test: Ajouter les tests unitaires manquants (backend et frontend)

Couverture des processors (RefreshToken, RequestPasswordReset, ResetPassword, SwitchRole, UpdateUserRoles), des query handlers (HasGradesInPeriod, HasStudentsInClass), des messaging handlers (SendActivationConfirmation, SendPasswordResetEmail), et côté frontend des modules auth, roles, monitoring, types et E2E tokens.
2026-02-15 18:44:33 +01:00
parent a0e19627a7
commit fdc26eb334
17 changed files with 4112 additions and 0 deletions
--- a/frontend/tests/unit/lib/api/config.test.ts
+++ b/frontend/tests/unit/lib/api/config.test.ts
@@ -0,0 +1,168 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+/**
+ * Unit tests for the API config module (config.ts).
+ *
+ * Tests getApiBaseUrl() and getCurrentTenant() which depend on:
+ * - $app/environment (browser flag)
+ * - $env/dynamic/public (environment variables)
+ * - window.location (hostname, protocol)
+ */
+
+// Mutable env object so we can change values per-test
+const mockEnv: Record<string, string | undefined> = {};
+
+// Mock $app/environment - default to browser=true
+let mockBrowser = true;
+vi.mock('$app/environment', () => ({
+	get browser() {
+		return mockBrowser;
+	}
+}));
+
+// Mock $env/dynamic/public
+vi.mock('$env/dynamic/public', () => ({
+	env: new Proxy(mockEnv, {
+		get(target, prop: string) {
+			return target[prop];
+		}
+	})
+}));
+
+describe('API config', () => {
+	let configModule: typeof import('$lib/api/config');
+
+	beforeEach(async () => {
+		// Reset env between tests
+		Object.keys(mockEnv).forEach((key) => delete mockEnv[key]);
+		mockBrowser = true;
+
+		// Reset modules to get a fresh import
+		vi.resetModules();
+		configModule = await import('$lib/api/config');
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	// ==========================================================================
+	// getApiBaseUrl
+	// ==========================================================================
+	describe('getApiBaseUrl', () => {
+		it('should return protocol://hostname:port/api when in browser with PUBLIC_API_PORT', () => {
+			mockBrowser = true;
+			mockEnv['PUBLIC_API_PORT'] = '18000';
+
+			// jsdom provides window.location - set it for the test
+			// Default jsdom location is http://localhost, so we work with that
+			const result = configModule.getApiBaseUrl();
+
+			expect(result).toBe(`${window.location.protocol}//${window.location.hostname}:18000/api`);
+		});
+
+		it('should return /api when in browser without PUBLIC_API_PORT', () => {
+			mockBrowser = true;
+			// PUBLIC_API_PORT is not set (undefined)
+
+			const result = configModule.getApiBaseUrl();
+
+			expect(result).toBe('/api');
+		});
+
+		it('should return PUBLIC_API_URL when in SSR and PUBLIC_API_URL is set', () => {
+			mockBrowser = false;
+			mockEnv['PUBLIC_API_URL'] = 'https://api.classeo.fr/api';
+
+			const result = configModule.getApiBaseUrl();
+
+			expect(result).toBe('https://api.classeo.fr/api');
+		});
+
+		it('should return http://php:8000/api as SSR fallback', () => {
+			mockBrowser = false;
+			// PUBLIC_API_URL is not set
+
+			const result = configModule.getApiBaseUrl();
+
+			expect(result).toBe('http://php:8000/api');
+		});
+	});
+
+	// ==========================================================================
+	// getCurrentTenant
+	// ==========================================================================
+	describe('getCurrentTenant', () => {
+		it('should return null when not in browser', () => {
+			mockBrowser = false;
+
+			const result = configModule.getCurrentTenant();
+
+			expect(result).toBeNull();
+		});
+
+		it('should extract subdomain correctly from hostname', () => {
+			mockBrowser = true;
+			mockEnv['PUBLIC_BASE_DOMAIN'] = 'classeo.local';
+
+			// Override window.location.hostname for this test
+			// jsdom default is "localhost" which won't match "classeo.local"
+			// We need to use Object.defineProperty since location is readonly
+			const originalHostname = window.location.hostname;
+			Object.defineProperty(window, 'location', {
+				value: { ...window.location, hostname: 'ecole-alpha.classeo.local' },
+				writable: true
+			});
+
+			const result = configModule.getCurrentTenant();
+
+			expect(result).toBe('ecole-alpha');
+
+			// Restore
+			Object.defineProperty(window, 'location', {
+				value: { ...window.location, hostname: originalHostname },
+				writable: true
+			});
+		});
+
+		it('should return null for www subdomain', () => {
+			mockBrowser = true;
+			mockEnv['PUBLIC_BASE_DOMAIN'] = 'classeo.fr';
+
+			Object.defineProperty(window, 'location', {
+				value: { ...window.location, hostname: 'www.classeo.fr' },
+				writable: true
+			});
+
+			const result = configModule.getCurrentTenant();
+
+			expect(result).toBeNull();
+
+			// Restore
+			Object.defineProperty(window, 'location', {
+				value: { ...window.location, hostname: 'localhost' },
+				writable: true
+			});
+		});
+
+		it('should return null when hostname does not match base domain', () => {
+			mockBrowser = true;
+			mockEnv['PUBLIC_BASE_DOMAIN'] = 'classeo.fr';
+
+			Object.defineProperty(window, 'location', {
+				value: { ...window.location, hostname: 'other-domain.com' },
+				writable: true
+			});
+
+			const result = configModule.getCurrentTenant();
+
+			expect(result).toBeNull();
+
+			// Restore
+			Object.defineProperty(window, 'location', {
+				value: { ...window.location, hostname: 'localhost' },
+				writable: true
+			});
+		});
+	});
+});
--- a/frontend/tests/unit/lib/constants/schoolLevels.test.ts
+++ b/frontend/tests/unit/lib/constants/schoolLevels.test.ts
@@ -0,0 +1,129 @@
+import { describe, it, expect } from 'vitest';
+import { SCHOOL_LEVELS, SCHOOL_LEVEL_OPTIONS } from '$lib/constants/schoolLevels';
+import type { SchoolLevel } from '$lib/constants/schoolLevels';
+
+/**
+ * Unit tests for the school levels constants (schoolLevels.ts).
+ *
+ * Verifies the complete list of levels matches the Education Nationale
+ * reference, the correct ordering from CP to Terminale, and the
+ * SCHOOL_LEVEL_OPTIONS formatting for select/dropdown components.
+ */
+
+describe('schoolLevels constants', () => {
+	// ==========================================================================
+	// SCHOOL_LEVELS
+	// ==========================================================================
+	describe('SCHOOL_LEVELS', () => {
+		it('should contain exactly 12 levels', () => {
+			expect(SCHOOL_LEVELS).toHaveLength(12);
+		});
+
+		it('should contain all primary school levels (CP to CM2)', () => {
+			expect(SCHOOL_LEVELS).toContain('CP');
+			expect(SCHOOL_LEVELS).toContain('CE1');
+			expect(SCHOOL_LEVELS).toContain('CE2');
+			expect(SCHOOL_LEVELS).toContain('CM1');
+			expect(SCHOOL_LEVELS).toContain('CM2');
+		});
+
+		it('should contain all college levels (6eme to 3eme)', () => {
+			expect(SCHOOL_LEVELS).toContain('6ème');
+			expect(SCHOOL_LEVELS).toContain('5ème');
+			expect(SCHOOL_LEVELS).toContain('4ème');
+			expect(SCHOOL_LEVELS).toContain('3ème');
+		});
+
+		it('should contain all lycee levels (2nde, 1ere, Terminale)', () => {
+			expect(SCHOOL_LEVELS).toContain('2nde');
+			expect(SCHOOL_LEVELS).toContain('1ère');
+			expect(SCHOOL_LEVELS).toContain('Terminale');
+		});
+
+		it('should be ordered from CP to Terminale', () => {
+			const expectedOrder = [
+				'CP',
+				'CE1',
+				'CE2',
+				'CM1',
+				'CM2',
+				'6ème',
+				'5ème',
+				'4ème',
+				'3ème',
+				'2nde',
+				'1ère',
+				'Terminale'
+			];
+			expect([...SCHOOL_LEVELS]).toEqual(expectedOrder);
+		});
+
+		it('should be a readonly array (as const)', () => {
+			// TypeScript ensures this at compile time, but we verify the runtime
+			// values are stable by checking identity
+			const firstRead = SCHOOL_LEVELS[0];
+			const secondRead = SCHOOL_LEVELS[0];
+			expect(firstRead).toBe(secondRead);
+			expect(firstRead).toBe('CP');
+		});
+	});
+
+	// ==========================================================================
+	// SchoolLevel type (compile-time check via runtime usage)
+	// ==========================================================================
+	describe('SchoolLevel type', () => {
+		it('should accept valid school level values', () => {
+			// This is a compile-time check expressed as a runtime test
+			const level: SchoolLevel = 'CP';
+			expect(level).toBe('CP');
+
+			const another: SchoolLevel = 'Terminale';
+			expect(another).toBe('Terminale');
+		});
+	});
+
+	// ==========================================================================
+	// SCHOOL_LEVEL_OPTIONS
+	// ==========================================================================
+	describe('SCHOOL_LEVEL_OPTIONS', () => {
+		it('should have the same number of options as SCHOOL_LEVELS', () => {
+			expect(SCHOOL_LEVEL_OPTIONS).toHaveLength(SCHOOL_LEVELS.length);
+		});
+
+		it('should have value and label properties for each option', () => {
+			for (const option of SCHOOL_LEVEL_OPTIONS) {
+				expect(option).toHaveProperty('value');
+				expect(option).toHaveProperty('label');
+			}
+		});
+
+		it('should use the level as both value and label', () => {
+			for (let i = 0; i < SCHOOL_LEVELS.length; i++) {
+				expect(SCHOOL_LEVEL_OPTIONS[i]!.value).toBe(SCHOOL_LEVELS[i]);
+				expect(SCHOOL_LEVEL_OPTIONS[i]!.label).toBe(SCHOOL_LEVELS[i]);
+			}
+		});
+
+		it('should format first option correctly (CP)', () => {
+			expect(SCHOOL_LEVEL_OPTIONS[0]).toEqual({ value: 'CP', label: 'CP' });
+		});
+
+		it('should format last option correctly (Terminale)', () => {
+			const last = SCHOOL_LEVEL_OPTIONS[SCHOOL_LEVEL_OPTIONS.length - 1];
+			expect(last).toEqual({ value: 'Terminale', label: 'Terminale' });
+		});
+
+		it('should format accented levels correctly', () => {
+			const sixieme = SCHOOL_LEVEL_OPTIONS.find((opt) => opt.value === '6ème');
+			expect(sixieme).toEqual({ value: '6ème', label: '6ème' });
+
+			const premiere = SCHOOL_LEVEL_OPTIONS.find((opt) => opt.value === '1ère');
+			expect(premiere).toEqual({ value: '1ère', label: '1ère' });
+		});
+
+		it('should preserve the order from SCHOOL_LEVELS', () => {
+			const optionValues = SCHOOL_LEVEL_OPTIONS.map((opt) => opt.value);
+			expect(optionValues).toEqual([...SCHOOL_LEVELS]);
+		});
+	});
+});
--- a/frontend/tests/unit/lib/features/roles/api/roles.test.ts
+++ b/frontend/tests/unit/lib/features/roles/api/roles.test.ts
@@ -0,0 +1,178 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+/**
+ * Unit tests for the roles API module.
+ *
+ * Tests getMyRoles(), switchRole(), and updateUserRoles() which all rely on
+ * authenticatedFetch from $lib/auth and getApiBaseUrl from $lib/api.
+ */
+
+// Mock $lib/api
+vi.mock('$lib/api', () => ({
+	getApiBaseUrl: () => 'http://test.classeo.local:18000/api'
+}));
+
+// Mock $lib/auth - authenticatedFetch is the primary dependency
+const mockAuthenticatedFetch = vi.fn();
+vi.mock('$lib/auth', () => ({
+	authenticatedFetch: (...args: unknown[]) => mockAuthenticatedFetch(...args)
+}));
+
+import { getMyRoles, switchRole, updateUserRoles } from '$lib/features/roles/api/roles';
+
+describe('roles API', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	// ==========================================================================
+	// getMyRoles
+	// ==========================================================================
+	describe('getMyRoles', () => {
+		it('should return roles array and activeRole on success', async () => {
+			const mockResponse = {
+				roles: [
+					{ value: 'ROLE_ADMIN', label: 'Administrateur' },
+					{ value: 'ROLE_TEACHER', label: 'Enseignant' }
+				],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Administrateur'
+			};
+
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: true,
+				json: () => Promise.resolve(mockResponse)
+			});
+
+			const result = await getMyRoles();
+
+			expect(mockAuthenticatedFetch).toHaveBeenCalledWith(
+				'http://test.classeo.local:18000/api/me/roles'
+			);
+			expect(result.roles).toHaveLength(2);
+			expect(result.roles[0]).toEqual({ value: 'ROLE_ADMIN', label: 'Administrateur' });
+			expect(result.activeRole).toBe('ROLE_ADMIN');
+			expect(result.activeRoleLabel).toBe('Administrateur');
+		});
+
+		it('should throw Error when the API response is not ok', async () => {
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: false,
+				status: 500
+			});
+
+			await expect(getMyRoles()).rejects.toThrow('Failed to fetch roles');
+		});
+	});
+
+	// ==========================================================================
+	// switchRole
+	// ==========================================================================
+	describe('switchRole', () => {
+		it('should return new activeRole on success', async () => {
+			const mockResponse = {
+				activeRole: 'ROLE_TEACHER',
+				activeRoleLabel: 'Enseignant'
+			};
+
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: true,
+				json: () => Promise.resolve(mockResponse)
+			});
+
+			const result = await switchRole('ROLE_TEACHER');
+
+			expect(mockAuthenticatedFetch).toHaveBeenCalledWith(
+				'http://test.classeo.local:18000/api/me/switch-role',
+				expect.objectContaining({
+					method: 'POST',
+					headers: { 'Content-Type': 'application/json' },
+					body: JSON.stringify({ role: 'ROLE_TEACHER' })
+				})
+			);
+			expect(result.activeRole).toBe('ROLE_TEACHER');
+			expect(result.activeRoleLabel).toBe('Enseignant');
+		});
+
+		it('should throw Error when the API response is not ok', async () => {
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: false,
+				status: 400
+			});
+
+			await expect(switchRole('ROLE_INVALID')).rejects.toThrow('Failed to switch role');
+		});
+	});
+
+	// ==========================================================================
+	// updateUserRoles
+	// ==========================================================================
+	describe('updateUserRoles', () => {
+		it('should complete without error on 2xx success', async () => {
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: true,
+				status: 204
+			});
+
+			// Should resolve without throwing
+			await expect(
+				updateUserRoles('user-uuid-123', ['ROLE_ADMIN', 'ROLE_TEACHER'])
+			).resolves.toBeUndefined();
+
+			expect(mockAuthenticatedFetch).toHaveBeenCalledWith(
+				'http://test.classeo.local:18000/api/users/user-uuid-123/roles',
+				expect.objectContaining({
+					method: 'PUT',
+					headers: { 'Content-Type': 'application/json' },
+					body: JSON.stringify({ roles: ['ROLE_ADMIN', 'ROLE_TEACHER'] })
+				})
+			);
+		});
+
+		it('should throw with hydra:description when present in error response', async () => {
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: false,
+				status: 422,
+				json: () =>
+					Promise.resolve({
+						'hydra:description': 'Le rôle ROLE_INVALID est inconnu.'
+					})
+			});
+
+			await expect(
+				updateUserRoles('user-uuid-123', ['ROLE_INVALID'])
+			).rejects.toThrow('Le rôle ROLE_INVALID est inconnu.');
+		});
+
+		it('should throw with detail when present in error response', async () => {
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: false,
+				status: 403,
+				json: () =>
+					Promise.resolve({
+						detail: 'Accès refusé.'
+					})
+			});
+
+			await expect(
+				updateUserRoles('user-uuid-123', ['ROLE_ADMIN'])
+			).rejects.toThrow('Accès refusé.');
+		});
+
+		it('should throw generic message when error body is not valid JSON', async () => {
+			mockAuthenticatedFetch.mockResolvedValueOnce({
+				ok: false,
+				status: 500,
+				json: () => Promise.reject(new Error('Unexpected token'))
+			});
+
+			await expect(
+				updateUserRoles('user-uuid-123', ['ROLE_ADMIN'])
+			).rejects.toThrow('Erreur lors de la mise à jour des rôles (500)');
+		});
+	});
+});
--- a/frontend/tests/unit/lib/features/roles/roleContext.test.ts
+++ b/frontend/tests/unit/lib/features/roles/roleContext.test.ts
@@ -0,0 +1,351 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+/**
+ * Unit tests for the role context (roleContext.svelte.ts).
+ *
+ * This module uses Svelte 5 $state runes for reactive state management.
+ * We test it through its public exported API and mock the underlying
+ * roles API module to isolate the context logic.
+ */
+
+// Mock the roles API module
+const mockGetMyRoles = vi.fn();
+const mockSwitchRole = vi.fn();
+vi.mock('$lib/features/roles/api/roles', () => ({
+	getMyRoles: (...args: unknown[]) => mockGetMyRoles(...args),
+	switchRole: (...args: unknown[]) => mockSwitchRole(...args)
+}));
+
+describe('roleContext', () => {
+	let roleContext: typeof import('$lib/features/roles/roleContext.svelte');
+
+	beforeEach(async () => {
+		vi.clearAllMocks();
+
+		// Fresh import to reset $state between tests
+		vi.resetModules();
+		roleContext = await import('$lib/features/roles/roleContext.svelte');
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	// ==========================================================================
+	// Initial state
+	// ==========================================================================
+	describe('initial state', () => {
+		it('should have no roles initially', () => {
+			expect(roleContext.getRoles()).toEqual([]);
+		});
+
+		it('should have null activeRole initially', () => {
+			expect(roleContext.getActiveRole()).toBeNull();
+		});
+
+		it('should have null activeRoleLabel initially', () => {
+			expect(roleContext.getActiveRoleLabel()).toBeNull();
+		});
+
+		it('should not be loading initially', () => {
+			expect(roleContext.getIsLoading()).toBe(false);
+		});
+
+		it('should not be switching initially', () => {
+			expect(roleContext.getIsSwitching()).toBe(false);
+		});
+
+		it('should not have multiple roles initially', () => {
+			expect(roleContext.hasMultipleRoles()).toBe(false);
+		});
+	});
+
+	// ==========================================================================
+	// fetchRoles
+	// ==========================================================================
+	describe('fetchRoles', () => {
+		it('should load roles from API and set state', async () => {
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [
+					{ value: 'ROLE_ADMIN', label: 'Administrateur' },
+					{ value: 'ROLE_TEACHER', label: 'Enseignant' }
+				],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Administrateur'
+			});
+
+			await roleContext.fetchRoles();
+
+			expect(mockGetMyRoles).toHaveBeenCalledOnce();
+			expect(roleContext.getRoles()).toHaveLength(2);
+			expect(roleContext.getActiveRole()).toBe('ROLE_ADMIN');
+			expect(roleContext.getActiveRoleLabel()).toBe('Administrateur');
+			expect(roleContext.getIsLoading()).toBe(false);
+		});
+
+		it('should guard against double loading (isFetched)', async () => {
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [{ value: 'ROLE_ADMIN', label: 'Admin' }],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+
+			// First call loads data
+			await roleContext.fetchRoles();
+			expect(mockGetMyRoles).toHaveBeenCalledOnce();
+
+			// Second call should be a no-op due to isFetched guard
+			await roleContext.fetchRoles();
+			expect(mockGetMyRoles).toHaveBeenCalledOnce();
+		});
+
+		it('should handle API errors gracefully without throwing', async () => {
+			const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+			mockGetMyRoles.mockRejectedValueOnce(new Error('Network error'));
+
+			// Should not throw
+			await roleContext.fetchRoles();
+
+			expect(consoleSpy).toHaveBeenCalledWith(
+				'[roleContext] Failed to fetch roles:',
+				expect.any(Error)
+			);
+			// State should remain empty
+			expect(roleContext.getRoles()).toEqual([]);
+			expect(roleContext.getActiveRole()).toBeNull();
+			expect(roleContext.getIsLoading()).toBe(false);
+
+			consoleSpy.mockRestore();
+		});
+	});
+
+	// ==========================================================================
+	// switchTo
+	// ==========================================================================
+	describe('switchTo', () => {
+		it('should return true immediately when switching to same role', async () => {
+			// First, load roles so activeRole is set
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [{ value: 'ROLE_ADMIN', label: 'Admin' }],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+
+			// Switch to the same role
+			const result = await roleContext.switchTo('ROLE_ADMIN');
+
+			expect(result).toBe(true);
+			// API should NOT be called for same-role switch
+			expect(mockSwitchRole).not.toHaveBeenCalled();
+		});
+
+		it('should call API and update state when switching to different role', async () => {
+			// Load initial roles
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [
+					{ value: 'ROLE_ADMIN', label: 'Admin' },
+					{ value: 'ROLE_TEACHER', label: 'Enseignant' }
+				],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+
+			// Switch to a different role
+			mockSwitchRole.mockResolvedValueOnce({
+				activeRole: 'ROLE_TEACHER',
+				activeRoleLabel: 'Enseignant'
+			});
+
+			const result = await roleContext.switchTo('ROLE_TEACHER');
+
+			expect(result).toBe(true);
+			expect(mockSwitchRole).toHaveBeenCalledWith('ROLE_TEACHER');
+			expect(roleContext.getActiveRole()).toBe('ROLE_TEACHER');
+			expect(roleContext.getActiveRoleLabel()).toBe('Enseignant');
+			expect(roleContext.getIsSwitching()).toBe(false);
+		});
+
+		it('should return false when the API call fails', async () => {
+			const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+			// Load initial roles
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [
+					{ value: 'ROLE_ADMIN', label: 'Admin' },
+					{ value: 'ROLE_TEACHER', label: 'Enseignant' }
+				],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+
+			// Switch fails
+			mockSwitchRole.mockRejectedValueOnce(new Error('Server error'));
+
+			const result = await roleContext.switchTo('ROLE_TEACHER');
+
+			expect(result).toBe(false);
+			expect(roleContext.getActiveRole()).toBe('ROLE_ADMIN'); // unchanged
+			expect(roleContext.getIsSwitching()).toBe(false);
+
+			consoleSpy.mockRestore();
+		});
+	});
+
+	// ==========================================================================
+	// hasMultipleRoles
+	// ==========================================================================
+	describe('hasMultipleRoles', () => {
+		it('should return true when user has more than one role', async () => {
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [
+					{ value: 'ROLE_ADMIN', label: 'Admin' },
+					{ value: 'ROLE_TEACHER', label: 'Enseignant' }
+				],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+
+			expect(roleContext.hasMultipleRoles()).toBe(true);
+		});
+
+		it('should return false when user has zero roles', () => {
+			// No fetch, so roles is empty
+			expect(roleContext.hasMultipleRoles()).toBe(false);
+		});
+
+		it('should return false when user has exactly one role', async () => {
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [{ value: 'ROLE_ADMIN', label: 'Admin' }],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+
+			expect(roleContext.hasMultipleRoles()).toBe(false);
+		});
+	});
+
+	// ==========================================================================
+	// resetRoleContext
+	// ==========================================================================
+	describe('resetRoleContext', () => {
+		it('should clear all state back to initial values', async () => {
+			// Load some data first
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [
+					{ value: 'ROLE_ADMIN', label: 'Admin' },
+					{ value: 'ROLE_TEACHER', label: 'Enseignant' }
+				],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+
+			// Verify state is set
+			expect(roleContext.getRoles()).toHaveLength(2);
+			expect(roleContext.getActiveRole()).toBe('ROLE_ADMIN');
+
+			// Reset
+			roleContext.resetRoleContext();
+
+			expect(roleContext.getRoles()).toEqual([]);
+			expect(roleContext.getActiveRole()).toBeNull();
+			expect(roleContext.getActiveRoleLabel()).toBeNull();
+			expect(roleContext.hasMultipleRoles()).toBe(false);
+		});
+
+		it('should allow fetchRoles to be called again after reset', async () => {
+			// Load initial data
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [{ value: 'ROLE_ADMIN', label: 'Admin' }],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+			expect(mockGetMyRoles).toHaveBeenCalledOnce();
+
+			// Reset clears isFetched
+			roleContext.resetRoleContext();
+
+			// Now fetchRoles should call the API again
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [{ value: 'ROLE_TEACHER', label: 'Enseignant' }],
+				activeRole: 'ROLE_TEACHER',
+				activeRoleLabel: 'Enseignant'
+			});
+			await roleContext.fetchRoles();
+
+			expect(mockGetMyRoles).toHaveBeenCalledTimes(2);
+			expect(roleContext.getActiveRole()).toBe('ROLE_TEACHER');
+		});
+	});
+
+	// ==========================================================================
+	// getIsLoading / getIsSwitching
+	// ==========================================================================
+	describe('loading and switching state', () => {
+		it('should set isLoading to true during fetchRoles and false after', async () => {
+			// Use a deferred promise to control resolution timing
+			let resolvePromise: (value: unknown) => void;
+			const pendingPromise = new Promise((resolve) => {
+				resolvePromise = resolve;
+			});
+			mockGetMyRoles.mockReturnValueOnce(pendingPromise);
+
+			const fetchPromise = roleContext.fetchRoles();
+
+			// While the API call is pending, isLoading should be true
+			expect(roleContext.getIsLoading()).toBe(true);
+
+			// Resolve the API call
+			resolvePromise!({
+				roles: [{ value: 'ROLE_ADMIN', label: 'Admin' }],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+
+			await fetchPromise;
+
+			expect(roleContext.getIsLoading()).toBe(false);
+		});
+
+		it('should set isSwitching to true during switchTo and false after', async () => {
+			// Load roles first so activeRole is set
+			mockGetMyRoles.mockResolvedValueOnce({
+				roles: [
+					{ value: 'ROLE_ADMIN', label: 'Admin' },
+					{ value: 'ROLE_TEACHER', label: 'Enseignant' }
+				],
+				activeRole: 'ROLE_ADMIN',
+				activeRoleLabel: 'Admin'
+			});
+			await roleContext.fetchRoles();
+
+			// Use a deferred promise for switch
+			let resolvePromise: (value: unknown) => void;
+			const pendingPromise = new Promise((resolve) => {
+				resolvePromise = resolve;
+			});
+			mockSwitchRole.mockReturnValueOnce(pendingPromise);
+
+			const switchPromise = roleContext.switchTo('ROLE_TEACHER');
+
+			// While switching, isSwitching should be true
+			expect(roleContext.getIsSwitching()).toBe(true);
+
+			// Resolve
+			resolvePromise!({
+				activeRole: 'ROLE_TEACHER',
+				activeRoleLabel: 'Enseignant'
+			});
+
+			await switchPromise;
+
+			expect(roleContext.getIsSwitching()).toBe(false);
+		});
+	});
+});
--- a/frontend/tests/unit/lib/monitoring/sentry.test.ts
+++ b/frontend/tests/unit/lib/monitoring/sentry.test.ts
@@ -0,0 +1,389 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+/**
+ * Unit tests for the Sentry/GlitchTip monitoring module (sentry.ts).
+ *
+ * Tests initialization, user context management, error capture, and
+ * breadcrumb recording. Verifies RGPD compliance: no PII is sent to
+ * GlitchTip (Authorization, Cookie headers are scrubbed, emails are
+ * redacted from breadcrumbs).
+ */
+
+// Mock @sentry/sveltekit before importing the module
+const mockInit = vi.fn();
+const mockSetUser = vi.fn();
+const mockSetTag = vi.fn();
+const mockCaptureException = vi.fn();
+const mockAddBreadcrumb = vi.fn();
+
+vi.mock('@sentry/sveltekit', () => ({
+	init: mockInit,
+	setUser: mockSetUser,
+	setTag: mockSetTag,
+	captureException: mockCaptureException,
+	addBreadcrumb: mockAddBreadcrumb
+}));
+
+describe('sentry monitoring', () => {
+	let sentryModule: typeof import('$lib/monitoring/sentry');
+
+	beforeEach(async () => {
+		vi.clearAllMocks();
+		vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+		vi.resetModules();
+		sentryModule = await import('$lib/monitoring/sentry');
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	// ==========================================================================
+	// initSentry
+	// ==========================================================================
+	describe('initSentry', () => {
+		it('should call Sentry.init with correct configuration', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production'
+			});
+
+			expect(mockInit).toHaveBeenCalledOnce();
+			expect(mockInit).toHaveBeenCalledWith(
+				expect.objectContaining({
+					dsn: 'https://key@glitchtip.classeo.fr/1',
+					environment: 'production',
+					sampleRate: 1.0,
+					tracesSampleRate: 0.0,
+					sendDefaultPii: false
+				})
+			);
+		});
+
+		it('should not initialize Sentry when DSN is empty', () => {
+			sentryModule.initSentry({
+				dsn: '',
+				environment: 'test'
+			});
+
+			expect(mockInit).not.toHaveBeenCalled();
+			expect(console.warn).toHaveBeenCalledWith(
+				'[Sentry] DSN not configured, error tracking disabled'
+			);
+		});
+
+		it('should set user context when userId is provided', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production',
+				userId: 'user-abc-123'
+			});
+
+			expect(mockSetUser).toHaveBeenCalledWith({ id: 'user-abc-123' });
+		});
+
+		it('should not set user context when userId is not provided', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production'
+			});
+
+			expect(mockSetUser).not.toHaveBeenCalled();
+		});
+
+		it('should set tenant tag when tenantId is provided', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'staging',
+				tenantId: 'ecole-alpha'
+			});
+
+			expect(mockSetTag).toHaveBeenCalledWith('tenant_id', 'ecole-alpha');
+		});
+
+		it('should not set tenant tag when tenantId is not provided', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production'
+			});
+
+			expect(mockSetTag).not.toHaveBeenCalled();
+		});
+
+		it('should set both user and tenant when both are provided', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production',
+				userId: 'user-xyz',
+				tenantId: 'lycee-beta'
+			});
+
+			expect(mockSetUser).toHaveBeenCalledWith({ id: 'user-xyz' });
+			expect(mockSetTag).toHaveBeenCalledWith('tenant_id', 'lycee-beta');
+		});
+
+		it('should disable performance tracing (tracesSampleRate = 0)', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production'
+			});
+
+			expect(mockInit).toHaveBeenCalledWith(
+				expect.objectContaining({
+					tracesSampleRate: 0.0
+				})
+			);
+		});
+
+		it('should disable sendDefaultPii for RGPD compliance', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production'
+			});
+
+			expect(mockInit).toHaveBeenCalledWith(
+				expect.objectContaining({
+					sendDefaultPii: false
+				})
+			);
+		});
+
+		it('should configure ignoreErrors for common non-errors', () => {
+			sentryModule.initSentry({
+				dsn: 'https://key@glitchtip.classeo.fr/1',
+				environment: 'production'
+			});
+
+			const initConfig = mockInit.mock.calls[0]![0];
+			expect(initConfig.ignoreErrors).toEqual(
+				expect.arrayContaining([
+					'ResizeObserver loop',
+					'ResizeObserver loop limit exceeded',
+					'NetworkError',
+					'Failed to fetch',
+					'Load failed',
+					'AbortError'
+				])
+			);
+		});
+
+		// PII scrubbing via beforeSend
+		describe('beforeSend PII scrubbing', () => {
+			it('should remove Authorization header from event request', () => {
+				sentryModule.initSentry({
+					dsn: 'https://key@glitchtip.classeo.fr/1',
+					environment: 'production'
+				});
+
+				const beforeSend = mockInit.mock.calls[0]![0].beforeSend;
+				const event = {
+					request: {
+						headers: {
+							Authorization: 'Bearer secret-token',
+							'Content-Type': 'application/json'
+						}
+					}
+				};
+
+				const result = beforeSend(event);
+
+				expect(result.request.headers.Authorization).toBeUndefined();
+				expect(result.request.headers['Content-Type']).toBe('application/json');
+			});
+
+			it('should remove Cookie header from event request', () => {
+				sentryModule.initSentry({
+					dsn: 'https://key@glitchtip.classeo.fr/1',
+					environment: 'production'
+				});
+
+				const beforeSend = mockInit.mock.calls[0]![0].beforeSend;
+				const event = {
+					request: {
+						headers: {
+							Cookie: 'session=abc123',
+							Accept: 'text/html'
+						}
+					}
+				};
+
+				const result = beforeSend(event);
+
+				expect(result.request.headers.Cookie).toBeUndefined();
+				expect(result.request.headers.Accept).toBe('text/html');
+			});
+
+			it('should redact email-like strings from breadcrumb messages', () => {
+				sentryModule.initSentry({
+					dsn: 'https://key@glitchtip.classeo.fr/1',
+					environment: 'production'
+				});
+
+				const beforeSend = mockInit.mock.calls[0]![0].beforeSend;
+				const event = {
+					breadcrumbs: [
+						{ message: 'Login failed for user@example.com', category: 'auth' },
+						{ message: 'Page loaded', category: 'navigation' },
+						{ message: 'Error with admin@school.fr account', category: 'auth' }
+					]
+				};
+
+				const result = beforeSend(event);
+
+				expect(result.breadcrumbs[0].message).toBe('[EMAIL_REDACTED]');
+				expect(result.breadcrumbs[1].message).toBe('Page loaded');
+				expect(result.breadcrumbs[2].message).toBe('[EMAIL_REDACTED]');
+			});
+
+			it('should pass through events without request or breadcrumbs', () => {
+				sentryModule.initSentry({
+					dsn: 'https://key@glitchtip.classeo.fr/1',
+					environment: 'production'
+				});
+
+				const beforeSend = mockInit.mock.calls[0]![0].beforeSend;
+				const event = { message: 'Simple error' };
+
+				const result = beforeSend(event);
+
+				expect(result).toEqual({ message: 'Simple error' });
+			});
+
+			it('should handle event with request but no headers', () => {
+				sentryModule.initSentry({
+					dsn: 'https://key@glitchtip.classeo.fr/1',
+					environment: 'production'
+				});
+
+				const beforeSend = mockInit.mock.calls[0]![0].beforeSend;
+				const event = { request: { url: 'https://example.com' } };
+
+				const result = beforeSend(event);
+
+				expect(result).toEqual({ request: { url: 'https://example.com' } });
+			});
+
+			it('should handle breadcrumbs without message', () => {
+				sentryModule.initSentry({
+					dsn: 'https://key@glitchtip.classeo.fr/1',
+					environment: 'production'
+				});
+
+				const beforeSend = mockInit.mock.calls[0]![0].beforeSend;
+				const event = {
+					breadcrumbs: [
+						{ category: 'http', data: { url: '/api/test' } }
+					]
+				};
+
+				const result = beforeSend(event);
+
+				expect(result.breadcrumbs[0].category).toBe('http');
+			});
+		});
+	});
+
+	// ==========================================================================
+	// setUserContext
+	// ==========================================================================
+	describe('setUserContext', () => {
+		it('should set user with ID only (no PII)', () => {
+			sentryModule.setUserContext('user-abc-123');
+
+			expect(mockSetUser).toHaveBeenCalledWith({ id: 'user-abc-123' });
+		});
+
+		it('should set tenant tag when tenantId is provided', () => {
+			sentryModule.setUserContext('user-abc-123', 'ecole-alpha');
+
+			expect(mockSetUser).toHaveBeenCalledWith({ id: 'user-abc-123' });
+			expect(mockSetTag).toHaveBeenCalledWith('tenant_id', 'ecole-alpha');
+		});
+
+		it('should not set tenant tag when tenantId is not provided', () => {
+			sentryModule.setUserContext('user-abc-123');
+
+			expect(mockSetTag).not.toHaveBeenCalled();
+		});
+	});
+
+	// ==========================================================================
+	// clearUserContext
+	// ==========================================================================
+	describe('clearUserContext', () => {
+		it('should set user to null', () => {
+			sentryModule.clearUserContext();
+
+			expect(mockSetUser).toHaveBeenCalledWith(null);
+		});
+	});
+
+	// ==========================================================================
+	// captureError
+	// ==========================================================================
+	describe('captureError', () => {
+		it('should call Sentry.captureException with the error', () => {
+			const error = new Error('Something went wrong');
+
+			sentryModule.captureError(error);
+
+			expect(mockCaptureException).toHaveBeenCalledWith(error, undefined);
+		});
+
+		it('should pass extra context when provided', () => {
+			const error = new Error('API error');
+			const context = { endpoint: '/api/users', statusCode: 500 };
+
+			sentryModule.captureError(error, context);
+
+			expect(mockCaptureException).toHaveBeenCalledWith(error, {
+				extra: { endpoint: '/api/users', statusCode: 500 }
+			});
+		});
+
+		it('should handle non-Error objects', () => {
+			const errorString = 'string error';
+
+			sentryModule.captureError(errorString);
+
+			expect(mockCaptureException).toHaveBeenCalledWith(errorString, undefined);
+		});
+	});
+
+	// ==========================================================================
+	// addBreadcrumb
+	// ==========================================================================
+	describe('addBreadcrumb', () => {
+		it('should add breadcrumb with category and message', () => {
+			sentryModule.addBreadcrumb('navigation', 'User navigated to /dashboard');
+
+			expect(mockAddBreadcrumb).toHaveBeenCalledWith({
+				category: 'navigation',
+				message: 'User navigated to /dashboard',
+				level: 'info'
+			});
+		});
+
+		it('should include data when provided', () => {
+			sentryModule.addBreadcrumb('api', 'API call', {
+				url: '/api/students',
+				method: 'GET'
+			});
+
+			expect(mockAddBreadcrumb).toHaveBeenCalledWith({
+				category: 'api',
+				message: 'API call',
+				level: 'info',
+				data: { url: '/api/students', method: 'GET' }
+			});
+		});
+
+		it('should not include data key when data is not provided', () => {
+			sentryModule.addBreadcrumb('ui', 'Button clicked');
+
+			const call = mockAddBreadcrumb.mock.calls[0]![0];
+			expect(call).not.toHaveProperty('data');
+		});
+	});
+});
--- a/frontend/tests/unit/lib/monitoring/webVitals.test.ts
+++ b/frontend/tests/unit/lib/monitoring/webVitals.test.ts
@@ -0,0 +1,476 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+/**
+ * Unit tests for the Web Vitals monitoring module (webVitals.ts).
+ *
+ * Tests metric collection initialization, rating calculations against
+ * Core Web Vitals 2024 thresholds, and the default reporter behavior
+ * (console logging in debug mode, sendBeacon/fetch in production).
+ */
+
+// Capture the callbacks registered by initWebVitals
+const mockOnLCP = vi.fn();
+const mockOnCLS = vi.fn();
+const mockOnINP = vi.fn();
+const mockOnFCP = vi.fn();
+const mockOnTTFB = vi.fn();
+
+vi.mock('web-vitals', () => ({
+	onLCP: mockOnLCP,
+	onCLS: mockOnCLS,
+	onINP: mockOnINP,
+	onFCP: mockOnFCP,
+	onTTFB: mockOnTTFB
+}));
+
+describe('webVitals monitoring', () => {
+	let webVitalsModule: typeof import('$lib/monitoring/webVitals');
+
+	beforeEach(async () => {
+		vi.clearAllMocks();
+		vi.spyOn(console, 'log').mockImplementation(() => {});
+
+		vi.resetModules();
+		webVitalsModule = await import('$lib/monitoring/webVitals');
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	// ==========================================================================
+	// initWebVitals
+	// ==========================================================================
+	describe('initWebVitals', () => {
+		it('should register callbacks for all five web vitals', () => {
+			const reporter = vi.fn();
+
+			webVitalsModule.initWebVitals(reporter);
+
+			expect(mockOnLCP).toHaveBeenCalledOnce();
+			expect(mockOnCLS).toHaveBeenCalledOnce();
+			expect(mockOnINP).toHaveBeenCalledOnce();
+			expect(mockOnFCP).toHaveBeenCalledOnce();
+			expect(mockOnTTFB).toHaveBeenCalledOnce();
+		});
+
+		it('should pass metrics to the reporter when LCP fires', () => {
+			const reporter = vi.fn();
+			webVitalsModule.initWebVitals(reporter);
+
+			// Simulate LCP metric firing
+			const lcpCallback = mockOnLCP.mock.calls[0]![0];
+			lcpCallback({ name: 'LCP', value: 2000, delta: 2000, id: 'v1-lcp' });
+
+			expect(reporter).toHaveBeenCalledOnce();
+			expect(reporter).toHaveBeenCalledWith(
+				expect.objectContaining({
+					name: 'LCP',
+					value: 2000,
+					rating: 'good',
+					delta: 2000,
+					id: 'v1-lcp'
+				})
+			);
+		});
+
+		it('should pass metrics to the reporter when CLS fires', () => {
+			const reporter = vi.fn();
+			webVitalsModule.initWebVitals(reporter);
+
+			const clsCallback = mockOnCLS.mock.calls[0]![0];
+			clsCallback({ name: 'CLS', value: 0.05, delta: 0.05, id: 'v1-cls' });
+
+			expect(reporter).toHaveBeenCalledWith(
+				expect.objectContaining({
+					name: 'CLS',
+					value: 0.05,
+					rating: 'good',
+					delta: 0.05,
+					id: 'v1-cls'
+				})
+			);
+		});
+
+		it('should pass metrics to the reporter when INP fires', () => {
+			const reporter = vi.fn();
+			webVitalsModule.initWebVitals(reporter);
+
+			const inpCallback = mockOnINP.mock.calls[0]![0];
+			inpCallback({ name: 'INP', value: 150, delta: 150, id: 'v1-inp' });
+
+			expect(reporter).toHaveBeenCalledWith(
+				expect.objectContaining({
+					name: 'INP',
+					value: 150,
+					rating: 'good'
+				})
+			);
+		});
+
+		it('should pass metrics to the reporter when FCP fires', () => {
+			const reporter = vi.fn();
+			webVitalsModule.initWebVitals(reporter);
+
+			const fcpCallback = mockOnFCP.mock.calls[0]![0];
+			fcpCallback({ name: 'FCP', value: 1500, delta: 1500, id: 'v1-fcp' });
+
+			expect(reporter).toHaveBeenCalledWith(
+				expect.objectContaining({
+					name: 'FCP',
+					value: 1500,
+					rating: 'good'
+				})
+			);
+		});
+
+		it('should pass metrics to the reporter when TTFB fires', () => {
+			const reporter = vi.fn();
+			webVitalsModule.initWebVitals(reporter);
+
+			const ttfbCallback = mockOnTTFB.mock.calls[0]![0];
+			ttfbCallback({ name: 'TTFB', value: 600, delta: 600, id: 'v1-ttfb' });
+
+			expect(reporter).toHaveBeenCalledWith(
+				expect.objectContaining({
+					name: 'TTFB',
+					value: 600,
+					rating: 'good'
+				})
+			);
+		});
+	});
+
+	// ==========================================================================
+	// Rating calculations (via initWebVitals callback pipeline)
+	// ==========================================================================
+	describe('rating calculations', () => {
+		// LCP thresholds: good <= 2500, needs-improvement <= 4000, poor > 4000
+		describe('LCP ratings', () => {
+			it('should rate LCP as good when value <= 2500', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const lcpCallback = mockOnLCP.mock.calls[0]![0];
+				lcpCallback({ name: 'LCP', value: 2500, delta: 2500, id: 'lcp-1' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('good');
+			});
+
+			it('should rate LCP as needs-improvement when 2500 < value <= 4000', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const lcpCallback = mockOnLCP.mock.calls[0]![0];
+				lcpCallback({ name: 'LCP', value: 3000, delta: 3000, id: 'lcp-2' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('needs-improvement');
+			});
+
+			it('should rate LCP as poor when value > 4000', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const lcpCallback = mockOnLCP.mock.calls[0]![0];
+				lcpCallback({ name: 'LCP', value: 5000, delta: 5000, id: 'lcp-3' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('poor');
+			});
+		});
+
+		// FCP thresholds: good <= 1800, needs-improvement <= 3000, poor > 3000
+		describe('FCP ratings', () => {
+			it('should rate FCP as good when value <= 1800', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const fcpCallback = mockOnFCP.mock.calls[0]![0];
+				fcpCallback({ name: 'FCP', value: 1800, delta: 1800, id: 'fcp-1' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('good');
+			});
+
+			it('should rate FCP as needs-improvement when 1800 < value <= 3000', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const fcpCallback = mockOnFCP.mock.calls[0]![0];
+				fcpCallback({ name: 'FCP', value: 2500, delta: 2500, id: 'fcp-2' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('needs-improvement');
+			});
+
+			it('should rate FCP as poor when value > 3000', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const fcpCallback = mockOnFCP.mock.calls[0]![0];
+				fcpCallback({ name: 'FCP', value: 4000, delta: 4000, id: 'fcp-3' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('poor');
+			});
+		});
+
+		// INP thresholds: good <= 200, needs-improvement <= 500, poor > 500
+		describe('INP ratings', () => {
+			it('should rate INP as good when value <= 200', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const inpCallback = mockOnINP.mock.calls[0]![0];
+				inpCallback({ name: 'INP', value: 200, delta: 200, id: 'inp-1' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('good');
+			});
+
+			it('should rate INP as needs-improvement when 200 < value <= 500', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const inpCallback = mockOnINP.mock.calls[0]![0];
+				inpCallback({ name: 'INP', value: 350, delta: 350, id: 'inp-2' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('needs-improvement');
+			});
+
+			it('should rate INP as poor when value > 500', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const inpCallback = mockOnINP.mock.calls[0]![0];
+				inpCallback({ name: 'INP', value: 600, delta: 600, id: 'inp-3' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('poor');
+			});
+		});
+
+		// CLS thresholds: good <= 0.1, needs-improvement <= 0.25, poor > 0.25
+		describe('CLS ratings', () => {
+			it('should rate CLS as good when value <= 0.1', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const clsCallback = mockOnCLS.mock.calls[0]![0];
+				clsCallback({ name: 'CLS', value: 0.1, delta: 0.1, id: 'cls-1' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('good');
+			});
+
+			it('should rate CLS as needs-improvement when 0.1 < value <= 0.25', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const clsCallback = mockOnCLS.mock.calls[0]![0];
+				clsCallback({ name: 'CLS', value: 0.15, delta: 0.15, id: 'cls-2' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('needs-improvement');
+			});
+
+			it('should rate CLS as poor when value > 0.25', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const clsCallback = mockOnCLS.mock.calls[0]![0];
+				clsCallback({ name: 'CLS', value: 0.5, delta: 0.5, id: 'cls-3' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('poor');
+			});
+		});
+
+		// TTFB thresholds: good <= 800, needs-improvement <= 1800, poor > 1800
+		describe('TTFB ratings', () => {
+			it('should rate TTFB as good when value <= 800', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const ttfbCallback = mockOnTTFB.mock.calls[0]![0];
+				ttfbCallback({ name: 'TTFB', value: 800, delta: 800, id: 'ttfb-1' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('good');
+			});
+
+			it('should rate TTFB as needs-improvement when 800 < value <= 1800', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const ttfbCallback = mockOnTTFB.mock.calls[0]![0];
+				ttfbCallback({ name: 'TTFB', value: 1200, delta: 1200, id: 'ttfb-2' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('needs-improvement');
+			});
+
+			it('should rate TTFB as poor when value > 1800', () => {
+				const reporter = vi.fn();
+				webVitalsModule.initWebVitals(reporter);
+
+				const ttfbCallback = mockOnTTFB.mock.calls[0]![0];
+				ttfbCallback({ name: 'TTFB', value: 2500, delta: 2500, id: 'ttfb-3' });
+
+				expect(reporter.mock.calls[0]![0].rating).toBe('poor');
+			});
+		});
+	});
+
+	// ==========================================================================
+	// createDefaultReporter
+	// ==========================================================================
+	describe('createDefaultReporter', () => {
+		it('should return a function', () => {
+			const reporter = webVitalsModule.createDefaultReporter({});
+
+			expect(typeof reporter).toBe('function');
+		});
+
+		it('should log to console when debug is true', () => {
+			const reporter = webVitalsModule.createDefaultReporter({ debug: true });
+
+			reporter({
+				name: 'LCP',
+				value: 2100.5,
+				rating: 'good',
+				delta: 2100.5,
+				id: 'v1-lcp'
+			});
+
+			expect(console.log).toHaveBeenCalledWith(
+				'[WebVitals] LCP: 2100.50 (good)'
+			);
+		});
+
+		it('should not log to console when debug is false', () => {
+			const reporter = webVitalsModule.createDefaultReporter({ debug: false });
+
+			reporter({
+				name: 'LCP',
+				value: 2100,
+				rating: 'good',
+				delta: 2100,
+				id: 'v1-lcp'
+			});
+
+			expect(console.log).not.toHaveBeenCalled();
+		});
+
+		it('should not log to console when debug is not set', () => {
+			const reporter = webVitalsModule.createDefaultReporter({});
+
+			reporter({
+				name: 'FCP',
+				value: 1500,
+				rating: 'good',
+				delta: 1500,
+				id: 'v1-fcp'
+			});
+
+			expect(console.log).not.toHaveBeenCalled();
+		});
+
+		it('should use sendBeacon when endpoint is set and sendBeacon is available', () => {
+			const mockSendBeacon = vi.fn().mockReturnValue(true);
+			vi.stubGlobal('navigator', { sendBeacon: mockSendBeacon });
+
+			const reporter = webVitalsModule.createDefaultReporter({
+				endpoint: 'https://analytics.classeo.fr/vitals'
+			});
+
+			const metric = {
+				name: 'CLS' as const,
+				value: 0.05,
+				rating: 'good' as const,
+				delta: 0.05,
+				id: 'v1-cls'
+			};
+
+			reporter(metric);
+
+			expect(mockSendBeacon).toHaveBeenCalledWith(
+				'https://analytics.classeo.fr/vitals',
+				expect.any(String)
+			);
+
+			// Verify the payload structure
+			const payload = JSON.parse(mockSendBeacon.mock.calls[0]![1]);
+			expect(payload).toEqual(
+				expect.objectContaining({
+					metric: 'CLS',
+					value: 0.05,
+					rating: 'good',
+					delta: 0.05,
+					id: 'v1-cls'
+				})
+			);
+			expect(payload.timestamp).toEqual(expect.any(Number));
+			expect(payload.url).toEqual(expect.any(String));
+		});
+
+		it('should fall back to fetch when sendBeacon is not available', () => {
+			vi.stubGlobal('navigator', { sendBeacon: undefined });
+			const mockFetch = vi.fn().mockResolvedValue({});
+			vi.stubGlobal('fetch', mockFetch);
+
+			const reporter = webVitalsModule.createDefaultReporter({
+				endpoint: 'https://analytics.classeo.fr/vitals'
+			});
+
+			reporter({
+				name: 'LCP',
+				value: 2000,
+				rating: 'good',
+				delta: 2000,
+				id: 'v1-lcp'
+			});
+
+			expect(mockFetch).toHaveBeenCalledWith(
+				'https://analytics.classeo.fr/vitals',
+				expect.objectContaining({
+					method: 'POST',
+					headers: { 'Content-Type': 'application/json' },
+					keepalive: true
+				})
+			);
+		});
+
+		it('should not send data when no endpoint is configured', () => {
+			const mockSendBeacon = vi.fn();
+			vi.stubGlobal('navigator', { sendBeacon: mockSendBeacon });
+			const mockFetch = vi.fn();
+			vi.stubGlobal('fetch', mockFetch);
+
+			const reporter = webVitalsModule.createDefaultReporter({});
+
+			reporter({
+				name: 'INP',
+				value: 100,
+				rating: 'good',
+				delta: 100,
+				id: 'v1-inp'
+			});
+
+			expect(mockSendBeacon).not.toHaveBeenCalled();
+			expect(mockFetch).not.toHaveBeenCalled();
+		});
+
+		it('should support both debug and endpoint at the same time', () => {
+			const mockSendBeacon = vi.fn().mockReturnValue(true);
+			vi.stubGlobal('navigator', { sendBeacon: mockSendBeacon });
+
+			const reporter = webVitalsModule.createDefaultReporter({
+				debug: true,
+				endpoint: 'https://analytics.classeo.fr/vitals'
+			});
+
+			reporter({
+				name: 'TTFB',
+				value: 500.123,
+				rating: 'good',
+				delta: 500.123,
+				id: 'v1-ttfb'
+			});
+
+			expect(console.log).toHaveBeenCalledWith(
+				'[WebVitals] TTFB: 500.12 (good)'
+			);
+			expect(mockSendBeacon).toHaveBeenCalled();
+		});
+	});
+});
--- a/frontend/tests/unit/lib/types/shared.test.ts
+++ b/frontend/tests/unit/lib/types/shared.test.ts
@@ -0,0 +1,133 @@
+import { describe, it, expect } from 'vitest';
+import {
+	createTenantId,
+	createUserId,
+	createNoteId,
+	createClasseId,
+	createEleveId
+} from '$lib/types/shared';
+
+/**
+ * Unit tests for branded type helper functions.
+ *
+ * Branded types provide compile-time type safety (e.g. preventing
+ * accidental use of a UserId where a TenantId is expected).
+ * At runtime, the create functions are identity functions that
+ * simply return the input string.
+ */
+
+describe('shared branded types', () => {
+	// ==========================================================================
+	// createTenantId
+	// ==========================================================================
+	describe('createTenantId', () => {
+		it('should return a string', () => {
+			const result = createTenantId('tenant-abc-123');
+			expect(typeof result).toBe('string');
+		});
+
+		it('should preserve the input value', () => {
+			const input = 'b2c3d4e5-f6a7-8901-bcde-f23456789012';
+			const result = createTenantId(input);
+			expect(result).toBe(input);
+		});
+
+		it('should handle empty string', () => {
+			const result = createTenantId('');
+			expect(result).toBe('');
+		});
+	});
+
+	// ==========================================================================
+	// createUserId
+	// ==========================================================================
+	describe('createUserId', () => {
+		it('should return a string', () => {
+			const result = createUserId('user-xyz-456');
+			expect(typeof result).toBe('string');
+		});
+
+		it('should preserve the input value', () => {
+			const input = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
+			const result = createUserId(input);
+			expect(result).toBe(input);
+		});
+	});
+
+	// ==========================================================================
+	// createNoteId
+	// ==========================================================================
+	describe('createNoteId', () => {
+		it('should return a string', () => {
+			const result = createNoteId('note-001');
+			expect(typeof result).toBe('string');
+		});
+
+		it('should preserve the input value', () => {
+			const input = 'd4e5f6a7-b890-1234-cdef-567890abcdef';
+			const result = createNoteId(input);
+			expect(result).toBe(input);
+		});
+	});
+
+	// ==========================================================================
+	// createClasseId
+	// ==========================================================================
+	describe('createClasseId', () => {
+		it('should return a string', () => {
+			const result = createClasseId('classe-6eme-a');
+			expect(typeof result).toBe('string');
+		});
+
+		it('should preserve the input value', () => {
+			const input = 'e5f6a7b8-9012-3456-cdef-890abcdef123';
+			const result = createClasseId(input);
+			expect(result).toBe(input);
+		});
+	});
+
+	// ==========================================================================
+	// createEleveId
+	// ==========================================================================
+	describe('createEleveId', () => {
+		it('should return a string', () => {
+			const result = createEleveId('eleve-jean-dupont');
+			expect(typeof result).toBe('string');
+		});
+
+		it('should preserve the input value', () => {
+			const input = 'f6a7b890-1234-5678-cdef-abcdef012345';
+			const result = createEleveId(input);
+			expect(result).toBe(input);
+		});
+	});
+
+	// ==========================================================================
+	// Type safety (compile-time checks)
+	// ==========================================================================
+	describe('type safety', () => {
+		it('should produce values that are assignable to string', () => {
+			// These assignments verify that branded types are assignable to string
+			const tenantId: string = createTenantId('t1');
+			const userId: string = createUserId('u1');
+			const noteId: string = createNoteId('n1');
+			const classeId: string = createClasseId('c1');
+			const eleveId: string = createEleveId('e1');
+
+			// Use all variables to avoid unused-variable warnings
+			expect(tenantId).toBe('t1');
+			expect(userId).toBe('u1');
+			expect(noteId).toBe('n1');
+			expect(classeId).toBe('c1');
+			expect(eleveId).toBe('e1');
+		});
+
+		it('should be usable in string operations', () => {
+			const userId = createUserId('user-123');
+			// Branded types should work in all string contexts
+			expect(userId.startsWith('user-')).toBe(true);
+			expect(userId.length).toBe(8);
+			expect(`ID: ${userId}`).toBe('ID: user-123');
+		});
+	});
+});