REORG

src/test/Yavsc.Api.Tests/ActivityApiControllerTests.cs

@@ -0,0 +1,161 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Abstract.Workflow;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class ActivityApiControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public ActivityApiControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+        return http;
+    }
+
+    [Fact]
+    public async Task GetUsers_returns_declared_user_for_exact_activity_code()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient();
+
+        var response = await http.GetAsync("/api/v1/activity/dev/users", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var payload = await response.Content.ReadFromJsonAsync<List<PerformerActivity>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(payload);
+        Assert.Single(payload!);
+        Assert.Equal("alice", payload[0].PerformerId);
+        Assert.Equal("alice", payload[0].UserName);
+        Assert.True(payload[0].HasPerformerProfile);
+        Assert.True(payload[0].Active);
+        Assert.Equal("dev", payload[0].ActivityCode);
+    }
+
+    [Fact]
+    public async Task GetUsers_returns_user_even_when_performer_inactive()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using (var scope = _fixture.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<Yavsc.Models.ApplicationDbContext>();
+            var performer = db.Performers.Single(p => p.PerformerId == "alice");
+            performer.Active = false;
+            db.SaveChanges();
+        }
+
+        using var http = NewClient();
+        var response = await http.GetAsync("/api/v1/activity/dev/users", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var payload = await response.Content.ReadFromJsonAsync<List<PerformerActivity>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(payload);
+        Assert.Single(payload!);
+        Assert.Equal("alice", payload[0].PerformerId);
+        Assert.False(payload[0].Active);
+    }
+
+    [Fact]
+    public async Task Catalog_and_Performers_are_consistent_for_dev_activity()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient();
+
+        var catalogResponse = await http.GetAsync("/api/v1/activity/catalog", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, catalogResponse.StatusCode);
+
+        var catalog = await catalogResponse.Content.ReadFromJsonAsync<List<ActivityInfo>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(catalog);
+
+        var dev = catalog!.Single(a => a.Code == "dev");
+        Assert.True(dev.PerformerCount > 0);
+
+        var performersResponse = await http.GetAsync("/api/v1/activity/dev/users", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, performersResponse.StatusCode);
+
+        var performers = await performersResponse.Content.ReadFromJsonAsync<List<PerformerActivity>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(performers);
+        Assert.Equal(dev.PerformerCount, performers!.Count);
+        Assert.Contains(performers, p => p.PerformerId == "alice");
+    }
+
+    [Fact]
+    public async Task Catalog_does_not_list_activity_without_declaration()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient();
+
+        var catalogResponse = await http.GetAsync("/api/v1/activity/catalog", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, catalogResponse.StatusCode);
+
+        var catalog = await catalogResponse.Content.ReadFromJsonAsync<List<ActivityInfo>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(catalog);
+        Assert.DoesNotContain(catalog!, a => a.Code == "ghost");
+        Assert.Contains(catalog!, a => a.Code == "dev");
+    }
+
+    [Fact]
+    public async Task Catalog_lists_declared_activity_even_when_performer_inactive()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient();
+
+        var catalogResponse = await http.GetAsync("/api/v1/activity/catalog", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, catalogResponse.StatusCode);
+
+        var catalog = await catalogResponse.Content.ReadFromJsonAsync<List<ActivityInfo>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(catalog);
+        Assert.Contains(catalog!, a => a.Code == "declared-only");
+
+        var response = await http.GetAsync("/api/v1/activity/declared-only/users", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var payload = await response.Content.ReadFromJsonAsync<List<PerformerActivity>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(payload);
+        Assert.Single(payload!);
+        Assert.Equal("bob", payload[0].PerformerId);
+        Assert.Equal("bob", payload[0].UserName);
+        Assert.True(payload[0].HasPerformerProfile);
+        Assert.False(payload[0].Active);
+    }
+
+    [Fact]
+    public async Task Performers_alias_returns_same_payload_as_users_endpoint()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient();
+
+        var usersResponse = await http.GetAsync("/api/v1/activity/dev/users", TestContext.Current.CancellationToken);
+        var performersResponse = await http.GetAsync("/api/v1/activity/dev/performers", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, usersResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, performersResponse.StatusCode);
+
+        var usersPayload = await usersResponse.Content.ReadFromJsonAsync<List<PerformerActivity>>(TestContext.Current.CancellationToken);
+        var performersPayload = await performersResponse.Content.ReadFromJsonAsync<List<PerformerActivity>>(TestContext.Current.CancellationToken);
+
+        Assert.NotNull(usersPayload);
+        Assert.NotNull(performersPayload);
+        Assert.Equal(usersPayload!.Count, performersPayload!.Count);
+        Assert.Equal(usersPayload[0].PerformerId, performersPayload[0].PerformerId);
+        Assert.Equal(usersPayload[0].UserName, performersPayload[0].UserName);
+    }
+}

src/test/Yavsc.Api.Tests/ApiCollection.cs

@@ -0,0 +1,6 @@
+namespace Yavsc.Api.Test;
+
+[CollectionDefinition("Yavsc Api")]
+public sealed class ApiCollection
+{
+}

src/test/Yavsc.Api.Tests/BillingControllerTests.cs

@@ -0,0 +1,236 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Helpers;
+using Yavsc.Models;
+using Yavsc.Models.Billing;
+using Yavsc.Models.Haircut;
+using Yavsc.Models.Workflow;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class BillingControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public BillingControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+
+        return http;
+    }
+
+    [Fact]
+    public async Task GetProviderOngoingCommands_returns_current_provider_requests()
+    {
+        WorkflowHelpers.ConfigureBillingService();
+        _fixture.ResetAndSeedActivityGraph();
+
+        using (var scope = _fixture.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+            var location = db.Locations.Single();
+
+            db.RdvQueries.Add(new RdvQuery
+            {
+                ActivityCode = "dev",
+                ClientId = "bob",
+                PerformerId = "alice",
+                Consent = true,
+                UserCreated = "alice",
+                UserModified = "alice",
+                DateCreated = DateTime.UtcNow.AddMinutes(-10),
+                DateModified = DateTime.UtcNow.AddMinutes(-8),
+                EventDate = DateTime.UtcNow.AddDays(1),
+                Location = location,
+                Reason = "Rendez-vous fournisseur",
+                Status = QueryStatus.InProgress,
+                Description = "Commande fournisseur en cours",
+            });
+
+            db.RdvQueries.Add(new RdvQuery
+            {
+                ActivityCode = "dev",
+                ClientId = "alice",
+                PerformerId = "bob",
+                Consent = true,
+                UserCreated = "bob",
+                UserModified = "bob",
+                DateCreated = DateTime.UtcNow.AddMinutes(-20),
+                DateModified = DateTime.UtcNow.AddMinutes(-20),
+                EventDate = DateTime.UtcNow.AddDays(2),
+                Location = location,
+                Reason = "Commande d'un autre prestataire",
+                Status = QueryStatus.Accepted,
+                Description = "Autre prestataire",
+            });
+
+            db.SaveChanges();
+        }
+
+        using var http = NewClient();
+
+        var response = await http.GetAsync("/api/v1/bill/provider/ongoing", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        var payload = await response.Content.ReadFromJsonAsync<List<ProviderOngoingCommandDto>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(payload);
+        Assert.NotEmpty(payload!);
+        Assert.All(payload!, item => Assert.Equal("alice", item.PerformerId));
+        Assert.Contains(payload!, item => item.BillingCode == BillingCodes.Rdv);
+    }
+
+    [Fact]
+    public async Task GetProviderOngoingCommands_ignores_rows_with_invalid_discriminator()
+    {
+        WorkflowHelpers.ConfigureBillingService();
+        _fixture.ResetAndSeedActivityGraph();
+
+        using (var scope = _fixture.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+            db.Database.ExecuteSqlInterpolated($@"
+INSERT INTO ""NominativeServiceCommands""
+(""ActivityCode"", ""ClientId"", ""Consent"", ""DateCreated"", ""DateModified"", ""Description"", ""Discriminator"", ""PerformerId"", ""Status"", ""UserCreated"", ""UserModified"")
+VALUES
+({"dev"}, {"bob"}, {true}, {DateTime.UtcNow.AddMinutes(-5)}, {DateTime.UtcNow.AddMinutes(-4)}, {"Legacy malformed row"}, {""}, {"alice"}, {(int)QueryStatus.Accepted}, {"alice"}, {"alice"});
+");
+
+            var location = db.Locations.Single();
+            db.RdvQueries.Add(new RdvQuery
+            {
+                ActivityCode = "dev",
+                ClientId = "bob",
+                PerformerId = "alice",
+                Consent = true,
+                UserCreated = "alice",
+                UserModified = "alice",
+                DateCreated = DateTime.UtcNow.AddMinutes(-3),
+                DateModified = DateTime.UtcNow.AddMinutes(-2),
+                EventDate = DateTime.UtcNow.AddDays(1),
+                Location = location,
+                Reason = "Commande valide",
+                Status = QueryStatus.InProgress,
+                Description = "Commande fournisseur valide",
+            });
+
+            db.SaveChanges();
+        }
+
+        using var http = NewClient();
+
+        var response = await http.GetAsync("/api/v1/bill/provider/ongoing", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        var payload = await response.Content.ReadFromJsonAsync<List<ProviderOngoingCommandDto>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(payload);
+        Assert.NotEmpty(payload!);
+        Assert.Contains(payload!, item => item.BillingCode == BillingCodes.Rdv && item.PerformerId == "alice");
+        Assert.DoesNotContain(payload!, item => string.IsNullOrWhiteSpace(item.BillingCode));
+    }
+
+    [Fact]
+    public async Task GetProviderOngoingCommands_returns_haircut_and_grouped_haircut_requests()
+    {
+        WorkflowHelpers.ConfigureBillingService();
+        _fixture.ResetAndSeedHaircutGraph();
+
+        using (var scope = _fixture.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+            db.UserActivities.Add(new UserActivity
+            {
+                UserId = "alice",
+                DoesCode = "brush",
+                Weight = 50,
+            });
+            db.UserActivities.Add(new UserActivity
+            {
+                UserId = "alice",
+                DoesCode = "mbrush",
+                Weight = 50,
+            });
+            db.CommandForm.Add(new CommandForm
+            {
+                ActivityCode = "brush",
+                ActionName = BillingCodes.Brush,
+                Title = "Brush",
+            });
+            db.CommandForm.Add(new CommandForm
+            {
+                ActivityCode = "mbrush",
+                ActionName = BillingCodes.MBrush,
+                Title = "MBrush",
+            });
+            db.SaveChanges();
+        }
+
+        using var http = NewClient();
+
+        var response = await http.GetAsync("/api/v1/bill/provider/ongoing", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        var payload = await response.Content.ReadFromJsonAsync<List<ProviderOngoingCommandDto>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(payload);
+        Assert.Contains(payload!, item => item.BillingCode == BillingCodes.Brush && item.PerformerId == "alice");
+        Assert.Contains(payload!, item => item.BillingCode == BillingCodes.MBrush && item.PerformerId == "alice");
+    }
+
+    [Fact]
+    public async Task GetProviderOngoingCommands_excludes_requests_outside_performer_declared_activities()
+    {
+        WorkflowHelpers.ConfigureBillingService();
+        _fixture.ResetAndSeedHaircutGraph();
+
+        using var http = NewClient();
+
+        var response = await http.GetAsync("/api/v1/bill/provider/ongoing", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        var payload = await response.Content.ReadFromJsonAsync<List<ProviderOngoingCommandDto>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(payload);
+        Assert.DoesNotContain(payload!, item => item.BillingCode == BillingCodes.Brush);
+        Assert.DoesNotContain(payload!, item => item.BillingCode == BillingCodes.MBrush);
+    }
+
+    private sealed class ProviderOngoingCommandDto
+    {
+        public long Id { get; set; }
+        public string BillingCode { get; set; } = string.Empty;
+        public string ActivityCode { get; set; } = string.Empty;
+        public string PerformerId { get; set; } = string.Empty;
+        public string ClientId { get; set; } = string.Empty;
+        public QueryStatus Status { get; set; }
+        public string Description { get; set; } = string.Empty;
+    }
+}

src/test/Yavsc.Api.Tests/EstimateApiControllerTests.cs

@@ -0,0 +1,342 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Models;
+using Yavsc.Models.Billing;
+using Yavsc.Models.Workflow;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class EstimateApiControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public EstimateApiControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+
+        return http;
+    }
+
+    /// <summary>
+    /// Seed a provider (alice) and a client (bob) with a pending
+    /// <see cref="RdvQuery"/> from bob to alice, and return the
+    /// command id.
+    /// </summary>
+    private long SeedPendingCommand()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var location = db.Locations.Single();
+
+        var query = new RdvQuery
+        {
+            ActivityCode = "dev",
+            ClientId = "bob",
+            PerformerId = "alice",
+            Consent = true,
+            UserCreated = "bob",
+            UserModified = "bob",
+            DateCreated = DateTime.UtcNow.AddMinutes(-10),
+            DateModified = DateTime.UtcNow.AddMinutes(-10),
+            EventDate = DateTime.UtcNow.AddDays(1),
+            Location = location,
+            Reason = "Demande de devis",
+            Status = QueryStatus.InProgress,
+            Description = "Demande en attente de devis",
+        };
+        db.RdvQueries.Add(query);
+        db.SaveChanges();
+
+        return query.Id;
+    }
+
+    private static object NewEstimatePayload(long? commandId, string clientId, string? ownerId = null)
+        => new
+        {
+            CommandId = commandId,
+            ClientId = clientId,
+            OwnerId = ownerId,
+            CommandType = BillingCodes.Rdv,
+            Title = "Devis prestation",
+            Description = "Devis détaillé",
+            AttachedFiles = Array.Empty<string>(),
+            AttachedGraphics = Array.Empty<string>(),
+            Bill = new[]
+            {
+                new { Name = "Prestation", Description = "Prestation de base", Count = 1, UnitaryCost = 120m, Currency = "EUR" },
+                new { Name = "Remise", Description = "Remise fidélité", Count = 1, UnitaryCost = -20m, Currency = "EUR" },
+            },
+        };
+
+    [Fact]
+    public async Task PostEstimate_creates_the_estimate_and_validates_the_linked_command()
+    {
+        var commandId = SeedPendingCommand();
+        using var http = NewClient("alice");
+
+        var response = await http.PostAsJsonAsync(
+            "/api/v1/estimate",
+            NewEstimatePayload(commandId, clientId: "bob"),
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var estimateId = doc.RootElement.GetProperty("id").GetInt64();
+        Assert.True(estimateId > 0);
+        Assert.Equal(2, doc.RootElement.GetProperty("bill").GetArrayLength());
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        var estimate = db.Estimates.Include(e => e.Bill).Single(e => e.Id == estimateId);
+        Assert.Equal("alice", estimate.OwnerId);
+        Assert.Equal("bob", estimate.ClientId);
+        Assert.Equal(commandId, estimate.CommandId);
+        Assert.Equal(BillingCodes.Rdv, estimate.CommandType);
+        Assert.Equal(2, estimate.Bill.Count);
+        Assert.Contains(estimate.Bill, line => line.UnitaryCost == -20m);
+
+        // PostEstimate stamps the linked command as validated.
+        var query = db.RdvQueries.Single(q => q.Id == commandId);
+        Assert.NotNull(query.ValidationDate);
+    }
+
+    [Fact]
+    public async Task PostEstimate_without_command_creates_a_standalone_estimate()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient("alice");
+
+        var response = await http.PostAsJsonAsync(
+            "/api/v1/estimate",
+            NewEstimatePayload(commandId: null, clientId: "bob"),
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var estimateId = doc.RootElement.GetProperty("id").GetInt64();
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var estimate = db.Estimates.Single(e => e.Id == estimateId);
+        Assert.Null(estimate.CommandId);
+        Assert.Equal("alice", estimate.OwnerId);
+    }
+
+    [Fact]
+    public async Task PostEstimate_for_another_owner_is_rejected()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient("alice");
+
+        var response = await http.PostAsJsonAsync(
+            "/api/v1/estimate",
+            NewEstimatePayload(commandId: null, clientId: "bob", ownerId: "bob"),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        Assert.Empty(db.Estimates);
+    }
+
+    [Fact]
+    public async Task PostEstimate_with_an_unknown_command_id_is_rejected()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient("alice");
+
+        var response = await http.PostAsJsonAsync(
+            "/api/v1/estimate",
+            NewEstimatePayload(commandId: 999999, clientId: "bob"),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        Assert.Empty(db.Estimates);
+    }
+
+    [Fact]
+    public async Task PostEstimate_without_token_is_unauthorized()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+        using var http = new HttpClient(handler) { BaseAddress = new Uri(_fixture.BaseAddress) };
+
+        var response = await http.PostAsJsonAsync(
+            "/api/v1/estimate",
+            NewEstimatePayload(commandId: null, clientId: "bob"),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+
+    /// <summary>
+    /// Seeds an estimate owned by alice (the provider) for the given
+    /// client, optionally already validated by the client. By default the
+    /// estimate is also provider-validated (i.e. the provider has submitted
+    /// it); pass <paramref name="providerValidated"/> = false to seed a
+    /// freshly inserted request the provider hasn't worked on yet.
+    /// </summary>
+    private long SeedEstimate(string clientId, bool clientValidated, bool providerValidated = true)
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        var estimate = new Estimate
+        {
+            ClientId = clientId,
+            OwnerId = "alice",
+            CommandType = BillingCodes.Rdv,
+            Title = "Devis prestation",
+            Description = "Devis de test",
+            AttachedFiles = new List<string>(),
+            AttachedGraphics = new List<string>(),
+            Bill = new List<CommandLine>
+            {
+                new() { Name = "Prestation", Description = "Prestation de base", Count = 1, UnitaryCost = 120m, Currency = "EUR" },
+            },
+            ProviderValidationDate = providerValidated ? DateTime.UtcNow : default,
+            ClientValidationDate = clientValidated ? DateTime.UtcNow : default,
+        };
+        db.Estimates.Add(estimate);
+        db.SaveChanges();
+        return estimate.Id;
+    }
+
+    [Fact]
+    public async Task GetOngoingEstimatesAsClient_returns_only_the_current_users_ongoing_estimates()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        var ongoingId = SeedEstimate(clientId: "bob", clientValidated: false);
+        SeedEstimate(clientId: "bob", clientValidated: true);    // already validated: excluded
+        SeedEstimate(clientId: "alice", clientValidated: false); // another client's: excluded
+
+        using var http = NewClient("bob");
+
+        var response = await http.GetAsync("/api/v1/estimate/asclient", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var items = doc.RootElement.EnumerateArray().ToArray();
+        var item = Assert.Single(items);
+        Assert.Equal(ongoingId, item.GetProperty("id").GetInt64());
+        Assert.Equal("bob", item.GetProperty("clientId").GetString());
+        Assert.Equal("alice", item.GetProperty("ownerId").GetString());
+    }
+
+    [Fact]
+    public async Task GetOngoingEstimatesAsClient_excludes_inserted_requests_not_yet_provider_validated()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        var submittedId = SeedEstimate(clientId: "bob", clientValidated: false);                  // provider submitted: visible
+        SeedEstimate(clientId: "bob", clientValidated: false, providerValidated: false);          // inserted, not worked on: excluded
+
+        using var http = NewClient("bob");
+
+        var response = await http.GetAsync("/api/v1/estimate/asclient", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var items = doc.RootElement.EnumerateArray().ToArray();
+        var item = Assert.Single(items);
+        Assert.Equal(submittedId, item.GetProperty("id").GetInt64());
+    }
+
+    [Fact]
+    public async Task GetOngoingEstimatesAsProvider_returns_estimates_the_provider_has_not_yet_signed()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        // Not yet provider-signed: visible in the provider's "awaiting
+        // provider signature" list.
+        var pendingId = SeedEstimate(clientId: "bob", clientValidated: false, providerValidated: false);
+        // Provider already signed: must leave the list immediately.
+        SeedEstimate(clientId: "bob", clientValidated: false, providerValidated: true);
+
+        using var http = NewClient("alice");
+
+        var response = await http.GetAsync("/api/v1/estimate/asprovider", TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var items = doc.RootElement.EnumerateArray().ToArray();
+        var item = Assert.Single(items);
+        Assert.Equal(pendingId, item.GetProperty("id").GetInt64());
+        Assert.Equal("alice", item.GetProperty("ownerId").GetString());
+        Assert.Single(item.GetProperty("bill").EnumerateArray());
+    }
+
+    [Fact]
+    public async Task GetOngoingEstimatesAsClient_without_token_is_unauthorized()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+        using var http = new HttpClient(handler) { BaseAddress = new Uri(_fixture.BaseAddress) };
+
+        var response = await http.GetAsync("/api/v1/estimate/asclient", TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task GetOngoingEstimatesAsProvider_without_token_is_unauthorized()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+        using var http = new HttpClient(handler) { BaseAddress = new Uri(_fixture.BaseAddress) };
+
+        var response = await http.GetAsync("/api/v1/estimate/asprovider", TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+}

src/test/Yavsc.Api.Tests/EstimateAttachmentsApiTests.cs

@@ -0,0 +1,303 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Models;
+using Yavsc.Models.Billing;
+using Yavsc.Models.Blog;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+/// <summary>
+/// Integration tests for the estimate attachment endpoints
+/// (<c>GET/POST/DELETE api/v1/estimate/{id}/attachments</c>), which
+/// attach a file from the provider's personal storage to an estimate
+/// **by reference** (<see cref="EstimateAttachedFile"/>).
+///
+/// <para>Coverage mirrors the authorization contract documented on the
+/// controller: only the provider (<c>estimate.OwnerId</c>) may attach or
+/// detach, the file must belong to the caller, and listing is open to
+/// both parties (provider/client) plus admin. A third party is refused.
+/// The download of the bytes themselves is served by the Blogs host and
+/// exercised in <c>Yavsc.Blogs.Tests</c>; these tests cover only the
+/// metadata/relationship endpoints that live on the API host.</para>
+/// </summary>
+[Collection("Yavsc Api")]
+public sealed class EstimateAttachmentsApiTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public EstimateAttachmentsApiTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+        return http;
+    }
+
+    /// <summary>
+    /// Reset the graph (seeding alice the provider and bob the client),
+    /// create an estimate owned by alice for bob, and seed two personal
+    /// <see cref="UploadedFile"/> rows: one owned by alice (the provider's
+    /// own file) and one owned by bob (a file that does NOT belong to the
+    /// provider, used to assert the ownership guard on attach).
+    /// </summary>
+    private (long estimateId, long aliceFileId, long bobFileId) Seed()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        var estimate = new Estimate
+        {
+            ClientId = "bob",
+            OwnerId = "alice",
+            CommandType = BillingCodes.Rdv,
+            Title = "Devis prestation",
+            Description = "Devis de test",
+            AttachedFiles = new List<string>(),
+            AttachedGraphics = new List<string>(),
+            Bill = new List<CommandLine>
+            {
+                new() { Name = "Prestation", Description = "Prestation de base", Count = 1, UnitaryCost = 120m, Currency = "EUR" },
+            },
+        };
+        db.Estimates.Add(estimate);
+        db.SaveChanges();
+
+        var aliceFile = new UploadedFile
+        {
+            OwnerId = "alice",
+            Path = "provider-doc.pdf",
+            ContentType = "application/pdf",
+            Length = 2048,
+        };
+        var bobFile = new UploadedFile
+        {
+            OwnerId = "bob",
+            Path = "client-note.txt",
+            ContentType = "text/plain",
+            Length = 64,
+        };
+        db.UploadedFiles.AddRange(aliceFile, bobFile);
+        db.SaveChanges();
+
+        return (estimate.Id, aliceFile.Id, bobFile.Id);
+    }
+
+    private int CountAttachments(long estimateId)
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        return db.EstimateAttachedFiles.Count(a => a.EstimateId == estimateId);
+    }
+
+    [Fact]
+    public async Task Provider_attaching_own_file_creates_the_link()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        using var http = NewClient("alice");
+        var response = await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK,
+            $"Expected 200, got {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        Assert.Equal(1, CountAttachments(estimateId));
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var link = Assert.Single(db.EstimateAttachedFiles.Where(a => a.EstimateId == estimateId));
+        Assert.Equal(aliceFileId, link.FileId);
+    }
+
+    [Fact]
+    public async Task Attaching_the_same_file_twice_is_idempotent()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        using var http = NewClient("alice");
+        await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+        var second = await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, second.StatusCode);
+        Assert.Equal(1, CountAttachments(estimateId));
+    }
+
+    [Fact]
+    public async Task Non_provider_cannot_attach_to_an_estimate()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        // bob is the client of the estimate, not the provider.
+        using var http = NewClient("bob");
+        var response = await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Equal(0, CountAttachments(estimateId));
+    }
+
+    [Fact]
+    public async Task Provider_cannot_attach_a_file_they_do_not_own()
+    {
+        var (estimateId, _, bobFileId) = Seed();
+
+        // alice is the provider, but the file belongs to bob.
+        using var http = NewClient("alice");
+        var response = await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = bobFileId },
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Equal(0, CountAttachments(estimateId));
+    }
+
+    [Fact]
+    public async Task Provider_detaches_a_file()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        using var http = NewClient("alice");
+        await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+        Assert.Equal(1, CountAttachments(estimateId));
+
+        var response = await http.DeleteAsync(
+            $"/api/v1/estimate/{estimateId}/attachments/{aliceFileId}",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Equal(0, CountAttachments(estimateId));
+    }
+
+    [Fact]
+    public async Task Non_provider_cannot_detach()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        using var http = NewClient("alice");
+        await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+
+        using var bob = NewClient("bob");
+        var response = await bob.DeleteAsync(
+            $"/api/v1/estimate/{estimateId}/attachments/{aliceFileId}",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Equal(1, CountAttachments(estimateId));
+    }
+
+    [Fact]
+    public async Task Provider_lists_attachments()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        using var http = NewClient("alice");
+        await http.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+
+        var response = await http.GetAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True(response.StatusCode == HttpStatusCode.OK,
+            $"Expected 200, got {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var item = Assert.Single(doc.RootElement.EnumerateArray());
+        Assert.Equal(aliceFileId, item.GetProperty("fileId").GetInt64());
+        Assert.Equal("provider-doc.pdf", item.GetProperty("path").GetString());
+        Assert.Equal("alice", item.GetProperty("ownerId").GetString());
+    }
+
+    [Fact]
+    public async Task Client_can_list_attachments_as_a_party()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        using var alice = NewClient("alice");
+        await alice.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+
+        // bob is the client of the estimate: a party, may list.
+        using var bob = NewClient("bob");
+        var response = await bob.GetAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Third_party_cannot_list_attachments()
+    {
+        var (estimateId, aliceFileId, _) = Seed();
+
+        using var alice = NewClient("alice");
+        await alice.PostAsJsonAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+
+        // carol is neither the provider nor the client.
+        using var carol = NewClient("carol");
+        var response = await carol.GetAsync(
+            $"/api/v1/estimate/{estimateId}/attachments",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Listing_an_unknown_estimate_returns_404()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+        using var http = NewClient("alice");
+
+        var response = await http.GetAsync(
+            "/api/v1/estimate/999999/attachments",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+}

src/test/Yavsc.Api.Tests/EstimatePdfGenerationTests.cs

@@ -0,0 +1,191 @@
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Reflection;
+using Yavsc.Helpers;
+using Yavsc.Models.Billing;
+using Yavsc.ViewModels.Gen;
+
+namespace Yavsc.Api.Test;
+
+// Unit test of the estimate PDF generation pipeline (no HTTP fixture
+// needed): it exercises TeXHelpers.SignatureToTikz — the vector drawing
+// of the provider and client signatures — and TeXHelpers.GenerateEstimatePdf
+// — the lualatex stdin compile that writes <name>.pdf into DestDir. The
+// TeX source mirrors what the Estimate_tex template emits for a devis
+// signed by both parties: two side-by-side minipages, each with a
+// tikzpicture bounded by \useasboundingbox and the strokes drawn by
+// SignatureToTikz.
+//
+// The PDF test requires the system `lualatex` (and the TeX Live packages
+// listed in the README runtime-deps section) on the host running the
+// tests. On hosts without lualatex it skips cleanly rather than failing.
+public sealed class EstimatePdfGenerationTests
+{
+    // A provider signature: a downstroke, a cross, and a tap (dot).
+    // PostIt wire format — [k, x0,y0, x1,y1, …] per stroke, coords in
+    // [0, 10000], y-down.
+    private static readonly int[] ProStrokes =
+    {
+        4, 2000, 8000, 2000, 5000, 2000, 2000, 2100, 1900,
+        3, 2000, 5000, 3500, 4500, 3500, 5100,
+        1, 4000, 3000,
+    };
+
+    // A client signature: a wavy stroke and a shorter one.
+    private static readonly int[] CliStrokes =
+    {
+        5, 1000, 7000, 1500, 4000, 2200, 3000, 3000, 2500, 4000, 1500,
+        2, 3000, 6000, 4200, 5500,
+    };
+
+    [Fact]
+    public void SignatureToTikz_RendersBothSignaturesAsVectorDraws()
+    {
+        var pro = MakeSig(SignatureType.Pro, ProStrokes);
+        var cli = MakeSig(SignatureType.Client, CliStrokes);
+
+        var proTex = pro.SignatureToTikz(5, 2.5).ToString();
+        var cliTex = cli.SignatureToTikz(5, 2.5).ToString();
+
+        Assert.Contains("\\draw[line cap=round, line join=round, line width=1.5pt]", proTex);
+        Assert.Contains("\\fill", proTex);            // the single-point tap → dot
+        Assert.Contains("(1.000,0.500)", proTex);    // first point (2000,8000), y flipped
+        Assert.Contains("\\draw[line cap=round, line join=round, line width=1.5pt]", cliTex);
+        Assert.Contains("--", cliTex);
+    }
+
+    [Fact]
+    public void SignatureToTikz_EmptySignatureIsEmpty()
+    {
+        var empty = MakeSig(SignatureType.Pro, Array.Empty<int>());
+        Assert.Equal("", empty.SignatureToTikz(5, 2.5).ToString());
+    }
+
+    [Fact]
+    public void GenerateEstimatePdf_WithBothSignatures_ProducesPdfInDestDir()
+    {
+        if (!IsLualatexAvailable())
+            throw Xunit.Sdk.SkipException.ForSkip(
+                "lualatex is not installed on this host; skipping PDF generation test. " +
+                "Install the TeX Live runtime deps documented in the README.");
+
+        var destDir = Path.Combine(Path.GetTempPath(),
+            "yavsc-estimate-pdf-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(destDir);
+
+        try
+        {
+            var pro = MakeSig(SignatureType.Pro, ProStrokes);
+            var cli = MakeSig(SignatureType.Client, CliStrokes);
+            var baseName = "estimate-test-both-signed";
+
+            var model = new PdfGenerationViewModel
+            {
+                TeXSource = BuildEstimateTeX(pro, cli),
+                BaseFileName = baseName,
+                DestDir = destDir,
+            };
+
+            var fo = model.GenerateEstimatePdf();
+
+            // The PDF must exist, at the expected path, and be non-empty.
+            var expectedPath = Path.Combine(destDir, baseName + ".pdf");
+            Assert.True(fo is not null && fo.Exists,
+                "GenerateEstimatePdf returned a non-existent file. Error: "
+                + model.GenerationErrorMessage?.Value);
+            Assert.Equal(expectedPath, fo.FullName);
+            Assert.True(fo.Length > 0, "generated PDF is empty");
+
+            // Only the PDF should persist in DestDir — aux/log artifacts
+            // are cleaned up by GenerateEstimatePdf on success.
+            var leftovers = Directory.GetFiles(destDir)
+                .Where(p => !Path.GetFileName(p).Equals(baseName + ".pdf", StringComparison.Ordinal))
+                .ToArray();
+            Assert.Empty(leftovers);
+        }
+        finally
+        {
+            if (Directory.Exists(destDir))
+                Directory.Delete(destDir, recursive: true);
+        }
+    }
+
+    private static Signature MakeSig(SignatureType type, int[] strokes)
+        => new()
+        {
+            Type = type,
+            CoordinateMax = 10_000,
+            Strokes = strokes,
+            CapturedAtUtc = new DateTime(2026, 9, 22, 0, 0, 0, DateTimeKind.Utc),
+        };
+
+    // Builds the LaTeX source the Estimate_tex template would emit for a
+    // devis signed by both parties: same preamble (incl. tikz + bera) and
+    // the two-minipage signature foot, with the strokes drawn by
+    // SignatureToTikz.
+    private static string BuildEstimateTeX(Signature pro, Signature cli)
+    {
+        var fr = CultureInfo.CreateSpecificCulture("fr-FR");
+        var date = new DateTime(2026, 9, 22).ToString("dddd dd MMMM yyyy", fr);
+        var proTikz = pro.SignatureToTikz(5, 2.5).ToString();
+        var cliTikz = cli.SignatureToTikz(5, 2.5).ToString();
+
+        return $@"\documentclass[french,11pt]{{article}}
+\usepackage{{eurosym}}
+\usepackage{{babel}}
+\usepackage[T1]{{fontenc}}
+\usepackage[utf8]{{inputenc}}
+\usepackage[a4paper]{{geometry}}
+\usepackage{{units}}
+\usepackage{{bera}}
+\usepackage{{graphicx}}
+\usepackage{{fancyhdr}}
+\usepackage{{fp}}
+\usepackage{{tikz}}
+\geometry{{verbose,tmargin=4em,bmargin=8em,lmargin=6em,rmargin=6em}}
+\setlength{{\parindent}}{{0pt}}
+\begin{{document}}
+Devis n°1 --- test signe par les deux parties
+
+\vspace{{2em}}
+\noindent
+\begin{{minipage}}[t]{{0.45\textwidth}}
+  \textbf{{Signature du fournisseur}}\\
+\small Valide le {date}\\
+\begin{{tikzpicture}}
+  \useasboundingbox (0,0) rectangle (5,2.5);
+  {proTikz}
+\end{{tikzpicture}}
+\end{{minipage}}\hfill
+\begin{{minipage}}[t]{{0.45\textwidth}}
+  \textbf{{Signature du client}}\\
+\small Valide le {date}\\
+\begin{{tikzpicture}}
+  \useasboundingbox (0,0) rectangle (5,2.5);
+  {cliTikz}
+\end{{tikzpicture}}
+\end{{minipage}}
+\end{{document}}
+";
+    }
+
+    private static bool IsLualatexAvailable()
+    {
+        try
+        {
+            using var p = Process.Start(new ProcessStartInfo("lualatex", "--version")
+            {
+                UseShellExecute = false,
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+            });
+            if (p is null) return false;
+            return p.WaitForExit(5000) && p.ExitCode == 0;
+        }
+        catch
+        {
+            return false;
+        }
+    }
+}

src/test/Yavsc.Api.Tests/Fixtures/ApiWebServerFixture.cs

@@ -0,0 +1,500 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
+using Npgsql;
+using Yavsc.Controllers;
+using Yavsc.Interfaces.Workflow;
+using Yavsc.Models;
+using Yavsc.Models.Billing;
+using Yavsc.Models.Google.Messaging;
+using Yavsc.Models.Haircut;
+using Yavsc.Models.Messaging;
+using Yavsc.Models.Relationship;
+using Yavsc.Models.Workflow;
+using Yavsc.Services;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test.Fixtures;
+
+public sealed class ApiWebServerFixture : WebHostFixture
+{
+    private const string DbProviderEnvVar = "YAVSC_API_TEST_DB_PROVIDER";
+    private const string NpgsqlAdminConnectionEnvVar = "YAVSC_API_TEST_NPGSQL_ADMIN_CONNECTION";
+    private const string DedicatedNpgsqlDatabaseName = "yavscTestDb";
+
+    protected override int HttpsPort => 5104;
+
+    private static SqliteConnection? _sharedSqliteConnection;
+    private static readonly object _sqliteLock = new();
+    private static readonly object _npgsqlLock = new();
+    private static string? _sharedNpgsqlConnectionString;
+
+    protected override WebApplication BuildApp(WebApplicationBuilder builder)
+    {
+        if (UseNpgsqlProvider())
+        {
+            var npgsqlConnectionString = EnsureNpgsqlDatabaseCreated();
+            builder.Services.AddDbContext<ApplicationDbContext>(opt =>
+                opt.UseNpgsql(npgsqlConnectionString,
+                    x => x.MigrationsAssembly("Yavsc.Org")));
+        }
+        else
+        {
+            SqliteConnection sharedConnection;
+            lock (_sqliteLock)
+            {
+                if (_sharedSqliteConnection is null)
+                {
+                    _sharedSqliteConnection = new SqliteConnection(
+                        "Data Source=YavscApiTests;Mode=Memory;Cache=Shared");
+                    _sharedSqliteConnection.Open();
+                }
+                sharedConnection = _sharedSqliteConnection;
+            }
+
+            builder.Services.AddDbContext<ApplicationDbContext>(opt =>
+                opt.UseSqlite(sharedConnection));
+        }
+
+        builder.Services.AddControllers()
+            .AddApplicationPart(typeof(ActivityApiController).Assembly);
+
+        builder.Services.AddLocalization();
+        builder.Services.Configure<GoogleAuthSettings>(_ => { });
+        builder.Services.AddTransient<IBillingService, BillingService>();
+        builder.Services.AddTransient<IYavscMessageSender, NoopMessageSender>();
+        builder.Services.AddAuthorization();
+
+        builder.Services.AddAuthentication("Bearer")
+            .AddJwtBearer("Bearer", options =>
+            {
+                options.IncludeErrorDetails = true;
+                options.MapInboundClaims = false;
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidIssuer = TestTokenIssuer.Issuer,
+                    ValidateAudience = false,
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = TestTokenIssuer.SigningKey,
+                    NameClaimType = "sub",
+                    RoleClaimType = Yavsc.Constants.RoleClaimType,
+                };
+            });
+
+        return builder.Build();
+    }
+
+    protected override async Task<WebApplication> ConfigurePipelineAsync(WebApplication app)
+    {
+        app.UseDeveloperExceptionPage();
+        app.UseRouting();
+        app.UseAuthentication();
+        app.UseAuthorization();
+        app.MapControllers();
+
+        using (var scope = app.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+            if (UseNpgsqlProvider())
+            {
+                // Apply the EF Core migrations (Yavsc.Org assembly) so the
+                // test database schema matches the production provider.
+                // EnsureCreated must not be used here: it would create the
+                // schema without the migrations history and break Migrate().
+                db.Database.Migrate();
+            }
+            else
+            {
+                db.Database.EnsureCreated();
+            }
+        }
+
+        await Task.CompletedTask;
+        return app;
+    }
+
+    public string BaseAddress => Addresses.First(a => a.StartsWith("https://", StringComparison.Ordinal));
+
+    public static bool UseNpgsqlProvider()
+        => string.Equals(
+            Environment.GetEnvironmentVariable(DbProviderEnvVar),
+            "npgsql",
+            StringComparison.OrdinalIgnoreCase);
+
+    private static string EnsureNpgsqlDatabaseCreated()
+    {
+        lock (_npgsqlLock)
+        {
+            if (!string.IsNullOrWhiteSpace(_sharedNpgsqlConnectionString))
+            {
+                return _sharedNpgsqlConnectionString;
+            }
+
+            var adminConnectionString = BuildAdminConnectionString();
+            var databaseName = DedicatedNpgsqlDatabaseName;
+
+            using (var adminConnection = new NpgsqlConnection(adminConnectionString))
+            {
+                adminConnection.Open();
+                using var existsCommand = adminConnection.CreateCommand();
+                existsCommand.CommandText = "SELECT 1 FROM pg_database WHERE datname = @databaseName";
+                existsCommand.Parameters.AddWithValue("databaseName", databaseName);
+
+                if (existsCommand.ExecuteScalar() is null)
+                {
+                    using var createCommand = adminConnection.CreateCommand();
+                    createCommand.CommandText = $"CREATE DATABASE \"{databaseName}\"";
+                    createCommand.ExecuteNonQuery();
+                }
+            }
+
+            var testConnectionBuilder = new NpgsqlConnectionStringBuilder(adminConnectionString)
+            {
+                Database = databaseName,
+                Pooling = false,
+                IncludeErrorDetail = true
+            };
+
+            _sharedNpgsqlConnectionString = testConnectionBuilder.ToString();
+            return _sharedNpgsqlConnectionString;
+        }
+    }
+
+    private static string BuildAdminConnectionString()
+    {
+        // The admin connection string (host + credentials) is supplied
+        // via environment, never embedded in source — committing a
+        // real dev password would leak it into git history. The Npgsql
+        // path is opt-in, so requiring the env var is fine: a missing
+        // value produces a clear failure rather than a silent fallback
+        // onto someone's local dev database.
+        var configured = Environment.GetEnvironmentVariable(NpgsqlAdminConnectionEnvVar);
+        if (string.IsNullOrWhiteSpace(configured))
+            throw new InvalidOperationException(
+                $"{NpgsqlAdminConnectionEnvVar} is not set. The Npgsql test "
+                + "provider requires an admin PostgreSQL connection string "
+                + "in that environment variable (e.g. "
+                + "'Server=localhost;Port=5432;Database=postgres;"
+                + "Username=yavscdev;Password=...;Include Error Detail=true').");
+
+        var builder = new NpgsqlConnectionStringBuilder(configured)
+        {
+            Pooling = false,
+            IncludeErrorDetail = true
+        };
+
+        // The admin connection targets the maintenance database
+        // (postgres) so we can CREATE/DROP the dedicated test database;
+        // whatever database the env var names is overridden here.
+        if (string.IsNullOrWhiteSpace(builder.Database))
+            builder.Database = "postgres";
+
+        return builder.ToString();
+    }
+
+    private sealed class NoopMessageSender : IYavscMessageSender
+    {
+        public Task<MessageWithPayloadResponse> NotifyBookQueryAsync(IEnumerable<string> connectionIds, RdvQueryEvent ev)
+            => Task.FromResult(new MessageWithPayloadResponse());
+
+        public Task<MessageWithPayloadResponse> NotifyEstimateAsync(IEnumerable<string> connectionIds, EstimationEvent ev)
+            => Task.FromResult(new MessageWithPayloadResponse());
+
+        public Task<MessageWithPayloadResponse> NotifyHairCutQueryAsync(IEnumerable<string> connectionIds, HairCutQueryEvent ev)
+            => Task.FromResult(new MessageWithPayloadResponse());
+
+        public Task<MessageWithPayloadResponse> NotifyAsync(IEnumerable<string> connectionIds, IEvent yaev)
+            => Task.FromResult(new MessageWithPayloadResponse());
+    }
+
+    public void ResetAndSeedActivityGraph()
+    {
+        using var scope = Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        ResetDatabase(db);
+        db.Database.EnsureCreated();
+
+        var user = new ApplicationUser
+        {
+            Id = "alice",
+            UserName = "alice",
+            Email = "alice@example.test",
+            EmailConfirmed = true,
+            FullName = "Alice",
+        };
+        db.Users.Add(user);
+
+        var location = new Location
+        {
+            Address = "1 rue du Test",
+            Latitude = 48.8566,
+            Longitude = 2.3522,
+        };
+        db.Add(location);
+        db.SaveChanges();
+
+        var activity = new Activity
+        {
+            Code = "dev",
+            Name = "Dev",
+            Hidden = false,
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+        };
+        db.Activities.Add(activity);
+
+        db.Activities.Add(new Activity
+        {
+            Code = "ghost",
+            Name = "Ghost",
+            Hidden = false,
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+        });
+
+        var performer = new PerformerProfile
+        {
+            PerformerId = "alice",
+            SIREN = "123456789",
+            OrganizationAddressId = location.Id,
+            AcceptNotifications = true,
+            AcceptPublicContact = true,
+            Active = true,
+            Rate = 5,
+            WebSite = "https://alice.dev",
+        };
+        db.Performers.Add(performer);
+
+        db.UserActivities.Add(new UserActivity
+        {
+            UserId = "alice",
+            DoesCode = "dev",
+            Weight = 100,
+        });
+
+        db.Users.Add(new ApplicationUser
+        {
+            Id = "bob",
+            UserName = "bob",
+            Email = "bob@example.test",
+            EmailConfirmed = true,
+            FullName = "Bob",
+        });
+
+        db.Activities.Add(new Activity
+        {
+            Code = "declared-only",
+            Name = "Declared Only",
+            Hidden = false,
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+        });
+
+        db.Performers.Add(new PerformerProfile
+        {
+            PerformerId = "bob",
+            SIREN = "987654321",
+            OrganizationAddressId = location.Id,
+            AcceptNotifications = false,
+            AcceptPublicContact = false,
+            Active = false,
+            Rate = 0,
+            WebSite = "",
+        });
+
+        db.UserActivities.Add(new UserActivity
+        {
+            UserId = "bob",
+            DoesCode = "declared-only",
+            Weight = 10,
+        });
+
+        db.SaveChanges();
+    }
+
+    private static void ResetDatabase(ApplicationDbContext db)
+    {
+        if (UseNpgsqlProvider())
+        {
+            // Purge only the tables of the test graph, children before
+            // parents, so no DELETE violates a foreign key. Estimate and
+            // CommandLine reference NominativeServiceCommand (CommandId) and
+            // must be deleted before the Rdv/HairCut/HairMultiCut queries.
+            db.Set<CommandLine>().RemoveRange(db.Set<CommandLine>());
+            db.Set<Estimate>().RemoveRange(db.Set<Estimate>());
+            db.Set<RdvQuery>().RemoveRange(db.Set<RdvQuery>());
+            db.Set<HairCutQuery>().RemoveRange(db.Set<HairCutQuery>());
+            db.Set<HairMultiCutQuery>().RemoveRange(db.Set<HairMultiCutQuery>());
+            db.Set<HairPrestationCollectionItem>().RemoveRange(db.Set<HairPrestationCollectionItem>());
+            db.Set<HairPrestation>().RemoveRange(db.Set<HairPrestation>());
+            db.Set<UserActivity>().RemoveRange(db.Set<UserActivity>());
+            db.Set<PerformerProfile>().RemoveRange(db.Set<PerformerProfile>());
+            db.Set<Activity>().RemoveRange(db.Set<Activity>());
+            db.Set<ApplicationUser>().RemoveRange(db.Set<ApplicationUser>());
+            db.Set<Location>().RemoveRange(db.Set<Location>());
+
+            db.SaveChanges();
+            return;
+        }
+
+        db.Database.EnsureDeleted();
+    }
+
+    public void ResetAndSeedRdvQueryGraph()
+    {
+        ResetAndSeedActivityGraph();
+
+        using var scope = Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        var location = db.Locations.Single(l => l.Address == "1 rue du Test");
+
+        db.RdvQueries.Add(new RdvQuery
+        {
+            ActivityCode = "dev",
+            ClientId = "alice",
+            PerformerId = "alice",
+            Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+            EventDate = DateTime.UtcNow.AddDays(1),
+            Location = location,
+            Reason = "Initial rendez-vous",
+            Status = Yavsc.QueryStatus.Inserted,
+        });
+
+        db.SaveChanges();
+    }
+
+    public void ResetAndSeedHaircutGraph()
+    {
+        ResetAndSeedActivityGraph();
+
+        using var scope = Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        var location = db.Locations.Single(l => l.Address == "1 rue du Test");
+
+        if (!db.Activities.Any(a => a.Code == "brush"))
+        {
+            db.Activities.Add(new Activity
+            {
+                Code = "brush",
+                Name = "Brush",
+                Hidden = false,
+                DateCreated = DateTime.UtcNow,
+                DateModified = DateTime.UtcNow,
+            });
+        }
+
+        if (!db.Activities.Any(a => a.Code == "mbrush"))
+        {
+            db.Activities.Add(new Activity
+            {
+                Code = "mbrush",
+                Name = "MBrush",
+                Hidden = false,
+                DateCreated = DateTime.UtcNow,
+                DateModified = DateTime.UtcNow,
+            });
+        }
+
+        if (!db.BrusherProfile.Any(p => p.UserId == "alice"))
+        {
+            db.BrusherProfile.Add(new BrusherProfile
+            {
+                UserId = "alice",
+                ActionDistance = 25,
+                WomenLongCutPrice = 50m,
+                WomenHalfCutPrice = 40m,
+                WomenShortCutPrice = 30m,
+                ManCutPrice = 20m,
+                KidCutPrice = 15m,
+                ShampooPrice = 5m,
+            });
+        }
+
+        var prestation1 = new HairPrestation
+        {
+            Gender = HairCutGenders.Women,
+            Length = HairLength.HalfLong,
+            Cut = true,
+            Shampoo = true,
+            Dressing = HairDressings.Brushing,
+            Tech = HairTechnos.NoTech,
+            Cares = false,
+            Taints = new List<HairTaintInstance>(),
+        };
+        var prestation2 = new HairPrestation
+        {
+            Gender = HairCutGenders.Man,
+            Length = HairLength.Short,
+            Cut = true,
+            Shampoo = false,
+            Dressing = HairDressings.Brushing,
+            Tech = HairTechnos.NoTech,
+            Cares = false,
+            Taints = new List<HairTaintInstance>(),
+        };
+
+        db.HairPrestation.AddRange(prestation1, prestation2);
+        db.SaveChanges();
+
+        db.HairCutQueries.Add(new HairCutQuery
+        {
+            ActivityCode = "brush",
+            ClientId = "alice",
+            PerformerId = "alice",
+            Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+            EventDate = DateTime.UtcNow.AddDays(3),
+            Location = location,
+            PrestationId = prestation1.Id,
+            Prestation = prestation1,
+            AdditionalInfo = "Coupe test",
+            Status = Yavsc.QueryStatus.Inserted,
+            Description = "Haircut seed",
+        });
+
+        db.HairMultiCutQueries.Add(new HairMultiCutQuery
+        {
+            ActivityCode = "mbrush",
+            ClientId = "alice",
+            PerformerId = "alice",
+            Consent = true,
+            UserCreated = "alice",
+            UserModified = "alice",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+            EventDate = DateTime.UtcNow.AddDays(4),
+            Location = location,
+            Prestations = new List<HairPrestationCollectionItem>
+            {
+                new() { PrestationId = prestation1.Id, Prestation = prestation1 },
+                new() { PrestationId = prestation2.Id, Prestation = prestation2 },
+            },
+            Status = Yavsc.QueryStatus.Inserted,
+        });
+
+        db.SaveChanges();
+    }
+
+    public override void Dispose()
+    {
+        // Keep the shared in-memory SQLite connection alive for the
+        // whole test process. Closing it from one fixture instance can
+        // drop the schema while other tests are still running.
+        base.Dispose();
+    }
+}

src/test/Yavsc.Api.Tests/FrontOfficeApiControllerTests.cs

@@ -0,0 +1,342 @@
+using System.Linq;
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Helpers;
+using Yavsc.Models;
+using Yavsc.Models.Billing;
+using Yavsc.Models.Workflow;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class FrontOfficeApiControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public FrontOfficeApiControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+        return http;
+    }
+
+    // Minimal valid PostIt wire-format signature: one stroke of one
+    // point (k=1, then 2*k coords). See PostIt.Models.SignaturePadData.
+    private static readonly int[] SampleStrokes = { 1, 5000, 5000 };
+
+    private static HttpContent NoSignature() => JsonBody(new { });
+
+    private static HttpContent WithSignature(SignatureType? type = null) =>
+        type is null
+            ? JsonBody(new { strokes = SampleStrokes, coordinateMax = 10_000 })
+            : JsonBody(new { strokes = SampleStrokes, coordinateMax = 10_000, signatureType = type });
+
+    private static JsonContent JsonBody(object value) =>
+        JsonContent.Create(value, mediaType: new MediaTypeHeaderValue("application/json"));
+
+    /// <summary>
+    /// Seeds an Rdv query and, when <paramref name="withEstimate"/> is
+    /// true, an estimate linked to it via CommandId. The provider is
+    /// <paramref name="performer"/> (default alice) and the client is
+    /// <paramref name="client"/> (default bob) — pass the same value
+    /// for both to model a user who is both parties. Returns the query
+    /// id and (when seeded) the estimate id.
+    /// </summary>
+    private (long queryId, long estimateId) SeedQuery(
+        bool withEstimate,
+        string performer = "alice",
+        string client = "bob")
+    {
+        WorkflowHelpers.ConfigureBillingService();
+        _fixture.ResetAndSeedActivityGraph();
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        var location = db.Locations.Single(l => l.Address == "1 rue du Test");
+
+        var query = new RdvQuery
+        {
+            ActivityCode = "dev",
+            ClientId = client,
+            PerformerId = performer,
+            Consent = true,
+            UserCreated = performer,
+            UserModified = performer,
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+            EventDate = DateTime.UtcNow.AddDays(1),
+            Location = location,
+            Reason = "Initial rendez-vous",
+            Status = Yavsc.QueryStatus.Inserted,
+        };
+        db.RdvQueries.Add(query);
+        db.SaveChanges();
+
+        long estimateId = 0;
+        if (withEstimate)
+        {
+            var estimate = new Estimate
+            {
+                CommandId = query.Id,
+                ClientId = client,
+                OwnerId = performer,
+                CommandType = BillingCodes.Rdv,
+                Title = "Devis prestation",
+                Description = "Devis de test",
+                AttachedFiles = new List<string>(),
+                AttachedGraphics = new List<string>(),
+                Bill = new List<CommandLine>
+                {
+                    new() { Name = "Prestation", Description = "Prestation de base", Count = 1, UnitaryCost = 120m, Currency = "EUR" },
+                },
+            };
+            db.Estimates.Add(estimate);
+            db.SaveChanges();
+            estimateId = estimate.Id;
+        }
+
+        return (query.Id, estimateId);
+    }
+
+    [Fact]
+    public async Task Front_accept_query_updates_status_without_server_error()
+    {
+        var (queryId, _) = SeedQuery(withEstimate: false);
+
+        using var http = NewClient();
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+            NoSignature(),
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var assertScope = _fixture.Services.CreateScope();
+        var assertDb = assertScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var updated = assertDb.RdvQueries.Single(q => q.Id == queryId);
+
+        // Default caller is "alice" (the provider) → ProAccepted.
+        Assert.Equal(QueryStatus.ProAccepted, updated.Status);
+    }
+
+    [Fact]
+    public async Task Provider_accept_with_signature_sets_ProValidationDate_and_Pro_signature()
+    {
+        var (queryId, estimateId) = SeedQuery(withEstimate: true);
+
+        using var http = NewClient(subject: "alice");
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+            WithSignature(),
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var assertScope = _fixture.Services.CreateScope();
+        var assertDb = assertScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        Assert.Equal(QueryStatus.ProAccepted, assertDb.RdvQueries.Single(q => q.Id == queryId).Status);
+
+        var estimate = assertDb.Estimates.Single(e => e.Id == estimateId);
+        Assert.True(estimate.ProviderValidationDate != default);
+        Assert.True(estimate.ClientValidationDate == default);
+
+        var signature = assertDb.Signatures.Single(s => s.EstimateId == estimateId);
+        Assert.Equal(SignatureType.Pro, signature.Type);
+        Assert.Equal("alice", signature.SignerId);
+    }
+
+    [Fact]
+    public async Task Client_accept_with_signature_sets_ClientValidationDate_and_Client_signature()
+    {
+        var (queryId, estimateId) = SeedQuery(withEstimate: true);
+
+        using var http = NewClient(subject: "bob");
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+            WithSignature(),
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var assertScope = _fixture.Services.CreateScope();
+        var assertDb = assertScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        Assert.Equal(QueryStatus.ClientAccepted, assertDb.RdvQueries.Single(q => q.Id == queryId).Status);
+
+        var estimate = assertDb.Estimates.Single(e => e.Id == estimateId);
+        Assert.True(estimate.ClientValidationDate != default);
+        Assert.True(estimate.ProviderValidationDate == default);
+
+        var signature = assertDb.Signatures.Single(s => s.EstimateId == estimateId);
+        Assert.Equal(SignatureType.Client, signature.Type);
+        Assert.Equal("bob", signature.SignerId);
+    }
+
+    [Fact]
+    public async Task Reject_sets_status_Rejected()
+    {
+        var (queryId, _) = SeedQuery(withEstimate: false);
+
+        using var http = NewClient(subject: "alice");
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/reject?billingCode=Rdv&queryId={queryId}",
+            NoSignature(),
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var assertScope = _fixture.Services.CreateScope();
+        var assertDb = assertScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        Assert.Equal(QueryStatus.Rejected, assertDb.RdvQueries.Single(q => q.Id == queryId).Status);
+    }
+
+    [Fact]
+    public async Task Non_party_actor_is_forbidden()
+    {
+        var (queryId, _) = SeedQuery(withEstimate: false);
+
+        using var http = NewClient(subject: "carol");
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+            NoSignature(),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Accept_with_signature_but_no_estimate_returns_400()
+    {
+        var (queryId, _) = SeedQuery(withEstimate: false);
+
+        using var http = NewClient(subject: "alice");
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+            WithSignature(),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Reject_with_signature_returns_400()
+    {
+        var (queryId, _) = SeedQuery(withEstimate: true);
+
+        using var http = NewClient(subject: "alice");
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/reject?billingCode=Rdv&queryId={queryId}",
+            WithSignature(),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Estimate_payload_carries_existing_signature_strokes()
+    {
+        var (queryId, estimateId) = SeedQuery(withEstimate: true);
+
+        // Provider accepts with a signature.
+        using (var pro = NewClient(subject: "alice"))
+        {
+            var r = await pro.PostAsync(
+                $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+                WithSignature(),
+                TestContext.Current.CancellationToken);
+            Assert.True(r.IsSuccessStatusCode, await r.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
+        }
+
+        // The estimate read endpoint carries the signature strokes on
+        // the estimate payload, so PostIt can repaint them on reopen.
+        using var reader = NewClient(subject: "alice");
+        var response = await reader.GetAsync(
+            $"/api/v1/estimate/{estimateId}",
+            TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>(TestContext.Current.CancellationToken);
+
+        // Signatures ride on the estimate payload as two dedicated
+        // slots, not a list: the provider signed here, so signaturePro
+        // is populated and signatureClient is absent/null.
+        var proSig = body.GetProperty("signaturePro");
+        Assert.Equal(JsonValueKind.Object, proSig.ValueKind);
+        Assert.Equal(JsonValueKind.Array, proSig.GetProperty("strokes").ValueKind);
+        Assert.True(body.TryGetProperty("signatureClient", out var cli)
+            && cli.ValueKind == JsonValueKind.Null,
+            "signatureClient should be null when only the provider has signed");
+    }
+
+    // When one user is both the provider and the client of a query, the
+    // server cannot infer which side they are signing as from identity
+    // alone (it would always pick the provider). The caller declares the
+    // side (signatureType=1 here = Client); the server honors it because
+    // the caller is that party, and stores a Client signature.
+    [Fact]
+    public async Task Accept_declared_client_side_stores_client_signature_when_user_is_both_parties()
+    {
+        var (queryId, estimateId) = SeedQuery(withEstimate: true, performer: "alice", client: "alice");
+
+        using var http = NewClient(subject: "alice");
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+            WithSignature(SignatureType.Client), // signing as the client
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True(response.StatusCode == HttpStatusCode.OK, $"Unexpected status {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var assertScope = _fixture.Services.CreateScope();
+        var assertDb = assertScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        Assert.Equal(QueryStatus.ClientAccepted, assertDb.RdvQueries.Single(q => q.Id == queryId).Status);
+
+        var estimate = assertDb.Estimates.Single(e => e.Id == estimateId);
+        Assert.True(estimate.ClientValidationDate != default);
+        Assert.True(estimate.ProviderValidationDate == default);
+
+        var signature = assertDb.Signatures.Single(s => s.EstimateId == estimateId);
+        Assert.Equal(SignatureType.Client, signature.Type);
+        Assert.Equal("alice", signature.SignerId);
+    }
+
+    // A provider may not sign as the client (and vice versa): declaring
+    // the other party's side is refused even though the caller is a
+    // party to the query. Write is authorized only for the signature's
+    // author.
+    [Fact]
+    public async Task Accept_declaring_other_party_side_is_forbidden()
+    {
+        var (queryId, _) = SeedQuery(withEstimate: true); // provider alice, client bob
+
+        using var http = NewClient(subject: "alice"); // alice is the provider
+        var response = await http.PostAsync(
+            $"/api/v1/front/query/accept?billingCode=Rdv&queryId={queryId}",
+            WithSignature(SignatureType.Client), // alice tries to sign as the client
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+}

src/test/Yavsc.Api.Tests/FrontOfficeQueryAttachmentsApiTests.cs

@@ -0,0 +1,256 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Helpers;
+using Yavsc.Models;
+using Yavsc.Models.Billing;
+using Yavsc.Models.Blog;
+using Yavsc.Models.Workflow;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+/// <summary>
+/// Integration tests for the query (demande) attachment endpoints
+/// (<c>GET/POST/DELETE api/v1/front/query/{queryId}/attachments</c>),
+/// which attach a file from the client's personal storage to their
+/// <c>NominativeServiceCommand</c> **by reference**
+/// (<see cref="QueryAttachedFile"/>).
+///
+/// <para>Coverage mirrors the controller contract: only the client
+/// (the demande's <c>ClientId</c>) may attach or detach, the file must
+/// belong to the caller, and listing is open to both parties
+/// (client/provider) plus admin. A third party is refused.</para>
+/// </summary>
+[Collection("Yavsc Api")]
+public sealed class FrontOfficeQueryAttachmentsApiTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public FrontOfficeQueryAttachmentsApiTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "bob", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+        return http;
+    }
+
+    /// <summary>
+    /// Seed an Rdv query from bob (client) to alice (provider) and two
+    /// personal <see cref="UploadedFile"/> rows: one owned by bob (the
+    /// client's own file) and one owned by alice (a file that does NOT
+    /// belong to the client, used to assert the ownership guard).
+    /// </summary>
+    private (long queryId, long bobFileId, long aliceFileId) Seed()
+    {
+        WorkflowHelpers.ConfigureBillingService();
+        _fixture.ResetAndSeedActivityGraph();
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var location = db.Locations.Single(l => l.Address == "1 rue du Test");
+
+        var query = new RdvQuery
+        {
+            ActivityCode = "dev",
+            ClientId = "bob",
+            PerformerId = "alice",
+            Consent = true,
+            UserCreated = "bob",
+            UserModified = "bob",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow,
+            EventDate = DateTime.UtcNow.AddDays(1),
+            Location = location,
+            Reason = "Demande de devis",
+            Status = QueryStatus.InProgress,
+            Description = "Demande en attente",
+        };
+        db.RdvQueries.Add(query);
+        db.SaveChanges();
+
+        var bobFile = new UploadedFile
+        {
+            OwnerId = "bob",
+            Path = "demande-photo.jpg",
+            ContentType = "image/jpeg",
+            Length = 4096,
+        };
+        var aliceFile = new UploadedFile
+        {
+            OwnerId = "alice",
+            Path = "provider-spec.pdf",
+            ContentType = "application/pdf",
+            Length = 1024,
+        };
+        db.UploadedFiles.AddRange(bobFile, aliceFile);
+        db.SaveChanges();
+
+        return (query.Id, bobFile.Id, aliceFile.Id);
+    }
+
+    private int CountAttachments(long queryId)
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        return db.QueryAttachedFiles.Count(a => a.CommandId == queryId);
+    }
+
+    private string AttachUrl(long queryId) =>
+        $"/api/v1/front/query/{queryId}/attachments?billingCode=Rdv";
+
+    private string DetachUrl(long queryId, long fileId) =>
+        $"/api/v1/front/query/{queryId}/attachments/{fileId}?billingCode=Rdv";
+
+    [Fact]
+    public async Task Client_attaching_own_file_creates_the_link()
+    {
+        var (queryId, bobFileId, _) = Seed();
+
+        using var http = NewClient("bob");
+        var response = await http.PostAsJsonAsync(
+            AttachUrl(queryId),
+            new { fileId = bobFileId },
+            TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(response.StatusCode == HttpStatusCode.OK,
+            $"Expected 200, got {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        Assert.Equal(1, CountAttachments(queryId));
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        var link = Assert.Single(db.QueryAttachedFiles.Where(a => a.CommandId == queryId));
+        Assert.Equal(bobFileId, link.FileId);
+    }
+
+    [Fact]
+    public async Task Provider_cannot_attach_to_a_query()
+    {
+        var (queryId, bobFileId, _) = Seed();
+
+        // alice is the provider of the query; only the client attaches.
+        using var http = NewClient("alice");
+        var response = await http.PostAsJsonAsync(
+            AttachUrl(queryId),
+            new { fileId = bobFileId },
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Equal(0, CountAttachments(queryId));
+    }
+
+    [Fact]
+    public async Task Client_cannot_attach_a_file_they_do_not_own()
+    {
+        var (queryId, _, aliceFileId) = Seed();
+
+        // bob is the client, but the file belongs to alice.
+        using var http = NewClient("bob");
+        var response = await http.PostAsJsonAsync(
+            AttachUrl(queryId),
+            new { fileId = aliceFileId },
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Equal(0, CountAttachments(queryId));
+    }
+
+    [Fact]
+    public async Task Client_detaches_a_file()
+    {
+        var (queryId, bobFileId, _) = Seed();
+
+        using var http = NewClient("bob");
+        await http.PostAsJsonAsync(
+            AttachUrl(queryId),
+            new { fileId = bobFileId },
+            TestContext.Current.CancellationToken);
+        Assert.Equal(1, CountAttachments(queryId));
+
+        var response = await http.DeleteAsync(
+            DetachUrl(queryId, bobFileId),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Equal(0, CountAttachments(queryId));
+    }
+
+    [Fact]
+    public async Task Provider_cannot_detach()
+    {
+        var (queryId, bobFileId, _) = Seed();
+
+        using var bob = NewClient("bob");
+        await bob.PostAsJsonAsync(
+            AttachUrl(queryId),
+            new { fileId = bobFileId },
+            TestContext.Current.CancellationToken);
+
+        using var alice = NewClient("alice");
+        var response = await alice.DeleteAsync(
+            DetachUrl(queryId, bobFileId),
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Equal(1, CountAttachments(queryId));
+    }
+
+    [Fact]
+    public async Task Provider_lists_attachments_as_a_party()
+    {
+        var (queryId, bobFileId, _) = Seed();
+
+        using var bob = NewClient("bob");
+        await bob.PostAsJsonAsync(
+            AttachUrl(queryId),
+            new { fileId = bobFileId },
+            TestContext.Current.CancellationToken);
+
+        // alice is the provider: a party, may list.
+        using var alice = NewClient("alice");
+        var response = await alice.GetAsync(AttachUrl(queryId), TestContext.Current.CancellationToken);
+        var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True(response.StatusCode == HttpStatusCode.OK,
+            $"Expected 200, got {(int)response.StatusCode} ({response.StatusCode}): {body}");
+
+        using var doc = JsonDocument.Parse(body);
+        var item = Assert.Single(doc.RootElement.EnumerateArray());
+        Assert.Equal(bobFileId, item.GetProperty("fileId").GetInt64());
+        Assert.Equal("bob", item.GetProperty("ownerId").GetString());
+    }
+
+    [Fact]
+    public async Task Third_party_cannot_list_attachments()
+    {
+        var (queryId, bobFileId, _) = Seed();
+
+        using var bob = NewClient("bob");
+        await bob.PostAsJsonAsync(
+            AttachUrl(queryId),
+            new { fileId = bobFileId },
+            TestContext.Current.CancellationToken);
+
+        using var carol = NewClient("carol");
+        var response = await carol.GetAsync(AttachUrl(queryId), TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+}

src/test/Yavsc.Api.Tests/HairCutQueryApiControllerTests.cs

@@ -0,0 +1,120 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.EntityFrameworkCore;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Models;
+using Yavsc.Models.Haircut;
+using Yavsc.Models.Relationship;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class HairCutQueryApiControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public HairCutQueryApiControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+        return http;
+    }
+
+    [Fact]
+    public async Task Billing_brush_route_supports_crud()
+    {
+        _fixture.ResetAndSeedHaircutGraph();
+        using var http = NewClient();
+
+        var prestationId = await GetPrestationIdAsync();
+
+        var createPayload = new HairCutQuery
+        {
+            ActivityCode = "brush",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(5),
+            Location = new Location
+            {
+                Address = "2 rue de la Coupe",
+                Latitude = 48.8570,
+                Longitude = 2.3525,
+            },
+            PrestationId = prestationId,
+            AdditionalInfo = "Brushing test",
+            Status = QueryStatus.Inserted,
+            Description = "Haircut create",
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Brush", createPayload, TestContext.Current.CancellationToken);
+        if (createResponse.StatusCode != HttpStatusCode.Created)
+        {
+            var body = await createResponse.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+            Assert.Fail($"Unexpected status {createResponse.StatusCode}: {body}");
+        }
+
+        var created = await createResponse.Content.ReadFromJsonAsync<HairCutQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.NotEqual(0, created!.Id);
+        Assert.Equal("alice", created.ClientId);
+
+        var getResponse = await http.GetAsync($"/api/v1/billing/Brush/{created.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, getResponse.StatusCode);
+
+        var fetched = await getResponse.Content.ReadFromJsonAsync<HairCutQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(fetched);
+        Assert.Equal(created.Id, fetched!.Id);
+        Assert.Equal("Brushing test", fetched.AdditionalInfo);
+
+        fetched.AdditionalInfo = "Brushing modifié";
+        var putResponse = await http.PutAsJsonAsync($"/api/v1/billing/Brush/{fetched.Id}", fetched, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.NoContent, putResponse.StatusCode);
+
+        var deleteResponse = await http.DeleteAsync($"/api/v1/billing/Brush/{fetched.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, deleteResponse.StatusCode);
+
+        var missingResponse = await http.GetAsync($"/api/v1/billing/Brush/{fetched.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.NotFound, missingResponse.StatusCode);
+    }
+
+    [Fact]
+    public async Task Billing_brush_route_exposes_prestation_catalog()
+    {
+        _fixture.ResetAndSeedHaircutGraph();
+        using var http = NewClient();
+
+        var response = await http.GetAsync("/api/v1/billing/Brush/prestations", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var catalog = await response.Content.ReadFromJsonAsync<List<HairPrestationDto>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(catalog);
+        Assert.NotEmpty(catalog!);
+        Assert.All(catalog!, item => Assert.False(string.IsNullOrWhiteSpace(item.Title)));
+        Assert.Contains(catalog!, item => item.Title == "Femme · Cheveux mi-longs"
+            && item.Details == "Coupe · Brushing · Aucune technique spécifique · Shampoing · Sans soins");
+    }
+
+    private async Task<long> GetPrestationIdAsync()
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        return await db.HairPrestation.Select(p => p.Id).FirstAsync(TestContext.Current.CancellationToken);
+    }
+}

src/test/Yavsc.Api.Tests/HairMultiCutQueryApiControllerTests.cs

@@ -0,0 +1,123 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Models;
+using Yavsc.Models.Haircut;
+using Yavsc.Models.Relationship;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class HairMultiCutQueryApiControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public HairMultiCutQueryApiControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+        return http;
+    }
+
+    [Fact]
+    public async Task Billing_mbrush_route_supports_crud()
+    {
+        _fixture.ResetAndSeedHaircutGraph();
+        using var http = NewClient();
+
+        var prestationIds = await GetPrestationIdsAsync();
+
+        var createPayload = new HairMultiCutQuery
+        {
+            ActivityCode = "mbrush",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(6),
+            Location = new Location
+            {
+                Address = "3 rue du Groupe",
+                Latitude = 48.8580,
+                Longitude = 2.3530,
+            },
+            Prestations = prestationIds.Select(id => new HairPrestationCollectionItem { PrestationId = id }).ToList(),
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/MBrush", createPayload, TestContext.Current.CancellationToken);
+        if (createResponse.StatusCode != HttpStatusCode.Created)
+        {
+            var body = await createResponse.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+            Assert.Fail($"Unexpected status {createResponse.StatusCode}: {body}");
+        }
+
+        var created = await createResponse.Content.ReadFromJsonAsync<HairMultiCutQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.NotEqual(0, created!.Id);
+        Assert.Equal("alice", created.ClientId);
+        Assert.Equal(2, created.Prestations.Count);
+
+        var getResponse = await http.GetAsync($"/api/v1/billing/MBrush/{created.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, getResponse.StatusCode);
+
+        var fetched = await getResponse.Content.ReadFromJsonAsync<HairMultiCutQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(fetched);
+        Assert.Equal(created.Id, fetched!.Id);
+        Assert.Equal(2, fetched.Prestations.Count);
+
+        fetched.Status = QueryStatus.Accepted;
+        var putResponse = await http.PutAsJsonAsync($"/api/v1/billing/MBrush/{fetched.Id}", fetched, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.NoContent, putResponse.StatusCode);
+
+        var deleteResponse = await http.DeleteAsync($"/api/v1/billing/MBrush/{fetched.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, deleteResponse.StatusCode);
+
+        var missingResponse = await http.GetAsync($"/api/v1/billing/MBrush/{fetched.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.NotFound, missingResponse.StatusCode);
+    }
+
+    [Fact]
+    public async Task Billing_mbrush_route_exposes_prestation_catalog()
+    {
+        _fixture.ResetAndSeedHaircutGraph();
+        using var http = NewClient();
+
+        var response = await http.GetAsync("/api/v1/billing/MBrush/prestations", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        var catalog = await response.Content.ReadFromJsonAsync<List<HairPrestationDto>>(TestContext.Current.CancellationToken);
+        Assert.NotNull(catalog);
+        Assert.NotEmpty(catalog!);
+        Assert.All(catalog!, item => Assert.False(string.IsNullOrWhiteSpace(item.Details)));
+        Assert.Contains(catalog!, item => item.Title == "Femme · Cheveux mi-longs"
+            && item.Details == "Coupe · Brushing · Aucune technique spécifique · Shampoing · Sans soins");
+    }
+
+    private async Task<List<long>> GetPrestationIdsAsync()
+    {
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+        return await db.HairPrestation
+            .OrderBy(p => p.Id)
+            .Select(p => p.Id)
+            .Take(2)
+            .ToListAsync(TestContext.Current.CancellationToken);
+    }
+}

src/test/Yavsc.Api.Tests/HomeControllerTests.cs

@@ -0,0 +1,69 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.FileProviders;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Controllers;
+using Yavsc.Models.Workflow;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class HomeControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public HomeControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    [Fact]
+    public async Task Index_does_not_list_activity_without_declaration()
+    {
+        _fixture.ResetAndSeedActivityGraph();
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<Yavsc.Models.ApplicationDbContext>();
+
+        var controller = new HomeController(
+            NullLogger<HomeController>.Instance,
+            localizer: null!,
+            context: db,
+            settingsOptions: Options.Create(new SiteSettings()),
+            env: new TestEnvironment());
+
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext
+            {
+                User = new ClaimsPrincipal(new ClaimsIdentity(new[]
+                {
+                    new Claim("sub", "alice"),
+                    new Claim(ClaimTypes.NameIdentifier, "alice")
+                }, "Bearer"))
+            }
+        };
+
+        var result = await controller.Index(id: null);
+        var view = Assert.IsType<ViewResult>(result);
+        var model = Assert.IsAssignableFrom<IEnumerable<Activity>>(view.Model);
+
+        Assert.Contains(model, a => a.Code == "dev");
+        Assert.DoesNotContain(model, a => a.Code == "ghost");
+    }
+
+    private sealed class TestEnvironment : IWebHostEnvironment
+    {
+        public string ApplicationName { get; set; } = "Yavsc.Api.Test";
+        public IFileProvider WebRootFileProvider { get; set; } = null!;
+        public string WebRootPath { get; set; } = string.Empty;
+        public string EnvironmentName { get; set; } = "Development";
+        public string ContentRootPath { get; set; } = string.Empty;
+        public IFileProvider ContentRootFileProvider { get; set; } = null!;
+    }
+}

src/test/Yavsc.Api.Tests/RdvQueryApiControllerTests.cs

@@ -0,0 +1,229 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using Yavsc;
+using Yavsc.Api.Test.Fixtures;
+using Yavsc.Models.Workflow;
+using Yavsc.Tests.Shared;
+
+namespace Yavsc.Api.Test;
+
+[Collection("Yavsc Api")]
+public sealed class RdvQueryApiControllerTests : IClassFixture<ApiWebServerFixture>
+{
+    private readonly ApiWebServerFixture _fixture;
+
+    public RdvQueryApiControllerTests(ApiWebServerFixture fixture)
+    {
+        _fixture = fixture;
+    }
+
+    private HttpClient NewClient(string subject = "alice", string scope = "api")
+    {
+        var handler = new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+        };
+
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri(_fixture.BaseAddress)
+        };
+        http.DefaultRequestHeaders.Authorization =
+            new AuthenticationHeaderValue("Bearer", TestTokenIssuer.Issue(subject, scope));
+        return http;
+    }
+
+    [Fact]
+    public async Task Billing_rdv_route_supports_crud()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient();
+
+        var createPayload = new RdvQuery
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(2),
+            Location = new Yavsc.Models.Relationship.Location
+            {
+                Address = "1 rue du Test",
+                Latitude = 48.8566,
+                Longitude = 2.3522,
+            },
+            Reason = "Second rendez-vous",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+
+        var created = await createResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.NotEqual(0, created!.Id);
+        Assert.Equal("alice", created.ClientId);
+
+        var getResponse = await http.GetAsync($"/api/v1/billing/Rdv/{created.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, getResponse.StatusCode);
+
+        var fetched = await getResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(fetched);
+        Assert.Equal(created.Id, fetched!.Id);
+        Assert.Equal("Second rendez-vous", fetched.Reason);
+
+        fetched.Reason = "Rendez-vous modifié";
+        var putResponse = await http.PutAsJsonAsync($"/api/v1/billing/Rdv/{fetched.Id}", fetched, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.NoContent, putResponse.StatusCode);
+
+        var deleteResponse = await http.DeleteAsync($"/api/v1/billing/Rdv/{fetched.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, deleteResponse.StatusCode);
+
+        var missingResponse = await http.GetAsync($"/api/v1/billing/Rdv/{fetched.Id}", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.NotFound, missingResponse.StatusCode);
+    }
+
+    [Fact]
+    public async Task PostQuery_ignores_client_field_and_uses_authenticated_user()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(2),
+            Location = new
+            {
+                Address = "2 rue du Test",
+                Latitude = 48.8567,
+                Longitude = 2.3523,
+            },
+            Reason = "Rendez-vous sans champ client",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+
+        var created = await createResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.Equal("alice", created!.ClientId);
+    }
+
+    [Fact]
+    public async Task PostQuery_accepts_local_datetime_and_persists_as_utc()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var localEventDate = DateTime.Now.AddDays(2);
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = localEventDate,
+            Location = new
+            {
+                Address = "3 rue du Test",
+                Latitude = 48.8568,
+                Longitude = 2.3524,
+            },
+            Reason = "Rendez-vous date locale",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+
+        var created = await createResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.Equal(DateTimeKind.Utc, created!.EventDate.Kind);
+    }
+
+    [Fact]
+    public async Task PostQuery_with_unknown_location_id_creates_location_and_succeeds()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(3),
+            Location = new
+            {
+                Id = 999999L,
+                Address = "4 rue du Test",
+                Latitude = 48.8569,
+                Longitude = 2.3525,
+            },
+            Reason = "Rendez-vous id location inconnu",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        var body = await createResponse.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+
+        Assert.True(createResponse.StatusCode == HttpStatusCode.Created, $"Unexpected status {(int)createResponse.StatusCode} ({createResponse.StatusCode}): {body}");
+
+        var created = await createResponse.Content.ReadFromJsonAsync<RdvQuery>(TestContext.Current.CancellationToken);
+        Assert.NotNull(created);
+        Assert.NotNull(created!.Location);
+        Assert.True(created.Location.Id > 0);
+        Assert.NotEqual(999999L, created.Location.Id);
+        Assert.Equal("alice", created.ClientId);
+    }
+
+    [Fact]
+    public async Task PostQuery_without_location_returns_bad_request()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(1),
+            Reason = "Rendez-vous sans location",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.BadRequest, createResponse.StatusCode);
+    }
+
+    [Fact]
+    public async Task PostQuery_with_unknown_location_id_and_missing_address_returns_bad_request()
+    {
+        _fixture.ResetAndSeedRdvQueryGraph();
+        using var http = NewClient(subject: "alice");
+
+        var createPayload = new
+        {
+            ActivityCode = "dev",
+            PerformerId = "alice",
+            Consent = true,
+            EventDate = DateTime.UtcNow.AddDays(1),
+            Location = new
+            {
+                Id = 777777L,
+                Address = "",
+                Latitude = 0.0,
+                Longitude = 0.0,
+            },
+            Reason = "Rendez-vous location invalide",
+            Status = QueryStatus.Inserted,
+        };
+
+        var createResponse = await http.PostAsJsonAsync("/api/v1/billing/Rdv", createPayload, TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.BadRequest, createResponse.StatusCode);
+    }
+}

src/test/Yavsc.Api.Tests/Yavsc.Api.Tests.csproj

@@ -0,0 +1,33 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+    <RootNamespace>Yavsc.Api.Tests</RootNamespace>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <AssemblyVersion>1.1.0.0</AssemblyVersion>
+    <FileVersion>1.1.0.0</FileVersion>
+    <InformationalVersion>1.1.0-estimate.1+364.Branch.feature-estimate.Sha.3d6ab6e72f9ba4ccfa250a1cce154b550281405e</InformationalVersion>
+    <Version>1.1.0-estimate.1</Version>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <PackageReference Include="xunit.v3" />
+    <PackageReference Include="xunit.v3.common" />
+    <PackageReference Include="xunit.v3.extensibility.core" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\Yavsc.Abstract\Yavsc.Abstract.csproj" />
+    <ProjectReference Include="..\..\Yavsc.Server\Yavsc.Server.csproj" />
+    <ProjectReference Include="..\..\Yavsc.Api\Yavsc.Api.csproj" />
+    <ProjectReference Include="..\..\Yavsc.Org\Yavsc.Org.csproj" />
+    <ProjectReference Include="..\Yavsc.Tests.Shared\Yavsc.Tests.Shared.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+</Project>