From 6dc9746a3f6a7bf15650936f6f0be36f239984c8 Mon Sep 17 00:00:00 2001
From: Pascal Rigaux <pascal.rigaux@univ-paris1.fr>
Date: Mon, 12 Feb 2018 15:32:37 +0100
Subject: [PATCH] CONF up1 common

---
 app/src/controllers/CompareUsers.vue          |   5 +-
 app/src/controllers/StepV.vue                 |   2 +-
 app/src/router.ts                             |  11 +-
 app/src/services/ws.ts                        |   9 +-
 server/conf.ts                                |  44 ++-
 server/conf_up1.ts                            | 312 ++++++++++++++++++
 server/steps/conf_needExternalModeration.ts   | 102 ++++++
 .../handle_login_or_mail_homonym_substep.ts   | 207 ++++++++++++
 shared/conf.ts                                |   2 +-
 9 files changed, 671 insertions(+), 23 deletions(-)
 create mode 100644 server/conf_up1.ts
 create mode 100644 server/steps/conf_needExternalModeration.ts
 create mode 100644 server/steps/handle_login_or_mail_homonym_substep.ts

diff --git a/app/src/controllers/CompareUsers.vue b/app/src/controllers/CompareUsers.vue
index 4c68d0f1..1e87028b 100644
--- a/app/src/controllers/CompareUsers.vue
+++ b/app/src/controllers/CompareUsers.vue
@@ -1,6 +1,9 @@
 <template>
  <div>
-     <p><b>{{homonyme.mail || homonyme.uid || homonyme.supannMailPerso || homonyme.barcode}}</b> <span v-html="homonyme.global_main_profile.description"></span></p>
+     <p><b>
+         <a v-if="homonyme.uid" :href="'https://userinfo.univ-paris1.fr/#' + (homonyme.mail || homonyme.uid)">{{homonyme.mail || homonyme.uid}}</a>
+         <span v-else>{{homonyme.supannMailPerso || homonyme.barcode}}</span>
+     </b> <span v-html="homonyme.global_main_profile.description"></span></p>
 
      <table class="table table-bordered">
        <tbody>
diff --git a/app/src/controllers/StepV.vue b/app/src/controllers/StepV.vue
index 2d70e3f9..2d1f2bbb 100644
--- a/app/src/controllers/StepV.vue
+++ b/app/src/controllers/StepV.vue
@@ -19,7 +19,7 @@
   </div>
 
   <div v-if="v_ldap && v_ldap.global_main_profile && !(v.global_main_profile && v.global_main_profile.description === v_ldap.global_main_profile.description) && !merged_homonyms.some(h => h.uid === v_ldap.uid)" class="alert alert-info">
-        La demande concerne le compte existant « {{v_ldap.uid}} »
+        La demande concerne le compte existant « <a style="text-decoration: underline;" :href="'https://userinfo.univ-paris1.fr/#' + v_ldap.uid">{{v_ldap.uid}}</a> »
         ({{v_ldap.givenName}} {{v_ldap.sn}} <span v-html="v_ldap.global_main_profile.description"></span>)
   </div>
 
diff --git a/app/src/router.ts b/app/src/router.ts
index 2cf20e8f..3df2627a 100644
--- a/app/src/router.ts
+++ b/app/src/router.ts
@@ -10,7 +10,13 @@ export let router;
 
 const _routes = {
     '/playground': () => import('./controllers/Playground.vue'),
-    '/login/:kind?': { render(_h) { router.replace(this.$route.query.then) } }, // TODO, use vue-router redirect
+    '/login/:kind?': { render(_h) {
+        const then = this.$route.query.then;
+        if ("reload_to_test" in this.$route.query)
+            document.location.href = conf.base_pathname + "test/#" + then;
+        else
+            router.replace(then) // TODO, use vue-router redirect
+    } },
     '/steps/:kind?': ModerateList,
     '/:stepName/:wanted_id?': Step,
     '/': { template: template_welcome },
@@ -29,8 +35,7 @@ const opts = {
     routes,
 };
 
-declare var process;
-if (process.env.NODE_ENV === 'production') {
+if (!conf.base_pathname.match(/\/test\/$/)) {
     opts.mode = 'history';
 }
 
diff --git a/app/src/services/ws.ts b/app/src/services/ws.ts
index 66e3bc77..1f4ccf0a 100644
--- a/app/src/services/ws.ts
+++ b/app/src/services/ws.ts
@@ -39,7 +39,8 @@ export interface InitialSteps {
 
 import conf from '../conf';
 
-const api_url = conf.base_pathname + 'api';
+const non_test_base_pathname = conf.base_pathname.replace(/\/test\/$/, '/');
+const api_url = non_test_base_pathname + 'api';
 
 export function eachAttrs(attrs: StepAttrsOption, oneOfTraversal: 'always' | 'never', f: (opts: StepAttrOption, key: string, attrs: StepAttrsOption) => void) {
     function rec_mpp(mpp: Mpp) {
@@ -141,7 +142,11 @@ function _handleErr(err : AxiosError, $scope = null, redirect = false) {
         console.log("must relog", resp.headers.toString());
         restarting = true;
         const type = resp.data && resp.data.authenticate && resp.data.authenticate.type || $scope.$route.query.idp || 'local';
-        const location = conf.base_pathname + 'login/' + type + '?then=' + encodeURIComponent($scope.$route.fullPath);
+        const need_reload_to_test = type === 'cas_with_pgt' && conf.base_pathname !== non_test_base_pathname;
+        const location = 
+            (need_reload_to_test ? non_test_base_pathname : conf.base_pathname) +
+            'login/' + type + '?then=' + encodeURIComponent($scope.$route.fullPath) +
+            (need_reload_to_test ? "&reload_to_test" : '');
         document.location.href = resp.data?.authenticate?.need_relog_local ? `/Shibboleth.sso/Logout?return=${encodeURIComponent(location)}` : location
         return Promise.reject("logging...");
     } else if (resp.status === 401) {
diff --git a/server/conf.ts b/server/conf.ts
index 3533d644..c22f7d6f 100644
--- a/server/conf.ts
+++ b/server/conf.ts
@@ -11,9 +11,9 @@ import { sameKeyNameChoices } from './helpers';
 import * as grouped_calls from './helper_grouped_calls';
 import shared_conf from '../shared/conf';
 
-const ldap_base = "dc=univ,dc=fr";
+const ldap_base = "dc=univ-paris1,dc=fr";
 const ldap_main = {
-        uri: ['ldap://ldap-test.univ.fr'],
+        uri: ['ldap://ldap-pmf2.univ-paris1.fr', 'ldap://ldap-pth2.univ-paris1.fr', 'ldap://ldap-pth1.univ-paris1.fr'],
 
         // empty for anonymous bind:
         dn: 'cn=comptex,ou=admin,' + ldap_base,
@@ -27,23 +27,24 @@ const ldap_main = {
         base_rolesGeneriques: "ou=supannRoleGenerique,ou=tables," + ldap_base,
         base_etablissements: "ou=supannEtablissement,ou=tables," + ldap_base,
 
-        uid_to_eppn: "@univ.fr",
+        uid_to_eppn: "@univ-paris1.fr",
 };
 
 const internal_organizations = [
     '{UAI}0751717J', // Univ Paris 1
     '{UAI}0752719Y', // SCD
+    '{UAI}0753364Z', // IAE
 ];
 
 const conf = {
     maxLiveModerators: 100,
 
-    mainUrl: 'https://comptex.univ.fr' + shared_conf.base_pathname.replace(/\/$/, ''),
+    mainUrl: 'https://comptex.univ-paris1.fr' + shared_conf.base_pathname.replace(/\/$/, ''),
     
     mail: {
-        from: 'Assistance <assistance@univ.fr>',
-        intercept: 'Admin <admin@univ.fr>',
-        transport: sendmailTransport({}),
+        from: 'DSIUN Université Paris 1 Panthéon-Sorbonne <no-reply@univ-paris1.fr>',
+        intercept: '', //'Admin <admin@univ.fr>',
+        transport: sendmailTransport({ path: '/usr/sbin/sendmail' }), // give sendmail with full path (since PATH may not have /usr/sbin/)
     },
 
     sv_ttl_days: 1/*year*/ * 365, // auto-purge after xxx days unmodified
@@ -53,15 +54,15 @@ const conf = {
     },
 
     esup_activ_bo: {
-        url: "http://xxxx.univ.fr:8080/esup-activ-bo/",
+        url: "http://marmite.univ-paris1.fr:8080/esup-activ-bo/",
     },
 
     esupUserApps: {
-        url: '', //'https://ent.univ.fr/EsupUserApps',
+        url: 'https://ent.univ-paris1.fr/EsupUserApps',
     },
     
     ldap: {
-        shibIdentityProvider: 'https://idp.univ.fr',
+        shibIdentityProvider: 'urn:mace:cru.fr:federation:univ-paris1.fr',
 
         ...ldap_main,
 
@@ -152,10 +153,13 @@ const conf = {
                 supannCodeINE: '',
                 
                 termsOfUse: [''],
+                supannConsentement: [''],
                 supannListeRouge: '',
 
+                comment: '', demandeUrl: '',
                 up1Profile: [] as any[],
-                '{SMSU}CG': '', '{PHOTO}PUBLIC': '', '{PHOTO}INTRANET': '', '{PHOTO}STUDENT': '',
+                '{SMSU}CG': '', '{PAGER}DISPLAY.FACULTY': '', '{PHOTO}PUBLIC': '', '{PHOTO}INTRANET': '', '{PHOTO}STUDENT': '',
+                '{APPLI:OFFICE365}CGU': '',
             },
 
             attrs : { 
@@ -166,6 +170,8 @@ const conf = {
                 altGivenName: { ldapAttr: 'up1AltGivenName' },
                 floorNumber: { ldapAttr: 'up1FloorNumber' },
                 roomAccess: { ldapAttr: 'up1RoomAccess' },
+                comment: { ldapAttr: 'info;x-demande' },
+                demandeUrl: { ldapAttr: 'labeledURI', convert: ldap_convert.withSuffixEtiquette(' {DEMANDE}') },
                 up1Profile: { convert: ldap_convert.up1Profile },
                 global_profilename: { ldapAttr: 'up1Profile', convert: ldap_convert.up1Profile_field('up1Source') },
                 profilename: { ldapAttr: 'up1Source', ldapAttrJson: 'profilename' },
@@ -188,17 +194,25 @@ const conf = {
                 global_siham: { ldapAttr: 'supannRefId', convert: ldap_convert.withEtiquette("{SIHAM}")  },
                 jpegPhoto: { ldapAttr: 'jpegPhoto;base64' },
                 termsOfUse: { ldapAttr: 'up1TermsOfUse' },
-                ..._.fromPairs(['{SMSU}CG', '{PHOTO}PUBLIC', '{PHOTO}INTRANET', '{PHOTO}STUDENT'].map(value => 
+                ..._.fromPairs(['{SMSU}CG', '{PAGER}DISPLAY.FACULTY', '{PHOTO}PUBLIC', '{PHOTO}INTRANET', '{PHOTO}STUDENT'].map(value => 
                     [ value, { ldapAttr: 'up1TermsOfUse', convert: ldap_convert.has_value(value) } ]
                 )),
+                ..._.fromPairs(['{APPLI:OFFICE365}CGU'].map(value => 
+                    [ value, { ldapAttr: 'supannConsentement', convert: ldap_convert.has_value(value) } ]
+                )),
             },
             supannCiviliteChoices: sameKeyNameChoices([ 'M.', 'Mme' ]),
 
             mail_domains: [
+                'univ-paris1.fr',
+                'etu.univ-paris1.fr',
+                'malix.univ-paris1.fr',
+                'anciens.univ-paris1.fr',
+                'bis-sorbonne.fr',
             ] as string[],
     
-            homonymes_preferStudent: (profilename: string) => !!(profilename || '').match(/^\{COMPTEX\}learner\./),
-            homonymes_restriction: '(objectClass=inetOrgPerson)',
+            homonymes_preferStudent: (profilename: string) => !!(profilename || '').match(/^\{COMPTEX:FC\}learner\./),
+            homonymes_restriction: '(&(objectClass=inetOrgPerson)(!(shadowFlag=2))(!(shadowFlag=8)))' // ignore dupes/deceased
         },
 
         group_cn_to_memberOf: (cn: string) => (
@@ -256,7 +270,7 @@ const conf = {
         path: "/tmp"
     } as session_file_store.Options,
 
-    trust_proxy: ['loopback'],
+    trust_proxy: ['loopback', /*ent-front*/ '193.55.96.44', '2001:660:3305::44'],
 
     cas: {
         ssoBaseURL: '', //'https://cas.univ.fr/cas/',
diff --git a/server/conf_up1.ts b/server/conf_up1.ts
new file mode 100644
index 00000000..4097efe5
--- /dev/null
+++ b/server/conf_up1.ts
@@ -0,0 +1,312 @@
+import * as _ from 'lodash';
+import { addDays, inclusive_range as range, sameKeyNameChoices } from './helpers';
+import * as search_ldap from './search_ldap';
+import * as ldap from './ldap';
+import * as conf from './conf';
+import * as helpers from './helpers';
+import * as translate from './translate'
+import * as crejsonldap from './crejsonldap';
+import * as ldap_convert from './ldap_convert';
+import shared_conf from '../shared/conf';
+const filters = ldap.filters;
+
+const up1Table = (constraint_filter: string, ldapAttr_for_const: string, optional: boolean) => (
+    async (token: string, sizeLimit: number) => {
+        let filter;
+        if (token.match(/\{.*/) || sizeLimit === 1) {
+            filter = filters.eq(ldapAttr_for_const, token);
+        } else if (token !== '') {
+            filter = filters.fuzzy(['displayName'], token);
+        }
+        const filter_ = token === '' ? constraint_filter : filters.and([ filter, constraint_filter ]); 
+        const l = await ldap.search(conf.ldap.base, filter_, { const: '', title: '' }, {
+            const: { ldapAttr: ldapAttr_for_const },
+            title: { ldapAttr: 'displayName' },
+        }, { sizeLimit });
+        let l_ = _.sortBy(l, 'title')
+        if (optional && token === '') l_.unshift({ const: undefined, title: 'Ne pas préciser' });
+        return l_;
+    }
+)
+
+export const search_supannRoleGenerique_up1 = (opts: StepAttrOption) => ({
+    oneOf_async: up1Table('(&(up1TableName=supannRoleGenerique)(up1Flags={PRIO}*))', 'up1TableKey', opts.optional),
+    ...opts
+})
+export const search_supannActivite_up1 = (opts: StepAttrOption) => ({
+    oneOf_async: up1Table('(&(up1TableName=supannActivite)(up1TableKey={UAI:0751717J:ACT}*))', 'displayName', opts.optional),
+    ...opts
+});
+export const search_supannActivite = (opts: StepAttrOption) => ({
+    oneOf_async: up1Table('(up1TableName=supannActivite)', 'up1TableKey', opts.optional),
+    ...opts
+});
+
+const get_buildingNameChoices = async () => {
+    const l = await ldap.search(conf.ldap.base_structures, "(supannTypeEntite={SIHAM}LDT)", 
+        { const: '', title: '', postalAddress: '' }, 
+        { const: { ldapAttr: 'description' }, title: { ldapAttr: 'description' }, postalAddress: { convert: ldap_convert.postalAddress } }, 
+        {})
+    return l.map(({ postalAddress, ...choice }) => (
+        { ...choice, merge_patch_parent_properties: {
+            postalAddress_: { default: postalAddress }
+        } } as StepAttrOptionChoices
+    ))
+}
+
+let buildingNameChoices: StepAttrOptionChoices[] = [
+    { const: undefined, title: "ne pas préciser" },
+]
+get_buildingNameChoices().then(l => buildingNameChoices.push(..._.sortBy(l, choice => _.deburr(choice.title))))
+
+const new_etablissement = {
+    etablissement_siret: {},
+    etablissement_description: {},
+    etablissement_labeledURI: { "optional": true },
+    etablissement_postalAddress: { "optional": true },
+    etablissement_telephoneNumber: { "optional": true },
+    etablissement_facsimileTelephoneNumber: { "optional": true },      
+};
+
+const etablissementExterneOrNew : StepAttrOption = {
+    default: 'existing',
+    oneOf: [
+        { const: 'existing', title: "chercher dans la liste ci-dessous", merge_patch_parent_properties: {
+            etablissementExterne: { oneOf_async: search_ldap.etablissements },
+            ..._.mapValues(new_etablissement, opts => ({ toUserOnly: true, ...opts })),
+        } },
+        { const: 'new', title: "non trouvé dans la liste", merge_patch_parent_properties: new_etablissement },
+    ]
+};
+
+const _main_profile_source_to_name: Dictionary<string> = {
+    'APOGEE': 'géré dans Apogée',
+    'SIHAM': 'géré par la DRH dans SIHAM',
+    'RESEAUPRO': 'géré par Réseau Pro',
+    'comptex/iae' : 'géré par la DRH IAE',
+    'comptex/OSE' : 'entrant OSE',
+}
+
+const account_status_to_name: Dictionary<string> = {
+    'active': "actif",
+    'noaccess': "verrouillé",
+    'disabled': "désactivé",
+    'deleted': "purgé",
+}
+
+const _explain_main_profile = (v: v) => {
+
+    let main_prof = _.maxBy(v.up1Profile || [], 'priority')
+
+    if ((main_prof?.priority || 0) < 590 && v.global_supannEtuAnneeInscription && v.global_eduPersonPrimaryAffiliation === 'student') {
+        const annees = v.global_supannEtuAnneeInscription;
+        const lastAnneeInscription = annees && Math.max(...annees);
+
+        const endDate = new Date(lastAnneeInscription + 1, 9 - 1, 1); // 201X/09/01
+        const willExpireSoon = endDate < new Date();
+        return { source: "APOGEE", lastAnneeInscription, willExpireSoon, willNotExpireSoon: !willExpireSoon }
+    }
+    if (!main_prof && v.etablissementExterne === '{AUTRE}PCU-ReseauPro' && v.global_structureParrain?.includes('DGJC')) {
+        main_prof = { profilename: "{RESEAUPRO}alum", enddate: v.global_shadowExpire }
+    }
+    if (!main_prof && v.global_eduPersonPrimaryAffiliation === 'alum') {
+        return { source: "{GRACE}student" }
+    }
+    const profilename = main_prof?.profilename || ''
+    let willExpireSoon, willNotExpireSoon
+    if (main_prof?.enddate) {
+        willExpireSoon = main_prof.enddate < helpers.addDays(new Date(), 31 * 2)
+        willNotExpireSoon = !willExpireSoon
+    }
+    let m
+    const source = 
+        profilename.match(/^\{HARPEGE}/) ? 'SIHAM' : 
+        (m = profilename.match(/^\{COMPTEX:(.*?)\}/)) ? 'comptex/' + m[1] :
+        profilename.match(/^\{RESEAUPRO}/) ? 'RESEAUPRO' :
+        null;
+    return { source, willExpireSoon, willNotExpireSoon }
+}
+
+const explain_main_profile = (_: any, v: v) => {
+    if (!v.uid) return undefined;
+
+    const r = _explain_main_profile(v)
+
+    const formatAcademicYear = (n : number) => n ? `${n} / ${n+1}` : '';
+
+    let description;
+    if (r.source === 'APOGEE' && r.willExpireSoon) {
+        description = `était étudiant en ${formatAcademicYear(r.lastAnneeInscription)}`
+    } else {
+        const handled_by = _main_profile_source_to_name[r.source]
+        description = `
+  est ${shared_conf.affiliation_labels[v.global_eduPersonPrimaryAffiliation] || 
+        (v.accountStatus === 'active' ? 'un ancien compte sans affiliation' :
+        'un compte ' + (account_status_to_name[v.accountStatus] || 'non activé'))}
+  ${formatAcademicYear(r.lastAnneeInscription)}
+  
+` + (handled_by && r.willNotExpireSoon ? `<b>${handled_by}</b>` : '')
+    }
+    return { ...r, description }
+}
+
+export const attrs : StepAttrsOption = {
+    barcode: { 
+        pattern: "[0-9]{12,}|",
+    },
+    mifare: { 
+        pattern: "[0-9A-F]{14}|", // MIFARE 7 bytes TAG
+    },
+    newPassword: {
+        uiType: 'newPassword',
+        labels: { custom_error_message: 'Veuillez choisir un mot de passe comportant au moins 8 caractères. Ce mot de passe doit contenir des lettres minuscules, des lettres majuscules et des chiffres.' },
+        pattern: "(?=.*[0-9])(?=.*[A-Z])(?=.*[a-z])[ -~]{8,}", // must contain digit / uppercase / lowercase. must be printable ASCII chars
+    },
+    roomNumber: {
+        // 2021-09 : autoriser les nouveaux numéros de bureau PMF (GLPI UP1#118479)
+        pattern: "(([A-Z]\\s[0-9]+)|([0-9]+(\\s[A-Z])?))(\\sbis|\\ster)?|[ABC][\\s.][0-9]{1,2}[\\s.][0-9]{2,3}[A-Z]?",
+        description: "(Exemples : 1805 ; A 406 ; 305 B ; A 406 bis ; 1506 ter ; C.4.03 ; B.8.05A)",
+        allowUnchangedValue: true,
+        labels: { 
+            custom_error_message: "Veuiller saisir un numéro de bureau sous la forme lettre+espace+numéro ou numéro+espace+lettre (en majuscule).",
+        },
+    },
+    floorNumber: { oneOf: [
+        { const: undefined, title: "Sélectionnez un étage" },
+        ... sameKeyNameChoices([ 
+            "Niveau -2", "Niveau -1", "Rez-de-chaussée", "1er", 
+            ... range(2, 22).map(n => `${n}e`), // "2e" .. "22e", PMF + autres
+        ]),
+    ] },
+    roomAccess: { oneOf: [
+        { const: undefined, title: "ne pas préciser" },
+        ... sameKeyNameChoices([ 
+            "Aile Cujas", "Aile Soufflot", "Cour d'honneur", // Pantheon ?
+            ... range("A", "O").map(c => "Esc. " + c), // Pantheon ?
+            ... range("A", "C").map(c => "Tour " + c), // PMF
+        ])
+    ] },
+
+    eduPersonAffiliation: { oneOf: [
+        { const: "teacher", title: "Enseignant" },
+        { const: "researcher", title: "Chercheur" },
+        { const: "staff", title: "Personnel Biatss" },
+        { const: "emeritus", title: "Professeur émérite" },
+        { const: "student", title: "Étudiant" },
+        { const: "alum", title: "Ancien étudiant" },
+    ] },
+
+    buildingName: { oneOf_is_dynamic: true, oneOf: buildingNameChoices },
+
+    structureParrain: { 
+        title: "Service qui invite : (UFR, service, laboratoire...)",
+        oneOf_async: search_ldap.structures,
+    },
+
+    etablissementExterneOrNew,
+
+    optional_etablissementExterneOrNew: {
+        default: 'existing',
+        uiType: 'radio',
+        oneOf: [
+            { const: 'unknown', title: "inconnu"},
+            ...etablissementExterneOrNew.oneOf,
+        ],
+    },
+
+    mailFrom_email: { 
+        optional: true, uiType: "email",
+        title: "Adresse courriel expéditeur pour l'envoi de courriel à l'utilisateur",
+    },
+    mailFrom_text: { 
+        optional: true, 
+        title: "Nom de l'expéditeur pour l'envoi de courriel à l'utilisateur",
+    },
+    
+    global_main_profile: { 
+        toUser: explain_main_profile, 
+        toUserOnly: true, 
+        uiHidden: true,
+    },
+
+    accountStatus: { 
+        title: 'Status', 
+        oneOf: [ {const: "active", title: "actif"}, { const: undefined, title: "non activé"}, { const: 'deleted', title: 'supprimé'}, { const: 'disabled', title: 'désactivé'} ],
+    },
+};
+
+translate.add_translations({
+    fr: {}, // default is french!
+    en: {
+        "Type de compte": "Account kind",
+        "Date de début": "Account start date",
+        "Date de fin": "Account end date",
+        "Fin du compte": "Account end date",
+        "Date de naissance": "Date of birth",
+        "Durée": "Duration",
+        "Civilité": "Gender",
+        "Nom d'usage": "Common name",
+        "Prénom": "First name",
+        "Nom de naissance": "Birth name",
+        "Informations personnelles": "Personal informations",
+        "Etablissement de provenance": "Establishment of origin",
+        "Courriel personnel": "Personal email",
+        "Adresse personnelle": "Home postal address",
+        "Téléphone personnel": "Home phone number",
+        "Choisir une durée": "Choose a duration",
+        "ou une date": "or a date",
+        "inconnu": "unknown",
+        "chercher dans la liste ci-dessous": "search it below",
+        "non trouvé dans la liste": "not found",
+        "M.": "Male",
+        "Mme": "Female",
+
+        "Choisir": "Choose",
+        "Courriel de la personne": "Guest email",
+        "Courriel professionnel": "Business email",
+        "Numéro de fax": "Fax number",
+        "Numéro de téléphone": "Phone number",
+        "Service qui invite : (UFR, service, laboratoire...)": "Service that invites (UFR, service, labotory...)",
+        "SIRET": "SIRET code",
+        "Téléphone professionnel": "Business phone",
+
+    },
+})
+
+const cardChoice: StepAttrOption = {
+    default: 'print',
+    uiType: 'radio',
+    oneOf: [
+        { const: "print", title: 'Créer une nouvelle carte' },
+        { const: "enroll", title: 'Enrôler une carte existante', merge_patch_parent_properties: {
+            mifare: { readOnly: false, uiHidden: false },
+            barcode: { readOnly: false, uiHidden: false },
+        } },
+    ],
+}
+const cardChoice_with_existing_card: StepAttrOption = {
+    default: 'unchanged',
+    oneOf: [
+        ...cardChoice.oneOf,
+        { const: "unchanged", title: 'Pas de modification de carte' },
+    ],
+}
+export const cardChoice_attrs: StepAttrsOption = {
+    cardChoice,
+    global_mifare: {
+        uiHidden: true, toUserOnly: true,
+        if: 'truthy',
+        then: { merge_patch_parent_properties: { cardChoice: cardChoice_with_existing_card } },
+    },
+    // if v.cardChoice "enroll" is chosen: 
+    // - value '' is prompted even if existing value
+    // otherwise, client can not modify and it is hidden
+    mifare: { ...attrs.mifare, optional: true, readOnly: true, uiHidden: true, toUser: _ => '' },
+    barcode: { ...attrs.barcode, optional: true, readOnly: true, uiHidden: true, toUser: _ => '' },
+}
+
+export const create_temp_profile_for_disabled_account = async (uid: string, structureParrain: string) => {
+    console.log("create_temp_profile_for_disabled_account", uid)
+    const v: v = { uid, profilename: '{COMPTEX}reactiv', structureParrain, enddate: addDays(new Date(), 2) }
+    return await crejsonldap.call(v, { create: false })
+}
diff --git a/server/steps/conf_needExternalModeration.ts b/server/steps/conf_needExternalModeration.ts
new file mode 100644
index 00000000..fe6bb715
--- /dev/null
+++ b/server/steps/conf_needExternalModeration.ts
@@ -0,0 +1,102 @@
+import * as _ from 'lodash';
+import * as actions from './actions';
+import * as db from '../db';
+import * as step_attrs_option from '../step_attrs_option';
+import * as v_display from '../v_display';
+import * as attrs_override from './attrs_override'
+
+export type MoreAttrOption = { 
+    needExternalModeration?: boolean;
+} & attrs_override.MoreAttrOption_cond_overrides
+
+export type StepAttrOption_ = StepAttrOptionT<MoreAttrOption>
+export type StepAttrsOption_ = Dictionary<StepAttrOption_>
+
+export const _add_opts_for_needExternalModeration = (attrs : StepAttrsOption_) => (
+    step_attrs_option.mapAttrs(attrs, (opts) => {
+        if (opts.needExternalModeration) {
+            opts.labels = { ...opts.labels, warning: `Les modifications de ce champ ne seront effectives qu'après validation par les services compétents. Des pièces justificatives peuvent vous être demandées.` } 
+            opts.cond_overrides = { not_is_SIHAM: { readOnly: true, labels: null } };
+        }
+        return opts
+    })
+)
+
+const mail_notif_RH =
+`Subject: Demande de modification des infos - {{v.displayName}}
+
+Bonjour,
+<br/><br/>
+{{#if moderator.mail}}
+<a href="https://annuaire.univ-paris1.fr/ent/{{moderator.mail}}">{{moderator.mail}}</a> veut modifier les informations de <b>{{v.displayName}} ({{v.supannAliasLogin}})</b> .
+{{^}}
+L'utilisateur <b>{{v.displayName}} ({{v.supannAliasLogin}})</b> veut modifier ses informations.
+{{/}}
+<br/><b>Numéro agent :</b> {{v.supannEmpId}}
+<br/><b>Corps :</b> {{v.employeeType}}
+ <p></p>
+{{{v_display.various.diff}}}
+`;
+
+const warn_RH_moderation =
+`
+{{#each v.various.modified_RH_attrs}}
+<p>Ces modifications ne seront effectives qu'après la validation de la DRH :</p>
+<span class="v-diff-RH">
+  {{{.}}}
+</span>
+{{/}}
+
+{{#each v.various.modified_other_attrs}}
+<p>Ces modifications seront effectives immédiatement :</p>
+<span class="v-diff-other">
+  {{{.}}}
+</span>
+{{/}}
+`
+
+export const handle_confirmation_and_needExternalModeration : action = async (req, sv) => {
+    const flat_attrs: StepAttrsOption_ = step_attrs_option.flatten_attrs(sv.attrs, sv.v)
+    const needExternalModerationAttrs = Object.keys(_.pickBy(flat_attrs, (opts, _) => opts['needExternalModeration']))
+    const diff_RH = _.pick(sv.v.various.diff, needExternalModerationAttrs)
+    const diff_other = _.omit(sv.v.various.diff, needExternalModerationAttrs)
+
+    sv.v.various.modified_RH_attrs = await v_display.format_various_diff(diff_RH, flat_attrs)
+    sv.v.various.modified_other_attrs = await v_display.format_various_diff(diff_other, flat_attrs)
+
+    await actions.ask_confirmation('warned_about_externalModeration', warn_RH_moderation, "Vous souhaitez modifier vos données")(req, sv)
+
+    const response : response = {}
+    if (!_.isEmpty(diff_RH)) {
+        let sv_external = _.cloneDeep(sv)
+        sv_external.v.various.diff = diff_RH
+        // GLPI UP1#119068
+        const to = sv.v.global_eduPersonPrimaryAffiliation === 'staff' ? (
+            sv.v.global_profilename?.includes('{HARPEGE}carriere') ? 'biatss-titulaires@univ-paris1.fr' : 
+            sv.v.global_profilename?.includes('{HARPEGE}contrat') ? 'biatss-nontitulaires@univ-paris1.fr' : 
+            sv.v.global_profilename?.includes('{HARPEGE}heberge') ? 'direval@univ-paris1.fr' : 
+            'adjbiatss@univ-paris1.fr' // ne devrait pas arriver (?)
+        ) : 'racpens@univ-paris1.fr'
+        await actions.sendMail(mail_notif_RH, { to })(req, sv_external)
+
+        // save information for checks
+        db.collection("needExternalModeration").insertOne({ 
+            diff: diff_RH,
+            user: _.pick(sv.v, ['displayName', 'supannAliasLogin', 'supannEmpId', 'employeeType']),
+            timestamp: new Date(),
+        } )
+
+        if (to !== 'direval@univ-paris1.fr') {
+            response.labels = { added : `
+                <h4>Des modifications ont été transmises à la DRH.</h4>
+                Ces modifications seront visibles dès qu'ils auront effectué le changement sur votre compte.
+                <p></p>
+                Si vous ne voyez aucune modification après une semaine, nous vous conseillons de contacter directement votre gestionnaire par téléphone (<a href="https://intranet.pantheonsorbonne.fr/ent/intranet2/drh">intranet &gt; rubrique DRH</a>)
+            ` }
+        }
+    }
+    let v = _.omit(sv.v, [ 'global_profilename', ...needExternalModerationAttrs ]) as v;
+    console.log("remaining v", v);
+    return { v, response };
+}
+
diff --git a/server/steps/handle_login_or_mail_homonym_substep.ts b/server/steps/handle_login_or_mail_homonym_substep.ts
new file mode 100644
index 00000000..a8004e3a
--- /dev/null
+++ b/server/steps/handle_login_or_mail_homonym_substep.ts
@@ -0,0 +1,207 @@
+import * as _ from 'lodash';
+import * as actions from './actions';
+import * as actions_pre from './actions_pre';
+import * as utils from '../utils';
+import * as helpers from '../helpers';
+import * as conf_up1 from '../conf_up1';
+import * as ldap from '../ldap';
+import * as search_ldap from '../search_ldap';
+import * as step_attrs_option from '../step_attrs_option';
+import { forceAttrs } from './attrs';
+import { sv_to_url } from '../sv';
+import conf = require('../conf');
+
+const validate_existing_up1_mail_msg = `Subject: Validation de votre compte Paris 1 Panthéon-Sorbonne
+
+Bonjour,
+<p></p>
+Merci de confirmer que vous êtes bien le propriétaire de ce compte en cliquant sur le lien suivant : <a href="{{{sv_url}}}?substep={{v.choice}}&otp={{v.otp}}">je valide mon adresse e-mail</a>.
+<p></p>
+Cordialement,
+<br>
+La DSIUN`
+
+// exported for Cujas migration step
+export const homo_choices = (homonymes: v[]): StepAttrsOption => ({
+    choice: {
+        uiType: 'radio',
+        oneOf: [
+            ...(homonymes || []).map((homo, i) => (
+                homo.supannMailPerso && { const: "mail" + i, title: "Prouver que je possède l'adresse " + helpers.anonymize_email(homo.supannMailPerso) }
+            )).filter(choice => choice),
+            { const: "login", title: "Me connecter avec mon compte et mon mot de passe" },
+            { const: "ignore", title: 
+            (homonymes || []).some(v => v.supannMailPerso) ? "Ce ne sont pas mes mails et je n'ai pas mon mot de passe" : "Je n'ai pas mon mot de passe" },
+        ],
+    },
+})
+
+export const getShibUserLdapAttrs_with_homonymes_restriction: firstAction_pre = async (req, _sv) => {
+    const v = await actions_pre.getShibUserLdapAttrs(req, _sv)
+
+    if (!await ldap.exist(conf.ldap.base_people, ldap.filters.and([
+        search_ldap.currentUser_to_filter(req.user), 
+        conf.ldap.people.homonymes_restriction,
+    ]))) {
+        throw { code: "Bad Request", message: `Ce compte étudiant n'est pas autorisé`, force_history_back: true }
+    }
+    return v
+}
+
+export const non_deleted_homonyms = async (v: v) => (
+    (await search_ldap.homonymes(v)).filter(v => v.accountStatus !== 'deleted')
+)
+
+const add_homo = async (v: v) => {
+    const homonymes = await non_deleted_homonyms(v)
+    // NB: there is no real reason to check the presence of supannMailPerso. To remove?
+    v.homonymes = homonymes.filter(v => v.supannMailPerso || ['active', 'disabled'].includes(v.accountStatus))
+    console.log("homonymes", v.homonymes)
+    return v.homonymes.length > 0
+
+}
+
+// exported for Cujas migration step
+export const may_create_temp_profiles_for_disabled_accounts = async (homonymes: v[]) => {
+    for (const homo of homonymes) {
+        console.log('may_create_temp_profiles_for_disabled_accounts', homo.uid, homo.accountStatus)
+
+        if (homo.accountStatus === 'disabled') {
+            await conf_up1.create_temp_profile_for_disabled_account(homo.uid, 'IU1')
+        }
+    }
+}
+
+const homo_choice_to_v_ldap = async (req: req, v: v, choice: string) => {
+    const v_ldap = choice === 'login' ? 
+        await getShibUserLdapAttrs_with_homonymes_restriction(req, {v}) :
+        v.homonymes[choice.match(/^mail(.*)/)?.[1]]
+    if (!v_ldap) throw "invalid choice " + choice
+    return v_ldap
+}
+
+// exported for Cujas migration step
+export const homo_substep_in_query_to_v_ldap = async (req: req, v: v) => {
+    if (!req.query.substep) throw "internal error"
+    if (req.query.substep !== 'login') {
+        await actions_pre.check_v_otp(req, {v})
+    }
+    return await homo_choice_to_v_ldap(req, v, req.query.substep)
+}
+
+// exported for Cujas migration step
+export const send_validation_up1_mail = async (req: req, sv: sva, choice: string) => {
+    const v_ldap = await homo_choice_to_v_ldap(req, sv.v, choice)
+    if (!v_ldap) throw "invalid choice " + choice
+    const to = v_ldap.supannMailPerso
+    sv.v.otp = utils.random_string()
+    await actions.sendMail(validate_existing_up1_mail_msg, { to })(req, sv)
+}
+
+
+const forceAttrsIf = (attrs: StepAttrsOption, attrsToForce: StepAttrsOption, if_: (attr: string) => boolean) => (
+    step_attrs_option.mapAttrs(attrs, (opts, attrName) => (if_(attrName) ? { ...opts, ...attrsToForce } : opts))
+)
+
+const mail = `Un message de validation de compte vous a été envoyé à l’adresse e-mail fournie. Merci de consulter ce message et de cliquer sur le lien de confirmation d'adresse e-mail.
+            <p></p>
+            Si ce courriel n’apparaît pas dans votre boîte de réception, nous vous suggérons de consulter le dossier « Courrier indésirable ». Il arrive parfois que les services de messagerie en ligne classe les messages générés automatiquement dans un dossier spécifique.` 
+
+export default ({ labels, attrs, action_pre, action_post, next, ...step_other }: Pick<step, "labels"|"attrs"|"action_pre_before_save"|"action_pre"|"action_post"> & { next?: string }): step => ({
+    ..._.pick(step_other, "action_pre_before_save"),
+    labels: {
+        ...labels,
+        description: (labels.description ? `<div class="pre_description">${labels.description}</div>` : '') + `
+        <div class="login_choices" v-if="!v_pre.substep && !v_pre.franceconnect">
+          <div class="login_choices_up1">
+            <h4>J'ai un compte Paris 1 Panthéon-Sorbonne</h4>
+            <router-link :to="addQueryParams({ substep: 'login' })">Je me connecte</router-link>
+          </div>
+          
+          <div class="login_choices_franceconnect">
+            <h4>J'ai un compte FranceConnect</h4>
+            <router-link :to="addQueryParams({ franceconnect: 1 })"><img src="https://partenaires.franceconnect.gouv.fr/images/franceconnect-bouton.svg" alt="S'identifier avec FranceConnect"></router-link>
+          </div>
+
+          <h4>Je n'ai pas de compte existant</h4>
+          Je remplis le formulaire ci-dessous
+        </div>
+        <div v-if="v_pre.substep === 'homonym'">
+           Il semble que vous ayez déjà un compte Paris 1 Panthéon-Sorbonne :
+        </div>
+        `,
+    },
+    action_pre: async (req, sv) => {
+        if (action_pre) {
+            sv.v = await action_pre(req, sv)
+        }
+        const choice = req.query.substep
+        if (!choice) {
+            if (req.query.franceconnect === '1') {
+                return await actions_pre.getOidcAttrs(req, sv)
+            } else {
+                return sv.v
+            }
+        } else if (choice === 'homonym') {
+            return sv.v
+        } else {
+            const v_ldap = await homo_substep_in_query_to_v_ldap(req, sv.v)
+            sv.v.homonymes ||= await non_deleted_homonyms(sv.v)
+            if (!sv.v.homonymes.some((v: v) => v.uid === v_ldap.uid)) {
+                console.log("ignoring values from user since the user logged in with a different account")
+                return v_ldap
+            } else {
+                delete sv.v.homonymes // no more needed
+                return { ...v_ldap, ...sv.v } // NB: keep values from user
+            }
+        } 
+    },
+    attrs: {
+        supannFCSub: { hidden: true }, // keep it
+        uid: { readOnly: true, uiHidden: true, optional: true }, // propagate to "next" step
+        homonymes: { hidden: true, optional: true }, // propagate to action_post
+        ...forceAttrsIf(attrs, { readOnly_ifNotEmpty: true }, 
+            attrName => ['supannCivilite', 'givenName', 'sn', 'birthName', 'birthDay'].includes(attrName)), 
+    },
+    attrs_override: async (_req, sv) => (
+        sv.v.homonymes?.length ? {
+            supannFCSub: { hidden: true }, // keep it
+            ...forceAttrs(attrs, { hidden: true }),
+            ...homo_choices(sv.v.homonymes)
+        } : ['active', 'disabled'].includes(sv.v.accountStatus) ? {
+            userPassword: { hidden: true }, // do no ask (or ignore) password if account already has one
+        } : {
+        }
+    ),
+    action_post: async (req, sv) => {
+        if (utils.email_has_one_of_our_mail_domains(sv.v.supannMailPerso)) {
+            throw `Les addresses de courriel Paris 1 ne sont pas acceptées.\n\nNous vous invitons à cliquer sur « Je me connecte » au début du formulaire.`
+        }
+        await actions.validateAccount(req, sv)
+
+        let v = sv.v
+        const choice = v.choice
+        let response: Partial<r>
+        if (choice && choice.match(/^mail/)) {
+            await send_validation_up1_mail(req, sv, choice)   
+            // advance to same step => v is saved in db
+            response = { step: sv.step, labels: { added: mail } }
+        } else if (choice === 'login') {
+            await may_create_temp_profiles_for_disabled_accounts(v.homonymes)
+            response = { step: sv.step, nextBrowserStep: { url: sv_to_url(sv) + "?substep=login" } }
+        } else if (choice === 'ignore' || v.uid || !await add_homo(v)) {
+            if (action_post) {
+                ({ v, response } = await action_post(req, sv))
+            }
+            if (next) {
+                response ||= {}
+                response.step = next
+            }
+        } else {
+            response = { step: sv.step, nextBrowserStep: { url: sv_to_url(sv) + "?substep=homonym" } }
+        }
+        console.log(">>>", response)
+        return { v, response }
+    },
+})
+
diff --git a/shared/conf.ts b/shared/conf.ts
index 1e8934bd..21e8ee47 100644
--- a/shared/conf.ts
+++ b/shared/conf.ts
@@ -21,7 +21,7 @@ const normalize_noAccent_noUpperCase_trim = (s:string) => trim(deburr(s.toLowerC
 const wsgroupsURL = "https://wsgroups.univ-paris1.fr";
 
 export default {
-    base_pathname: '/',
+    base_pathname: '/foo/',
     wsgroupsURL,
     title: "Gestion de comptes",
     may_display_fieldIsRequired_hint: true,