feat: add CRUD forms with Server Actions for establishments, users, classes, students

server/app/dashboard/classes/[id]/DeleteClassDialog.tsx

@@ -0,0 +1,31 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { deleteClass } from "./actions";
+
+export function DeleteClassDialog({ classId, className: name }: { classId: string; className: string }) {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <>
+      <Button variant="destructive" onClick={() => setOpen(true)}>Supprimer</Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Supprimer la classe</DialogTitle>
+          </DialogHeader>
+          <p>Êtes-vous sûr de vouloir supprimer <strong>{name}</strong> ? Cette action est irréversible.</p>
+          <div className="flex justify-end gap-2">
+            <Button variant="outline" onClick={() => setOpen(false)}>Annuler</Button>
+            <form action={deleteClass}>
+              <input type="hidden" name="id" value={classId} />
+              <Button type="submit" variant="destructive">Supprimer</Button>
+            </form>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

server/app/dashboard/classes/[id]/actions.ts

@@ -0,0 +1,22 @@
+"use server";
+
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+
+export async function deleteClass(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const id = formData.get("id") as string;
+  if (!id) return;
+
+  const establishmentId = session.user.establishmentId;
+  await prisma.class.deleteMany({
+    where: { id, ...(establishmentId ? { establishmentId } : {}) },
+  });
+
+  redirect("/dashboard/classes");
+}

server/app/dashboard/classes/[id]/page.tsx

@@ -0,0 +1,74 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect, notFound } from "next/navigation";
+import { Card, CardContent } from "@/components/ui/card";
+import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+import { Badge } from "@/components/ui/badge";
+import { DeleteClassDialog } from "./DeleteClassDialog";
+
+export const dynamic = "force-dynamic";
+
+export default async function ClassDetailPage({ params }: { params: { id: string } }) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const establishmentId = session.user.establishmentId;
+  const cls = await prisma.class.findFirst({
+    where: { id: params.id, ...(establishmentId ? { establishmentId } : {}) },
+    include: { students: true },
+  });
+
+  if (!cls) notFound();
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">{cls.name}</h1>
+        <DeleteClassDialog classId={cls.id} className={cls.name} />
+      </div>
+      <Card>
+        <CardContent className="pt-6 space-y-4">
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Niveau :</span>
+            <Badge variant="secondary">{cls.level}</Badge>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Étudiants :</span>
+            <span>{cls.students.length}</span>
+          </div>
+        </CardContent>
+      </Card>
+
+      <h2 className="text-2xl font-bold">Étudiants</h2>
+      <Card>
+        <CardContent className="pt-6">
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Nom</TableHead>
+                <TableHead>Email</TableHead>
+                <TableHead>Code activation</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {cls.students.map((s) => (
+                <TableRow key={s.id}>
+                  <TableCell className="font-medium">{s.firstName} {s.lastName}</TableCell>
+                  <TableCell>{s.email}</TableCell>
+                  <TableCell>{s.activationCode || "-"}</TableCell>
+                </TableRow>
+              ))}
+              {cls.students.length === 0 && (
+                <TableRow>
+                  <TableCell colSpan={3} className="text-center text-muted-foreground">Aucun étudiant</TableCell>
+                </TableRow>
+              )}
+            </TableBody>
+          </Table>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/classes/new/page.tsx

@@ -0,0 +1,67 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
+import { z } from "zod";
+
+export const dynamic = "force-dynamic";
+
+const schema = z.object({
+  name: z.string().min(2),
+  level: z.string().min(1),
+});
+
+async function createClass(formData: FormData) {
+  "use server";
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const parsed = schema.safeParse(Object.fromEntries(formData));
+  if (!parsed.success) return;
+
+  await prisma.class.create({
+    data: {
+      name: parsed.data.name,
+      level: parsed.data.level,
+      establishmentId: session.user.establishmentId!,
+    },
+  });
+
+  redirect("/dashboard/classes");
+}
+
+export default async function NewClassPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Nouvelle classe</h1>
+      <Card>
+        <CardHeader>
+          <CardTitle>Créer une classe</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form action={createClass} className="space-y-4">
+            <div className="space-y-2">
+              <label htmlFor="name" className="text-sm font-medium">Nom</label>
+              <Input id="name" name="name" required minLength={2} />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="level" className="text-sm font-medium">Niveau</label>
+              <Input id="level" name="level" required minLength={1} />
+            </div>
+            <div className="flex justify-end">
+              <Button type="submit">Créer</Button>
+            </div>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/classes/page.tsx

@@ -3,7 +3,9 @@ import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth-config";
 import { redirect } from "next/navigation";
 import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
-import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Card, CardContent } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import Link from "next/link";
 
 export const dynamic = "force-dynamic";
 
@@ -21,7 +23,12 @@ export default async function ClassesPage() {
 
   return (
     <div className="space-y-6">
-      <h1 className="text-3xl font-bold">Classes</h1>
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Classes</h1>
+        <Link href="/dashboard/classes/new">
+          <Button>Ajouter</Button>
+        </Link>
+      </div>
       <Card>
         <CardContent className="pt-6">
           <Table>

server/app/dashboard/students/[id]/DeleteStudentDialog.tsx

@@ -0,0 +1,31 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { deleteStudent } from "./actions";
+
+export function DeleteStudentDialog({ studentId, studentName }: { studentId: string; studentName: string }) {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <>
+      <Button variant="destructive" onClick={() => setOpen(true)}>Supprimer</Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Supprimer l'étudiant</DialogTitle>
+          </DialogHeader>
+          <p>Êtes-vous sûr de vouloir supprimer <strong>{studentName}</strong> ? Cette action est irréversible.</p>
+          <div className="flex justify-end gap-2">
+            <Button variant="outline" onClick={() => setOpen(false)}>Annuler</Button>
+            <form action={deleteStudent}>
+              <input type="hidden" name="id" value={studentId} />
+              <Button type="submit" variant="destructive">Supprimer</Button>
+            </form>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

server/app/dashboard/students/[id]/actions.ts

@@ -0,0 +1,60 @@
+"use server";
+
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+
+function generateCode(): string {
+  const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  let code = "";
+  for (let i = 0; i < 6; i++) {
+    code += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return code;
+}
+
+export async function deleteStudent(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const id = formData.get("id") as string;
+  if (!id) return;
+
+  const establishmentId = session.user.establishmentId;
+  await prisma.student.deleteMany({
+    where: {
+      id,
+      class: establishmentId ? { establishmentId } : undefined,
+    },
+  });
+
+  redirect("/dashboard/students");
+}
+
+export async function generateActivationCodeAction(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const id = formData.get("id") as string;
+  if (!id) return;
+
+  const establishmentId = session.user.establishmentId;
+  const student = await prisma.student.findFirst({
+    where: {
+      id,
+      class: establishmentId ? { establishmentId } : undefined,
+    },
+  });
+
+  if (!student) return;
+
+  await prisma.student.update({
+    where: { id },
+    data: { activationCode: generateCode() },
+  });
+
+  redirect(`/dashboard/students/${id}`);
+}

server/app/dashboard/students/[id]/page.tsx

@@ -0,0 +1,61 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect, notFound } from "next/navigation";
+import { Card, CardContent } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { DeleteStudentDialog } from "./DeleteStudentDialog";
+import { generateActivationCodeAction } from "./actions";
+
+export const dynamic = "force-dynamic";
+
+export default async function StudentDetailPage({ params }: { params: { id: string } }) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const establishmentId = session.user.establishmentId;
+  const student = await prisma.student.findFirst({
+    where: {
+      id: params.id,
+      class: establishmentId ? { establishmentId } : undefined,
+    },
+    include: { class: true },
+  });
+
+  if (!student) notFound();
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">{student.firstName} {student.lastName}</h1>
+        <DeleteStudentDialog studentId={student.id} studentName={`${student.firstName} ${student.lastName}`} />
+      </div>
+      <Card>
+        <CardContent className="pt-6 space-y-4">
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Email :</span>
+            <span>{student.email}</span>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Classe :</span>
+            <Badge variant="secondary">{student.class.name} ({student.class.level})</Badge>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Code d'activation :</span>
+            {student.activationCode ? (
+              <Input value={student.activationCode} readOnly className="w-32 text-center font-mono" />
+            ) : (
+              <form action={generateActivationCodeAction} className="flex items-center gap-2">
+                <input type="hidden" name="id" value={student.id} />
+                <Button type="submit" variant="outline" size="sm">Générer code</Button>
+              </form>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/students/new/page.tsx

@@ -0,0 +1,100 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
+import { Select } from "@/components/ui/select";
+import { z } from "zod";
+
+export const dynamic = "force-dynamic";
+
+const schema = z.object({
+  firstName: z.string().min(2),
+  lastName: z.string().min(2),
+  email: z.string().email(),
+  classId: z.string().min(1),
+});
+
+function generateActivationCode(): string {
+  const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  let code = "";
+  for (let i = 0; i < 6; i++) {
+    code += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return code;
+}
+
+async function createStudent(formData: FormData) {
+  "use server";
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const parsed = schema.safeParse(Object.fromEntries(formData));
+  if (!parsed.success) return;
+
+  await prisma.student.create({
+    data: {
+      firstName: parsed.data.firstName,
+      lastName: parsed.data.lastName,
+      email: parsed.data.email,
+      classId: parsed.data.classId,
+      activationCode: generateActivationCode(),
+    },
+  });
+
+  redirect("/dashboard/students");
+}
+
+export default async function NewStudentPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+  if (!session.user.establishmentId && session.user.role !== "superadmin") redirect("/dashboard");
+
+  const establishmentId = session.user.establishmentId;
+  const classes = await prisma.class.findMany({
+    where: establishmentId ? { establishmentId } : {},
+    orderBy: { name: "asc" },
+  });
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Nouvel étudiant</h1>
+      <Card>
+        <CardHeader>
+          <CardTitle>Créer un étudiant</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form action={createStudent} className="space-y-4">
+            <div className="space-y-2">
+              <label htmlFor="firstName" className="text-sm font-medium">Prénom</label>
+              <Input id="firstName" name="firstName" required minLength={2} />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="lastName" className="text-sm font-medium">Nom</label>
+              <Input id="lastName" name="lastName" required minLength={2} />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="email" className="text-sm font-medium">Email</label>
+              <Input id="email" name="email" type="email" required />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="classId" className="text-sm font-medium">Classe</label>
+              <Select id="classId" name="classId" required>
+                <option value="">Choisir une classe</option>
+                {classes.map((c) => (
+                  <option key={c.id} value={c.id}>{c.name} ({c.level})</option>
+                ))}
+              </Select>
+            </div>
+            <div className="flex justify-end">
+              <Button type="submit">Créer</Button>
+            </div>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/students/page.tsx

@@ -3,8 +3,10 @@ import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth-config";
 import { redirect } from "next/navigation";
 import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
-import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Card, CardContent } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import Link from "next/link";
 
 export const dynamic = "force-dynamic";
 
@@ -22,7 +24,12 @@ export default async function StudentsPage() {
 
   return (
     <div className="space-y-6">
-      <h1 className="text-3xl font-bold">Étudiants</h1>
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Étudiants</h1>
+        <Link href="/dashboard/students/new">
+          <Button>Ajouter</Button>
+        </Link>
+      </div>
       <Card>
         <CardContent className="pt-6">
           <Table>

server/app/dashboard/users/[id]/DeleteUserButton.tsx

@@ -0,0 +1,66 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { deleteUser } from "../actions";
+
+export default function DeleteUserButton({
+  userId,
+  currentUserId,
+}: {
+  userId: string;
+  currentUserId: string;
+}) {
+  const [open, setOpen] = useState(false);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  if (userId === currentUserId) {
+    return null;
+  }
+
+  async function handleDelete() {
+    setLoading(true);
+    setError(null);
+    try {
+      await deleteUser(userId);
+    } catch (err: any) {
+      setError(err.message || "Une erreur est survenue");
+      setLoading(false);
+    }
+  }
+
+  return (
+    <>
+      <Button variant="destructive" onClick={() => setOpen(true)}>
+        Supprimer
+      </Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Confirmer la suppression</DialogTitle>
+          </DialogHeader>
+          <div className="space-y-4">
+            <p className="text-sm text-muted-foreground">
+              Êtes-vous sûr de vouloir supprimer cet utilisateur ? Cette action est irréversible.
+            </p>
+            {error && (
+              <div className="rounded-md bg-destructive/10 p-3 text-sm text-destructive">
+                {error}
+              </div>
+            )}
+            <div className="flex justify-end gap-2">
+              <Button variant="outline" onClick={() => setOpen(false)} disabled={loading}>
+                Annuler
+              </Button>
+              <Button variant="destructive" onClick={handleDelete} disabled={loading}>
+                {loading ? "Suppression..." : "Supprimer"}
+              </Button>
+            </div>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

server/app/dashboard/users/[id]/page.tsx

@@ -0,0 +1,72 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect, notFound } from "next/navigation";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import Link from "next/link";
+import DeleteUserButton from "./DeleteUserButton";
+
+export const dynamic = "force-dynamic";
+
+export default async function UserDetailPage({ params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") redirect("/dashboard");
+
+  const user = await prisma.user.findUnique({
+    where: { id },
+    include: { establishment: true },
+  });
+
+  if (!user) notFound();
+
+  if (!isSuperadmin && user.establishmentId !== session.user.establishmentId) {
+    redirect("/dashboard/users");
+  }
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Détail de l'utilisateur</h1>
+      <Card>
+        <CardHeader>
+          <CardTitle>{user.email}</CardTitle>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Rôle :</span>
+            <Badge
+              variant={
+                user.role === "superadmin"
+                  ? "default"
+                  : user.role === "admin"
+                  ? "secondary"
+                  : "outline"
+              }
+            >
+              {user.role}
+            </Badge>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Établissement :</span>
+            <span>{user.establishment?.name || "-"}</span>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="text-sm font-medium text-muted-foreground">Créé le :</span>
+            <span>{new Date(user.createdAt).toLocaleDateString("fr-FR")}</span>
+          </div>
+          <div className="flex gap-2 pt-4">
+            <Link href="/dashboard/users">
+              <Button variant="outline">Retour</Button>
+            </Link>
+            <DeleteUserButton userId={user.id} currentUserId={session.user.id as string} />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/dashboard/users/actions.ts

@@ -0,0 +1,75 @@
+'use server';
+
+import { z } from "zod";
+import { prisma } from "@/lib/prisma";
+import { hashPassword } from "@/lib/auth";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { revalidatePath } from "next/cache";
+
+const createUserSchema = z.object({
+  email: z.string().email("Email invalide"),
+  password: z.string().min(8, "Le mot de passe doit faire au moins 8 caractères"),
+  role: z.enum(["admin", "teacher"], { message: "Rôle invalide" }),
+  establishmentId: z.string().optional().nullable(),
+});
+
+export async function createUser(formData: FormData) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) throw new Error("Non authentifié");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") throw new Error("Accès interdit");
+
+  const raw = Object.fromEntries(formData);
+  const parsed = createUserSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(parsed.error.issues.map((e: any) => e.message).join(", "));
+  }
+
+  const { email, password, role, establishmentId } = parsed.data;
+
+  const finalEstablishmentId = isSuperadmin
+    ? (establishmentId || null)
+    : session.user.establishmentId;
+
+  const existing = await prisma.user.findUnique({ where: { email } });
+  if (existing) throw new Error("Cet email est déjà utilisé");
+
+  const hashed = await hashPassword(password);
+
+  await prisma.user.create({
+    data: {
+      email,
+      password: hashed,
+      role,
+      establishmentId: finalEstablishmentId,
+    },
+  });
+
+  revalidatePath("/dashboard/users");
+  redirect("/dashboard/users");
+}
+
+export async function deleteUser(userId: string) {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) throw new Error("Non authentifié");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") throw new Error("Accès interdit");
+
+  if (userId === session.user.id) throw new Error("Vous ne pouvez pas supprimer votre propre compte");
+
+  const user = await prisma.user.findUnique({ where: { id: userId } });
+  if (!user) throw new Error("Utilisateur introuvable");
+
+  if (!isSuperadmin && user.establishmentId !== session.user.establishmentId) {
+    throw new Error("Accès interdit");
+  }
+
+  await prisma.user.delete({ where: { id: userId } });
+
+  revalidatePath("/dashboard/users");
+  redirect("/dashboard/users");
+}

server/app/dashboard/users/new/NewUserForm.tsx

@@ -0,0 +1,89 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { Card, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Select } from "@/components/ui/select";
+import { Button } from "@/components/ui/button";
+import { createUser } from "../actions";
+
+export default function NewUserForm({
+  establishments,
+  isSuperadmin,
+}: {
+  establishments: any[];
+  isSuperadmin: boolean;
+}) {
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+  const router = useRouter();
+
+  async function handleSubmit(formData: FormData) {
+    setLoading(true);
+    setError(null);
+    try {
+      await createUser(formData);
+    } catch (err: any) {
+      setError(err.message || "Une erreur est survenue");
+      setLoading(false);
+    }
+  }
+
+  return (
+    <Card>
+      <CardContent className="pt-6">
+        <form action={handleSubmit} className="space-y-4">
+          {error && (
+            <div className="rounded-md bg-destructive/10 p-3 text-sm text-destructive">
+              {error}
+            </div>
+          )}
+          <div>
+            <label className="block text-sm font-medium mb-1">Email</label>
+            <Input type="email" name="email" required />
+          </div>
+          <div>
+            <label className="block text-sm font-medium mb-1">Mot de passe</label>
+            <Input type="password" name="password" minLength={8} required />
+            <p className="text-xs text-muted-foreground mt-1">Minimum 8 caractères</p>
+          </div>
+          <div>
+            <label className="block text-sm font-medium mb-1">Rôle</label>
+            <Select name="role" required>
+              <option value="">Choisir un rôle</option>
+              <option value="admin">Admin</option>
+              <option value="teacher">Teacher</option>
+            </Select>
+          </div>
+          {isSuperadmin && (
+            <div>
+              <label className="block text-sm font-medium mb-1">Établissement</label>
+              <Select name="establishmentId">
+                <option value="">Aucun</option>
+                {establishments.map((e) => (
+                  <option key={e.id} value={e.id}>
+                    {e.name}
+                  </option>
+                ))}
+              </Select>
+            </div>
+          )}
+          <div className="flex gap-2 pt-2">
+            <Button type="submit" disabled={loading}>
+              {loading ? "Création..." : "Créer"}
+            </Button>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => router.push("/dashboard/users")}
+              disabled={loading}
+            >
+              Annuler
+            </Button>
+          </div>
+        </form>
+      </CardContent>
+    </Card>
+  );
+}

server/app/dashboard/users/new/page.tsx

@@ -0,0 +1,26 @@
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import { prisma } from "@/lib/prisma";
+import NewUserForm from "./NewUserForm";
+
+export const dynamic = "force-dynamic";
+
+export default async function NewUserPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  if (!isSuperadmin && session.user.role !== "admin") redirect("/dashboard");
+
+  const establishments = isSuperadmin
+    ? await prisma.establishment.findMany({ orderBy: { name: "asc" } })
+    : [];
+
+  return (
+    <div className="space-y-6 max-w-xl">
+      <h1 className="text-3xl font-bold">Nouvel utilisateur</h1>
+      <NewUserForm establishments={establishments} isSuperadmin={isSuperadmin} />
+    </div>
+  );
+}

server/app/dashboard/users/page.tsx

@@ -0,0 +1,88 @@
+import { prisma } from "@/lib/prisma";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth-config";
+import { redirect } from "next/navigation";
+import Link from "next/link";
+import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+
+export const dynamic = "force-dynamic";
+
+export default async function UsersPage() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user) redirect("/login");
+
+  const isSuperadmin = session.user.role === "superadmin";
+  const establishmentId = session.user.establishmentId;
+
+  if (!isSuperadmin && session.user.role !== "admin") redirect("/dashboard");
+
+  const users = await prisma.user.findMany({
+    where: isSuperadmin ? {} : { establishmentId },
+    include: { establishment: true },
+    orderBy: { createdAt: "desc" },
+  });
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Utilisateurs</h1>
+        <Link href="/dashboard/users/new">
+          <Button>Ajouter</Button>
+        </Link>
+      </div>
+      <Card>
+        <CardHeader>
+          <CardTitle>Liste des utilisateurs</CardTitle>
+        </CardHeader>
+        <CardContent className="pt-0">
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Email</TableHead>
+                <TableHead>Rôle</TableHead>
+                <TableHead>Établissement</TableHead>
+                <TableHead>Créé le</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {users.map((user) => (
+                <TableRow key={user.id}>
+                  <TableCell className="font-medium">
+                    <Link href={`/dashboard/users/${user.id}`} className="hover:underline">
+                      {user.email}
+                    </Link>
+                  </TableCell>
+                  <TableCell>
+                    <Badge
+                      variant={
+                        user.role === "superadmin"
+                          ? "default"
+                          : user.role === "admin"
+                          ? "secondary"
+                          : "outline"
+                      }
+                    >
+                      {user.role}
+                    </Badge>
+                  </TableCell>
+                  <TableCell>{user.establishment?.name || "-"}</TableCell>
+                  <TableCell>{new Date(user.createdAt).toLocaleDateString("fr-FR")}</TableCell>
+                </TableRow>
+              ))}
+              {users.length === 0 && (
+                <TableRow>
+                  <TableCell colSpan={4} className="text-center text-muted-foreground">
+                    Aucun utilisateur
+                  </TableCell>
+                </TableRow>
+              )}
+            </TableBody>
+          </Table>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/superadmin/establishments/[id]/actions.ts

@@ -0,0 +1,38 @@
+'use server'
+
+import { prisma } from "@/lib/prisma";
+import { redirect } from "next/navigation";
+import { revalidatePath } from "next/cache";
+import { z } from "zod";
+
+const updateSchema = z.object({
+  plan: z.enum(["trial", "starter", "standard", "premium"]),
+  status: z.enum(["active", "suspended", "expired"]),
+});
+
+export async function updateSubscription(establishmentId: string, formData: FormData) {
+  const plan = formData.get("plan") as string;
+  const status = formData.get("status") as string;
+
+  const parsed = updateSchema.safeParse({ plan, status });
+  if (!parsed.success) {
+    throw new Error("Données invalides");
+  }
+
+  await prisma.subscription.update({
+    where: { establishmentId },
+    data: {
+      plan: parsed.data.plan,
+      status: parsed.data.status,
+    },
+  });
+
+  revalidatePath(`/superadmin/establishments/${establishmentId}`);
+}
+
+export async function deleteEstablishment(establishmentId: string) {
+  await prisma.establishment.delete({
+    where: { id: establishmentId },
+  });
+  redirect("/superadmin/establishments");
+}

server/app/superadmin/establishments/[id]/delete-dialog.tsx

@@ -0,0 +1,37 @@
+'use client'
+
+import { useState } from "react";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+
+export function DeleteDialog({ deleteAction }: { deleteAction: () => void }) {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <>
+      <Button variant="destructive" onClick={() => setOpen(true)}>
+        Supprimer
+      </Button>
+      <Dialog open={open} onOpenChange={setOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Confirmer la suppression</DialogTitle>
+          </DialogHeader>
+          <p className="text-sm text-muted-foreground">
+            Cette action est irréversible. L&apos;établissement et toutes ses données associées seront supprimés.
+          </p>
+          <div className="flex justify-end gap-2 mt-4">
+            <Button variant="outline" onClick={() => setOpen(false)}>
+              Annuler
+            </Button>
+            <form action={deleteAction}>
+              <Button variant="destructive" type="submit">
+                Supprimer définitivement
+              </Button>
+            </form>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

server/app/superadmin/establishments/[id]/page.tsx

@@ -0,0 +1,112 @@
+export const dynamic = "force-dynamic";
+
+import { prisma } from "@/lib/prisma";
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Select } from "@/components/ui/select";
+import { Button } from "@/components/ui/button";
+import { updateSubscription, deleteEstablishment } from "./actions";
+import { DeleteDialog } from "./delete-dialog";
+
+export default async function EstablishmentDetailPage({ params }: { params: { id: string } }) {
+  const establishment = await prisma.establishment.findUnique({
+    where: { id: params.id },
+    include: {
+      subscription: true,
+      _count: { select: { users: true, classes: true } },
+    },
+  });
+
+  if (!establishment) notFound();
+
+  const boundDelete = deleteEstablishment.bind(null, establishment.id);
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">{establishment.name}</h1>
+        <div className="flex items-center gap-2">
+          <Button variant="outline" asChild>
+            <Link href="/superadmin/establishments">Retour</Link>
+          </Button>
+          <DeleteDialog deleteAction={boundDelete} />
+        </div>
+      </div>
+
+      <div className="grid gap-6 md:grid-cols-2">
+        <Card>
+          <CardHeader>
+            <CardTitle>Informations</CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            <div className="flex justify-between text-sm">
+              <span className="text-muted-foreground">Slug</span>
+              <span className="font-medium">{establishment.slug}</span>
+            </div>
+            <div className="flex justify-between text-sm">
+              <span className="text-muted-foreground">Utilisateurs</span>
+              <span className="font-medium">{establishment._count.users}</span>
+            </div>
+            <div className="flex justify-between text-sm">
+              <span className="text-muted-foreground">Classes</span>
+              <span className="font-medium">{establishment._count.classes}</span>
+            </div>
+            <div className="flex justify-between text-sm">
+              <span className="text-muted-foreground">Créé le</span>
+              <span className="font-medium">
+                {new Date(establishment.createdAt).toLocaleDateString("fr-FR")}
+              </span>
+            </div>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Abonnement</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <form action={updateSubscription.bind(null, establishment.id)} className="space-y-4">
+              <div className="space-y-2">
+                <label htmlFor="plan" className="text-sm font-medium">
+                  Plan
+                </label>
+                <Select
+                  id="plan"
+                  name="plan"
+                  defaultValue={establishment.subscription?.plan || "trial"}
+                >
+                  <option value="trial">Trial</option>
+                  <option value="starter">Starter</option>
+                  <option value="standard">Standard</option>
+                  <option value="premium">Premium</option>
+                </Select>
+              </div>
+              <div className="space-y-2">
+                <label htmlFor="status" className="text-sm font-medium">
+                  Statut
+                </label>
+                <Select
+                  id="status"
+                  name="status"
+                  defaultValue={establishment.subscription?.status || "active"}
+                >
+                  <option value="active">Active</option>
+                  <option value="suspended">Suspended</option>
+                  <option value="expired">Expired</option>
+                </Select>
+              </div>
+              <div className="flex items-center justify-between">
+                <Badge variant={establishment.subscription?.status === "active" ? "success" : "destructive"}>
+                  {establishment.subscription?.status || "-"}
+                </Badge>
+                <Button type="submit">Mettre à jour</Button>
+              </div>
+            </form>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}

server/app/superadmin/establishments/new/actions.ts

@@ -0,0 +1,40 @@
+'use server'
+
+import { prisma } from "@/lib/prisma";
+import { redirect } from "next/navigation";
+import { z } from "zod";
+
+const schema = z.object({
+  name: z.string().min(2, "Le nom doit contenir au moins 2 caractères"),
+  slug: z.string().regex(/^[a-z0-9-]+$/, "Le slug ne peut contenir que des minuscules, chiffres et tirets"),
+});
+
+export async function createEstablishment(formData: FormData) {
+  const name = formData.get("name") as string;
+  const slug = formData.get("slug") as string;
+
+  const parsed = schema.safeParse({ name, slug });
+  if (!parsed.success) {
+    const message = parsed.error.issues.map((e) => e.message).join(", ");
+    redirect(`/superadmin/establishments/new?error=${encodeURIComponent(message)}`);
+  }
+
+  try {
+    await prisma.establishment.create({
+      data: {
+        name: parsed.data.name,
+        slug: parsed.data.slug,
+        subscription: {
+          create: {
+            plan: "trial",
+            status: "active",
+          },
+        },
+      },
+    });
+  } catch {
+    redirect(`/superadmin/establishments/new?error=${encodeURIComponent("Ce slug existe déjà ou une erreur est survenue")}`);
+  }
+
+  redirect("/superadmin/establishments");
+}

server/app/superadmin/establishments/new/page.tsx

@@ -0,0 +1,55 @@
+export const dynamic = "force-dynamic";
+
+import Link from "next/link";
+import { createEstablishment } from "./actions";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
+
+export default function NewEstablishmentPage({
+  searchParams,
+}: {
+  searchParams?: { error?: string };
+}) {
+  const error = searchParams?.error;
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Nouvel établissement</h1>
+        <Button variant="outline" asChild>
+          <Link href="/superadmin/establishments">Retour</Link>
+        </Button>
+      </div>
+      <Card>
+        <CardHeader>
+          <CardTitle>Créer un établissement</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form action={createEstablishment} className="space-y-4">
+            {error && (
+              <div className="rounded-md border border-destructive bg-destructive/10 p-3 text-sm text-destructive">
+                {error}
+              </div>
+            )}
+            <div className="space-y-2">
+              <label htmlFor="name" className="text-sm font-medium">
+                Nom
+              </label>
+              <Input id="name" name="name" placeholder="Nom de l'établissement" required />
+            </div>
+            <div className="space-y-2">
+              <label htmlFor="slug" className="text-sm font-medium">
+                Slug
+              </label>
+              <Input id="slug" name="slug" placeholder="mon-etablissement" required />
+            </div>
+            <div className="flex justify-end">
+              <Button type="submit">Créer</Button>
+            </div>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

server/app/superadmin/establishments/page.tsx

@@ -1,21 +1,34 @@
+export const dynamic = "force-dynamic";
+
 import { prisma } from "@/lib/prisma";
+import Link from "next/link";
 import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
 import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
-
+import { Button } from "@/components/ui/button";
-export const dynamic = "force-dynamic";
 
 export default async function EstablishmentsPage() {
   const establishments = await prisma.establishment.findMany({
-    include: { subscription: true, _count: { select: { users: true, classes: true } } },
+    include: {
+      subscription: true,
+      _count: { select: { users: true, classes: true } },
+    },
     orderBy: { createdAt: "desc" },
   });
 
   return (
     <div className="space-y-6">
-      <h1 className="text-3xl font-bold">Établissements</h1>
+      <div className="flex items-center justify-between">
+        <h1 className="text-3xl font-bold">Établissements</h1>
+        <Button asChild>
+          <Link href="/superadmin/establishments/new">Ajouter</Link>
+        </Button>
+      </div>
       <Card>
-        <CardContent className="pt-6">
+        <CardHeader>
+          <CardTitle>Liste des établissements</CardTitle>
+        </CardHeader>
+        <CardContent>
           <Table>
             <TableHeader>
               <TableRow>
@@ -25,28 +38,34 @@ export default async function EstablishmentsPage() {
                 <TableHead>Statut</TableHead>
                 <TableHead>Utilisateurs</TableHead>
                 <TableHead>Classes</TableHead>
-                <TableHead>Expiration</TableHead>
               </TableRow>
             </TableHeader>
             <TableBody>
               {establishments.map((e) => (
                 <TableRow key={e.id}>
-                  <TableCell className="font-medium">{e.name}</TableCell>
+                  <TableCell className="font-medium">
+                    <Link href={`/superadmin/establishments/${e.id}`} className="hover:underline">
+                      {e.name}
+                    </Link>
+                  </TableCell>
                   <TableCell>{e.slug}</TableCell>
                   <TableCell>
                     <Badge variant="secondary">{e.subscription?.plan || "-"}</Badge>
                   </TableCell>
                   <TableCell>
-                    <Badge variant={e.subscription?.status === "active" ? "success" : "destructive"}>{e.subscription?.status || "-"}</Badge>
+                    <Badge variant={e.subscription?.status === "active" ? "success" : "destructive"}>
+                      {e.subscription?.status || "-"}
+                    </Badge>
                   </TableCell>
                   <TableCell>{e._count.users}</TableCell>
                   <TableCell>{e._count.classes}</TableCell>
-                  <TableCell>{e.subscription?.expiresAt ? new Date(e.subscription.expiresAt).toLocaleDateString("fr-FR") : "-"}</TableCell>
                 </TableRow>
               ))}
               {establishments.length === 0 && (
                 <TableRow>
-                  <TableCell colSpan={7} className="text-center text-muted-foreground">Aucun établissement</TableCell>
+                  <TableCell colSpan={6} className="text-center text-muted-foreground">
+                    Aucun établissement
+                  </TableCell>
                 </TableRow>
               )}
             </TableBody>

server/lib/auth-config.ts

@@ -33,6 +33,7 @@ export const authOptions = {
     async session({ session, token }: any) {
       session.user.role = token.role;
       session.user.establishmentId = token.establishmentId;
+      session.user.id = token.sub;
       return session;
     },
   },

server/package-lock.json

@@ -19,7 +19,8 @@
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
         "tailwind-merge": "^2.2.0",
-        "ws": "^8.16.0"
+        "ws": "^8.16.0",
+        "zod": "^4.4.3"
       },
       "devDependencies": {
         "@types/bcryptjs": "^2.4.6",
@@ -2682,6 +2683,15 @@
       "engines": {
         "node": ">=6"
       }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
     }
   }
 }

server/package.json

@@ -23,7 +23,8 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "tailwind-merge": "^2.2.0",
-    "ws": "^8.16.0"
+    "ws": "^8.16.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/bcryptjs": "^2.4.6",