feat: add CRUD forms with Server Actions for establishments, users, classes, students

server/app/dashboard/classes/[id]/DeleteClassDialog.tsx

@@ -0,0 +1,31 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { deleteClass } from "./actions";
+
+export function DeleteClassDialog({ classId, className: name }: { classId: string; className: string }) {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <>
+      <Button variant="destructive" onClick={() => setOpen(true)}>Supprimer</Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Supprimer la classe</DialogTitle>
+          </DialogHeader>
+          <p>Êtes-vous sûr de vouloir supprimer <strong>{name}</strong> ? Cette action est irréversible.</p>
+          <div className="flex justify-end gap-2">
+            <Button variant="outline" onClick={() => setOpen(false)}>Annuler</Button>
+            <form action={deleteClass}>
+              <input type="hidden" name="id" value={classId} />
+              <Button type="submit" variant="destructive">Supprimer</Button>
+            </form>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

server/app/dashboard/classes/[id]/actions.ts

@@ -0,0 +1,22 @@
+"use server";
+
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+
+export async function deleteClass(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const id = formData.get("id") as string;
+  if (!id) return;
+
+  const establishmentId = session.user.establishmentId;
+  await prisma.class.deleteMany({
+    where: { id, ...(establishmentId ? { establishmentId } : {}) },
+  });
+
+  redirect("/dashboard/classes");
+}

server/app/dashboard/classes/[id]/page.tsx

@@ -0,0 +1,74 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect, notFound } from "next/navigation";
+import { Card, CardContent } from "@/components/ui/card";
+import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+import { Badge } from "@/components/ui/badge";
+import { DeleteClassDialog } from "./DeleteClassDialog";
+
+export const dynamic = "force-dynamic";
+
+export default async function ClassDetailPage({ params }: { params: { id: string } }) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const establishmentId = session.user.establishmentId;
+  const cls = await prisma.class.findFirst({
+    where: { id: params.id, ...(establishmentId ? { establishmentId } : {}) },
+    include: { students: true },
+  });
+
+  if (!cls) notFound();
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">{cls.name}</h1>
+        <DeleteClassDialog classId={cls.id} className={cls.name} />
+      </div>
+      <Card>
+        <CardContent className="pt-6 space-y-4">
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Niveau :</span>
+            <Badge variant="secondary">{cls.level}</Badge>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Étudiants :</span>
+            <span>{cls.students.length}</span>
+          </div>
+        </CardContent>
+      </Card>
+
+      <h2 className="text-2xl font-bold">Étudiants</h2>
+      <Card>
+        <CardContent className="pt-6">
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Nom</TableHead>
+                <TableHead>Email</TableHead>
+                <TableHead>Code activation</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {cls.students.map((s) => (
+                <TableRow key={s.id}>
+                  <TableCell className="font-medium">{s.firstName} {s.lastName}</TableCell>
+                  <TableCell>{s.email}</TableCell>
+                  <TableCell>{s.activationCode || "-"}</TableCell>
+                </TableRow>
+              ))}
+              {cls.students.length === 0 && (
+                <TableRow>
+                  <TableCell colSpan={3} className="text-center text-muted-foreground">Aucun étudiant</TableCell>
+                </TableRow>
+              )}
+            </TableBody>
+          </Table>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/classes/new/page.tsx

@@ -0,0 +1,67 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
+import { z } from "zod";
+
+export const dynamic = "force-dynamic";
+
+const schema = z.object({
+  name: z.string().min(2),
+  level: z.string().min(1),
+});
+
+async function createClass(formData: FormData) {
+  "use server";
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const parsed = schema.safeParse(Object.fromEntries(formData));
+  if (!parsed.success) return;
+
+  await prisma.class.create({
+    data: {
+      name: parsed.data.name,
+      level: parsed.data.level,
+      establishmentId: session.user.establishmentId!,
+    },
+  });
+
+  redirect("/dashboard/classes");
+}
+
+export default async function NewClassPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Nouvelle classe</h1>
+      <Card>
+        <CardHeader>
+          <CardTitle>Créer une classe</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form action={createClass} className="space-y-4">
+            <div className="space-y-2">
+              <label htmlFor="name" className="text-sm font-medium">Nom</label>
+              <Input id="name" name="name" required minLength={2} />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="level" className="text-sm font-medium">Niveau</label>
+              <Input id="level" name="level" required minLength={1} />
+            </div>
+            <div className="flex justify-end">
+              <Button type="submit">Créer</Button>
+            </div>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/classes/page.tsx

@@ -3,7 +3,9 @@ import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth-config";
 import { redirect } from "next/navigation";
 import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
-import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Card, CardContent } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import Link from "next/link";
 
 export const dynamic = "force-dynamic";
 
@@ -21,7 +23,12 @@ export default async function ClassesPage() {
 
   return (
     <div className="space-y-6">
-      <h1 className="text-3xl font-bold">Classes</h1>
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Classes</h1>
+        <Link href="/dashboard/classes/new">
+          <Button>Ajouter</Button>
+        </Link>
+      </div>
       <Card>
         <CardContent className="pt-6">
           <Table>

server/app/dashboard/students/[id]/DeleteStudentDialog.tsx

@@ -0,0 +1,31 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { deleteStudent } from "./actions";
+
+export function DeleteStudentDialog({ studentId, studentName }: { studentId: string; studentName: string }) {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <>
+      <Button variant="destructive" onClick={() => setOpen(true)}>Supprimer</Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Supprimer l'étudiant</DialogTitle>
+          </DialogHeader>
+          <p>Êtes-vous sûr de vouloir supprimer <strong>{studentName}</strong> ? Cette action est irréversible.</p>
+          <div className="flex justify-end gap-2">
+            <Button variant="outline" onClick={() => setOpen(false)}>Annuler</Button>
+            <form action={deleteStudent}>
+              <input type="hidden" name="id" value={studentId} />
+              <Button type="submit" variant="destructive">Supprimer</Button>
+            </form>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

server/app/dashboard/students/[id]/actions.ts

@@ -0,0 +1,60 @@
+"use server";
+
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+
+function generateCode(): string {
+  const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  let code = "";
+  for (let i = 0; i < 6; i++) {
+    code += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return code;
+}
+
+export async function deleteStudent(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const id = formData.get("id") as string;
+  if (!id) return;
+
+  const establishmentId = session.user.establishmentId;
+  await prisma.student.deleteMany({
+    where: {
+      id,
+      class: establishmentId ? { establishmentId } : undefined,
+    },
+  });
+
+  redirect("/dashboard/students");
+}
+
+export async function generateActivationCodeAction(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const id = formData.get("id") as string;
+  if (!id) return;
+
+  const establishmentId = session.user.establishmentId;
+  const student = await prisma.student.findFirst({
+    where: {
+      id,
+      class: establishmentId ? { establishmentId } : undefined,
+    },
+  });
+
+  if (!student) return;
+
+  await prisma.student.update({
+    where: { id },
+    data: { activationCode: generateCode() },
+  });
+
+  redirect(`/dashboard/students/${id}`);
+}

server/app/dashboard/students/[id]/page.tsx

@@ -0,0 +1,61 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect, notFound } from "next/navigation";
+import { Card, CardContent } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { DeleteStudentDialog } from "./DeleteStudentDialog";
+import { generateActivationCodeAction } from "./actions";
+
+export const dynamic = "force-dynamic";
+
+export default async function StudentDetailPage({ params }: { params: { id: string } }) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const establishmentId = session.user.establishmentId;
+  const student = await prisma.student.findFirst({
+    where: {
+      id: params.id,
+      class: establishmentId ? { establishmentId } : undefined,
+    },
+    include: { class: true },
+  });
+
+  if (!student) notFound();
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">{student.firstName} {student.lastName}</h1>
+        <DeleteStudentDialog studentId={student.id} studentName={`${student.firstName} ${student.lastName}`} />
+      </div>
+      <Card>
+        <CardContent className="pt-6 space-y-4">
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Email :</span>
+            <span>{student.email}</span>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Classe :</span>
+            <Badge variant="secondary">{student.class.name} ({student.class.level})</Badge>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Code d'activation :</span>
+            {student.activationCode ? (
+              <Input value={student.activationCode} readOnly className="w-32 text-center font-mono" />
+            ) : (
+              <form action={generateActivationCodeAction} className="flex items-center gap-2">
+                <input type="hidden" name="id" value={student.id} />
+                <Button type="submit" variant="outline" size="sm">Générer code</Button>
+              </form>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/students/new/page.tsx

@@ -0,0 +1,100 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
+import { Select } from "@/components/ui/select";
+import { z } from "zod";
+
+export const dynamic = "force-dynamic";
+
+const schema = z.object({
+  firstName: z.string().min(2),
+  lastName: z.string().min(2),
+  email: z.string().email(),
+  classId: z.string().min(1),
+});
+
+function generateActivationCode(): string {
+  const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  let code = "";
+  for (let i = 0; i < 6; i++) {
+    code += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return code;
+}
+
+async function createStudent(formData: FormData) {
+  "use server";
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const parsed = schema.safeParse(Object.fromEntries(formData));
+  if (!parsed.success) return;
+
+  await prisma.student.create({
+    data: {
+      firstName: parsed.data.firstName,
+      lastName: parsed.data.lastName,
+      email: parsed.data.email,
+      classId: parsed.data.classId,
+      activationCode: generateActivationCode(),
+    },
+  });
+
+  redirect("/dashboard/students");
+}
+
+export default async function NewStudentPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const establishmentId = session.user.establishmentId;
+  const classes = await prisma.class.findMany({
+    where: establishmentId ? { establishmentId } : {},
+    orderBy: { name: "asc" },
+  });
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Nouvel étudiant</h1>
+      <Card>
+        <CardHeader>
+          <CardTitle>Créer un étudiant</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form action={createStudent} className="space-y-4">
+            <div className="space-y-2">
+              <label htmlFor="firstName" className="text-sm font-medium">Prénom</label>
+              <Input id="firstName" name="firstName" required minLength={2} />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="lastName" className="text-sm font-medium">Nom</label>
+              <Input id="lastName" name="lastName" required minLength={2} />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="email" className="text-sm font-medium">Email</label>
+              <Input id="email" name="email" type="email" required />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="classId" className="text-sm font-medium">Classe</label>
+              <Select id="classId" name="classId" required>
+                <option value="">Choisir une classe</option>
+                {classes.map((c) => (
+                  <option key={c.id} value={c.id}>{c.name} ({c.level})</option>
+                ))}
+              </Select>
+            </div>
+            <div className="flex justify-end">
+              <Button type="submit">Créer</Button>
+            </div>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/students/page.tsx

@@ -3,8 +3,10 @@ import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth-config";
 import { redirect } from "next/navigation";
 import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
-import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Card, CardContent } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import Link from "next/link";
 
 export const dynamic = "force-dynamic";
 
@@ -22,7 +24,12 @@ export default async function StudentsPage() {
 
   return (
     <div className="space-y-6">
-      <h1 className="text-3xl font-bold">Étudiants</h1>
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Étudiants</h1>
+        <Link href="/dashboard/students/new">
+          <Button>Ajouter</Button>
+        </Link>
+      </div>
       <Card>
         <CardContent className="pt-6">
           <Table>

server/app/dashboard/users/[id]/DeleteUserButton.tsx

@@ -0,0 +1,66 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { deleteUser } from "../actions";
+
+export default function DeleteUserButton({
+  userId,
+  currentUserId,
+}: {
+  userId: string;
+  currentUserId: string;
+}) {
+  const [open, setOpen] = useState(false);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  if (userId === currentUserId) {
+    return null;
+  }
+
+  async function handleDelete() {
+    setLoading(true);
+    setError(null);
+    try {
+      await deleteUser(userId);
+    } catch (err: any) {
+      setError(err.message || "Une erreur est survenue");
+      setLoading(false);
+    }
+  }
+
+  return (
+    <>
+      <Button variant="destructive" onClick={() => setOpen(true)}>
+        Supprimer
+      </Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Confirmer la suppression</DialogTitle>
+          </DialogHeader>
+          <div className="space-y-4">
+            <p className="text-sm text-muted-foreground">
+              Êtes-vous sûr de vouloir supprimer cet utilisateur ? Cette action est irréversible.
+            </p>
+            {error && (
+              <div className="rounded-md bg-destructive/10 p-3 text-sm text-destructive">
+                {error}
+              </div>
+            )}
+            <div className="flex justify-end gap-2">
+              <Button variant="outline" onClick={() => setOpen(false)} disabled={loading}>
+                Annuler
+              </Button>
+              <Button variant="destructive" onClick={handleDelete} disabled={loading}>
+                {loading ? "Suppression..." : "Supprimer"}
+              </Button>
+            </div>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

server/app/dashboard/users/[id]/page.tsx

@@ -0,0 +1,72 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect, notFound } from "next/navigation";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import Link from "next/link";
+import DeleteUserButton from "./DeleteUserButton";
+
+export const dynamic = "force-dynamic";
+
+export default async function UserDetailPage({ params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") redirect("/dashboard");
+
+  const user = await prisma.user.findUnique({
+    where: { id },
+    include: { establishment: true },
+  });
+
+  if (!user) notFound();
+
+  if (!isSuperadmin && user.establishmentId !== session.user.establishmentId) {
+    redirect("/dashboard/users");
+  }
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Détail de l'utilisateur</h1>
+      <Card>
+        <CardHeader>
+          <CardTitle>{user.email}</CardTitle>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Rôle :</span>
+            <Badge
+              variant={
+                user.role === "superadmin"
+                  ? "default"
+                  : user.role === "admin"
+                  ? "secondary"
+                  : "outline"
+              }
+            >
+              {user.role}
+            </Badge>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Établissement :</span>
+            <span>{user.establishment?.name || "-"}</span>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Créé le :</span>
+            <span>{new Date(user.createdAt).toLocaleDateString("fr-FR")}</span>
+          </div>
+          <div className="flex gap-2 pt-4">
+            <Link href="/dashboard/users">
+              <Button variant="outline">Retour</Button>
+            </Link>
+            <DeleteUserButton userId={user.id} currentUserId={session.user.id as string} />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/users/actions.ts

@@ -0,0 +1,75 @@
+'use server';
+
+import { z } from "zod";
+import { prisma } from "@/lib/prisma";
+import { hashPassword } from "@/lib/auth";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { revalidatePath } from "next/cache";
+
+const createUserSchema = z.object({
+  email: z.string().email("Email invalide"),
+  password: z.string().min(8, "Le mot de passe doit faire au moins 8 caractères"),
+  role: z.enum(["admin", "teacher"], { message: "Rôle invalide" }),
+  establishmentId: z.string().optional().nullable(),
+});
+
+export async function createUser(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) throw new Error("Non authentifié");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") throw new Error("Accès interdit");
+
+  const raw = Object.fromEntries(formData);
+  const parsed = createUserSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(parsed.error.issues.map((e: any) => e.message).join(", "));
+  }
+
+  const { email, password, role, establishmentId } = parsed.data;
+
+  const finalEstablishmentId = isSuperadmin
+    ? (establishmentId || null)
+    : session.user.establishmentId;
+
+  const existing = await prisma.user.findUnique({ where: { email } });
+  if (existing) throw new Error("Cet email est déjà utilisé");
+
+  const hashed = await hashPassword(password);
+
+  await prisma.user.create({
+    data: {
+      email,
+      password: hashed,
+      role,
+      establishmentId: finalEstablishmentId,
+    },
+  });
+
+  revalidatePath("/dashboard/users");
+  redirect("/dashboard/users");
+}
+
+export async function deleteUser(userId: string) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) throw new Error("Non authentifié");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") throw new Error("Accès interdit");
+
+  if (userId === session.user.id) throw new Error("Vous ne pouvez pas supprimer votre propre compte");
+
+  const user = await prisma.user.findUnique({ where: { id: userId } });
+  if (!user) throw new Error("Utilisateur introuvable");
+
+  if (!isSuperadmin && user.establishmentId !== session.user.establishmentId) {
+    throw new Error("Accès interdit");
+  }
+
+  await prisma.user.delete({ where: { id: userId } });
+
+  revalidatePath("/dashboard/users");
+  redirect("/dashboard/users");
+}

server/app/dashboard/users/new/NewUserForm.tsx

@@ -0,0 +1,89 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { Card, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Select } from "@/components/ui/select";
+import { Button } from "@/components/ui/button";
+import { createUser } from "../actions";
+
+export default function NewUserForm({
+  establishments,
+  isSuperadmin,
+}: {
+  establishments: any[];
+  isSuperadmin: boolean;
+}) {
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+  const router = useRouter();
+
+  async function handleSubmit(formData: FormData) {
+    setLoading(true);
+    setError(null);
+    try {
+      await createUser(formData);
+    } catch (err: any) {
+      setError(err.message || "Une erreur est survenue");
+      setLoading(false);
+    }
+  }
+
+  return (
+    <Card>
+      <CardContent className="pt-6">
+        <form action={handleSubmit} className="space-y-4">
+          {error && (
+            <div className="rounded-md bg-destructive/10 p-3 text-sm text-destructive">
+              {error}
+            </div>
+          )}
+          <div>
+            <label className="block text-sm font-medium mb-1">Email</label>
+            <Input type="email" name="email" required />
+          </div>
+          <div>
+            <label className="block text-sm font-medium mb-1">Mot de passe</label>
+            <Input type="password" name="password" minLength={8} required />
+            <p className="text-xs text-muted-foreground mt-1">Minimum 8 caractères</p>
+          </div>
+          <div>
+            <label className="block text-sm font-medium mb-1">Rôle</label>
+            <Select name="role" required>
+              <option value="">Choisir un rôle</option>
+              <option value="admin">Admin</option>
+              <option value="teacher">Teacher</option>
+            </Select>
+          </div>
+          {isSuperadmin && (
+            <div>
+              <label className="block text-sm font-medium mb-1">Établissement</label>
+              <Select name="establishmentId">
+                <option value="">Aucun</option>
+                {establishments.map((e) => (
+                  <option key={e.id} value={e.id}>
+                    {e.name}
+                  </option>
+                ))}
+              </Select>
+            </div>
+          )}
+          <div className="flex gap-2 pt-2">
+            <Button type="submit" disabled={loading}>
+              {loading ? "Création..." : "Créer"}
+            </Button>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => router.push("/dashboard/users")}
+              disabled={loading}
+            >
+              Annuler
+            </Button>
+          </div>
+        </form>
+      </CardContent>
+    </Card>
+  );
+}

server/app/dashboard/users/new/page.tsx

@@ -0,0 +1,26 @@
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { prisma } from "@/lib/prisma";
+import NewUserForm from "./NewUserForm";
+
+export const dynamic = "force-dynamic";
+
+export default async function NewUserPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") redirect("/dashboard");
+
+  const establishments = isSuperadmin
+    ? await prisma.establishment.findMany({ orderBy: { name: "asc" } })
+    : [];
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Nouvel utilisateur</h1>
+      <NewUserForm establishments={establishments} isSuperadmin={isSuperadmin} />
+    </div>
+  );
+}

server/app/dashboard/users/page.tsx

@@ -0,0 +1,88 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import Link from "next/link";
+import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+
+export const dynamic = "force-dynamic";
+
+export default async function UsersPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  const establishmentId = session.user.establishmentId;
+
+  if (!isSuperadmin && session.user.role !== "admin") redirect("/dashboard");
+
+  const users = await prisma.user.findMany({
+    where: isSuperadmin ? {} : { establishmentId },
+    include: { establishment: true },
+    orderBy: { createdAt: "desc" },
+  });
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Utilisateurs</h1>
+        <Link href="/dashboard/users/new">
+          <Button>Ajouter</Button>
+        </Link>
+      </div>
+      <Card>
+        <CardHeader>
+          <CardTitle>Liste des utilisateurs</CardTitle>
+        </CardHeader>
+        <CardContent className="pt-0">
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Email</TableHead>
+                <TableHead>Rôle</TableHead>
+                <TableHead>Établissement</TableHead>
+                <TableHead>Créé le</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {users.map((user) => (
+                <TableRow key={user.id}>
+                  <TableCell className="font-medium">
+                    <Link href={`/dashboard/users/${user.id}`} className="hover:underline">
+                      {user.email}
+                    </Link>
+                  </TableCell>
+                  <TableCell>
+                    <Badge
+                      variant={
+                        user.role === "superadmin"
+                          ? "default"
+                          : user.role === "admin"
+                          ? "secondary"
+                          : "outline"
+                      }
+                    >
+                      {user.role}
+                    </Badge>
+                  </TableCell>
+                  <TableCell>{user.establishment?.name || "-"}</TableCell>
+                  <TableCell>{new Date(user.createdAt).toLocaleDateString("fr-FR")}</TableCell>
+                </TableRow>
+              ))}
+              {users.length === 0 && (
+                <TableRow>
+                  <TableCell colSpan={4} className="text-center text-muted-foreground">
+                    Aucun utilisateur
+                  </TableCell>
+                </TableRow>
+              )}
+            </TableBody>
+          </Table>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}