKey('average', $data);
+        self::assertArrayHasKey('successRate', $data);
+        self::assertArrayHasKey('distribution', $data);
+        self::assertCount(8, $data['distribution']);
+        self::assertArrayHasKey('evolution', $data);
+        self::assertArrayHasKey('students', $data);
+        self::assertNotEmpty($data['students']);
+
+        $student = $data['students'][0];
+        self::assertArrayHasKey('studentId', $student);
+        self::assertArrayHasKey('studentName', $student);
+        self::assertArrayHasKey('average', $student);
+        self::assertArrayHasKey('inDifficulty', $student);
+        self::assertArrayHasKey('trend', $student);
+    }
+
+    // =========================================================================
+    // GET /me/statistics/export — Auth & Validation
+    // =========================================================================
+
+    #[Test]
+    public function exportReturns401WithoutAuthentication(): void
+    {
+        $client = static::createClient();
+        $client->request('GET', self::BASE_URL . '/me/statistics/export?classId=' . self::CLASS_ID . '&subjectId=' . self::SUBJECT_ID);
+
+        self::assertResponseStatusCodeSame(401);
+    }
+
+    #[Test]
+    public function exportReturns403ForStudent(): void
+    {
+        $client = $this->createAuthenticatedClient(self::STUDENT_ID, ['ROLE_ELEVE']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/export?classId=' . self::CLASS_ID . '&subjectId=' . self::SUBJECT_ID);
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    #[Test]
+    public function exportReturns400WithoutClassId(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/export?subjectId=' . self::SUBJECT_ID);
+
+        self::assertResponseStatusCodeSame(400);
+    }
+
+    #[Test]
+    public function exportReturns400WithoutSubjectId(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/export?classId=' . self::CLASS_ID);
+
+        self::assertResponseStatusCodeSame(400);
+    }
+
+    // =========================================================================
+    // GET /me/statistics/export — Happy path
+    // =========================================================================
+
+    #[Test]
+    public function exportReturnsCsvWithCorrectHeaders(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/export?classId=' . self::CLASS_ID . '&subjectId=' . self::SUBJECT_ID . '&className=6eB&subjectName=Math%C3%A9matiques');
+
+        self::assertResponseIsSuccessful();
+        self::assertResponseHeaderSame('content-type', 'text/csv; charset=UTF-8');
+
+        /** @var string $csv */
+        $csv = $client->getResponse()->getContent();
+        self::assertNotEmpty($csv);
+        self::assertStringContainsString('Moyenne', $csv);
+    }
+
+    // =========================================================================
+    // GET /me/statistics/evaluations — Auth & Access
+    // =========================================================================
+
+    #[Test]
+    public function evaluationDifficultyReturns401WithoutAuthentication(): void
+    {
+        $client = static::createClient();
+        $client->request('GET', self::BASE_URL . '/me/statistics/evaluations', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(401);
+    }
+
+    #[Test]
+    public function evaluationDifficultyReturns403ForStudent(): void
+    {
+        $client = $this->createAuthenticatedClient(self::STUDENT_ID, ['ROLE_ELEVE']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/evaluations', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    #[Test]
+    public function evaluationDifficultyReturnsDataForTeacher(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/evaluations', [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseIsSuccessful();
+
+        /** @var string $content */
+        $content = $client->getResponse()->getContent();
+        /** @var array<string, mixed> $payload */
+        $payload = json_decode($content, true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertArrayHasKey('evaluations', $payload);
+        /** @var list<array<string, mixed>> $evaluations */
+        $evaluations = $payload['evaluations'];
+        self::assertIsArray($evaluations);
+        self::assertNotEmpty($evaluations);
+
+        $eval = $evaluations[0];
+        self::assertArrayHasKey('evaluationId', $eval);
+        self::assertArrayHasKey('title', $eval);
+        self::assertArrayHasKey('gradedCount', $eval);
+    }
+
+    // =========================================================================
+    // GET /me/statistics/students/{studentId} — Auth & Validation
+    // =========================================================================
+
+    #[Test]
+    public function studentProgressionReturns401WithoutAuthentication(): void
+    {
+        $client = static::createClient();
+        $client->request('GET', self::BASE_URL . '/me/statistics/students/' . self::STUDENT_ID . '?subjectId=' . self::SUBJECT_ID . '&classId=' . self::CLASS_ID, [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(401);
+    }
+
+    #[Test]
+    public function studentProgressionReturns403ForStudent(): void
+    {
+        $client = $this->createAuthenticatedClient(self::STUDENT_ID, ['ROLE_ELEVE']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/students/' . self::STUDENT_ID . '?subjectId=' . self::SUBJECT_ID . '&classId=' . self::CLASS_ID, [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    #[Test]
+    public function studentProgressionReturnsDataForTeacher(): void
+    {
+        $client = $this->createAuthenticatedClient(self::TEACHER_ID, ['ROLE_PROF']);
+        $client->request('GET', self::BASE_URL . '/me/statistics/students/' . self::STUDENT_ID . '?subjectId=' . self::SUBJECT_ID . '&classId=' . self::CLASS_ID, [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        self::assertResponseIsSuccessful();
+
+        /** @var string $content */
+        $content = $client->getResponse()->getContent();
+        /** @var array<string, mixed> $data */
+        $data = json_decode($content, true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertArrayHasKey('grades', $data);
+        self::assertIsArray($data['grades']);
+    }
+
+    // =========================================================================
+    // Helpers
+    // =========================================================================
+
+    /**
+     * @param list<string> $roles
+     */
+    private function createAuthenticatedClient(string $userId, array $roles): \ApiPlatform\Symfony\Bundle\Test\Client
+    {
+        $client = static::createClient();
+
+        $user = new SecurityUser(
+            userId: UserId::fromString($userId),
+            email: 'test-stats@classeo.local',
+            hashedPassword: '',
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            roles: $roles,
+        );
+
+        $client->loginUser($user, 'api');
+
+        return $client;
+    }
+
+    private function seedFixtures(): void
+    {
+        $container = static::getContainer();
+        /** @var Connection $connection */
+        $connection = $container->get(Connection::class);
+        $tenantId = TenantId::fromString(self::TENANT_ID);
+        $now = new DateTimeImmutable();
+
+        $schoolId = '550e8400-e29b-41d4-a716-ff6655440001';
+        $academicYearId = '550e8400-e29b-41d4-a716-ff6655440002';
+
+        // Seed users
+        $connection->executeStatement(
+            "INSERT INTO users (id, tenant_id, email, hashed_password, first_name, last_name, roles, statut, created_at, updated_at)
+             VALUES (:id, :tid, 'teacher-stats@test.local', '', 'Marc', 'Dupont', '[\"ROLE_PROF\"]', 'active', NOW(), NOW())
+             ON CONFLICT (id) DO NOTHING",
+            ['id' => self::TEACHER_ID, 'tid' => self::TENANT_ID],
+        );
+        $connection->executeStatement(
+            "INSERT INTO users (id, tenant_id, email, hashed_password, first_name, last_name, roles, statut, created_at, updated_at)
+             VALUES (:id, :tid, 'student-stats1@test.local', '', 'Alice', 'Durand', '[\"ROLE_ELEVE\"]', 'active', NOW(), NOW())
+             ON CONFLICT (id) DO NOTHING",
+            ['id' => self::STUDENT_ID, 'tid' => self::TENANT_ID],
+        );
+        $connection->executeStatement(
+            "INSERT INTO users (id, tenant_id, email, hashed_password, first_name, last_name, roles, statut, created_at, updated_at)
+             VALUES (:id, :tid, 'student-stats2@test.local', '', 'Bob', 'Martin', '[\"ROLE_ELEVE\"]', 'active', NOW(), NOW())
+             ON CONFLICT (id) DO NOTHING",
+            ['id' => self::STUDENT2_ID, 'tid' => self::TENANT_ID],
+        );
+
+        // Seed class and subject
+        $connection->executeStatement(
+            "INSERT INTO school_classes (id, tenant_id, school_id, academic_year_id, name, status, created_at, updated_at)
+             VALUES (:id, :tid, :sid, :ayid, 'Stats-6eB', 'active', NOW(), NOW())
+             ON CONFLICT (id) DO NOTHING",
+            ['id' => self::CLASS_ID, 'tid' => self::TENANT_ID, 'sid' => $schoolId, 'ayid' => $academicYearId],
+        );
+        $connection->executeStatement(
+            "INSERT INTO subjects (id, tenant_id, school_id, name, code, status, created_at, updated_at)
+             VALUES (:id, :tid, :sid, 'Mathématiques', 'MATH', 'active', NOW(), NOW())
+             ON CONFLICT (id) DO NOTHING",
+            ['id' => self::SUBJECT_ID, 'tid' => self::TENANT_ID, 'sid' => $schoolId],
+        );
+
+        // Seed academic period (must cover current date for queries to return data)
+        // Clean up any conflicting rows first (unique constraint on tenant_id, academic_year_id, sequence)
+        $connection->executeStatement(
+            'DELETE FROM academic_periods WHERE tenant_id = :tid AND academic_year_id = :ayid AND sequence = 2',
+            ['tid' => self::TENANT_ID, 'ayid' => $academicYearId],
+        );
+        $connection->executeStatement(
+            'DELETE FROM academic_periods WHERE id = :id',
+            ['id' => self::PERIOD_ID],
+        );
+        $connection->executeStatement(
+            "INSERT INTO academic_periods (id, tenant_id, academic_year_id, period_type, sequence, label, start_date, end_date)
+             VALUES (:id, :tid, :ayid, 'trimester', 2, 'Trimestre 2', '2026-01-01', '2026-06-30')",
+            ['id' => self::PERIOD_ID, 'tid' => self::TENANT_ID, 'ayid' => $academicYearId],
+        );
+
+        // Seed teacher assignment (required for statistics reader queries)
+        $connection->executeStatement(
+            "INSERT INTO teacher_assignments (id, tenant_id, teacher_id, school_class_id, subject_id, academic_year_id, status, start_date, created_at, updated_at)
+             VALUES (gen_random_uuid(), :tid, :teach, :class, :subj, :ayid, 'active', NOW(), NOW(), NOW())
+             ON CONFLICT DO NOTHING",
+            ['tid' => self::TENANT_ID, 'teach' => self::TEACHER_ID, 'class' => self::CLASS_ID, 'subj' => self::SUBJECT_ID, 'ayid' => $academicYearId],
+        );
+
+        // Seed student class assignments (class_assignments links students to classes)
+        $connection->executeStatement(
+            'INSERT INTO class_assignments (id, tenant_id, user_id, school_class_id, academic_year_id, created_at, updated_at)
+             VALUES (gen_random_uuid(), :tid, :sid, :class, :ayid, NOW(), NOW())
+             ON CONFLICT DO NOTHING',
+            ['tid' => self::TENANT_ID, 'sid' => self::STUDENT_ID, 'class' => self::CLASS_ID, 'ayid' => $academicYearId],
+        );
+        $connection->executeStatement(
+            'INSERT INTO class_assignments (id, tenant_id, user_id, school_class_id, academic_year_id, created_at, updated_at)
+             VALUES (gen_random_uuid(), :tid, :sid, :class, :ayid, NOW(), NOW())
+             ON CONFLICT DO NOTHING',
+            ['tid' => self::TENANT_ID, 'sid' => self::STUDENT2_ID, 'class' => self::CLASS_ID, 'ayid' => $academicYearId],
+        );
+
+        // Create and publish evaluations with grades
+        /** @var EvaluationRepository $evalRepo */
+        $evalRepo = $container->get(EvaluationRepository::class);
+        /** @var GradeRepository $gradeRepo */
+        $gradeRepo = $container->get(GradeRepository::class);
+
+        $eval = Evaluation::creer(
+            tenantId: $tenantId,
+            classId: ClassId::fromString(self::CLASS_ID),
+            subjectId: SubjectId::fromString(self::SUBJECT_ID),
+            teacherId: UserId::fromString(self::TEACHER_ID),
+            title: 'DS Maths Stats',
+            description: null,
+            evaluationDate: new DateTimeImmutable('2026-03-15'),
+            gradeScale: new GradeScale(20),
+            coefficient: new Coefficient(1.0),
+            now: $now,
+        );
+        $eval->publierNotes($now);
+        $eval->pullDomainEvents();
+        $evalRepo->save($eval);
+
+        foreach ([
+            [self::STUDENT_ID, 15.0],
+            [self::STUDENT2_ID, 8.0],
+        ] as [$studentId, $value]) {
+            $grade = Grade::saisir(
+                tenantId: $tenantId,
+                evaluationId: $eval->id,
+                studentId: UserId::fromString($studentId),
+                value: new GradeValue($value),
+                status: GradeStatus::GRADED,
+                gradeScale: new GradeScale(20),
+                createdBy: UserId::fromString(self::TEACHER_ID),
+                now: $now,
+            );
+            $grade->pullDomainEvents();
+            $gradeRepo->save($grade);
+        }
+    }
+}
--- a/backend/tests/Functional/Shared/Infrastructure/Audit/AuditTrailFunctionalTest.php
+++ b/backend/tests/Functional/Shared/Infrastructure/Audit/AuditTrailFunctionalTest.php
@@ -0,0 +1,185 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Functional\Shared\Infrastructure\Audit;
+
+use ApiPlatform\Symfony\Bundle\Test\ApiTestCase;
+use App\Shared\Application\Port\AuditLogger;
+use Doctrine\DBAL\Connection;
+
+use const JSON_THROW_ON_ERROR;
+
+use PHPUnit\Framework\Attributes\Test;
+use Ramsey\Uuid\Uuid;
+
+/**
+ * [P1] Functional tests for audit trail infrastructure.
+ *
+ * Verifies that the AuditLogger writes to the real audit_log table
+ * and that entries contain correct metadata.
+ *
+ * @see NFR-S7: Audit trail immutable (qui, quoi, quand)
+ * @see FR90: Tracage actions sensibles
+ */
+final class AuditTrailFunctionalTest extends ApiTestCase
+{
+    protected static ?bool $alwaysBootKernel = true;
+
+    private Connection $connection;
+    private AuditLogger $auditLogger;
+
+    protected function setUp(): void
+    {
+        static::bootKernel();
+        $container = static::getContainer();
+
+        /* @var Connection $connection */
+        $this->connection = $container->get(Connection::class);
+
+        /* @var AuditLogger $auditLogger */
+        $this->auditLogger = $container->get(AuditLogger::class);
+    }
+
+    #[Test]
+    public function logAuthenticationWritesEntryToAuditLogTable(): void
+    {
+        $userId = Uuid::uuid4();
+
+        $this->auditLogger->logAuthentication(
+            eventType: 'ConnexionReussie',
+            userId: $userId,
+            payload: [
+                'email_hash' => hash('sha256', 'test@example.com'),
+                'result' => 'success',
+                'method' => 'password',
+            ],
+        );
+
+        $entry = $this->connection->fetchAssociative(
+            'SELECT * FROM audit_log WHERE aggregate_id = ? AND event_type = ? ORDER BY occurred_at DESC LIMIT 1',
+            [$userId->toString(), 'ConnexionReussie'],
+        );
+
+        self::assertNotFalse($entry, 'Audit log entry should exist after logAuthentication');
+        self::assertSame('User', $entry['aggregate_type']);
+        self::assertSame($userId->toString(), $entry['aggregate_id']);
+        self::assertSame('ConnexionReussie', $entry['event_type']);
+
+        $payload = json_decode($entry['payload'], true, 512, JSON_THROW_ON_ERROR);
+        self::assertSame('success', $payload['result']);
+        self::assertSame('password', $payload['method']);
+        self::assertArrayHasKey('email_hash', $payload);
+    }
+
+    #[Test]
+    public function logAuthenticationIncludesMetadataWithTimestamp(): void
+    {
+        $userId = Uuid::uuid4();
+
+        $this->auditLogger->logAuthentication(
+            eventType: 'ConnexionReussie',
+            userId: $userId,
+            payload: ['result' => 'success'],
+        );
+
+        $entry = $this->connection->fetchAssociative(
+            'SELECT * FROM audit_log WHERE aggregate_id = ? ORDER BY occurred_at DESC LIMIT 1',
+            [$userId->toString()],
+        );
+
+        self::assertNotFalse($entry);
+        self::assertNotEmpty($entry['occurred_at'], 'Audit entry must have a timestamp');
+
+        $metadata = json_decode($entry['metadata'], true, 512, JSON_THROW_ON_ERROR);
+        self::assertIsArray($metadata);
+    }
+
+    #[Test]
+    public function logFailedAuthenticationWritesWithNullUserId(): void
+    {
+        $this->auditLogger->logAuthentication(
+            eventType: 'ConnexionEchouee',
+            userId: null,
+            payload: [
+                'email_hash' => hash('sha256', 'unknown@example.com'),
+                'result' => 'failure',
+                'reason' => 'invalid_credentials',
+            ],
+        );
+
+        $entry = $this->connection->fetchAssociative(
+            "SELECT * FROM audit_log WHERE event_type = 'ConnexionEchouee' ORDER BY occurred_at DESC LIMIT 1",
+        );
+
+        self::assertNotFalse($entry, 'Failed login audit entry should exist');
+        self::assertNull($entry['aggregate_id'], 'Failed login should have null user ID');
+        self::assertSame('User', $entry['aggregate_type']);
+
+        $payload = json_decode($entry['payload'], true, 512, JSON_THROW_ON_ERROR);
+        self::assertSame('failure', $payload['result']);
+        self::assertSame('invalid_credentials', $payload['reason']);
+    }
+
+    #[Test]
+    public function logDataChangeWritesOldAndNewValues(): void
+    {
+        $aggregateId = Uuid::uuid4();
+
+        $this->auditLogger->logDataChange(
+            aggregateType: 'Grade',
+            aggregateId: $aggregateId,
+            eventType: 'GradeModified',
+            oldValues: ['value' => 14.0],
+            newValues: ['value' => 16.0],
+            reason: 'Correction erreur de saisie',
+        );
+
+        $entry = $this->connection->fetchAssociative(
+            'SELECT * FROM audit_log WHERE aggregate_id = ? AND event_type = ? ORDER BY occurred_at DESC LIMIT 1',
+            [$aggregateId->toString(), 'GradeModified'],
+        );
+
+        self::assertNotFalse($entry);
+        self::assertSame('Grade', $entry['aggregate_type']);
+
+        $payload = json_decode($entry['payload'], true, 512, JSON_THROW_ON_ERROR);
+        self::assertSame(['value' => 14.0], $payload['old_values']);
+        self::assertSame(['value' => 16.0], $payload['new_values']);
+        self::assertSame('Correction erreur de saisie', $payload['reason']);
+    }
+
+    #[Test]
+    public function auditLogEntriesAreAppendOnly(): void
+    {
+        $userId = Uuid::uuid4();
+
+        $this->auditLogger->logAuthentication(
+            eventType: 'ConnexionReussie',
+            userId: $userId,
+            payload: ['result' => 'success'],
+        );
+
+        $countBefore = (int) $this->connection->fetchOne(
+            'SELECT COUNT(*) FROM audit_log WHERE aggregate_id = ?',
+            [$userId->toString()],
+        );
+
+        self::assertSame(1, $countBefore);
+
+        // Log a second event for the same user
+        $this->auditLogger->logAuthentication(
+            eventType: 'ConnexionReussie',
+            userId: $userId,
+            payload: ['result' => 'success'],
+        );
+
+        $countAfter = (int) $this->connection->fetchOne(
+            'SELECT COUNT(*) FROM audit_log WHERE aggregate_id = ?',
+            [$userId->toString()],
+        );
+
+        // Both entries should exist (append-only, no overwrite)
+        self::assertSame(2, $countAfter, 'Audit log must be append-only — both entries should exist');
+    }
+}
--- a/backend/tests/Integration/Administration/Infrastructure/Service/GouvFrCalendarApiTest.php
+++ b/backend/tests/Integration/Administration/Infrastructure/Service/GouvFrCalendarApiTest.php
@@ -21,6 +21,9 @@ use function sprintf;
 use Symfony\Component\HttpClient\HttpClient;

 use function sys_get_temp_dir;
+
+use Throwable;
+
 use function unlink;

 /**
@@ -42,6 +45,16 @@ final class GouvFrCalendarApiTest extends TestCase

    protected function setUp(): void
    {
+        // Skip si l'API externe est injoignable (timeout réseau, DNS, etc.)
+        try {
+            $check = HttpClient::create()->request('GET', 'https://data.education.gouv.fr', [
+                'timeout' => 5,
+            ]);
+            $check->getStatusCode();
+        } catch (Throwable) {
+            self::markTestSkipped('API data.education.gouv.fr injoignable — test ignoré.');
+        }
+
        $this->tempDir = sys_get_temp_dir() . '/classeo-calendar-test-' . uniqid();
        mkdir($this->tempDir);

@@ -55,6 +68,10 @@ final class GouvFrCalendarApiTest extends TestCase

    protected function tearDown(): void
    {
+        if (!isset($this->tempDir) || !is_dir($this->tempDir)) {
+            return;
+        }
+
        // Supprimer les fichiers générés
        $files = glob($this->tempDir . '/*.json');
        foreach ($files as $file) {
--- a/backend/tests/Unit/Scolarite/Application/Command/PublishGrades/PublishGradesHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Command/PublishGrades/PublishGradesHandlerTest.php
@@ -9,6 +9,8 @@ use App\Administration\Domain\Model\Subject\SubjectId;
 use App\Administration\Domain\Model\User\UserId;
 use App\Scolarite\Application\Command\PublishGrades\PublishGradesCommand;
 use App\Scolarite\Application\Command\PublishGrades\PublishGradesHandler;
+use App\Scolarite\Application\Port\EnseignantAffectationChecker;
+use App\Scolarite\Application\Service\AutorisationSaisieNotesChecker;
 use App\Scolarite\Domain\Exception\AucuneNoteSaisieException;
 use App\Scolarite\Domain\Exception\NonProprietaireDeLEvaluationException;
 use App\Scolarite\Domain\Exception\NotesDejaPublieesException;
@@ -22,6 +24,7 @@ use App\Scolarite\Domain\Model\Grade\GradeStatus;
 use App\Scolarite\Domain\Model\Grade\GradeValue;
 use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryEvaluationRepository;
 use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryGradeRepository;
+use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryTeacherReplacementRepository;
 use App\Shared\Domain\Clock;
 use App\Shared\Domain\Tenant\TenantId;
 use DateTimeImmutable;
@@ -37,12 +40,17 @@ final class PublishGradesHandlerTest extends TestCase

    private InMemoryEvaluationRepository $evaluationRepository;
    private InMemoryGradeRepository $gradeRepository;
+    private InMemoryTeacherReplacementRepository $replacementRepository;
    private Clock $clock;

+    /** @var array<string, bool> */
+    private array $affectationResults = [];
+
    protected function setUp(): void
    {
        $this->evaluationRepository = new InMemoryEvaluationRepository();
        $this->gradeRepository = new InMemoryGradeRepository();
+        $this->replacementRepository = new InMemoryTeacherReplacementRepository();
        $this->clock = new class implements Clock {
            public function now(): DateTimeImmutable
            {
@@ -50,9 +58,16 @@ final class PublishGradesHandlerTest extends TestCase
            }
        };

+        $this->affectationResults = [];
+        $this->affectationResults[self::TEACHER_ID] = true;
        $this->seedEvaluation();
    }

+    public function isTeacherAffecte(string $teacherId): bool
+    {
+        return $this->affectationResults[$teacherId] ?? false;
+    }
+
    #[Test]
    public function itPublishesGradesWhenGradesExist(): void
    {
@@ -107,18 +122,18 @@ final class PublishGradesHandlerTest extends TestCase
    }

    #[Test]
-    public function itThrowsWhenTeacherNotOwner(): void
+    public function itThrowsWhenTeacherNotAssigned(): void
    {
        $this->seedGrade();
        $handler = $this->createHandler();
-        $otherTeacher = '550e8400-e29b-41d4-a716-446655440099';
+        $unassignedTeacher = '550e8400-e29b-41d4-a716-446655440099';

        $this->expectException(NonProprietaireDeLEvaluationException::class);

        $handler(new PublishGradesCommand(
            tenantId: self::TENANT_ID,
            evaluationId: self::EVALUATION_ID,
-            teacherId: $otherTeacher,
+            teacherId: $unassignedTeacher,
        ));
    }

@@ -145,10 +160,35 @@ final class PublishGradesHandlerTest extends TestCase
        return new PublishGradesHandler(
            $this->evaluationRepository,
            $this->gradeRepository,
+            $this->createAutorisationChecker(),
            $this->clock,
        );
    }

+    private function createAutorisationChecker(): AutorisationSaisieNotesChecker
+    {
+        $test = $this;
+        $affectationChecker = new class($test) implements EnseignantAffectationChecker {
+            public function __construct(private readonly PublishGradesHandlerTest $test)
+            {
+            }
+
+            public function estAffecte(
+                UserId $teacherId,
+                ClassId $classId,
+                SubjectId $subjectId,
+                TenantId $tenantId,
+            ): bool {
+                return $this->test->isTeacherAffecte((string) $teacherId);
+            }
+        };
+
+        return new AutorisationSaisieNotesChecker(
+            $affectationChecker,
+            $this->replacementRepository,
+        );
+    }
+
    private function seedEvaluation(): void
    {
        $evaluation = Evaluation::reconstitute(
--- a/backend/tests/Unit/Scolarite/Application/Command/SaveAppreciation/SaveAppreciationHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Command/SaveAppreciation/SaveAppreciationHandlerTest.php
@@ -9,6 +9,8 @@ use App\Administration\Domain\Model\Subject\SubjectId;
 use App\Administration\Domain\Model\User\UserId;
 use App\Scolarite\Application\Command\SaveAppreciation\SaveAppreciationCommand;
 use App\Scolarite\Application\Command\SaveAppreciation\SaveAppreciationHandler;
+use App\Scolarite\Application\Port\EnseignantAffectationChecker;
+use App\Scolarite\Application\Service\AutorisationSaisieNotesChecker;
 use App\Scolarite\Domain\Exception\AppreciationTropLongueException;
 use App\Scolarite\Domain\Exception\GradeNotFoundException;
 use App\Scolarite\Domain\Exception\NonProprietaireDeLEvaluationException;
@@ -22,6 +24,7 @@ use App\Scolarite\Domain\Model\Grade\GradeStatus;
 use App\Scolarite\Domain\Model\Grade\GradeValue;
 use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryEvaluationRepository;
 use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryGradeRepository;
+use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryTeacherReplacementRepository;
 use App\Shared\Domain\Clock;
 use App\Shared\Domain\Tenant\TenantId;
 use DateTimeImmutable;
@@ -39,13 +42,18 @@ final class SaveAppreciationHandlerTest extends TestCase

    private InMemoryEvaluationRepository $evaluationRepository;
    private InMemoryGradeRepository $gradeRepository;
+    private InMemoryTeacherReplacementRepository $replacementRepository;
    private Clock $clock;
    private string $gradeId;

+    /** @var array<string, bool> */
+    private array $affectationResults = [];
+
    protected function setUp(): void
    {
        $this->evaluationRepository = new InMemoryEvaluationRepository();
        $this->gradeRepository = new InMemoryGradeRepository();
+        $this->replacementRepository = new InMemoryTeacherReplacementRepository();
        $this->clock = new class implements Clock {
            public function now(): DateTimeImmutable
            {
@@ -53,9 +61,16 @@ final class SaveAppreciationHandlerTest extends TestCase
            }
        };

+        $this->affectationResults = [];
+        $this->affectationResults[self::TEACHER_ID] = true;
        $this->seedEvaluationAndGrade();
    }

+    public function isTeacherAffecte(string $teacherId): bool
+    {
+        return $this->affectationResults[$teacherId] ?? false;
+    }
+
    #[Test]
    public function itSavesAppreciation(): void
    {
@@ -144,10 +159,35 @@ final class SaveAppreciationHandlerTest extends TestCase
        return new SaveAppreciationHandler(
            $this->evaluationRepository,
            $this->gradeRepository,
+            $this->createAutorisationChecker(),
            $this->clock,
        );
    }

+    private function createAutorisationChecker(): AutorisationSaisieNotesChecker
+    {
+        $test = $this;
+        $affectationChecker = new class($test) implements EnseignantAffectationChecker {
+            public function __construct(private readonly SaveAppreciationHandlerTest $test)
+            {
+            }
+
+            public function estAffecte(
+                UserId $teacherId,
+                ClassId $classId,
+                SubjectId $subjectId,
+                TenantId $tenantId,
+            ): bool {
+                return $this->test->isTeacherAffecte((string) $teacherId);
+            }
+        };
+
+        return new AutorisationSaisieNotesChecker(
+            $affectationChecker,
+            $this->replacementRepository,
+        );
+    }
+
    private function seedEvaluationAndGrade(): void
    {
        $tenantId = TenantId::fromString(self::TENANT_ID);
--- a/backend/tests/Unit/Scolarite/Application/Command/SaveGrades/SaveGradesHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Command/SaveGrades/SaveGradesHandlerTest.php
@@ -9,6 +9,8 @@ use App\Administration\Domain\Model\Subject\SubjectId;
 use App\Administration\Domain\Model\User\UserId;
 use App\Scolarite\Application\Command\SaveGrades\SaveGradesCommand;
 use App\Scolarite\Application\Command\SaveGrades\SaveGradesHandler;
+use App\Scolarite\Application\Port\EnseignantAffectationChecker;
+use App\Scolarite\Application\Service\AutorisationSaisieNotesChecker;
 use App\Scolarite\Domain\Exception\NonProprietaireDeLEvaluationException;
 use App\Scolarite\Domain\Exception\NoteRequiseException;
 use App\Scolarite\Domain\Exception\ValeurNoteInvalideException;
@@ -18,8 +20,11 @@ use App\Scolarite\Domain\Model\Evaluation\EvaluationId;
 use App\Scolarite\Domain\Model\Evaluation\EvaluationStatus;
 use App\Scolarite\Domain\Model\Evaluation\GradeScale;
 use App\Scolarite\Domain\Model\Grade\GradeStatus;
+use App\Scolarite\Domain\Model\TeacherReplacement\ClassSubjectPair;
+use App\Scolarite\Domain\Model\TeacherReplacement\TeacherReplacement;
 use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryEvaluationRepository;
 use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryGradeRepository;
+use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryTeacherReplacementRepository;
 use App\Shared\Domain\Clock;
 use App\Shared\Domain\Tenant\TenantId;
 use DateTimeImmutable;
@@ -36,12 +41,17 @@ final class SaveGradesHandlerTest extends TestCase

    private InMemoryEvaluationRepository $evaluationRepository;
    private InMemoryGradeRepository $gradeRepository;
+    private InMemoryTeacherReplacementRepository $replacementRepository;
    private Clock $clock;

+    /** @var array<string, bool> */
+    private array $affectationResults = [];
+
    protected function setUp(): void
    {
        $this->evaluationRepository = new InMemoryEvaluationRepository();
        $this->gradeRepository = new InMemoryGradeRepository();
+        $this->replacementRepository = new InMemoryTeacherReplacementRepository();
        $this->clock = new class implements Clock {
            public function now(): DateTimeImmutable
            {
@@ -49,9 +59,16 @@ final class SaveGradesHandlerTest extends TestCase
            }
        };

+        $this->affectationResults = [];
+        $this->setTeacherAffecte(self::TEACHER_ID);
        $this->seedEvaluation();
    }

+    private function setTeacherAffecte(string $teacherId): void
+    {
+        $this->affectationResults[$teacherId] = true;
+    }
+
    #[Test]
    public function itSavesNewGrades(): void
    {
@@ -169,24 +186,7 @@ final class SaveGradesHandlerTest extends TestCase
        self::assertNull($savedGrades[0]->value);
    }

-    #[Test]
-    public function itThrowsWhenTeacherNotOwner(): void
-    {
-        $handler = $this->createHandler();
-        $otherTeacher = '550e8400-e29b-41d4-a716-446655440099';
-
-        $this->expectException(NonProprietaireDeLEvaluationException::class);
-
-        $handler(new SaveGradesCommand(
-            tenantId: self::TENANT_ID,
-            evaluationId: self::EVALUATION_ID,
-            teacherId: $otherTeacher,
-            grades: [
-                ['studentId' => self::STUDENT_1_ID, 'value' => 15.5, 'status' => 'graded'],
-            ],
-        ));
-    }
-
+    /** @see itThrowsWhenTeacherNotAssigned - renamed, now checks assignment instead of ownership */
    #[Test]
    public function itThrowsWhenValueExceedsGradeScale(): void
    {
@@ -221,15 +221,119 @@ final class SaveGradesHandlerTest extends TestCase
        ));
    }

+    #[Test]
+    public function itThrowsWhenTeacherNotAssigned(): void
+    {
+        $handler = $this->createHandler();
+        $unassignedTeacher = '550e8400-e29b-41d4-a716-446655440099';
+
+        $this->expectException(NonProprietaireDeLEvaluationException::class);
+
+        $handler(new SaveGradesCommand(
+            tenantId: self::TENANT_ID,
+            evaluationId: self::EVALUATION_ID,
+            teacherId: $unassignedTeacher,
+            grades: [
+                ['studentId' => self::STUDENT_1_ID, 'value' => 15.5, 'status' => 'graded'],
+            ],
+        ));
+    }
+
+    #[Test]
+    public function itAllowsReplacementTeacherToSave(): void
+    {
+        $replacementTeacherId = '550e8400-e29b-41d4-a716-446655440088';
+        $now = $this->clock->now();
+
+        $replacement = TeacherReplacement::designer(
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            replacedTeacherId: UserId::fromString(self::TEACHER_ID),
+            replacementTeacherId: UserId::fromString($replacementTeacherId),
+            startDate: $now->modify('-1 day'),
+            endDate: $now->modify('+7 days'),
+            classes: [new ClassSubjectPair(
+                ClassId::fromString('550e8400-e29b-41d4-a716-446655440020'),
+                SubjectId::fromString('550e8400-e29b-41d4-a716-446655440030'),
+            )],
+            reason: 'Maladie',
+            createdBy: UserId::generate(),
+            now: $now->modify('-1 day'),
+        );
+        $this->replacementRepository->save($replacement);
+
+        $handler = $this->createHandler();
+        $savedGrades = $handler(new SaveGradesCommand(
+            tenantId: self::TENANT_ID,
+            evaluationId: self::EVALUATION_ID,
+            teacherId: $replacementTeacherId,
+            grades: [
+                ['studentId' => self::STUDENT_1_ID, 'value' => 14.0, 'status' => 'graded'],
+            ],
+        ));
+
+        self::assertCount(1, $savedGrades);
+        self::assertSame((string) UserId::fromString($replacementTeacherId), (string) $savedGrades[0]->createdBy);
+    }
+
+    #[Test]
+    public function itBlocksEvaluationOwnerWithRemovedAssignment(): void
+    {
+        // Teacher IS the evaluation owner but has no active assignment
+        $this->affectationResults = [];  // Remove all assignments
+
+        $handler = $this->createHandler();
+
+        $this->expectException(NonProprietaireDeLEvaluationException::class);
+
+        $handler(new SaveGradesCommand(
+            tenantId: self::TENANT_ID,
+            evaluationId: self::EVALUATION_ID,
+            teacherId: self::TEACHER_ID,
+            grades: [
+                ['studentId' => self::STUDENT_1_ID, 'value' => 15.5, 'status' => 'graded'],
+            ],
+        ));
+    }
+
    private function createHandler(): SaveGradesHandler
    {
        return new SaveGradesHandler(
            $this->evaluationRepository,
            $this->gradeRepository,
+            $this->createAutorisationChecker(),
            $this->clock,
        );
    }

+    private function createAutorisationChecker(): AutorisationSaisieNotesChecker
+    {
+        $test = $this;
+        $affectationChecker = new class($test) implements EnseignantAffectationChecker {
+            public function __construct(private readonly SaveGradesHandlerTest $test)
+            {
+            }
+
+            public function estAffecte(
+                UserId $teacherId,
+                ClassId $classId,
+                SubjectId $subjectId,
+                TenantId $tenantId,
+            ): bool {
+                return $this->test->isTeacherAffecte((string) $teacherId);
+            }
+        };
+
+        return new AutorisationSaisieNotesChecker(
+            $affectationChecker,
+            $this->replacementRepository,
+        );
+    }
+
+    public function isTeacherAffecte(string $teacherId): bool
+    {
+        return $this->affectationResults[$teacherId] ?? false;
+    }
+
    private function seedEvaluation(): void
    {
        $evaluation = Evaluation::reconstitute(
--- a/backend/tests/Unit/Scolarite/Application/Command/UploadSubmissionAttachment/UploadSubmissionAttachmentHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Command/UploadSubmissionAttachment/UploadSubmissionAttachmentHandlerTest.php
@@ -112,6 +112,14 @@ final class UploadSubmissionAttachmentHandlerTest extends TestCase
            public function delete(string $path): void
            {
            }
+
+            public function readStream(string $path): mixed
+            {
+                /** @var resource $stream */
+                $stream = fopen('php://memory', 'r+');
+
+                return $stream;
+            }
        };

        $clock = new class implements Clock {
--- a/backend/tests/Unit/Scolarite/Application/Query/GetBlockedDates/GetBlockedDatesHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Query/GetBlockedDates/GetBlockedDatesHandlerTest.php
@@ -10,8 +10,11 @@ use App\Administration\Domain\Model\SchoolCalendar\CalendarEntryType;
 use App\Administration\Domain\Model\SchoolCalendar\SchoolCalendar;
 use App\Administration\Domain\Model\SchoolClass\AcademicYearId;
 use App\Administration\Infrastructure\Persistence\InMemory\InMemorySchoolCalendarRepository;
+use App\Scolarite\Application\Port\HomeworkRulesChecker;
+use App\Scolarite\Application\Port\HomeworkRulesCheckResult;
 use App\Scolarite\Application\Query\GetBlockedDates\GetBlockedDatesHandler;
 use App\Scolarite\Application\Query\GetBlockedDates\GetBlockedDatesQuery;
+use App\Shared\Domain\Clock;
 use App\Shared\Domain\Tenant\TenantId;
 use DateTimeImmutable;
 use PHPUnit\Framework\Attributes\Test;
@@ -28,7 +31,29 @@ final class GetBlockedDatesHandlerTest extends TestCase
    protected function setUp(): void
    {
        $this->calendarRepository = new InMemorySchoolCalendarRepository();
-        $this->handler = new GetBlockedDatesHandler($this->calendarRepository);
+
+        $rulesChecker = new class implements HomeworkRulesChecker {
+            public function verifier(
+                TenantId $tenantId,
+                DateTimeImmutable $dueDate,
+                DateTimeImmutable $creationDate,
+            ): HomeworkRulesCheckResult {
+                return HomeworkRulesCheckResult::ok();
+            }
+        };
+
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-03-01 10:00:00');
+            }
+        };
+
+        $this->handler = new GetBlockedDatesHandler(
+            $this->calendarRepository,
+            $rulesChecker,
+            $clock,
+        );
    }

    #[Test]
@@ -110,6 +135,93 @@ final class GetBlockedDatesHandlerTest extends TestCase
        self::assertCount(5, $vacations);
    }

+    #[Test]
+    public function returnsRuleHardBlockedDates(): void
+    {
+        $rulesChecker = new class implements HomeworkRulesChecker {
+            public function verifier(
+                TenantId $tenantId,
+                DateTimeImmutable $dueDate,
+                DateTimeImmutable $creationDate,
+            ): HomeworkRulesCheckResult {
+                // Block Tuesday March 3
+                if ($dueDate->format('Y-m-d') === '2026-03-03') {
+                    return new HomeworkRulesCheckResult(
+                        warnings: [new \App\Scolarite\Application\Port\RuleWarning('minimum_delay', 'Délai minimum non respecté')],
+                        bloquant: true,
+                    );
+                }
+
+                return HomeworkRulesCheckResult::ok();
+            }
+        };
+
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-03-01 10:00:00');
+            }
+        };
+
+        $handler = new GetBlockedDatesHandler($this->calendarRepository, $rulesChecker, $clock);
+
+        $result = ($handler)(new GetBlockedDatesQuery(
+            tenantId: self::TENANT_ID,
+            academicYearId: self::ACADEMIC_YEAR_ID,
+            startDate: '2026-03-02',
+            endDate: '2026-03-06',
+        ));
+
+        $ruleBlocked = array_filter($result, static fn ($d) => $d->type === 'rule_hard');
+        self::assertCount(1, $ruleBlocked);
+        $blocked = array_values($ruleBlocked)[0];
+        self::assertSame('2026-03-03', $blocked->date);
+        self::assertSame('Délai minimum non respecté', $blocked->reason);
+    }
+
+    #[Test]
+    public function returnsRuleSoftWarningDates(): void
+    {
+        $rulesChecker = new class implements HomeworkRulesChecker {
+            public function verifier(
+                TenantId $tenantId,
+                DateTimeImmutable $dueDate,
+                DateTimeImmutable $creationDate,
+            ): HomeworkRulesCheckResult {
+                if ($dueDate->format('Y-m-d') === '2026-03-04') {
+                    return new HomeworkRulesCheckResult(
+                        warnings: [new \App\Scolarite\Application\Port\RuleWarning('no_monday_after', 'Devoirs pour lundi déconseillés')],
+                        bloquant: false,
+                    );
+                }
+
+                return HomeworkRulesCheckResult::ok();
+            }
+        };
+
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-03-01 10:00:00');
+            }
+        };
+
+        $handler = new GetBlockedDatesHandler($this->calendarRepository, $rulesChecker, $clock);
+
+        $result = ($handler)(new GetBlockedDatesQuery(
+            tenantId: self::TENANT_ID,
+            academicYearId: self::ACADEMIC_YEAR_ID,
+            startDate: '2026-03-02',
+            endDate: '2026-03-06',
+        ));
+
+        $ruleSoft = array_filter($result, static fn ($d) => $d->type === 'rule_soft');
+        self::assertCount(1, $ruleSoft);
+        $soft = array_values($ruleSoft)[0];
+        self::assertSame('2026-03-04', $soft->date);
+        self::assertSame('rule_soft', $soft->type);
+    }
+
    private function createCalendarWithHoliday(DateTimeImmutable $date, string $label): SchoolCalendar
    {
        $tenantId = TenantId::fromString(self::TENANT_ID);
--- a/backend/tests/Unit/Scolarite/Application/Query/GetClassStatisticsDetail/GetClassStatisticsDetailHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Query/GetClassStatisticsDetail/GetClassStatisticsDetailHandlerTest.php
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Application\Query\GetClassStatisticsDetail;
+
+use App\Scolarite\Application\Port\PeriodFinder;
+use App\Scolarite\Application\Port\PeriodInfo;
+use App\Scolarite\Application\Query\GetClassStatisticsDetail\GetClassStatisticsDetailHandler;
+use App\Scolarite\Application\Query\GetClassStatisticsDetail\GetClassStatisticsDetailQuery;
+use App\Scolarite\Domain\Service\AverageCalculator;
+use App\Scolarite\Domain\Service\TeacherStatisticsCalculator;
+use App\Scolarite\Infrastructure\ReadModel\InMemoryTeacherStatisticsReader;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class GetClassStatisticsDetailHandlerTest extends TestCase
+{
+    private const string TEACHER_ID = '550e8400-e29b-41d4-a716-446655440010';
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440001';
+    private const string CLASS_ID = '550e8400-e29b-41d4-a716-446655440020';
+    private const string SUBJECT_ID = '550e8400-e29b-41d4-a716-446655440030';
+
+    private InMemoryTeacherStatisticsReader $reader;
+
+    protected function setUp(): void
+    {
+        $this->reader = new InMemoryTeacherStatisticsReader();
+    }
+
+    #[Test]
+    public function itReturnsEmptyWhenNoPeriodFound(): void
+    {
+        $handler = $this->createHandler(periodInfo: null);
+
+        $result = $handler($this->query());
+
+        self::assertNull($result->average);
+        self::assertSame(0.0, $result->successRate);
+        self::assertSame([], $result->students);
+    }
+
+    #[Test]
+    public function itComputesClassStatisticsFromGrades(): void
+    {
+        $this->reader->feedClassGrades([8.0, 10.0, 12.0, 14.0, 16.0]);
+        $this->reader->feedMonthlyAverages([
+            ['month' => '2026-01', 'average' => 11.0],
+            ['month' => '2026-02', 'average' => 12.5],
+        ]);
+        $this->reader->feedStudentAverages([
+            ['studentId' => 's1', 'studentName' => 'Alice Dupont', 'average' => 14.0],
+            ['studentId' => 's2', 'studentName' => 'Bob Martin', 'average' => 7.0],
+        ]);
+
+        $handler = $this->createHandler(periodInfo: $this->currentPeriod());
+        $result = $handler($this->query());
+
+        self::assertSame(12.0, $result->average);
+        self::assertSame(80.0, $result->successRate); // 4/5 >= 10
+        self::assertSame([0, 0, 0, 1, 2, 1, 1, 0], $result->distribution);
+        self::assertCount(2, $result->evolution);
+        self::assertCount(2, $result->students);
+        self::assertFalse($result->students[0]->inDifficulty); // Alice 14.0 >= 8.0
+        self::assertTrue($result->students[1]->inDifficulty); // Bob 7.0 < 8.0
+    }
+
+    private function query(): GetClassStatisticsDetailQuery
+    {
+        return new GetClassStatisticsDetailQuery(
+            teacherId: self::TEACHER_ID,
+            classId: self::CLASS_ID,
+            subjectId: self::SUBJECT_ID,
+            tenantId: self::TENANT_ID,
+        );
+    }
+
+    private function createHandler(?PeriodInfo $periodInfo): GetClassStatisticsDetailHandler
+    {
+        $periodFinder = new class($periodInfo) implements PeriodFinder {
+            public function __construct(private readonly ?PeriodInfo $info)
+            {
+            }
+
+            public function findForDate(DateTimeImmutable $date, TenantId $tenantId): ?PeriodInfo
+            {
+                return $this->info;
+            }
+        };
+
+        return new GetClassStatisticsDetailHandler(
+            $this->reader,
+            $periodFinder,
+            new TeacherStatisticsCalculator(),
+            new AverageCalculator(),
+        );
+    }
+
+    private function currentPeriod(): PeriodInfo
+    {
+        return new PeriodInfo(
+            periodId: 'period-1',
+            startDate: new DateTimeImmutable('2026-01-05'),
+            endDate: new DateTimeImmutable('2026-03-31'),
+        );
+    }
+}
--- a/backend/tests/Unit/Scolarite/Application/Query/GetEvaluationDifficulty/GetEvaluationDifficultyHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Query/GetEvaluationDifficulty/GetEvaluationDifficultyHandlerTest.php
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Application\Query\GetEvaluationDifficulty;
+
+use App\Scolarite\Application\Query\GetEvaluationDifficulty\GetEvaluationDifficultyHandler;
+use App\Scolarite\Application\Query\GetEvaluationDifficulty\GetEvaluationDifficultyQuery;
+use App\Scolarite\Domain\Service\TeacherStatisticsCalculator;
+use App\Scolarite\Infrastructure\ReadModel\InMemoryTeacherStatisticsReader;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class GetEvaluationDifficultyHandlerTest extends TestCase
+{
+    private const string TEACHER_ID = '550e8400-e29b-41d4-a716-446655440010';
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440001';
+
+    private InMemoryTeacherStatisticsReader $reader;
+    private GetEvaluationDifficultyHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->reader = new InMemoryTeacherStatisticsReader();
+        $this->handler = new GetEvaluationDifficultyHandler(
+            $this->reader,
+            new TeacherStatisticsCalculator(),
+        );
+    }
+
+    #[Test]
+    public function itReturnsEmptyWhenNoEvaluations(): void
+    {
+        $result = ($this->handler)($this->query());
+
+        self::assertSame([], $result);
+    }
+
+    #[Test]
+    public function itReturnsEvaluationDifficultyWithComparison(): void
+    {
+        $this->reader->feedEvaluationDifficulties([
+            [
+                'evaluationId' => 'eval-1',
+                'title' => 'Contrôle chapitre 5',
+                'classId' => 'class-1',
+                'className' => '6ème A',
+                'subjectId' => 'subject-1',
+                'subjectName' => 'Mathématiques',
+                'date' => '2026-03-15',
+                'average' => 12.0,
+                'gradedCount' => 25,
+            ],
+        ]);
+
+        // Other teachers' averages for same subject
+        $this->reader->feedOtherTeachersAverages([10.0, 11.0, 13.0]);
+
+        $result = ($this->handler)($this->query());
+
+        self::assertCount(1, $result);
+        self::assertSame('Contrôle chapitre 5', $result[0]->title);
+        self::assertSame(12.0, $result[0]->average);
+        self::assertEqualsWithDelta(11.33, $result[0]->subjectAverage, 0.01);
+        self::assertNotNull($result[0]->percentile);
+    }
+
+    #[Test]
+    public function itHandlesNoOtherTeachersForComparison(): void
+    {
+        $this->reader->feedEvaluationDifficulties([
+            [
+                'evaluationId' => 'eval-1',
+                'title' => 'Test unique',
+                'classId' => 'class-1',
+                'className' => '6ème A',
+                'subjectId' => 'subject-1',
+                'subjectName' => 'Musique',
+                'date' => '2026-03-15',
+                'average' => 14.0,
+                'gradedCount' => 20,
+            ],
+        ]);
+
+        $this->reader->feedOtherTeachersAverages([]);
+
+        $result = ($this->handler)($this->query());
+
+        self::assertCount(1, $result);
+        self::assertNull($result[0]->subjectAverage);
+        self::assertNull($result[0]->percentile);
+    }
+
+    private function query(): GetEvaluationDifficultyQuery
+    {
+        return new GetEvaluationDifficultyQuery(
+            teacherId: self::TEACHER_ID,
+            tenantId: self::TENANT_ID,
+        );
+    }
+}
--- a/backend/tests/Unit/Scolarite/Application/Query/GetStudentProgression/GetStudentProgressionHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Query/GetStudentProgression/GetStudentProgressionHandlerTest.php
@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Application\Query\GetStudentProgression;
+
+use App\Scolarite\Application\Query\GetStudentProgression\GetStudentProgressionHandler;
+use App\Scolarite\Application\Query\GetStudentProgression\GetStudentProgressionQuery;
+use App\Scolarite\Domain\Service\TeacherStatisticsCalculator;
+use App\Scolarite\Infrastructure\ReadModel\InMemoryTeacherStatisticsReader;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class GetStudentProgressionHandlerTest extends TestCase
+{
+    private InMemoryTeacherStatisticsReader $reader;
+    private GetStudentProgressionHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->reader = new InMemoryTeacherStatisticsReader();
+        $this->handler = new GetStudentProgressionHandler(
+            $this->reader,
+            new TeacherStatisticsCalculator(),
+        );
+    }
+
+    #[Test]
+    public function itReturnsEmptyProgressionWhenNoGrades(): void
+    {
+        $result = ($this->handler)($this->query());
+
+        self::assertSame([], $result->grades);
+        self::assertNull($result->trendLine);
+    }
+
+    #[Test]
+    public function itReturnsSingleGradeWithNoTrendLine(): void
+    {
+        $this->reader->feedGradeHistory([
+            ['date' => '2026-01-15', 'value' => 12.0, 'evaluationTitle' => 'Contrôle 1'],
+        ]);
+
+        $result = ($this->handler)($this->query());
+
+        self::assertCount(1, $result->grades);
+        self::assertSame('2026-01-15', $result->grades[0]->date);
+        self::assertSame(12.0, $result->grades[0]->value);
+        self::assertNull($result->trendLine);
+    }
+
+    #[Test]
+    public function itComputesTrendLineFromMultipleGrades(): void
+    {
+        $this->reader->feedGradeHistory([
+            ['date' => '2026-01-15', 'value' => 10.0, 'evaluationTitle' => 'Contrôle 1'],
+            ['date' => '2026-02-10', 'value' => 12.0, 'evaluationTitle' => 'Contrôle 2'],
+            ['date' => '2026-03-05', 'value' => 14.0, 'evaluationTitle' => 'Contrôle 3'],
+        ]);
+
+        $result = ($this->handler)($this->query());
+
+        self::assertCount(3, $result->grades);
+        self::assertNotNull($result->trendLine);
+        self::assertGreaterThan(0, $result->trendLine->slope); // Positive trend
+    }
+
+    private function query(): GetStudentProgressionQuery
+    {
+        return new GetStudentProgressionQuery(
+            studentId: '550e8400-e29b-41d4-a716-446655440050',
+            subjectId: '550e8400-e29b-41d4-a716-446655440030',
+            classId: '550e8400-e29b-41d4-a716-446655440020',
+            teacherId: '550e8400-e29b-41d4-a716-446655440010',
+            tenantId: '550e8400-e29b-41d4-a716-446655440001',
+        );
+    }
+}
--- a/backend/tests/Unit/Scolarite/Application/Query/GetTeacherStatisticsOverview/GetTeacherStatisticsOverviewHandlerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Query/GetTeacherStatisticsOverview/GetTeacherStatisticsOverviewHandlerTest.php
@@ -0,0 +1,106 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Application\Query\GetTeacherStatisticsOverview;
+
+use App\Scolarite\Application\Port\PeriodFinder;
+use App\Scolarite\Application\Port\PeriodInfo;
+use App\Scolarite\Application\Query\GetTeacherStatisticsOverview\GetTeacherStatisticsOverviewHandler;
+use App\Scolarite\Application\Query\GetTeacherStatisticsOverview\GetTeacherStatisticsOverviewQuery;
+use App\Scolarite\Infrastructure\ReadModel\InMemoryTeacherStatisticsReader;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class GetTeacherStatisticsOverviewHandlerTest extends TestCase
+{
+    private const string TEACHER_ID = '550e8400-e29b-41d4-a716-446655440010';
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440001';
+
+    private InMemoryTeacherStatisticsReader $reader;
+
+    protected function setUp(): void
+    {
+        $this->reader = new InMemoryTeacherStatisticsReader();
+    }
+
+    #[Test]
+    public function itReturnsEmptyWhenNoPeriodFound(): void
+    {
+        $handler = $this->createHandler(periodInfo: null);
+
+        $result = $handler(new GetTeacherStatisticsOverviewQuery(
+            teacherId: self::TEACHER_ID,
+            tenantId: self::TENANT_ID,
+        ));
+
+        self::assertSame([], $result);
+    }
+
+    #[Test]
+    public function itReturnsClassOverviewDtos(): void
+    {
+        $this->reader->feedClassesSummary([
+            [
+                'classId' => 'class-1',
+                'className' => '6ème A',
+                'subjectId' => 'subject-1',
+                'subjectName' => 'Mathématiques',
+                'evaluationCount' => 3,
+                'studentCount' => 25,
+                'average' => 12.5,
+                'successRate' => 72.0,
+            ],
+            [
+                'classId' => 'class-2',
+                'className' => '5ème B',
+                'subjectId' => 'subject-1',
+                'subjectName' => 'Mathématiques',
+                'evaluationCount' => 2,
+                'studentCount' => 28,
+                'average' => 10.8,
+                'successRate' => 57.0,
+            ],
+        ]);
+
+        $handler = $this->createHandler(periodInfo: $this->currentPeriod());
+
+        $result = $handler(new GetTeacherStatisticsOverviewQuery(
+            teacherId: self::TEACHER_ID,
+            tenantId: self::TENANT_ID,
+        ));
+
+        self::assertCount(2, $result);
+        self::assertSame('6ème A', $result[0]->className);
+        self::assertSame(12.5, $result[0]->average);
+        self::assertSame(72.0, $result[0]->successRate);
+        self::assertSame('5ème B', $result[1]->className);
+    }
+
+    private function createHandler(?PeriodInfo $periodInfo): GetTeacherStatisticsOverviewHandler
+    {
+        $periodFinder = new class($periodInfo) implements PeriodFinder {
+            public function __construct(private readonly ?PeriodInfo $info)
+            {
+            }
+
+            public function findForDate(DateTimeImmutable $date, TenantId $tenantId): ?PeriodInfo
+            {
+                return $this->info;
+            }
+        };
+
+        return new GetTeacherStatisticsOverviewHandler($this->reader, $periodFinder);
+    }
+
+    private function currentPeriod(): PeriodInfo
+    {
+        return new PeriodInfo(
+            periodId: 'period-1',
+            startDate: new DateTimeImmutable('2026-01-05'),
+            endDate: new DateTimeImmutable('2026-03-31'),
+        );
+    }
+}
--- a/backend/tests/Unit/Scolarite/Application/Service/AutorisationSaisieNotesCheckerTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Service/AutorisationSaisieNotesCheckerTest.php
@@ -0,0 +1,249 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Application\Service;
+
+use App\Administration\Domain\Model\SchoolClass\ClassId;
+use App\Administration\Domain\Model\Subject\SubjectId;
+use App\Administration\Domain\Model\User\UserId;
+use App\Scolarite\Application\Port\EnseignantAffectationChecker;
+use App\Scolarite\Application\Service\AutorisationSaisieNotesChecker;
+use App\Scolarite\Domain\Model\Evaluation\Coefficient;
+use App\Scolarite\Domain\Model\Evaluation\Evaluation;
+use App\Scolarite\Domain\Model\Evaluation\GradeScale;
+use App\Scolarite\Domain\Model\TeacherReplacement\ClassSubjectPair;
+use App\Scolarite\Domain\Model\TeacherReplacement\TeacherReplacement;
+use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryTeacherReplacementRepository;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class AutorisationSaisieNotesCheckerTest extends TestCase
+{
+    private TenantId $tenantId;
+    private ClassId $classId;
+    private SubjectId $subjectId;
+    private InMemoryTeacherReplacementRepository $replacementRepository;
+    private DateTimeImmutable $now;
+
+    /** @var array<string, bool> */
+    private array $affectationResults = [];
+
+    protected function setUp(): void
+    {
+        $this->tenantId = TenantId::generate();
+        $this->classId = ClassId::generate();
+        $this->subjectId = SubjectId::generate();
+        $this->replacementRepository = new InMemoryTeacherReplacementRepository();
+        $this->now = new DateTimeImmutable('2026-04-14 10:00:00');
+    }
+
+    #[Test]
+    public function itReturnsTrueWhenTeacherIsAffected(): void
+    {
+        $teacherId = UserId::generate();
+        $this->setTeacherAffecte($teacherId);
+
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertTrue($checker->peutSaisirNotes($teacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    #[Test]
+    public function itReturnsFalseWhenTeacherIsNotAffectedAndNoReplacement(): void
+    {
+        $teacherId = UserId::generate();
+
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertFalse($checker->peutSaisirNotes($teacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    #[Test]
+    public function itReturnsTrueWhenTeacherHasActiveReplacement(): void
+    {
+        $replacementTeacherId = UserId::generate();
+        $this->createActiveReplacement($replacementTeacherId);
+
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertTrue($checker->peutSaisirNotes($replacementTeacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    #[Test]
+    public function itReturnsFalseWhenReplacementIsExpired(): void
+    {
+        $replacementTeacherId = UserId::generate();
+        $this->createExpiredReplacement($replacementTeacherId);
+
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertFalse($checker->peutSaisirNotes($replacementTeacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    #[Test]
+    public function itReturnsTrueWhenBothAffectedAndActiveReplacement(): void
+    {
+        $teacherId = UserId::generate();
+        $this->setTeacherAffecte($teacherId);
+        $this->createActiveReplacement($teacherId);
+
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertTrue($checker->peutSaisirNotes($teacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    #[Test]
+    public function itReturnsFalseWhenReplacementIsOnDifferentClassSubject(): void
+    {
+        $replacementTeacherId = UserId::generate();
+
+        $otherClassId = ClassId::generate();
+        $otherSubjectId = SubjectId::generate();
+        $replacement = TeacherReplacement::designer(
+            tenantId: $this->tenantId,
+            replacedTeacherId: UserId::generate(),
+            replacementTeacherId: $replacementTeacherId,
+            startDate: $this->now->modify('-1 day'),
+            endDate: $this->now->modify('+7 days'),
+            classes: [new ClassSubjectPair($otherClassId, $otherSubjectId)],
+            reason: 'Maladie',
+            createdBy: UserId::generate(),
+            now: $this->now->modify('-1 day'),
+        );
+        $this->replacementRepository->save($replacement);
+
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertFalse($checker->peutSaisirNotes($replacementTeacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    #[Test]
+    public function itReturnsFalseWhenReplacementStartsInTheFuture(): void
+    {
+        $replacementTeacherId = UserId::generate();
+        $futureStart = $this->now->modify('+1 day');
+
+        $replacement = TeacherReplacement::designer(
+            tenantId: $this->tenantId,
+            replacedTeacherId: UserId::generate(),
+            replacementTeacherId: $replacementTeacherId,
+            startDate: $futureStart,
+            endDate: $this->now->modify('+14 days'),
+            classes: [new ClassSubjectPair($this->classId, $this->subjectId)],
+            reason: 'Congé prévu',
+            createdBy: UserId::generate(),
+            now: $this->now,
+        );
+        $this->replacementRepository->save($replacement);
+
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertFalse($checker->peutSaisirNotes($replacementTeacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    #[Test]
+    public function itShortCircuitsOnAffectationWithoutCheckingReplacement(): void
+    {
+        $teacherId = UserId::generate();
+        $this->setTeacherAffecte($teacherId);
+
+        // No replacement seeded — if it tries to check replacement for an
+        // assigned teacher, the result should still be true (short-circuit)
+        $checker = $this->createChecker();
+        $evaluation = $this->createEvaluation();
+
+        self::assertTrue($checker->peutSaisirNotes($teacherId, $evaluation, $this->tenantId, $this->now));
+    }
+
+    private function setTeacherAffecte(UserId $teacherId): void
+    {
+        $this->affectationResults[(string) $teacherId] = true;
+    }
+
+    private function createChecker(): AutorisationSaisieNotesChecker
+    {
+        $test = $this;
+        $affectationChecker = new class($test) implements EnseignantAffectationChecker {
+            public function __construct(private readonly AutorisationSaisieNotesCheckerTest $test)
+            {
+            }
+
+            public function estAffecte(
+                UserId $teacherId,
+                ClassId $classId,
+                SubjectId $subjectId,
+                TenantId $tenantId,
+            ): bool {
+                return $this->test->isTeacherAffecte((string) $teacherId);
+            }
+        };
+
+        return new AutorisationSaisieNotesChecker(
+            $affectationChecker,
+            $this->replacementRepository,
+        );
+    }
+
+    public function isTeacherAffecte(string $teacherId): bool
+    {
+        return $this->affectationResults[$teacherId] ?? false;
+    }
+
+    private function createEvaluation(): Evaluation
+    {
+        return Evaluation::creer(
+            tenantId: $this->tenantId,
+            classId: $this->classId,
+            subjectId: $this->subjectId,
+            teacherId: UserId::generate(),
+            title: 'Contrôle de maths',
+            description: null,
+            evaluationDate: $this->now,
+            gradeScale: new GradeScale(20),
+            coefficient: new Coefficient(1.0),
+            now: $this->now,
+        );
+    }
+
+    private function createActiveReplacement(UserId $replacementTeacherId): void
+    {
+        $replacement = TeacherReplacement::designer(
+            tenantId: $this->tenantId,
+            replacedTeacherId: UserId::generate(),
+            replacementTeacherId: $replacementTeacherId,
+            startDate: $this->now->modify('-1 day'),
+            endDate: $this->now->modify('+7 days'),
+            classes: [new ClassSubjectPair($this->classId, $this->subjectId)],
+            reason: 'Maladie',
+            createdBy: UserId::generate(),
+            now: $this->now->modify('-1 day'),
+        );
+        $this->replacementRepository->save($replacement);
+    }
+
+    private function createExpiredReplacement(UserId $replacementTeacherId): void
+    {
+        $replacement = TeacherReplacement::designer(
+            tenantId: $this->tenantId,
+            replacedTeacherId: UserId::generate(),
+            replacementTeacherId: $replacementTeacherId,
+            startDate: $this->now->modify('-14 days'),
+            endDate: $this->now->modify('-1 day'),
+            classes: [new ClassSubjectPair($this->classId, $this->subjectId)],
+            reason: 'Maladie',
+            createdBy: UserId::generate(),
+            now: $this->now->modify('-14 days'),
+        );
+        $this->replacementRepository->save($replacement);
+    }
+}
--- a/backend/tests/Unit/Scolarite/Application/Service/StatisticsExporterTest.php
+++ b/backend/tests/Unit/Scolarite/Application/Service/StatisticsExporterTest.php
@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Application\Service;
+
+use App\Scolarite\Application\Query\GetClassStatisticsDetail\ClassStatisticsDetailDto;
+use App\Scolarite\Application\Query\GetClassStatisticsDetail\StudentAverageDto;
+use App\Scolarite\Application\Service\StatisticsExporter;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+use function str_contains;
+
+final class StatisticsExporterTest extends TestCase
+{
+    private StatisticsExporter $exporter;
+
+    protected function setUp(): void
+    {
+        $this->exporter = new StatisticsExporter();
+    }
+
+    #[Test]
+    public function itExportsClassStatisticsToCsv(): void
+    {
+        $stats = new ClassStatisticsDetailDto(
+            average: 12.5,
+            successRate: 72.0,
+            distribution: [0, 0, 1, 2, 3, 2, 1, 0],
+            evolution: [],
+            students: [
+                new StudentAverageDto(
+                    studentId: 's1',
+                    studentName: 'Alice Dupont',
+                    average: 14.0,
+                    inDifficulty: false,
+                    trend: 'improving',
+                ),
+                new StudentAverageDto(
+                    studentId: 's2',
+                    studentName: 'Bob Martin',
+                    average: 7.0,
+                    inDifficulty: true,
+                    trend: 'declining',
+                ),
+            ],
+        );
+
+        $csv = $this->exporter->exportClassToCsv($stats, '6ème A', 'Mathématiques');
+
+        self::assertNotSame('', $csv);
+        self::assertTrue(str_contains($csv, '6ème A'));
+        self::assertTrue(str_contains($csv, 'Mathématiques'));
+        self::assertTrue(str_contains($csv, '12.5'));
+        self::assertTrue(str_contains($csv, '72%'));
+        self::assertTrue(str_contains($csv, 'Alice Dupont'));
+        self::assertTrue(str_contains($csv, '14'));
+        self::assertTrue(str_contains($csv, 'Progression'));
+        self::assertTrue(str_contains($csv, 'Bob Martin'));
+        self::assertTrue(str_contains($csv, 'Oui'));
+        self::assertTrue(str_contains($csv, 'Régression'));
+    }
+
+    #[Test]
+    public function itHandlesEmptyStudentList(): void
+    {
+        $stats = new ClassStatisticsDetailDto(
+            average: null,
+            successRate: 0.0,
+            distribution: [0, 0, 0, 0, 0, 0, 0, 0],
+            evolution: [],
+            students: [],
+        );
+
+        $csv = $this->exporter->exportClassToCsv($stats, '5ème B', 'Français');
+
+        self::assertNotSame('', $csv);
+        self::assertTrue(str_contains($csv, '5ème B'));
+        self::assertTrue(str_contains($csv, 'N/A'));
+    }
+}
--- a/backend/tests/Unit/Scolarite/Domain/Service/TeacherStatisticsCalculatorTest.php
+++ b/backend/tests/Unit/Scolarite/Domain/Service/TeacherStatisticsCalculatorTest.php
@@ -0,0 +1,281 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Domain\Service;
+
+use App\Scolarite\Domain\Service\TeacherStatisticsCalculator;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class TeacherStatisticsCalculatorTest extends TestCase
+{
+    private TeacherStatisticsCalculator $calculator;
+
+    protected function setUp(): void
+    {
+        $this->calculator = new TeacherStatisticsCalculator();
+    }
+
+    // --- Distribution ---
+
+    #[Test]
+    public function distributionReturnsEmptyBinsWhenNoValues(): void
+    {
+        $bins = $this->calculator->calculateDistribution([]);
+
+        self::assertSame([0, 0, 0, 0, 0, 0, 0, 0], $bins);
+    }
+
+    #[Test]
+    public function distributionPlacesValuesInCorrectBins(): void
+    {
+        // Bins: [0-2.5[, [2.5-5[, [5-7.5[, [7.5-10[, [10-12.5[, [12.5-15[, [15-17.5[, [17.5-20]
+        $values = [1.0, 3.0, 6.0, 9.0, 11.0, 14.0, 16.0, 19.0];
+        $bins = $this->calculator->calculateDistribution($values);
+
+        self::assertSame([1, 1, 1, 1, 1, 1, 1, 1], $bins);
+    }
+
+    #[Test]
+    public function distributionHandlesMaxValue20InLastBin(): void
+    {
+        $bins = $this->calculator->calculateDistribution([20.0]);
+
+        self::assertSame([0, 0, 0, 0, 0, 0, 0, 1], $bins);
+    }
+
+    #[Test]
+    public function distributionHandlesMultipleValuesInSameBin(): void
+    {
+        $values = [10.0, 10.5, 11.0, 12.0];
+        $bins = $this->calculator->calculateDistribution($values);
+
+        // All in bin [10-12.5[
+        self::assertSame([0, 0, 0, 0, 4, 0, 0, 0], $bins);
+    }
+
+    #[Test]
+    public function distributionHandlesBoundaryValues(): void
+    {
+        $values = [0.0, 2.5, 5.0, 7.5, 10.0, 12.5, 15.0, 17.5];
+        $bins = $this->calculator->calculateDistribution($values);
+
+        // 0.0 → bin 0, 2.5 → bin 1, 5.0 → bin 2, 7.5 → bin 3
+        // 10.0 → bin 4, 12.5 → bin 5, 15.0 → bin 6, 17.5 → bin 7
+        self::assertSame([1, 1, 1, 1, 1, 1, 1, 1], $bins);
+    }
+
+    // --- Success Rate ---
+
+    #[Test]
+    public function successRateReturnsZeroWhenNoValues(): void
+    {
+        self::assertSame(0.0, $this->calculator->calculateSuccessRate([]));
+    }
+
+    #[Test]
+    public function successRateCountsValuesAboveThreshold(): void
+    {
+        // Threshold defaults to 10.0
+        $values = [8.0, 10.0, 12.0, 14.0, 6.0];
+
+        // 10.0, 12.0, 14.0 are >= 10 → 3/5 = 60%
+        self::assertSame(60.0, $this->calculator->calculateSuccessRate($values));
+    }
+
+    #[Test]
+    public function successRateWithCustomThreshold(): void
+    {
+        $values = [8.0, 10.0, 12.0, 14.0, 6.0];
+
+        // >= 12: 12.0, 14.0 → 2/5 = 40%
+        self::assertSame(40.0, $this->calculator->calculateSuccessRate($values, 12.0));
+    }
+
+    #[Test]
+    public function successRateWithAllAbove(): void
+    {
+        $values = [15.0, 18.0, 12.0];
+
+        self::assertSame(100.0, $this->calculator->calculateSuccessRate($values));
+    }
+
+    #[Test]
+    public function successRateWithNoneAbove(): void
+    {
+        $values = [4.0, 6.0, 8.0];
+
+        self::assertSame(0.0, $this->calculator->calculateSuccessRate($values));
+    }
+
+    // --- Trend Line ---
+
+    #[Test]
+    public function trendLineReturnsNullWhenLessThanTwoPoints(): void
+    {
+        self::assertNull($this->calculator->calculateTrendLine([]));
+        self::assertNull($this->calculator->calculateTrendLine([[1, 10.0]]));
+    }
+
+    #[Test]
+    public function trendLineCalculatesLinearRegression(): void
+    {
+        // Perfectly increasing line: y = 2x + 8
+        $points = [[1, 10.0], [2, 12.0], [3, 14.0]];
+
+        $result = $this->calculator->calculateTrendLine($points);
+
+        self::assertNotNull($result);
+        self::assertEqualsWithDelta(2.0, $result->slope, 0.01);
+        self::assertEqualsWithDelta(8.0, $result->intercept, 0.01);
+    }
+
+    #[Test]
+    public function trendLineWithFlatData(): void
+    {
+        $points = [[1, 12.0], [2, 12.0], [3, 12.0]];
+
+        $result = $this->calculator->calculateTrendLine($points);
+
+        self::assertNotNull($result);
+        self::assertEqualsWithDelta(0.0, $result->slope, 0.01);
+    }
+
+    #[Test]
+    public function trendLineWithDecreasingData(): void
+    {
+        $points = [[1, 16.0], [2, 14.0], [3, 12.0]];
+
+        $result = $this->calculator->calculateTrendLine($points);
+
+        self::assertNotNull($result);
+        self::assertLessThan(0, $result->slope);
+    }
+
+    // --- Detect Trend ---
+
+    #[Test]
+    public function detectTrendReturnsStableWhenLessThanTwoAverages(): void
+    {
+        self::assertSame('stable', $this->calculator->detectTrend([]));
+        self::assertSame('stable', $this->calculator->detectTrend([12.0]));
+    }
+
+    #[Test]
+    public function detectTrendReturnsImprovingWhenLastIsHigherByThreshold(): void
+    {
+        // Last - first > 1.0 (default threshold)
+        self::assertSame('improving', $this->calculator->detectTrend([10.0, 11.5, 13.0]));
+    }
+
+    #[Test]
+    public function detectTrendReturnsDecliningWhenLastIsLowerByThreshold(): void
+    {
+        self::assertSame('declining', $this->calculator->detectTrend([14.0, 12.0, 10.0]));
+    }
+
+    #[Test]
+    public function detectTrendReturnsStableWhenDifferenceIsBelowThreshold(): void
+    {
+        self::assertSame('stable', $this->calculator->detectTrend([12.0, 12.5, 12.8]));
+    }
+
+    // --- Percentile ---
+
+    #[Test]
+    public function percentileReturnsHundredWhenNoOtherValues(): void
+    {
+        self::assertSame(100.0, $this->calculator->calculatePercentile(12.0, []));
+    }
+
+    #[Test]
+    public function percentileCalculatesCorrectly(): void
+    {
+        // My value: 14.0, others: [10, 12, 16, 18]
+        // 2 out of 4 are below → 50th percentile
+        self::assertSame(50.0, $this->calculator->calculatePercentile(14.0, [10.0, 12.0, 16.0, 18.0]));
+    }
+
+    #[Test]
+    public function percentileAtBottom(): void
+    {
+        self::assertSame(0.0, $this->calculator->calculatePercentile(5.0, [10.0, 12.0, 14.0]));
+    }
+
+    #[Test]
+    public function percentileAtTop(): void
+    {
+        self::assertSame(100.0, $this->calculator->calculatePercentile(20.0, [10.0, 12.0, 14.0]));
+    }
+
+    #[Test]
+    public function percentileWithDuplicateValues(): void
+    {
+        // My value: 12.0, others: [12.0, 12.0, 12.0]
+        // 0 strictly below → 0th percentile
+        self::assertSame(0.0, $this->calculator->calculatePercentile(12.0, [12.0, 12.0, 12.0]));
+    }
+
+    // --- Detect Trend edge cases ---
+
+    #[Test]
+    public function detectTrendAtExactThresholdReturnsStable(): void
+    {
+        // Difference is exactly 1.0 → should be stable (not strictly above threshold)
+        self::assertSame('stable', $this->calculator->detectTrend([10.0, 11.0]));
+    }
+
+    #[Test]
+    public function detectTrendJustAboveThresholdReturnsImproving(): void
+    {
+        // Difference is 1.01 → should be improving
+        self::assertSame('improving', $this->calculator->detectTrend([10.0, 11.01]));
+    }
+
+    // --- Distribution edge cases ---
+
+    #[Test]
+    public function distributionWithSingleValue(): void
+    {
+        $bins = $this->calculator->calculateDistribution([10.0]);
+
+        self::assertSame([0, 0, 0, 0, 1, 0, 0, 0], $bins);
+    }
+
+    #[Test]
+    public function distributionWithAllSameValues(): void
+    {
+        $values = [12.0, 12.0, 12.0, 12.0, 12.0];
+        $bins = $this->calculator->calculateDistribution($values);
+
+        // All in bin [10-12.5[
+        self::assertSame([0, 0, 0, 0, 5, 0, 0, 0], $bins);
+    }
+
+    // --- Trend Line edge cases ---
+
+    #[Test]
+    public function trendLineWithTwoPointsExact(): void
+    {
+        $points = [[1, 10.0], [2, 14.0]];
+
+        $result = $this->calculator->calculateTrendLine($points);
+
+        self::assertNotNull($result);
+        self::assertEqualsWithDelta(4.0, $result->slope, 0.01);
+        self::assertEqualsWithDelta(6.0, $result->intercept, 0.01);
+    }
+
+    #[Test]
+    public function trendLineWithNoisyData(): void
+    {
+        // Noisy but overall increasing
+        $points = [[1, 8.0], [2, 12.0], [3, 10.0], [4, 14.0], [5, 13.0]];
+
+        $result = $this->calculator->calculateTrendLine($points);
+
+        self::assertNotNull($result);
+        self::assertGreaterThan(0, $result->slope);
+    }
+}
--- a/backend/tests/Unit/Scolarite/Infrastructure/Api/Controller/HomeworkAttachmentControllerTest.php
+++ b/backend/tests/Unit/Scolarite/Infrastructure/Api/Controller/HomeworkAttachmentControllerTest.php
@@ -0,0 +1,271 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Infrastructure\Api\Controller;
+
+use App\Administration\Domain\Model\SchoolClass\ClassId;
+use App\Administration\Domain\Model\Subject\SubjectId;
+use App\Administration\Domain\Model\User\UserId;
+use App\Administration\Infrastructure\Security\SecurityUser;
+use App\Scolarite\Application\Command\UploadHomeworkAttachment\UploadHomeworkAttachmentHandler;
+use App\Scolarite\Application\Port\FileStorage;
+use App\Scolarite\Domain\Model\Homework\Homework;
+use App\Scolarite\Domain\Model\Homework\HomeworkAttachment;
+use App\Scolarite\Domain\Model\Homework\HomeworkAttachmentId;
+use App\Scolarite\Domain\Repository\HomeworkRepository;
+use App\Scolarite\Infrastructure\Api\Controller\HomeworkAttachmentController;
+use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryHomeworkAttachmentRepository;
+use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryHomeworkRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use App\Tests\Unit\Scolarite\Infrastructure\Storage\InMemoryFileStorage;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+final class HomeworkAttachmentControllerTest extends TestCase
+{
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440001';
+    private const string TEACHER_ID = '550e8400-e29b-41d4-a716-446655440010';
+    private const string OTHER_TEACHER_ID = '550e8400-e29b-41d4-a716-446655440099';
+
+    private InMemoryHomeworkRepository $homeworkRepository;
+    private InMemoryHomeworkAttachmentRepository $attachmentRepository;
+    private InMemoryFileStorage $fileStorage;
+
+    protected function setUp(): void
+    {
+        $this->homeworkRepository = new InMemoryHomeworkRepository();
+        $this->attachmentRepository = new InMemoryHomeworkAttachmentRepository();
+        $this->fileStorage = new InMemoryFileStorage();
+    }
+
+    #[Test]
+    public function downloadReturnsStreamedResponseForExistingAttachment(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $attachment = $this->createAttachment('exercices.pdf', 'homework/files/exercices.pdf');
+        $this->attachmentRepository->save($homework->id, $attachment);
+        $this->fileStorage->upload('homework/files/exercices.pdf', 'PDF content here', 'application/pdf');
+
+        $controller = $this->createController(self::TEACHER_ID);
+
+        $response = $controller->download((string) $homework->id, (string) $attachment->id);
+
+        self::assertInstanceOf(StreamedResponse::class, $response);
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('application/pdf', $response->headers->get('Content-Type'));
+        self::assertStringContainsString('exercices.pdf', $response->headers->get('Content-Disposition') ?? '');
+    }
+
+    #[Test]
+    public function downloadReturns404ForNonExistentAttachment(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $controller = $this->createController(self::TEACHER_ID);
+
+        $this->expectException(NotFoundHttpException::class);
+
+        $controller->download((string) $homework->id, 'non-existent-attachment-id');
+    }
+
+    #[Test]
+    public function downloadReturns404WhenFileNotFoundInStorage(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $attachment = $this->createAttachment('missing.pdf', 'homework/files/missing.pdf');
+        $this->attachmentRepository->save($homework->id, $attachment);
+        // File NOT uploaded to storage — simulates a missing blob
+
+        $controller = $this->createController(self::TEACHER_ID);
+
+        $this->expectException(NotFoundHttpException::class);
+
+        $controller->download((string) $homework->id, (string) $attachment->id);
+    }
+
+    #[Test]
+    public function downloadDeniesAccessToNonOwnerTeacher(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $attachment = $this->createAttachment('exercices.pdf', 'homework/files/exercices.pdf');
+        $this->attachmentRepository->save($homework->id, $attachment);
+
+        $controller = $this->createController(self::OTHER_TEACHER_ID);
+
+        $this->expectException(AccessDeniedHttpException::class);
+
+        $controller->download((string) $homework->id, (string) $attachment->id);
+    }
+
+    #[Test]
+    public function listDeniesAccessToNonOwnerTeacher(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $controller = $this->createController(self::OTHER_TEACHER_ID);
+
+        $this->expectException(AccessDeniedHttpException::class);
+
+        $controller->list((string) $homework->id);
+    }
+
+    #[Test]
+    public function deleteDeniesAccessToNonOwnerTeacher(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $attachment = $this->createAttachment('exercices.pdf', 'homework/files/exercices.pdf');
+        $this->attachmentRepository->save($homework->id, $attachment);
+
+        $controller = $this->createController(self::OTHER_TEACHER_ID);
+
+        $this->expectException(AccessDeniedHttpException::class);
+
+        $controller->delete((string) $homework->id, (string) $attachment->id);
+    }
+
+    #[Test]
+    public function downloadDeniesAccessToUnauthenticatedUser(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $controller = $this->createControllerWithoutUser();
+
+        $this->expectException(AccessDeniedHttpException::class);
+
+        $controller->download((string) $homework->id, 'any-attachment-id');
+    }
+
+    #[Test]
+    public function listReturnsAttachmentsForOwner(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $attachment = $this->createAttachment('exercices.pdf', 'homework/files/exercices.pdf');
+        $this->attachmentRepository->save($homework->id, $attachment);
+
+        $controller = $this->createController(self::TEACHER_ID);
+
+        $response = $controller->list((string) $homework->id);
+
+        self::assertSame(200, $response->getStatusCode());
+        /** @var array<array{id: string, filename: string}> $data */
+        $data = json_decode((string) $response->getContent(), true);
+        self::assertCount(1, $data);
+        self::assertSame('exercices.pdf', $data[0]['filename']);
+    }
+
+    #[Test]
+    public function deleteRemovesAttachmentAndFile(): void
+    {
+        $homework = $this->createHomework();
+        $this->homeworkRepository->save($homework);
+
+        $attachment = $this->createAttachment('exercices.pdf', 'homework/files/exercices.pdf');
+        $this->attachmentRepository->save($homework->id, $attachment);
+        $this->fileStorage->upload('homework/files/exercices.pdf', 'content', 'application/pdf');
+
+        $controller = $this->createController(self::TEACHER_ID);
+        $response = $controller->delete((string) $homework->id, (string) $attachment->id);
+
+        self::assertSame(204, $response->getStatusCode());
+        self::assertEmpty($this->attachmentRepository->findByHomeworkId($homework->id));
+        self::assertFalse($this->fileStorage->has('homework/files/exercices.pdf'));
+    }
+
+    private function createHomework(): Homework
+    {
+        return Homework::creer(
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            classId: ClassId::fromString('550e8400-e29b-41d4-a716-446655440020'),
+            subjectId: SubjectId::fromString('550e8400-e29b-41d4-a716-446655440030'),
+            teacherId: UserId::fromString(self::TEACHER_ID),
+            title: 'Devoir test',
+            description: 'Description',
+            dueDate: new DateTimeImmutable('2026-05-01'),
+            now: new DateTimeImmutable('2026-04-09'),
+        );
+    }
+
+    private function createAttachment(string $filename, string $filePath): HomeworkAttachment
+    {
+        return new HomeworkAttachment(
+            id: HomeworkAttachmentId::generate(),
+            filename: $filename,
+            filePath: $filePath,
+            fileSize: 5000,
+            mimeType: 'application/pdf',
+            uploadedAt: new DateTimeImmutable('2026-04-09'),
+        );
+    }
+
+    private function createController(string $teacherId): HomeworkAttachmentController
+    {
+        $securityUser = new SecurityUser(
+            userId: UserId::fromString($teacherId),
+            email: 'teacher@example.com',
+            hashedPassword: 'hashed',
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            roles: ['ROLE_PROF'],
+        );
+
+        $security = $this->createMock(Security::class);
+        $security->method('getUser')->willReturn($securityUser);
+
+        $uploadHandler = $this->createUploadHandler($this->homeworkRepository, $this->fileStorage);
+
+        return new HomeworkAttachmentController(
+            security: $security,
+            homeworkRepository: $this->homeworkRepository,
+            attachmentRepository: $this->attachmentRepository,
+            uploadHandler: $uploadHandler,
+            fileStorage: $this->fileStorage,
+        );
+    }
+
+    private function createControllerWithoutUser(): HomeworkAttachmentController
+    {
+        $security = $this->createMock(Security::class);
+        $security->method('getUser')->willReturn(null);
+
+        $uploadHandler = $this->createUploadHandler($this->homeworkRepository, $this->fileStorage);
+
+        return new HomeworkAttachmentController(
+            security: $security,
+            homeworkRepository: $this->homeworkRepository,
+            attachmentRepository: $this->attachmentRepository,
+            uploadHandler: $uploadHandler,
+            fileStorage: $this->fileStorage,
+        );
+    }
+
+    private function createUploadHandler(HomeworkRepository $homeworkRepository, FileStorage $fileStorage): UploadHomeworkAttachmentHandler
+    {
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-04-09 10:00:00');
+            }
+        };
+
+        return new UploadHomeworkAttachmentHandler($homeworkRepository, $fileStorage, $clock);
+    }
+}
--- a/backend/tests/Unit/Scolarite/Infrastructure/Security/GradeVoterTest.php
+++ b/backend/tests/Unit/Scolarite/Infrastructure/Security/GradeVoterTest.php
@@ -0,0 +1,459 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Infrastructure\Security;
+
+use App\Administration\Domain\Model\SchoolClass\ClassId;
+use App\Administration\Domain\Model\Subject\SubjectId;
+use App\Administration\Domain\Model\User\Role;
+use App\Administration\Domain\Model\User\UserId;
+use App\Administration\Infrastructure\Security\SecurityUser;
+use App\Scolarite\Application\Port\EnseignantAffectationChecker;
+use App\Scolarite\Application\Service\AutorisationSaisieNotesChecker;
+use App\Scolarite\Domain\Model\Evaluation\Coefficient;
+use App\Scolarite\Domain\Model\Evaluation\Evaluation;
+use App\Scolarite\Domain\Model\Evaluation\GradeScale;
+use App\Scolarite\Domain\Model\TeacherReplacement\ClassSubjectPair;
+use App\Scolarite\Domain\Model\TeacherReplacement\TeacherReplacement;
+use App\Scolarite\Infrastructure\Persistence\InMemory\InMemoryTeacherReplacementRepository;
+use App\Scolarite\Infrastructure\Security\GradeVoter;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use App\Shared\Infrastructure\Tenant\TenantConfig;
+use App\Shared\Infrastructure\Tenant\TenantContext;
+use App\Shared\Infrastructure\Tenant\TenantId as InfraTenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+final class GradeVoterTest extends TestCase
+{
+    private TenantId $tenantId;
+    private ClassId $classId;
+    private SubjectId $subjectId;
+    private InMemoryTeacherReplacementRepository $replacementRepository;
+    private TenantContext $tenantContext;
+    private DateTimeImmutable $now;
+    private GradeVoter $voter;
+
+    /** @var array<string, bool> */
+    private array $affectationResults = [];
+
+    protected function setUp(): void
+    {
+        $this->tenantId = TenantId::generate();
+        $this->classId = ClassId::generate();
+        $this->subjectId = SubjectId::generate();
+        $this->replacementRepository = new InMemoryTeacherReplacementRepository();
+        $this->tenantContext = new TenantContext();
+        $this->now = new DateTimeImmutable('2026-04-13 10:00:00');
+
+        $this->tenantContext->setCurrentTenant(new TenantConfig(
+            tenantId: InfraTenantId::fromString((string) $this->tenantId),
+            subdomain: 'test',
+            databaseUrl: 'sqlite:///:memory:',
+        ));
+
+        $this->affectationResults = [];
+        $test = $this;
+        $affectationChecker = new class($test) implements EnseignantAffectationChecker {
+            public function __construct(private readonly GradeVoterTest $test)
+            {
+            }
+
+            public function estAffecte(
+                UserId $teacherId,
+                ClassId $classId,
+                SubjectId $subjectId,
+                TenantId $tenantId,
+            ): bool {
+                return $this->test->getAffectationResult((string) $teacherId);
+            }
+        };
+
+        $autorisationChecker = new AutorisationSaisieNotesChecker(
+            $affectationChecker,
+            $this->replacementRepository,
+        );
+
+        $clock = $this->createMock(Clock::class);
+        $clock->method('now')->willReturn($this->now);
+
+        $this->voter = new GradeVoter(
+            $autorisationChecker,
+            $this->tenantContext,
+            $clock,
+        );
+    }
+
+    public function getAffectationResult(string $teacherId): bool
+    {
+        return $this->affectationResults[$teacherId] ?? false;
+    }
+
+    private function setTeacherAffecte(UserId $teacherId): void
+    {
+        $this->affectationResults[(string) $teacherId] = true;
+    }
+
+    #[Test]
+    public function itAbstainsForUnrelatedAttributes(): void
+    {
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value);
+
+        $result = $this->voter->vote($token, $evaluation, ['SOME_OTHER_ATTRIBUTE']);
+
+        self::assertSame(Voter::ACCESS_ABSTAIN, $result);
+    }
+
+    #[Test]
+    public function itAbstainsWhenSubjectIsNotAnEvaluation(): void
+    {
+        $token = $this->tokenWithSecurityUser(Role::PROF->value);
+
+        $result = $this->voter->vote($token, null, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_ABSTAIN, $result);
+    }
+
+    #[Test]
+    public function itDeniesAccessToUnauthenticatedUsers(): void
+    {
+        $evaluation = $this->createEvaluation();
+        $token = $this->createMock(TokenInterface::class);
+        $token->method('getUser')->willReturn(null);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itDeniesAccessToNonSecurityUser(): void
+    {
+        $evaluation = $this->createEvaluation();
+        $user = $this->createMock(UserInterface::class);
+        $user->method('getRoles')->willReturn([Role::PROF->value]);
+
+        $token = $this->createMock(TokenInterface::class);
+        $token->method('getUser')->willReturn($user);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToAdmin(): void
+    {
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::ADMIN->value);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesEditToAdmin(): void
+    {
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::ADMIN->value);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::EDIT]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToSuperAdmin(): void
+    {
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::SUPER_ADMIN->value);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToAssignedTeacher(): void
+    {
+        $teacherId = UserId::generate();
+        $this->setTeacherAffecte($teacherId);
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $teacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itGrantsEditToAssignedTeacher(): void
+    {
+        $teacherId = UserId::generate();
+        $this->setTeacherAffecte($teacherId);
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $teacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::EDIT]);
+
+        self::assertSame(Voter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesEditToUnassignedTeacher(): void
+    {
+        $teacherId = UserId::generate();
+        // No assignment set
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $teacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::EDIT]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToEvaluationOwnerWithoutAssignment(): void
+    {
+        $teacherId = UserId::generate();
+        // Teacher owns the evaluation but is no longer assigned
+
+        $evaluation = $this->createEvaluation(teacherId: $teacherId);
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $teacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesEditToEvaluationOwnerWithoutAssignment(): void
+    {
+        $teacherId = UserId::generate();
+        // Teacher owns the evaluation but is no longer assigned
+
+        $evaluation = $this->createEvaluation(teacherId: $teacherId);
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $teacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::EDIT]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToActiveReplacement(): void
+    {
+        $replacementTeacherId = UserId::generate();
+        $this->createActiveReplacement($replacementTeacherId);
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $replacementTeacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itGrantsEditToActiveReplacement(): void
+    {
+        $replacementTeacherId = UserId::generate();
+        $this->createActiveReplacement($replacementTeacherId);
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $replacementTeacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::EDIT]);
+
+        self::assertSame(Voter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesEditToExpiredReplacement(): void
+    {
+        $replacementTeacherId = UserId::generate();
+        $this->createExpiredReplacement($replacementTeacherId);
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $replacementTeacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::EDIT]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itDeniesViewToExpiredReplacementWhoIsNotOwner(): void
+    {
+        $replacementTeacherId = UserId::generate();
+        $this->createExpiredReplacement($replacementTeacherId);
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $replacementTeacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itDeniesViewToReplacementOnDifferentClassSubject(): void
+    {
+        $replacementTeacherId = UserId::generate();
+
+        // Remplacement actif mais sur une AUTRE classe/matière
+        $otherClassId = ClassId::generate();
+        $otherSubjectId = SubjectId::generate();
+        $replacement = TeacherReplacement::designer(
+            tenantId: $this->tenantId,
+            replacedTeacherId: UserId::generate(),
+            replacementTeacherId: $replacementTeacherId,
+            startDate: $this->now->modify('-1 day'),
+            endDate: $this->now->modify('+7 days'),
+            classes: [new ClassSubjectPair($otherClassId, $otherSubjectId)],
+            reason: 'Maladie',
+            createdBy: UserId::generate(),
+            now: $this->now->modify('-1 day'),
+        );
+        $this->replacementRepository->save($replacement);
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $replacementTeacherId);
+
+        $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itDeniesViewToNonTeacherNonAdminRoles(): void
+    {
+        $evaluation = $this->createEvaluation();
+
+        foreach ([Role::ELEVE->value, Role::PARENT->value, Role::SECRETARIAT->value, Role::VIE_SCOLAIRE->value] as $role) {
+            $token = $this->tokenWithSecurityUser($role);
+            $result = $this->voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+            self::assertSame(Voter::ACCESS_DENIED, $result, "Role {$role} should be denied VIEW");
+        }
+    }
+
+    #[Test]
+    public function itDeniesWhenNoTenantIsSet(): void
+    {
+        $teacherId = UserId::generate();
+        $this->setTeacherAffecte($teacherId);
+
+        $tenantContext = new TenantContext();
+        $clock = $this->createMock(Clock::class);
+        $clock->method('now')->willReturn($this->now);
+
+        $test = $this;
+        $affectationChecker = new class($test) implements EnseignantAffectationChecker {
+            public function __construct(private readonly GradeVoterTest $test)
+            {
+            }
+
+            public function estAffecte(
+                UserId $teacherId,
+                ClassId $classId,
+                SubjectId $subjectId,
+                TenantId $tenantId,
+            ): bool {
+                return $this->test->getAffectationResult((string) $teacherId);
+            }
+        };
+
+        $autorisationChecker = new AutorisationSaisieNotesChecker(
+            $affectationChecker,
+            $this->replacementRepository,
+        );
+
+        $voter = new GradeVoter(
+            $autorisationChecker,
+            $tenantContext,
+            $clock,
+        );
+
+        $evaluation = $this->createEvaluation();
+        $token = $this->tokenWithSecurityUser(Role::PROF->value, $teacherId);
+
+        $result = $voter->vote($token, $evaluation, [GradeVoter::VIEW]);
+
+        self::assertSame(Voter::ACCESS_DENIED, $result);
+    }
+
+    private function createEvaluation(?UserId $teacherId = null): Evaluation
+    {
+        return Evaluation::creer(
+            tenantId: $this->tenantId,
+            classId: $this->classId,
+            subjectId: $this->subjectId,
+            teacherId: $teacherId ?? UserId::generate(),
+            title: 'Contrôle de maths',
+            description: null,
+            evaluationDate: $this->now,
+            gradeScale: new GradeScale(20),
+            coefficient: new Coefficient(1.0),
+            now: $this->now,
+        );
+    }
+
+    private function createActiveReplacement(UserId $replacementTeacherId): void
+    {
+        $replacement = TeacherReplacement::designer(
+            tenantId: $this->tenantId,
+            replacedTeacherId: UserId::generate(),
+            replacementTeacherId: $replacementTeacherId,
+            startDate: $this->now->modify('-1 day'),
+            endDate: $this->now->modify('+7 days'),
+            classes: [new ClassSubjectPair($this->classId, $this->subjectId)],
+            reason: 'Maladie',
+            createdBy: UserId::generate(),
+            now: $this->now->modify('-1 day'),
+        );
+        $this->replacementRepository->save($replacement);
+    }
+
+    private function createExpiredReplacement(UserId $replacementTeacherId): void
+    {
+        $replacement = TeacherReplacement::designer(
+            tenantId: $this->tenantId,
+            replacedTeacherId: UserId::generate(),
+            replacementTeacherId: $replacementTeacherId,
+            startDate: $this->now->modify('-14 days'),
+            endDate: $this->now->modify('-1 day'),
+            classes: [new ClassSubjectPair($this->classId, $this->subjectId)],
+            reason: 'Maladie',
+            createdBy: UserId::generate(),
+            now: $this->now->modify('-14 days'),
+        );
+        $this->replacementRepository->save($replacement);
+    }
+
+    private function tokenWithSecurityUser(string $role, ?UserId $userId = null): TokenInterface
+    {
+        $securityUser = new SecurityUser(
+            userId: $userId ?? UserId::generate(),
+            email: 'test@example.com',
+            hashedPassword: 'hashed',
+            tenantId: $this->tenantId,
+            roles: [$role],
+        );
+
+        $token = $this->createMock(TokenInterface::class);
+        $token->method('getUser')->willReturn($securityUser);
+
+        return $token;
+    }
+}
--- a/backend/tests/Unit/Scolarite/Infrastructure/Storage/InMemoryFileStorage.php
+++ b/backend/tests/Unit/Scolarite/Infrastructure/Storage/InMemoryFileStorage.php
@@ -6,10 +6,16 @@ namespace App\Tests\Unit\Scolarite\Infrastructure\Storage;

 use App\Scolarite\Application\Port\FileStorage;

+use function fopen;
+use function fwrite;
 use function is_string;

 use Override;

+use function rewind;
+
+use RuntimeException;
+
 final class InMemoryFileStorage implements FileStorage
 {
    /** @var array<string, string> */
@@ -29,6 +35,21 @@ final class InMemoryFileStorage implements FileStorage
        unset($this->files[$path]);
    }

+    #[Override]
+    public function readStream(string $path): mixed
+    {
+        if (!isset($this->files[$path])) {
+            throw new RuntimeException("File not found: {$path}");
+        }
+
+        /** @var resource $stream */
+        $stream = fopen('php://memory', 'r+');
+        fwrite($stream, $this->files[$path]);
+        rewind($stream);
+
+        return $stream;
+    }
+
    public function has(string $path): bool
    {
        return isset($this->files[$path]);
--- a/backend/tests/Unit/Scolarite/Infrastructure/Storage/S3FileStorageTest.php
+++ b/backend/tests/Unit/Scolarite/Infrastructure/Storage/S3FileStorageTest.php
@@ -0,0 +1,141 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Scolarite\Infrastructure\Storage;
+
+use App\Scolarite\Infrastructure\Storage\S3FileStorage;
+
+use function fopen;
+
+use League\Flysystem\Filesystem;
+use League\Flysystem\UnableToDeleteFile;
+use League\Flysystem\UnableToReadFile;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+use ReflectionClass;
+use RuntimeException;
+
+final class S3FileStorageTest extends TestCase
+{
+    private Filesystem $filesystem;
+    private LoggerInterface $logger;
+    private S3FileStorage $storage;
+
+    protected function setUp(): void
+    {
+        $this->filesystem = $this->createMock(Filesystem::class);
+        $this->logger = $this->createMock(LoggerInterface::class);
+
+        $this->storage = $this->createStorageWithMockedFilesystem($this->filesystem, $this->logger);
+    }
+
+    #[Test]
+    public function uploadWritesStringContentToFilesystem(): void
+    {
+        $this->filesystem->expects(self::once())
+            ->method('write')
+            ->with('homework/abc/file.pdf', 'fake content', ['ContentType' => 'application/pdf']);
+
+        $result = $this->storage->upload('homework/abc/file.pdf', 'fake content', 'application/pdf');
+
+        self::assertSame('homework/abc/file.pdf', $result);
+    }
+
+    #[Test]
+    public function uploadWritesStreamContentToFilesystem(): void
+    {
+        /** @var resource $stream */
+        $stream = fopen('php://memory', 'r+');
+
+        $this->filesystem->expects(self::once())
+            ->method('writeStream')
+            ->with('homework/abc/file.pdf', $stream, ['ContentType' => 'application/pdf']);
+
+        $result = $this->storage->upload('homework/abc/file.pdf', $stream, 'application/pdf');
+
+        self::assertSame('homework/abc/file.pdf', $result);
+    }
+
+    #[Test]
+    public function deleteRemovesFileFromFilesystem(): void
+    {
+        $this->filesystem->expects(self::once())
+            ->method('delete')
+            ->with('homework/abc/file.pdf');
+
+        $this->logger->expects(self::never())
+            ->method('warning');
+
+        $this->storage->delete('homework/abc/file.pdf');
+    }
+
+    #[Test]
+    public function deleteLogsWarningOnFailure(): void
+    {
+        $this->filesystem->expects(self::once())
+            ->method('delete')
+            ->willThrowException(UnableToDeleteFile::atLocation('homework/abc/file.pdf'));
+
+        $this->logger->expects(self::once())
+            ->method('warning')
+            ->with(
+                'S3 delete failed, possible orphan blob: {path}',
+                self::callback(static fn (array $context): bool => $context['path'] === 'homework/abc/file.pdf'),
+            );
+
+        $this->storage->delete('homework/abc/file.pdf');
+    }
+
+    #[Test]
+    public function readStreamReturnsResourceFromFilesystem(): void
+    {
+        /** @var resource $expectedStream */
+        $expectedStream = fopen('php://memory', 'r+');
+
+        $this->filesystem->expects(self::once())
+            ->method('readStream')
+            ->with('homework/abc/file.pdf')
+            ->willReturn($expectedStream);
+
+        $result = $this->storage->readStream('homework/abc/file.pdf');
+
+        self::assertSame($expectedStream, $result);
+    }
+
+    #[Test]
+    public function readStreamThrowsRuntimeExceptionOnMissingFile(): void
+    {
+        $this->filesystem->expects(self::once())
+            ->method('readStream')
+            ->with('homework/abc/missing.pdf')
+            ->willThrowException(UnableToReadFile::fromLocation('homework/abc/missing.pdf'));
+
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Impossible de lire le fichier : homework/abc/missing.pdf');
+
+        $this->storage->readStream('homework/abc/missing.pdf');
+    }
+
+    /**
+     * Creates an S3FileStorage instance with a mocked Filesystem injected via reflection.
+     *
+     * S3FileStorage is `final readonly` and its constructor creates a real S3Client,
+     * so we bypass it with newInstanceWithoutConstructor() and inject mocks directly.
+     * If the class gains new properties, this method must be updated.
+     */
+    private function createStorageWithMockedFilesystem(Filesystem $filesystem, LoggerInterface $logger): S3FileStorage
+    {
+        $reflection = new ReflectionClass(S3FileStorage::class);
+        $storage = $reflection->newInstanceWithoutConstructor();
+
+        $fsProp = $reflection->getProperty('filesystem');
+        $fsProp->setValue($storage, $filesystem);
+
+        $loggerProp = $reflection->getProperty('logger');
+        $loggerProp->setValue($storage, $logger);
+
+        return $storage;
+    }
+}
--- a/backend/tests/Unit/Shared/Infrastructure/Tenant/DoctrineTenantRegistryTest.php
+++ b/backend/tests/Unit/Shared/Infrastructure/Tenant/DoctrineTenantRegistryTest.php
@@ -0,0 +1,119 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Shared\Infrastructure\Tenant;
+
+use App\Shared\Infrastructure\Tenant\DoctrineTenantRegistry;
+use App\Shared\Infrastructure\Tenant\TenantId;
+use App\Shared\Infrastructure\Tenant\TenantNotFoundException;
+use Doctrine\DBAL\Connection;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+#[CoversClass(DoctrineTenantRegistry::class)]
+final class DoctrineTenantRegistryTest extends TestCase
+{
+    private const string MASTER_URL = 'postgresql://classeo:secret@db:5432/classeo_master';
+    private const string TENANT_ID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
+    private const string SUBDOMAIN = 'ecole-alpha';
+    private const string DB_NAME = 'classeo_tenant_a1b2c3d4e5f67890abcdef1234567890';
+
+    #[Test]
+    public function itResolvesConfigBySubdomain(): void
+    {
+        $registry = $this->registryWith([
+            ['tenant_id' => self::TENANT_ID, 'subdomain' => self::SUBDOMAIN, 'database_name' => self::DB_NAME],
+        ]);
+
+        $config = $registry->getBySubdomain(self::SUBDOMAIN);
+
+        self::assertSame(self::SUBDOMAIN, $config->subdomain);
+        self::assertSame(self::TENANT_ID, (string) $config->tenantId);
+        self::assertSame('postgresql://classeo:secret@db:5432/' . self::DB_NAME, $config->databaseUrl);
+    }
+
+    #[Test]
+    public function itResolvesConfigByTenantId(): void
+    {
+        $registry = $this->registryWith([
+            ['tenant_id' => self::TENANT_ID, 'subdomain' => self::SUBDOMAIN, 'database_name' => self::DB_NAME],
+        ]);
+
+        $config = $registry->getConfig(TenantId::fromString(self::TENANT_ID));
+
+        self::assertSame(self::SUBDOMAIN, $config->subdomain);
+    }
+
+    #[Test]
+    public function itThrowsForUnknownSubdomain(): void
+    {
+        $registry = $this->registryWith([]);
+
+        $this->expectException(TenantNotFoundException::class);
+        $registry->getBySubdomain('inexistant');
+    }
+
+    #[Test]
+    public function itThrowsForUnknownTenantId(): void
+    {
+        $registry = $this->registryWith([]);
+
+        $this->expectException(TenantNotFoundException::class);
+        $registry->getConfig(TenantId::fromString(self::TENANT_ID));
+    }
+
+    #[Test]
+    public function itChecksExistence(): void
+    {
+        $registry = $this->registryWith([
+            ['tenant_id' => self::TENANT_ID, 'subdomain' => self::SUBDOMAIN, 'database_name' => self::DB_NAME],
+        ]);
+
+        self::assertTrue($registry->exists(self::SUBDOMAIN));
+        self::assertFalse($registry->exists('inexistant'));
+    }
+
+    #[Test]
+    public function itReturnsAllConfigs(): void
+    {
+        $registry = $this->registryWith([
+            ['tenant_id' => self::TENANT_ID, 'subdomain' => self::SUBDOMAIN, 'database_name' => self::DB_NAME],
+            ['tenant_id' => 'b2c3d4e5-f6a7-8901-bcde-f12345678901', 'subdomain' => 'ecole-beta', 'database_name' => 'classeo_tenant_beta'],
+        ]);
+
+        $configs = $registry->getAllConfigs();
+
+        self::assertCount(2, $configs);
+    }
+
+    #[Test]
+    public function itQueriesDatabaseOnlyOnce(): void
+    {
+        $connection = $this->createMock(Connection::class);
+        $connection->expects(self::once())
+            ->method('fetchAllAssociative')
+            ->willReturn([
+                ['tenant_id' => self::TENANT_ID, 'subdomain' => self::SUBDOMAIN, 'database_name' => self::DB_NAME],
+            ]);
+
+        $registry = new DoctrineTenantRegistry($connection, self::MASTER_URL);
+
+        $registry->getBySubdomain(self::SUBDOMAIN);
+        $registry->getConfig(TenantId::fromString(self::TENANT_ID));
+        $registry->exists(self::SUBDOMAIN);
+        $registry->getAllConfigs();
+    }
+
+    /**
+     * @param array<array{tenant_id: string, subdomain: string, database_name: string}> $rows
+     */
+    private function registryWith(array $rows): DoctrineTenantRegistry
+    {
+        $connection = $this->createMock(Connection::class);
+        $connection->method('fetchAllAssociative')->willReturn($rows);
+
+        return new DoctrineTenantRegistry($connection, self::MASTER_URL);
+    }
+}
--- a/backend/tests/Unit/SuperAdmin/Application/Command/CreateEstablishment/CreateEstablishmentHandlerTest.php
+++ b/backend/tests/Unit/SuperAdmin/Application/Command/CreateEstablishment/CreateEstablishmentHandlerTest.php
@@ -37,7 +37,7 @@ final class CreateEstablishmentHandlerTest extends TestCase
    }

    #[Test]
-    public function createsEstablishmentAndReturnsResult(): void
+    public function createsEstablishmentAndReturnsIt(): void
    {
        $command = new CreateEstablishmentCommand(
            name: 'École Alpha',
@@ -46,13 +46,13 @@ final class CreateEstablishmentHandlerTest extends TestCase
            superAdminId: self::SUPER_ADMIN_ID,
        );

-        $result = ($this->handler)($command);
+        $establishment = ($this->handler)($command);

-        self::assertNotEmpty($result->establishmentId);
-        self::assertNotEmpty($result->tenantId);
-        self::assertSame('École Alpha', $result->name);
-        self::assertSame('ecole-alpha', $result->subdomain);
-        self::assertStringStartsWith('classeo_tenant_', $result->databaseName);
+        self::assertNotEmpty((string) $establishment->id);
+        self::assertNotEmpty((string) $establishment->tenantId);
+        self::assertSame('École Alpha', $establishment->name);
+        self::assertSame('ecole-alpha', $establishment->subdomain);
+        self::assertStringStartsWith('classeo_tenant_', $establishment->databaseName);
    }

    #[Test]
@@ -65,10 +65,10 @@ final class CreateEstablishmentHandlerTest extends TestCase
            superAdminId: self::SUPER_ADMIN_ID,
        );

-        $result = ($this->handler)($command);
+        $establishment = ($this->handler)($command);

        $establishments = $this->repository->findAll();
        self::assertCount(1, $establishments);
-        self::assertSame($result->establishmentId, (string) $establishments[0]->id);
+        self::assertSame((string) $establishment->id, (string) $establishments[0]->id);
    }
 }
--- a/backend/tests/Unit/SuperAdmin/Application/Query/GetEstablishments/GetEstablishmentsHandlerTest.php
+++ b/backend/tests/Unit/SuperAdmin/Application/Query/GetEstablishments/GetEstablishmentsHandlerTest.php
@@ -40,6 +40,7 @@ final class GetEstablishmentsHandlerTest extends TestCase
        $this->repository->save(Establishment::creer(
            name: 'École Alpha',
            subdomain: 'ecole-alpha',
+            adminEmail: 'admin@ecole-alpha.fr',
            createdBy: SuperAdminId::fromString(self::SUPER_ADMIN_ID),
            createdAt: new DateTimeImmutable('2026-02-16 10:00:00'),
        ));
@@ -47,6 +48,7 @@ final class GetEstablishmentsHandlerTest extends TestCase
        $this->repository->save(Establishment::creer(
            name: 'École Beta',
            subdomain: 'ecole-beta',
+            adminEmail: 'admin@ecole-beta.fr',
            createdBy: SuperAdminId::fromString(self::SUPER_ADMIN_ID),
            createdAt: new DateTimeImmutable('2026-02-16 11:00:00'),
        ));
@@ -56,6 +58,6 @@ final class GetEstablishmentsHandlerTest extends TestCase
        self::assertCount(2, $result);
        self::assertSame('École Alpha', $result[0]->name);
        self::assertSame('ecole-alpha', $result[0]->subdomain);
-        self::assertSame('active', $result[0]->status);
+        self::assertSame('provisioning', $result[0]->status);
    }
 }
--- a/backend/tests/Unit/SuperAdmin/Domain/Model/Establishment/EstablishmentTest.php
+++ b/backend/tests/Unit/SuperAdmin/Domain/Model/Establishment/EstablishmentTest.php
@@ -23,11 +23,11 @@ final class EstablishmentTest extends TestCase
    private const string SUBDOMAIN = 'ecole-alpha';

    #[Test]
-    public function creerCreatesActiveEstablishment(): void
+    public function creerCreatesProvisioningEstablishment(): void
    {
        $establishment = $this->createEstablishment();

-        self::assertSame(EstablishmentStatus::ACTIF, $establishment->status);
+        self::assertSame(EstablishmentStatus::PROVISIONING, $establishment->status);
        self::assertSame(self::ESTABLISHMENT_NAME, $establishment->name);
        self::assertSame(self::SUBDOMAIN, $establishment->subdomain);
        self::assertNull($establishment->lastActivityAt);
@@ -59,10 +59,21 @@ final class EstablishmentTest extends TestCase
        self::assertStringStartsWith('classeo_tenant_', $establishment->databaseName);
    }

+    #[Test]
+    public function activerChangesStatusToActif(): void
+    {
+        $establishment = $this->createEstablishment();
+
+        self::assertSame(EstablishmentStatus::PROVISIONING, $establishment->status);
+        $establishment->activer();
+        self::assertSame(EstablishmentStatus::ACTIF, $establishment->status);
+    }
+
    #[Test]
    public function desactiverChangesStatusToInactif(): void
    {
        $establishment = $this->createEstablishment();
+        $establishment->activer();

        $establishment->desactiver(new DateTimeImmutable('2026-02-16 12:00:00'));

@@ -73,6 +84,7 @@ final class EstablishmentTest extends TestCase
    public function desactiverRecordsEtablissementDesactiveEvent(): void
    {
        $establishment = $this->createEstablishment();
+        $establishment->activer();
        $establishment->pullDomainEvents(); // Clear creation event

        $establishment->desactiver(new DateTimeImmutable('2026-02-16 12:00:00'));
@@ -86,6 +98,7 @@ final class EstablishmentTest extends TestCase
    public function desactiverThrowsWhenAlreadyInactive(): void
    {
        $establishment = $this->createEstablishment();
+        $establishment->activer();
        $establishment->desactiver(new DateTimeImmutable('2026-02-16 12:00:00'));

        $this->expectException(EstablishmentDejaInactifException::class);
@@ -141,6 +154,7 @@ final class EstablishmentTest extends TestCase
        return Establishment::creer(
            name: self::ESTABLISHMENT_NAME,
            subdomain: self::SUBDOMAIN,
+            adminEmail: 'admin@ecole-alpha.fr',
            createdBy: SuperAdminId::fromString(self::SUPER_ADMIN_ID),
            createdAt: new DateTimeImmutable('2026-02-16 10:00:00'),
        );
--- a/backend/tests/Unit/SuperAdmin/Infrastructure/Api/Processor/CreateEstablishmentProcessorTest.php
+++ b/backend/tests/Unit/SuperAdmin/Infrastructure/Api/Processor/CreateEstablishmentProcessorTest.php
@@ -7,6 +7,7 @@ namespace App\Tests\Unit\SuperAdmin\Infrastructure\Api\Processor;
 use ApiPlatform\Metadata\Post;
 use App\Shared\Domain\Clock;
 use App\SuperAdmin\Application\Command\CreateEstablishment\CreateEstablishmentHandler;
+use App\SuperAdmin\Application\Command\ProvisionEstablishment\ProvisionEstablishmentCommand;
 use App\SuperAdmin\Domain\Model\SuperAdmin\SuperAdminId;
 use App\SuperAdmin\Infrastructure\Api\Processor\CreateEstablishmentProcessor;
 use App\SuperAdmin\Infrastructure\Api\Resource\EstablishmentResource;
@@ -16,13 +17,15 @@ use DateTimeImmutable;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\TestCase;
 use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Messenger\Envelope;
+use Symfony\Component\Messenger\MessageBusInterface;

 final class CreateEstablishmentProcessorTest extends TestCase
 {
    private const string SUPER_ADMIN_ID = '550e8400-e29b-41d4-a716-446655440001';

    #[Test]
-    public function processCreatesEstablishmentAndReturnsResource(): void
+    public function processCreatesEstablishmentAndDispatchesProvisioning(): void
    {
        $repository = new InMemoryEstablishmentRepository();
        $clock = new class implements Clock {
@@ -42,7 +45,16 @@ final class CreateEstablishmentProcessorTest extends TestCase
        $security = $this->createMock(Security::class);
        $security->method('getUser')->willReturn($securityUser);

-        $processor = new CreateEstablishmentProcessor($handler, $security);
+        $dispatched = [];
+        $commandBus = $this->createMock(MessageBusInterface::class);
+        $commandBus->method('dispatch')
+            ->willReturnCallback(static function (object $message) use (&$dispatched): Envelope {
+                $dispatched[] = $message;
+
+                return new Envelope($message);
+            });
+
+        $processor = new CreateEstablishmentProcessor($handler, $security, $commandBus);

        $input = new EstablishmentResource();
        $input->name = 'École Gamma';
@@ -55,6 +67,12 @@ final class CreateEstablishmentProcessorTest extends TestCase
        self::assertNotNull($result->tenantId);
        self::assertSame('École Gamma', $result->name);
        self::assertSame('ecole-gamma', $result->subdomain);
-        self::assertSame('active', $result->status);
+        self::assertSame('provisioning', $result->status);
+
+        self::assertCount(1, $dispatched);
+        self::assertInstanceOf(ProvisionEstablishmentCommand::class, $dispatched[0]);
+        self::assertSame('admin@ecole-gamma.fr', $dispatched[0]->adminEmail);
+        self::assertSame('ecole-gamma', $dispatched[0]->subdomain);
+        self::assertSame('École Gamma', $dispatched[0]->establishmentName);
    }
 }
--- a/backend/tests/Unit/SuperAdmin/Infrastructure/Api/Provider/EstablishmentCollectionProviderTest.php
+++ b/backend/tests/Unit/SuperAdmin/Infrastructure/Api/Provider/EstablishmentCollectionProviderTest.php
@@ -37,6 +37,7 @@ final class EstablishmentCollectionProviderTest extends TestCase
        $repository->save(Establishment::creer(
            name: 'École Alpha',
            subdomain: 'ecole-alpha',
+            adminEmail: 'admin@ecole-alpha.fr',
            createdBy: SuperAdminId::fromString(self::SUPER_ADMIN_ID),
            createdAt: new DateTimeImmutable('2026-02-16 10:00:00'),
        ));
@@ -49,6 +50,6 @@ final class EstablishmentCollectionProviderTest extends TestCase
        self::assertCount(1, $result);
        self::assertSame('École Alpha', $result[0]->name);
        self::assertSame('ecole-alpha', $result[0]->subdomain);
-        self::assertSame('active', $result[0]->status);
+        self::assertSame('provisioning', $result[0]->status);
    }
 }
--- a/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/DatabaseTenantProvisionerTest.php
+++ b/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/DatabaseTenantProvisionerTest.php
@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\SuperAdmin\Infrastructure\Provisioning;
+
+use App\SuperAdmin\Application\Port\TenantProvisioner;
+use App\SuperAdmin\Infrastructure\Provisioning\DatabaseTenantProvisioner;
+use App\SuperAdmin\Infrastructure\Provisioning\TenantDatabaseCreator;
+use App\SuperAdmin\Infrastructure\Provisioning\TenantMigrator;
+use Doctrine\DBAL\Connection;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use RuntimeException;
+
+final class DatabaseTenantProvisionerTest extends TestCase
+{
+    #[Test]
+    public function itCallsCreatorThenMigratorInOrder(): void
+    {
+        $steps = [];
+
+        $connection = $this->createMock(Connection::class);
+        $connection->method('fetchOne')->willReturn(false);
+        $connection->method('executeStatement')->willReturnCallback(
+            static function () use (&$steps): int {
+                $steps[] = 'create';
+
+                return 1;
+            },
+        );
+
+        $creator = new TenantDatabaseCreator($connection, new NullLogger());
+
+        // TenantMigrator is final — we wrap via the TenantProvisioner interface
+        // to verify the creator is called. Migration subprocess cannot be tested unitarily.
+        $provisioner = new class($creator, $steps) implements TenantProvisioner {
+            /** @param string[] $steps */
+            public function __construct(
+                private readonly TenantDatabaseCreator $creator,
+                private array &$steps,
+            ) {
+            }
+
+            public function provision(string $databaseName): void
+            {
+                $this->creator->create($databaseName);
+                $this->steps[] = 'migrate';
+            }
+        };
+
+        $provisioner->provision('classeo_tenant_test');
+
+        self::assertSame(['create', 'migrate'], $steps);
+    }
+
+    #[Test]
+    public function itPropagatesCreationFailure(): void
+    {
+        $connection = $this->createMock(Connection::class);
+        $connection->method('fetchOne')->willThrowException(new RuntimeException('Connection refused'));
+
+        $creator = new TenantDatabaseCreator($connection, new NullLogger());
+        $migrator = new TenantMigrator('/tmp', 'postgresql://u:p@h/db', new NullLogger());
+
+        $provisioner = new DatabaseTenantProvisioner($creator, $migrator);
+
+        $this->expectException(RuntimeException::class);
+        $provisioner->provision('classeo_tenant_test');
+    }
+}
--- a/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/ProvisionEstablishmentHandlerTest.php
+++ b/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/ProvisionEstablishmentHandlerTest.php
@@ -0,0 +1,236 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\SuperAdmin\Infrastructure\Provisioning;
+
+use App\Administration\Application\Command\InviteUser\InviteUserHandler;
+use App\Administration\Domain\Event\InvitationRenvoyee;
+use App\Administration\Domain\Event\UtilisateurInvite;
+use App\Administration\Infrastructure\Persistence\InMemory\InMemoryUserRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use App\SuperAdmin\Application\Command\ProvisionEstablishment\ProvisionEstablishmentCommand;
+use App\SuperAdmin\Application\Port\TenantProvisioner;
+use App\SuperAdmin\Domain\Model\Establishment\Establishment;
+use App\SuperAdmin\Domain\Model\Establishment\EstablishmentId;
+use App\SuperAdmin\Domain\Model\Establishment\EstablishmentStatus;
+use App\SuperAdmin\Domain\Model\SuperAdmin\SuperAdminId;
+use App\SuperAdmin\Infrastructure\Persistence\InMemory\InMemoryEstablishmentRepository;
+use App\SuperAdmin\Infrastructure\Provisioning\ProvisionEstablishmentHandler;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use RuntimeException;
+use Symfony\Component\Messenger\Envelope;
+use Symfony\Component\Messenger\MessageBusInterface;
+
+final class ProvisionEstablishmentHandlerTest extends TestCase
+{
+    private const string MASTER_URL = 'postgresql://classeo:secret@db:5432/classeo_master?serverVersion=18';
+    private const string ESTABLISHMENT_ID = '550e8400-e29b-41d4-a716-446655440001';
+    private const string TENANT_ID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
+
+    #[Test]
+    public function itProvisionsTenantDatabase(): void
+    {
+        $provisioner = $this->createMock(TenantProvisioner::class);
+        $provisioner->expects(self::once())
+            ->method('provision')
+            ->with('classeo_tenant_abc123');
+
+        $handler = $this->buildHandler(provisioner: $provisioner);
+        $handler($this->command());
+    }
+
+    #[Test]
+    public function itCreatesAdminUser(): void
+    {
+        $userRepository = new InMemoryUserRepository();
+
+        $handler = $this->buildHandler(userRepository: $userRepository);
+        $handler($this->command());
+
+        $users = $userRepository->findAllByTenant(TenantId::fromString(self::TENANT_ID));
+        self::assertCount(1, $users);
+        self::assertSame('admin@ecole-gamma.fr', (string) $users[0]->email);
+    }
+
+    #[Test]
+    public function itDispatchesInvitationEvent(): void
+    {
+        $dispatched = [];
+        $eventBus = $this->spyEventBus($dispatched);
+
+        $handler = $this->buildHandler(eventBus: $eventBus);
+        $handler($this->command());
+
+        self::assertNotEmpty($dispatched);
+        self::assertInstanceOf(UtilisateurInvite::class, $dispatched[0]);
+    }
+
+    #[Test]
+    public function itActivatesEstablishmentAfterProvisioning(): void
+    {
+        $establishmentRepo = $this->establishmentRepoWithProvisioningEstablishment();
+
+        $handler = $this->buildHandler(establishmentRepository: $establishmentRepo);
+        $handler($this->command());
+
+        $establishment = $establishmentRepo->get(
+            EstablishmentId::fromString(self::ESTABLISHMENT_ID),
+        );
+        self::assertSame(EstablishmentStatus::ACTIF, $establishment->status);
+    }
+
+    #[Test]
+    public function itIsIdempotentWhenAdminAlreadyExists(): void
+    {
+        $userRepository = new InMemoryUserRepository();
+        $dispatched = [];
+        $eventBus = $this->spyEventBus($dispatched);
+
+        $handler = $this->buildHandler(userRepository: $userRepository, eventBus: $eventBus);
+
+        // First call creates the admin
+        $handler($this->command());
+        self::assertCount(1, $dispatched);
+        self::assertInstanceOf(UtilisateurInvite::class, $dispatched[0]);
+
+        // Second call is idempotent — re-sends invitation
+        $dispatched = [];
+        $handler($this->command());
+        self::assertCount(1, $dispatched);
+        self::assertInstanceOf(InvitationRenvoyee::class, $dispatched[0]);
+    }
+
+    #[Test]
+    public function itSwitchesDatabaseAndRestores(): void
+    {
+        $switcher = new SpyDatabaseSwitcher();
+
+        $handler = $this->buildHandler(databaseSwitcher: $switcher);
+        $handler($this->command());
+
+        self::assertCount(1, $switcher->switchedTo);
+        self::assertStringContainsString('classeo_tenant_abc123', $switcher->switchedTo[0]);
+        self::assertTrue($switcher->restoredToDefault);
+    }
+
+    #[Test]
+    public function itPreservesQueryParametersInDatabaseUrl(): void
+    {
+        $switcher = new SpyDatabaseSwitcher();
+
+        $handler = $this->buildHandler(databaseSwitcher: $switcher);
+        $handler($this->command());
+
+        self::assertStringContainsString('?serverVersion=18', $switcher->switchedTo[0]);
+    }
+
+    #[Test]
+    public function itRestoresDatabaseEvenOnFailure(): void
+    {
+        $switcher = new SpyDatabaseSwitcher();
+
+        $eventBus = $this->createMock(MessageBusInterface::class);
+        $eventBus->method('dispatch')
+            ->willThrowException(new RuntimeException('Event bus failure'));
+
+        $handler = $this->buildHandler(databaseSwitcher: $switcher, eventBus: $eventBus);
+
+        try {
+            $handler($this->command());
+        } catch (RuntimeException) {
+            // Expected
+        }
+
+        self::assertTrue($switcher->restoredToDefault);
+    }
+
+    private function command(): ProvisionEstablishmentCommand
+    {
+        return new ProvisionEstablishmentCommand(
+            establishmentId: self::ESTABLISHMENT_ID,
+            establishmentTenantId: self::TENANT_ID,
+            databaseName: 'classeo_tenant_abc123',
+            subdomain: 'ecole-gamma',
+            adminEmail: 'admin@ecole-gamma.fr',
+            establishmentName: 'École Gamma',
+        );
+    }
+
+    private function establishmentRepoWithProvisioningEstablishment(): InMemoryEstablishmentRepository
+    {
+        $repo = new InMemoryEstablishmentRepository();
+        $establishment = Establishment::reconstitute(
+            id: EstablishmentId::fromString(self::ESTABLISHMENT_ID),
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            name: 'École Gamma',
+            subdomain: 'ecole-gamma',
+            databaseName: 'classeo_tenant_abc123',
+            status: EstablishmentStatus::PROVISIONING,
+            createdAt: new DateTimeImmutable('2026-04-07 10:00:00'),
+            createdBy: SuperAdminId::fromString('550e8400-e29b-41d4-a716-446655440002'),
+        );
+        $repo->save($establishment);
+
+        return $repo;
+    }
+
+    /**
+     * @param object[] $dispatched
+     */
+    private function spyEventBus(array &$dispatched): MessageBusInterface
+    {
+        $eventBus = $this->createMock(MessageBusInterface::class);
+        $eventBus->method('dispatch')
+            ->willReturnCallback(static function (object $message) use (&$dispatched): Envelope {
+                $dispatched[] = $message;
+
+                return new Envelope($message);
+            });
+
+        return $eventBus;
+    }
+
+    private function buildHandler(
+        ?TenantProvisioner $provisioner = null,
+        ?InMemoryUserRepository $userRepository = null,
+        ?SpyDatabaseSwitcher $databaseSwitcher = null,
+        ?InMemoryEstablishmentRepository $establishmentRepository = null,
+        ?MessageBusInterface $eventBus = null,
+    ): ProvisionEstablishmentHandler {
+        $provisioner ??= $this->createMock(TenantProvisioner::class);
+
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-04-07 10:00:00');
+            }
+        };
+
+        $userRepository ??= new InMemoryUserRepository();
+
+        $databaseSwitcher ??= new SpyDatabaseSwitcher();
+
+        $establishmentRepository ??= $this->establishmentRepoWithProvisioningEstablishment();
+
+        $eventBus ??= $this->createMock(MessageBusInterface::class);
+        $eventBus->method('dispatch')
+            ->willReturnCallback(static fn (object $m): Envelope => new Envelope($m));
+
+        return new ProvisionEstablishmentHandler(
+            tenantProvisioner: $provisioner,
+            inviteUserHandler: new InviteUserHandler($userRepository, $clock),
+            userRepository: $userRepository,
+            clock: $clock,
+            databaseSwitcher: $databaseSwitcher,
+            establishmentRepository: $establishmentRepository,
+            eventBus: $eventBus,
+            logger: new NullLogger(),
+            masterDatabaseUrl: self::MASTER_URL,
+        );
+    }
+}
--- a/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/ProvisioningIntegrationTest.php
+++ b/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/ProvisioningIntegrationTest.php
@@ -0,0 +1,166 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\SuperAdmin\Infrastructure\Provisioning;
+
+use ApiPlatform\Metadata\Post;
+use App\Administration\Application\Command\InviteUser\InviteUserHandler;
+use App\Administration\Domain\Event\UtilisateurInvite;
+use App\Administration\Domain\Model\User\Role;
+use App\Administration\Infrastructure\Persistence\InMemory\InMemoryUserRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use App\SuperAdmin\Application\Command\CreateEstablishment\CreateEstablishmentHandler;
+use App\SuperAdmin\Application\Command\ProvisionEstablishment\ProvisionEstablishmentCommand;
+use App\SuperAdmin\Application\Port\TenantProvisioner;
+use App\SuperAdmin\Domain\Model\Establishment\EstablishmentStatus;
+use App\SuperAdmin\Domain\Model\SuperAdmin\SuperAdminId;
+use App\SuperAdmin\Infrastructure\Api\Processor\CreateEstablishmentProcessor;
+use App\SuperAdmin\Infrastructure\Api\Resource\EstablishmentResource;
+use App\SuperAdmin\Infrastructure\Persistence\InMemory\InMemoryEstablishmentRepository;
+use App\SuperAdmin\Infrastructure\Provisioning\ProvisionEstablishmentHandler;
+use App\SuperAdmin\Infrastructure\Security\SecuritySuperAdmin;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Messenger\Envelope;
+use Symfony\Component\Messenger\MessageBusInterface;
+
+/**
+ * Integration tests: verify the full provisioning flow from API request
+ * through establishment creation to async provisioning and admin user creation.
+ *
+ * Split into focused tests that each verify one aspect of the flow.
+ */
+final class ProvisioningIntegrationTest extends TestCase
+{
+    private const string SUPER_ADMIN_ID = '550e8400-e29b-41d4-a716-446655440001';
+    private const string MASTER_URL = 'postgresql://classeo:secret@db:5432/classeo_master';
+
+    private InMemoryEstablishmentRepository $establishmentRepository;
+    private InMemoryUserRepository $userRepository;
+    private ?ProvisionEstablishmentCommand $provisionCommand;
+    /** @var object[] */
+    private array $dispatchedEvents;
+
+    private function runFullFlow(): void
+    {
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-04-07 10:00:00');
+            }
+        };
+
+        // Phase 1: API processor creates establishment
+        $this->establishmentRepository = new InMemoryEstablishmentRepository();
+        $createHandler = new CreateEstablishmentHandler($this->establishmentRepository, $clock);
+
+        $security = $this->createMock(Security::class);
+        $security->method('getUser')->willReturn(new SecuritySuperAdmin(
+            SuperAdminId::fromString(self::SUPER_ADMIN_ID),
+            'superadmin@classeo.fr',
+            'hashed',
+        ));
+
+        $this->provisionCommand = null;
+        $commandBus = $this->createMock(MessageBusInterface::class);
+        $commandBus->method('dispatch')
+            ->willReturnCallback(function (object $message): Envelope {
+                if ($message instanceof ProvisionEstablishmentCommand) {
+                    $this->provisionCommand = $message;
+                }
+
+                return new Envelope($message);
+            });
+
+        $processor = new CreateEstablishmentProcessor($createHandler, $security, $commandBus);
+
+        $input = new EstablishmentResource();
+        $input->name = 'École Test';
+        $input->subdomain = 'ecole-test';
+        $input->adminEmail = 'admin@ecole-test.fr';
+
+        $processor->process($input, new Post());
+
+        // Phase 2: Provisioning handler processes the command
+        self::assertNotNull($this->provisionCommand);
+
+        $this->userRepository = new InMemoryUserRepository();
+        $this->dispatchedEvents = [];
+
+        $eventBus = $this->createMock(MessageBusInterface::class);
+        $eventBus->method('dispatch')
+            ->willReturnCallback(function (object $message): Envelope {
+                $this->dispatchedEvents[] = $message;
+
+                return new Envelope($message);
+            });
+
+        $provisioner = $this->createMock(TenantProvisioner::class);
+
+        $switcher = new SpyDatabaseSwitcher();
+
+        $provisionHandler = new ProvisionEstablishmentHandler(
+            tenantProvisioner: $provisioner,
+            inviteUserHandler: new InviteUserHandler($this->userRepository, $clock),
+            userRepository: $this->userRepository,
+            clock: $clock,
+            databaseSwitcher: $switcher,
+            establishmentRepository: $this->establishmentRepository,
+            eventBus: $eventBus,
+            logger: new NullLogger(),
+            masterDatabaseUrl: self::MASTER_URL,
+        );
+
+        $provisionHandler($this->provisionCommand);
+    }
+
+    #[Test]
+    public function processorCreatesEstablishmentInProvisioningStatus(): void
+    {
+        $this->runFullFlow();
+
+        $establishments = $this->establishmentRepository->findAll();
+        self::assertCount(1, $establishments);
+        self::assertSame('École Test', $establishments[0]->name);
+    }
+
+    #[Test]
+    public function processorDispatchesProvisioningCommandWithAdminEmail(): void
+    {
+        $this->runFullFlow();
+
+        self::assertNotNull($this->provisionCommand);
+        self::assertSame('admin@ecole-test.fr', $this->provisionCommand->adminEmail);
+        self::assertSame('ecole-test', $this->provisionCommand->subdomain);
+    }
+
+    #[Test]
+    public function provisioningCreatesAdminUserWithCorrectRole(): void
+    {
+        $this->runFullFlow();
+
+        $users = $this->userRepository->findAllByTenant(
+            TenantId::fromString($this->provisionCommand->establishmentTenantId),
+        );
+        self::assertCount(1, $users);
+        self::assertSame('admin@ecole-test.fr', (string) $users[0]->email);
+        self::assertSame(Role::ADMIN, $users[0]->role);
+    }
+
+    #[Test]
+    public function provisioningActivatesEstablishmentAndDispatchesEvent(): void
+    {
+        $this->runFullFlow();
+
+        $establishments = $this->establishmentRepository->findAll();
+        self::assertSame(EstablishmentStatus::ACTIF, $establishments[0]->status);
+
+        self::assertCount(1, $this->dispatchedEvents);
+        self::assertInstanceOf(UtilisateurInvite::class, $this->dispatchedEvents[0]);
+    }
+}
--- a/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/SpyDatabaseSwitcher.php
+++ b/backend/tests/Unit/SuperAdmin/Infrastructure/Provisioning/SpyDatabaseSwitcher.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\SuperAdmin\Infrastructure\Provisioning;
+
+use App\Shared\Infrastructure\Tenant\TenantDatabaseSwitcher;
+
+/**
+ * Test double that records database switching operations.
+ */
+final class SpyDatabaseSwitcher implements TenantDatabaseSwitcher
+{
+    /** @var string[] */
+    public array $switchedTo = [];
+    public bool $restoredToDefault = false;
+
+    public function useTenantDatabase(string $databaseUrl): void
+    {
+        $this->switchedTo[] = $databaseUrl;
+    }
+
+    public function useDefaultDatabase(): void
+    {
+        $this->restoredToDefault = true;
+    }
+
+    public function currentDatabaseUrl(): ?string
+    {
+        return null;
+    }
+}