portail-associations/scripts/fill_compliance_observed.mts

import { appRouter } from "../server/routers.ts";
import * as db from "../server/db.ts";
import { withEffectiveInternalAccess } from "../server/internalAccess.ts";

async function main() {
  const baseUser = await db.getUserByEmail("selectakeke973@gmail.com");
  if (!baseUser) {
    throw new Error("super admin introuvable");
  }

  const user = await withEffectiveInternalAccess(baseUser);
  const caller = appRouter.createCaller({
    req: {
      headers: {},
      socket: { remoteAddress: "127.0.0.1" },
    } as any,
    res: {} as any,
    user,
  });

  const reviewDate = "2026-06-12";

  await caller.compliance.upsertSupplier({
    id: "ovh-hosting",
    supplierName: "OVHcloud",
    service: "Hebergement VPS de production et preproduction, DNS et exposition web",
    location: "Montreal, Quebec, Canada",
    criticality: "critique",
    dpaStatus: "pending",
    reviewDate,
    owner: "Referent interne a confirmer",
    notes: "Hebergement observe sur OVHcloud via VPS avec volumes Docker distincts pour production et preproduction.",
  });

  await caller.compliance.upsertSupplier({
    id: "smtp-ovh",
    supplierName: "OVH Mail",
    service: "SMTP transactionnel pour notifications, MFA email et messages systeme",
    location: "A confirmer contractuellement",
    criticality: "elevee",
    dpaStatus: "pending",
    reviewDate,
    owner: "Referent interne a confirmer",
    notes: "Configuration SMTP OVH detectee et active dans l administration du portail.",
  });

  await caller.compliance.upsertSupplier({
    id: "google-oauth",
    supplierName: "Google",
    service: "Connexion OAuth Google pour comptes utilises sur le portail",
    location: "A confirmer contractuellement",
    criticality: "elevee",
    dpaStatus: "pending",
    reviewDate,
    owner: "Referent interne a confirmer",
    notes: "Client OAuth Google configure sur le portail.",
  });

  await caller.compliance.upsertSupplier({
    id: "meta-oauth",
    supplierName: "Meta / Facebook",
    service: "Connexion OAuth Facebook pour comptes utilises sur le portail",
    location: "A confirmer contractuellement",
    criticality: "moyenne",
    dpaStatus: "pending",
    reviewDate,
    owner: "Referent interne a confirmer",
    notes: "Client OAuth Facebook configure sur le portail.",
  });

  await caller.compliance.upsertDpa({
    id: "dpa-ovh-hosting",
    supplierId: "ovh-hosting",
    supplierName: "OVHcloud",
    status: "pending",
    signedAt: "",
    expiresAt: "",
    reviewDueAt: "2027-06-12",
    owner: "Referent interne a confirmer",
    notes: "DPA hebergeur a centraliser ou confirmer dans le centre de conformite.",
  });

  await caller.compliance.upsertDpa({
    id: "dpa-smtp-ovh",
    supplierId: "smtp-ovh",
    supplierName: "OVH Mail",
    status: "pending",
    signedAt: "",
    expiresAt: "",
    reviewDueAt: "2027-06-12",
    owner: "Referent interne a confirmer",
    notes: "DPA ou clauses RGPD du service de messagerie a centraliser.",
  });

  await caller.compliance.upsertDpa({
    id: "dpa-google-oauth",
    supplierId: "google-oauth",
    supplierName: "Google",
    status: "pending",
    signedAt: "",
    expiresAt: "",
    reviewDueAt: "2026-12-12",
    owner: "Referent interne a confirmer",
    notes: "Verifier le cadre contractuel lie a l authentification Google.",
  });

  await caller.compliance.upsertDpa({
    id: "dpa-meta-oauth",
    supplierId: "meta-oauth",
    supplierName: "Meta / Facebook",
    status: "pending",
    signedAt: "",
    expiresAt: "",
    reviewDueAt: "2026-12-12",
    owner: "Referent interne a confirmer",
    notes: "Verifier le cadre contractuel lie a l authentification Facebook.",
  });

  await caller.compliance.upsertEvidence({
    id: "evidence-backup-observed-vps",
    category: "backup_report",
    title: "Archives de sauvegarde code observees sur le VPS",
    reference: "Observation infrastructure",
    url: "",
    description:
      "Dernieres archives observees dans /home/ubuntu/backups le 2026-06-12 a 03:05 pour production et preproduction. Cette observation ne remplace pas encore une preuve complete de sauvegarde 3-2-1.",
    updatedAt: "2026-06-12T03:05:00Z",
  });

  await caller.compliance.upsertEvidence({
    id: "evidence-no-third-party-analytics",
    category: "audit_report",
    title: "Absence d analytics tiers detectee dans le code applicatif",
    reference: "Revue technique",
    url: "",
    description:
      "Aucun traceur tiers de type Google Analytics, Matomo, Plausible, Umami ou equivalent n a ete detecte dans le front et le serveur lors de la revue technique.",
    updatedAt: new Date().toISOString(),
  });

  await caller.compliance.upsertEvidence({
    id: "evidence-openmaptiles-healthcheck",
    category: "audit_report",
    title: "Diagnostic healthcheck OpenMapTiles",
    reference: "Infrastructure cartographique",
    url: "",
    description:
      "Le conteneur OpenMapTiles repond aux styles, tuiles et glyphes, mais son healthcheck /health retourne en erreur. Sujet a traiter a part du lot conformite.",
    updatedAt: new Date().toISOString(),
  });

  const result = await caller.compliance.getOperations();
  console.log(
    JSON.stringify(
      {
        suppliers: result.suppliers.length,
        dpas: result.dpas.length,
        evidence: result.evidenceCenter.length,
        backupRecords: result.backupRecords.length,
        restoreTests: result.restoreTests.length,
      },
      null,
      2,
    ),
  );
}

main().catch((error) => {
  console.error(error);
  process.exit(1);
});