Fix crash bugs and secure webhook/TMDB key

- Add missing MovieController::remove/markWatched (routes called undefined methods)
- Fix linkPartner(): commit() was unreachable after an early return, so partner
  linking was never actually persisted in the DB
- Add missing removeMovie/markWatched functions in app.js
- webhook.php now verifies a GitHub HMAC signature before running git reset --hard
- Move TMDB API key server-side via a new TmdbController proxy (tmdb-search/tmdb-details)
  instead of exposing it in client-side JS

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -1 +1,2 @@
 config/database.php
+webhook.log

config/database.example.php

@@ -7,6 +7,8 @@ class Database {
     private $username = "VOTRE_USER"; // N'utilisez par "root"
     private $password = "VOTRE_MDP";
     public $jwt_secret = "VOTRE_CLE_SECRETE_POUR_JWT"; // Une passphrase est préférable
+    public $tmdb_api_key = "VOTRE_CLE_API_TMDB_V3";
+    public $webhook_secret = "VOTRE_SECRET_WEBHOOK"; // Doit matcher le "Secret" configuré côté GitHub, ex: openssl rand -hex 32
     public $conn;
 
     // Récupérer la connexion

controllers/MovieController.php

@@ -47,4 +47,24 @@ class MovieController {
             "lists" => $lists
         ]);
     }
+
+    public function remove($data) {
+        if (!isset($data['movie_id'])) {
+            http_response_code(400);
+            echo json_encode(["error" => "ID du film manquant"]);
+            return;
+        }
+        $res = $this->movieModel->remove($data['movie_id'], $data['user_id']);
+        echo json_encode(["success" => $res]);
+    }
+
+    public function markWatched($data) {
+        if (!isset($data['movie_id'])) {
+            http_response_code(400);
+            echo json_encode(["error" => "ID du film manquant"]);
+            return;
+        }
+        $res = $this->movieModel->markWatched($data['movie_id'], $data['user_id']);
+        echo json_encode(["success" => $res]);
+    }
 }

controllers/TmdbController.php

@@ -0,0 +1,61 @@
+<?php
+// controllers/TmdbController.php
+// Proxy serveur vers TMDB : la clé API ne quitte jamais le backend.
+
+class TmdbController {
+    private $apiKey;
+    private $baseUrl = 'https://api.themoviedb.org/3';
+
+    public function __construct($apiKey) {
+        $this->apiKey = $apiKey;
+    }
+
+    private function fetch($endpoint, $params = []) {
+        $params['api_key'] = $this->apiKey;
+        $url = $this->baseUrl . $endpoint . '?' . http_build_query($params);
+
+        $ch = curl_init($url);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_TIMEOUT, 10);
+        $response = curl_exec($ch);
+        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE) ?: 502;
+        curl_close($ch);
+
+        return ['code' => $httpCode, 'body' => $response ?: json_encode(["error" => "TMDB injoignable"])];
+    }
+
+    public function search($data) {
+        $query = trim($data['query'] ?? '');
+        if ($query === '') {
+            http_response_code(400);
+            echo json_encode(["error" => "Paramètre 'query' manquant"]);
+            return;
+        }
+
+        $result = $this->fetch('/search/movie', [
+            'query' => $query,
+            'language' => 'fr-FR',
+            'page' => 1
+        ]);
+
+        http_response_code($result['code']);
+        echo $result['body'];
+    }
+
+    public function details($data) {
+        $id = $data['id'] ?? null;
+        if (!$id || !ctype_digit((string)$id)) {
+            http_response_code(400);
+            echo json_encode(["error" => "ID de film invalide"]);
+            return;
+        }
+
+        $result = $this->fetch("/movie/{$id}", [
+            'language' => 'fr-FR',
+            'append_to_response' => 'credits'
+        ]);
+
+        http_response_code($result['code']);
+        echo $result['body'];
+    }
+}

index.php

@@ -22,6 +22,7 @@ require_once __DIR__ . '/config/database.php';
 require_once __DIR__ . '/controllers/UserController.php';
 require_once __DIR__ . '/utils/JWT.php';
 require_once __DIR__ . '/controllers/MovieController.php';
+require_once __DIR__ . '/controllers/TmdbController.php';
 
 // Initialisation de la BDD et du contrôleur
 $database = new Database();
@@ -30,6 +31,7 @@ $jwt_secret = $database->jwt_secret;
 
 $userController = new UserController($db, $jwt_secret);
 $movieController = new MovieController($db);
+$tmdbController = new TmdbController($database->tmdb_api_key);
 
 // On récupère la route épurée (ex: si on tape /register, $route vaudra 'register')
 $request_uri = explode('?', $_SERVER['REQUEST_URI'], 2)[0];
@@ -133,6 +135,20 @@ switch ($route) {
         } else { http_response_code(405); }
         break;
 
+    case 'tmdb-search':
+        if ($method === 'POST') {
+            getAuthenticatedUserId($jwt_secret); // On exige juste un token valide, pas d'usage anonyme du quota TMDB
+            $tmdbController->search($data);
+        } else { http_response_code(405); }
+        break;
+
+    case 'tmdb-details':
+        if ($method === 'POST') {
+            getAuthenticatedUserId($jwt_secret);
+            $tmdbController->details($data);
+        } else { http_response_code(405); }
+        break;
+
     default:
         http_response_code(404);
         echo json_encode(["error" => "Route /" . $route . " non trouvée"]);

models/User.php

@@ -120,8 +120,6 @@ class User {
             ");
             $stmt->execute([$current_user_id, $partner_id]);
 
-            return ["success" => true];
-
             $this->conn->commit();
             return ["success" => true, "message" => "Comptes liés avec succès !"];
 

webhook.php

@@ -1,6 +1,28 @@
 <?php
-// On se déplace dans le dossier
+// webhook.php
+// Déclenché par un webhook GitHub (push sur main) pour resynchroniser le serveur.
+
 chdir(__DIR__);
+require_once __DIR__ . '/config/database.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    exit('Method not allowed');
+}
+
+$database = new Database();
+$secret = $database->webhook_secret;
+
+$payload = file_get_contents('php://input');
+$signatureHeader = $_SERVER['HTTP_X_HUB_SIGNATURE_256'] ?? '';
+$expectedSignature = 'sha256=' . hash_hmac('sha256', $payload, $secret);
+
+// Comparaison en temps constant pour éviter les attaques par timing
+if (!$signatureHeader || !hash_equals($expectedSignature, $signatureHeader)) {
+    http_response_code(403);
+    file_put_contents('webhook.log', date('Y-m-d H:i:s') . " - Tentative refusée (signature invalide)\n", FILE_APPEND);
+    exit('Forbidden');
+}
 
 // On récupère les modifs et on force l'écrasement pour éviter les conflits
 $output = shell_exec('git fetch origin && git reset --hard origin/main 2>&1');
@@ -9,4 +31,3 @@ $output = shell_exec('git fetch origin && git reset --hard origin/main 2>&1');
 file_put_contents('webhook.log', date('Y-m-d H:i:s') . "\n" . $output . "\n---\n", FILE_APPEND);
 
 echo "Sync done.";
-?>