diff --git a/.docker/e2e/frontend/Dockerfile b/.docker/e2e/frontend/Dockerfile
new file mode 100644
index 00000000..fcc828e0
--- /dev/null
+++ b/.docker/e2e/frontend/Dockerfile
@@ -0,0 +1,33 @@
+# Stage 1 — build the AngularJS SPA
+# Uses the same Node 10 + Ruby/Compass combination as the development Docker.
+FROM debian:bullseye-slim AS builder
+
+RUN apt-get update -q \
+ && apt-get install -y -q --no-install-recommends \
+      ca-certificates curl git unzip ruby-dev build-essential \
+ && mkdir /opt/nodejs \
+ && curl -sL https://nodejs.org/download/release/v10.24.1/node-v10.24.1-linux-x64.tar.gz \
+    | tar -xz --strip-components=1 -C /opt/nodejs \
+ && ln -s /opt/nodejs/bin/node /usr/bin/node \
+ && ln -s /opt/nodejs/bin/npm /usr/bin/npm \
+ && gem install compass \
+ && npm install -g bower grunt-cli \
+ && rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/opt/nodejs/bin/:${PATH}"
+
+WORKDIR /build/frontend
+COPY frontend/package.json frontend/bower.json frontend/.bowerrc ./
+RUN npm install
+RUN bower install --allow-root
+
+COPY frontend/ ./
+# Point the API constant to /api — nginx (stage 2) proxies it to the api container.
+RUN sed 's|http://glpiplugindirectory/api|/api|' app/scripts/conf.example.js \
+      > app/scripts/conf.js \
+ && grunt build --force
+
+# Stage 2 — serve dist/ with nginx + proxy /api to the PHP backend
+FROM nginx:1.25-alpine
+COPY --from=builder /build/frontend/dist /usr/share/nginx/html
+COPY .docker/e2e/frontend/nginx.conf /etc/nginx/conf.d/default.conf
diff --git a/.docker/e2e/frontend/nginx.conf b/.docker/e2e/frontend/nginx.conf
new file mode 100644
index 00000000..a31b8d26
--- /dev/null
+++ b/.docker/e2e/frontend/nginx.conf
@@ -0,0 +1,20 @@
+server {
+    listen 80;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Proxy all /api requests to the PHP backend (strips /api prefix).
+    # The AngularJS app uses API_URL = '/api', so /api/plugin becomes
+    # http://api/plugin on the backend.
+    location /api {
+        proxy_pass http://api/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Authorization $http_authorization;
+    }
+
+    # SPA routing: serve index.html for all unmatched frontend routes.
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
diff --git a/.docker/test/Dockerfile b/.docker/test/Dockerfile
new file mode 100644
index 00000000..01ddc5cc
--- /dev/null
+++ b/.docker/test/Dockerfile
@@ -0,0 +1,13 @@
+FROM php:7.4-cli-bullseye
+
+RUN apt-get update -q \
+ && apt-get install -y -q --no-install-recommends \
+      git unzip libssl-dev libcurl4-openssl-dev libzip-dev \
+ && docker-php-ext-install pdo pdo_mysql \
+ && docker-php-ext-configure curl \
+ && docker-php-ext-install curl \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+WORKDIR /app
diff --git a/.docker/test/api/Dockerfile b/.docker/test/api/Dockerfile
new file mode 100644
index 00000000..041773d4
--- /dev/null
+++ b/.docker/test/api/Dockerfile
@@ -0,0 +1,11 @@
+FROM php:7.4-apache-bullseye
+
+RUN apt-get update -q \
+ && apt-get install -y -q --no-install-recommends \
+      libssl-dev libcurl4-openssl-dev wget \
+ && docker-php-ext-configure curl \
+ && docker-php-ext-install pdo pdo_mysql curl \
+ && a2enmod headers setenvif \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY .docker/test/api/apache.conf /etc/apache2/sites-available/000-default.conf
diff --git a/.docker/test/api/apache.conf b/.docker/test/api/apache.conf
new file mode 100644
index 00000000..f4f4fa7d
--- /dev/null
+++ b/.docker/test/api/apache.conf
@@ -0,0 +1,15 @@
+<VirtualHost *:80>
+    DocumentRoot /var/www/api
+
+    # Pass the Authorization header through to PHP (same as production VirtualHost)
+    SetEnvIf Authorization "(.+)" HTTP_AUTHORIZATION=$1
+
+    <Directory /var/www/api>
+        Options FollowSymLinks
+        AllowOverride None
+        Require all granted
+        # FallbackResource serves index.php for any URI that doesn't map to a file,
+        # while preserving REQUEST_URI — so Slim 2 routing works correctly.
+        FallbackResource /index.php
+    </Directory>
+</VirtualHost>
diff --git a/.github/workflows/tests_e2e.yml b/.github/workflows/tests_e2e.yml
new file mode 100644
index 00000000..e6c81403
--- /dev/null
+++ b/.github/workflows/tests_e2e.yml
@@ -0,0 +1,77 @@
+name: E2E Tests
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  e2e:
+    name: E2E tests (Playwright)
+    runs-on: ubuntu-latest
+    env:
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP 7.4
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '7.4'
+
+      - name: Install API dependencies
+        working-directory: api
+        run: composer install --no-interaction --prefer-dist --ignore-platform-reqs
+
+      - name: Log in to Docker Hub
+        if: env.DOCKERHUB_TOKEN != ''
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and start the E2E stack
+        run: docker compose -f docker-compose.e2e.yml up -d --build
+
+      - name: Wait for the frontend to be ready
+        run: |
+          for i in $(seq 1 30); do
+            curl -sf http://localhost:4200 && break
+            echo "Waiting for frontend… ($i/30)"
+            sleep 5
+          done || exit 1 || exit 1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/e2e/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend/e2e
+        run: npm ci
+
+      - name: Install Playwright browsers
+        working-directory: frontend/e2e
+        run: npx playwright install --with-deps chromium
+
+      - name: Run E2E tests
+        working-directory: frontend/e2e
+        env:
+          E2E_BASE_URL: http://localhost:4200
+        run: npx playwright test
+
+      - name: Upload test report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: frontend/e2e/playwright-report/
+          retention-days: 7
+
+      - name: Tear down
+        if: always()
+        run: docker compose -f docker-compose.e2e.yml down -v
diff --git a/.github/workflows/tests_phpunit.yml b/.github/workflows/tests_phpunit.yml
new file mode 100644
index 00000000..d447e50a
--- /dev/null
+++ b/.github/workflows/tests_phpunit.yml
@@ -0,0 +1,37 @@
+name: Tests
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # Functional tests — Apache/PHP 7.4 + MySQL 8.0 via Docker Compose
+  # ---------------------------------------------------------------------------
+  functional:
+    name: Functional tests
+    runs-on: ubuntu-latest
+    env:
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        if: env.DOCKERHUB_TOKEN != ''
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build test images
+        run: docker compose -f docker-compose.test.yml build
+
+      - name: Run functional tests
+        run: docker compose -f docker-compose.test.yml run --rm phpunit
+
+      - name: Tear down
+        if: always()
+        run: docker compose -f docker-compose.test.yml down -v
diff --git a/.gitignore b/.gitignore
index de8d2fa6..99f3876e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,9 @@ npm-debug.log
 api/config.php
 *.swp
 /frontend/app/scripts/conf.js
+/frontend/**/node_modules
+/frontend/e2e/test-results
 /misc/illuminate_queries.log
 .vagrant
 /docker-compose.override.yaml
+api/.phpunit.result.cache
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 00000000..48f77904
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,100 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is the **GLPI Plugin Directory** — a web application for browsing and managing plugins for the GLPI IT management system. It consists of:
+
+- `api/` — PHP REST API built on Slim 2 + Eloquent ORM
+- `frontend/` — AngularJS 1 SPA built with Grunt
+- `specs/` — Modernization specs and test plans (functional, e2e)
+- `misc/` — Background task runner and DB initialization scripts
+
+The project is in **active modernization** (Step 1: adding test coverage is in progress). The stack is intentionally legacy (Slim 2, AngularJS 1) and will be upgraded in later steps.
+
+## Commands
+
+### API (PHP)
+
+```bash
+cd api
+composer install                              # Install dependencies
+vendor/bin/phpunit                            # Run all tests
+vendor/bin/phpunit --testsuite Functional     # Functional tests (requires MySQL)
+```
+
+Functional tests require a MySQL database. Default credentials (overridable via env vars):
+- DB: `glpi_plugins_functional_test`, user: `glpi`, pass: `glpi`, host: `localhost`
+- Env vars: `TEST_DB_HOST`, `TEST_DB_NAME`, `TEST_DB_USER`, `TEST_DB_PASS`
+
+### Frontend (JavaScript)
+
+```bash
+cd frontend
+npm install && bower install   # Install dependencies
+grunt build                    # Build production output to dist/
+grunt serve                    # Dev server at http://localhost:9000
+grunt test                     # Run Karma/Jasmine tests
+```
+
+### Docker
+
+```bash
+docker-compose up -d                                    # Start dev environment
+docker exec -it plugins.glpi-project.org bash          # Enter container
+# Inside container: Apache on :8080, Node dev server on :9000
+```
+
+### Background Tasks
+
+```bash
+php misc/run_tasks.php                        # Run all tasks (plugin updates, token cleanup)
+php misc/run_tasks.php -k genericobject -t update   # Update specific plugin by key
+php misc/run_tasks.php -i 44 -t update        # Update plugin by DB id
+```
+
+## Architecture
+
+### API (Slim 2)
+
+Entry point: `api/index.php` — initializes Illuminate DB capsule, Slim app, OAuth2 resource server, then `require`s all files from `src/endpoints/`.
+
+```
+api/src/
+├── core/          # Tool.php (request/response helpers), DB.php, Mailer.php, PaginatedCollection.php, ValidableXMLPluginDescription.php
+├── endpoints/     # One file per resource (Plugin.php, User.php, Author.php, OAuth.php, Tags.php, …)
+├── models/        # Eloquent ORM models (Plugin, User, Author, PluginVersion, OAuth tokens, …)
+├── exceptions/    # ErrorResponse base + subclasses (InvalidField, ResourceNotFound, …)
+└── oauthserver/   # OAuthHelper.php — league/oauth2-server v4.1 storage & factory
+```
+
+**Key patterns:**
+- Endpoint files are procedural PHP modules, not classes — they register Slim routes directly.
+- Pagination uses HTTP headers (`x-range`, `x-lang`) rather than query params.
+- OAuth2 supports `password`, `refresh_token`, and `client_credentials` grants.
+- Config is loaded from `api/config.php` (copy from `api/config.example.php`).
+
+### Tests
+
+**Functional tests** (`api/tests/Functional/`) — spin up PHP built-in server as subprocess, send real HTTP requests via Guzzle. Each test class reloads seeds (`tests/Functional/seeds.sql`) and wraps tests in a rolled-back transaction. Schema is initialized once per suite from `tests/Functional/schema.sql`.
+
+**Frontend tests** (`frontend/test/spec/`) — Karma + Jasmine, cover controllers, services, directives, filters.
+
+### Frontend (AngularJS 1)
+
+SPA routed via `ng-route`. API endpoint configured in `frontend/app/scripts/conf.js` (copy from `conf.example.js`). Build output goes to `frontend/dist/`.
+
+## CI/CD
+
+GitHub Actions (`.github/workflows/tests_phpunit.yml`):
+- **Functional**: PHP 7.4 + MySQL 8.0
+- Triggers on push/PR to `master`
+
+## Spec Files
+
+Detailed test specifications live in `specs/testing/`:
+- `functional.md` — what functional tests should cover
+- `e2e.md` — E2E test plan
+
+`specs/api/endpoints.md` is the full REST API reference including auth scopes, request/response shapes, and pagination behavior.
diff --git a/api/composer.json b/api/composer.json
index dddd90c8..2a158b17 100644
--- a/api/composer.json
+++ b/api/composer.json
@@ -38,8 +38,31 @@
          "API\\Exception\\": "src/exceptions"
       }
    },
+   "require-dev": {
+      "guzzlehttp/guzzle": "^6.0",
+      "mockery/mockery": "^1.6",
+      "phpunit/phpunit": "^9.5",
+      "symfony/process": "^5.0"
+   },
+   "autoload-dev": {
+      "psr-4": {
+         "Tests\\": "tests/"
+      }
+   },
+   "extra": {
+      "upgrade-notes": [
+         "slim/slim is pinned to ~2.0 — index.php has a get_magic_quotes_gpc() polyfill that must be removed when upgrading to Slim 3+.",
+         "illuminate/database is pinned to 5.1.* — vendor/nesbot/carbon Carbon.php has a manual PHP 8.2 compat patch (getLastErrors() returning false) that must be removed when upgrading Eloquent/Carbon."
+      ]
+   },
    "config": {
       "optimize-autoloader": true,
-      "sort-packages": true
+      "sort-packages": true,
+      "platform": {
+         "php": "7.4.0"
+      },
+      "allow-plugins": {
+         "kylekatarnls/update-helper": true
+      }
    }
 }
diff --git a/api/composer.lock b/api/composer.lock
index 771d2698..b0f5b4de 100644
--- a/api/composer.lock
+++ b/api/composer.lock
@@ -4,44 +4,8 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "b7b16dfdd013b55252da786830a1392c",
+    "content-hash": "de61b22472bfcd20afe82706911be541",
     "packages": [
-        {
-            "name": "container-interop/container-interop",
-            "version": "1.2.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/container-interop/container-interop.git",
-                "reference": "79cbf1341c22ec75643d841642dd5d6acd83bdb8"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/container-interop/container-interop/zipball/79cbf1341c22ec75643d841642dd5d6acd83bdb8",
-                "reference": "79cbf1341c22ec75643d841642dd5d6acd83bdb8",
-                "shasum": ""
-            },
-            "require": {
-                "psr/container": "^1.0"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Interop\\Container\\": "src/Interop/Container/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "description": "Promoting the interoperability of container objects (DIC, SL, etc.)",
-            "homepage": "https://github.com/container-interop/container-interop",
-            "support": {
-                "issues": "https://github.com/container-interop/container-interop/issues",
-                "source": "https://github.com/container-interop/container-interop/tree/master"
-            },
-            "abandoned": "psr/container",
-            "time": "2017-02-14T19:40:03+00:00"
-        },
         {
             "name": "danielstjules/stringy",
             "version": "1.10.0",
@@ -65,12 +29,12 @@
             },
             "type": "library",
             "autoload": {
-                "psr-4": {
-                    "Stringy\\": "src/"
-                },
                 "files": [
                     "src/Create.php"
-                ]
+                ],
+                "psr-4": {
+                    "Stringy\\": "src/"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -104,26 +68,26 @@
         },
         {
             "name": "doctrine/inflector",
-            "version": "1.4.3",
+            "version": "1.4.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/doctrine/inflector.git",
-                "reference": "4650c8b30c753a76bf44fb2ed00117d6f367490c"
+                "reference": "4bd5c1cdfcd00e9e2d8c484f79150f67e5d355d9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/doctrine/inflector/zipball/4650c8b30c753a76bf44fb2ed00117d6f367490c",
-                "reference": "4650c8b30c753a76bf44fb2ed00117d6f367490c",
+                "url": "https://api.github.com/repos/doctrine/inflector/zipball/4bd5c1cdfcd00e9e2d8c484f79150f67e5d355d9",
+                "reference": "4bd5c1cdfcd00e9e2d8c484f79150f67e5d355d9",
                 "shasum": ""
             },
             "require": {
-                "php": "^7.2 || ^8.0"
+                "php": "^7.1 || ^8.0"
             },
             "require-dev": {
-                "doctrine/coding-standard": "^7.0",
-                "phpstan/phpstan": "^0.11",
-                "phpstan/phpstan-phpunit": "^0.11",
-                "phpstan/phpstan-strict-rules": "^0.11",
+                "doctrine/coding-standard": "^8.0",
+                "phpstan/phpstan": "^0.12",
+                "phpstan/phpstan-phpunit": "^0.12",
+                "phpstan/phpstan-strict-rules": "^0.12",
                 "phpunit/phpunit": "^7.0 || ^8.0 || ^9.0"
             },
             "type": "library",
@@ -134,8 +98,8 @@
             },
             "autoload": {
                 "psr-4": {
-                    "Doctrine\\Common\\Inflector\\": "lib/Doctrine/Common/Inflector",
-                    "Doctrine\\Inflector\\": "lib/Doctrine/Inflector"
+                    "Doctrine\\Inflector\\": "lib/Doctrine/Inflector",
+                    "Doctrine\\Common\\Inflector\\": "lib/Doctrine/Common/Inflector"
                 }
             },
             "notification-url": "https://packagist.org/downloads/",
@@ -180,7 +144,7 @@
             ],
             "support": {
                 "issues": "https://github.com/doctrine/inflector/issues",
-                "source": "https://github.com/doctrine/inflector/tree/1.4.x"
+                "source": "https://github.com/doctrine/inflector/tree/1.4.4"
             },
             "funding": [
                 {
@@ -196,7 +160,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2020-05-29T07:19:59+00:00"
+            "time": "2021-04-16T17:34:40+00:00"
         },
         {
             "name": "google/recaptcha",
@@ -252,24 +216,24 @@
         },
         {
             "name": "guzzlehttp/guzzle",
-            "version": "6.5.5",
+            "version": "6.5.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/guzzle.git",
-                "reference": "9d4290de1cfd701f38099ef7e183b64b4b7b0c5e"
+                "reference": "a52f0440530b54fa079ce76e8c5d196a42cad981"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/9d4290de1cfd701f38099ef7e183b64b4b7b0c5e",
-                "reference": "9d4290de1cfd701f38099ef7e183b64b4b7b0c5e",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/a52f0440530b54fa079ce76e8c5d196a42cad981",
+                "reference": "a52f0440530b54fa079ce76e8c5d196a42cad981",
                 "shasum": ""
             },
             "require": {
                 "ext-json": "*",
                 "guzzlehttp/promises": "^1.0",
-                "guzzlehttp/psr7": "^1.6.1",
+                "guzzlehttp/psr7": "^1.9",
                 "php": ">=5.5",
-                "symfony/polyfill-intl-idn": "^1.17.0"
+                "symfony/polyfill-intl-idn": "^1.17"
             },
             "require-dev": {
                 "ext-curl": "*",
@@ -286,22 +250,52 @@
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "GuzzleHttp\\": "src/"
-                },
                 "files": [
                     "src/functions_include.php"
-                ]
+                ],
+                "psr-4": {
+                    "GuzzleHttp\\": "src/"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "MIT"
             ],
             "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                },
                 {
                     "name": "Michael Dowling",
                     "email": "mtdowling@gmail.com",
                     "homepage": "https://github.com/mtdowling"
+                },
+                {
+                    "name": "Jeremy Lindblom",
+                    "email": "jeremeamia@gmail.com",
+                    "homepage": "https://github.com/jeremeamia"
+                },
+                {
+                    "name": "George Mponos",
+                    "email": "gmponos@gmail.com",
+                    "homepage": "https://github.com/gmponos"
+                },
+                {
+                    "name": "Tobias Nyholm",
+                    "email": "tobias.nyholm@gmail.com",
+                    "homepage": "https://github.com/Nyholm"
+                },
+                {
+                    "name": "Márk Sági-Kazár",
+                    "email": "mark.sagikazar@gmail.com",
+                    "homepage": "https://github.com/sagikazarmark"
+                },
+                {
+                    "name": "Tobias Schultze",
+                    "email": "webmaster@tubo-world.de",
+                    "homepage": "https://github.com/Tobion"
                 }
             ],
             "description": "Guzzle is a PHP HTTP client library",
@@ -317,22 +311,36 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/guzzle/issues",
-                "source": "https://github.com/guzzle/guzzle/tree/6.5"
+                "source": "https://github.com/guzzle/guzzle/tree/6.5.8"
             },
-            "time": "2020-06-16T21:01:06+00:00"
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/Nyholm",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/guzzlehttp/guzzle",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2022-06-20T22:16:07+00:00"
         },
         {
             "name": "guzzlehttp/promises",
-            "version": "1.4.1",
+            "version": "1.5.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/promises.git",
-                "reference": "8e7d04f1f6450fef59366c399cfad4b9383aa30d"
+                "reference": "67ab6e18aaa14d753cc148911d273f6e6cb6721e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/promises/zipball/8e7d04f1f6450fef59366c399cfad4b9383aa30d",
-                "reference": "8e7d04f1f6450fef59366c399cfad4b9383aa30d",
+                "url": "https://api.github.com/repos/guzzle/promises/zipball/67ab6e18aaa14d753cc148911d273f6e6cb6721e",
+                "reference": "67ab6e18aaa14d753cc148911d273f6e6cb6721e",
                 "shasum": ""
             },
             "require": {
@@ -342,28 +350,38 @@
                 "symfony/phpunit-bridge": "^4.4 || ^5.1"
             },
             "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "1.4-dev"
-                }
-            },
             "autoload": {
-                "psr-4": {
-                    "GuzzleHttp\\Promise\\": "src/"
-                },
                 "files": [
                     "src/functions_include.php"
-                ]
+                ],
+                "psr-4": {
+                    "GuzzleHttp\\Promise\\": "src/"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "MIT"
             ],
             "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                },
                 {
                     "name": "Michael Dowling",
                     "email": "mtdowling@gmail.com",
                     "homepage": "https://github.com/mtdowling"
+                },
+                {
+                    "name": "Tobias Nyholm",
+                    "email": "tobias.nyholm@gmail.com",
+                    "homepage": "https://github.com/Nyholm"
+                },
+                {
+                    "name": "Tobias Schultze",
+                    "email": "webmaster@tubo-world.de",
+                    "homepage": "https://github.com/Tobion"
                 }
             ],
             "description": "Guzzle promises library",
@@ -372,22 +390,36 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/promises/issues",
-                "source": "https://github.com/guzzle/promises/tree/1.4.1"
+                "source": "https://github.com/guzzle/promises/tree/1.5.3"
             },
-            "time": "2021-03-07T09:25:29+00:00"
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/Nyholm",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/guzzlehttp/promises",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2023-05-21T12:31:43+00:00"
         },
         {
             "name": "guzzlehttp/psr7",
-            "version": "1.8.1",
+            "version": "1.9.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/psr7.git",
-                "reference": "35ea11d335fd638b5882ff1725228b3d35496ab1"
+                "reference": "e4490cabc77465aaee90b20cfc9a770f8c04be6b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/35ea11d335fd638b5882ff1725228b3d35496ab1",
-                "reference": "35ea11d335fd638b5882ff1725228b3d35496ab1",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/e4490cabc77465aaee90b20cfc9a770f8c04be6b",
+                "reference": "e4490cabc77465aaee90b20cfc9a770f8c04be6b",
                 "shasum": ""
             },
             "require": {
@@ -406,31 +438,47 @@
                 "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
             },
             "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "1.7-dev"
-                }
-            },
             "autoload": {
-                "psr-4": {
-                    "GuzzleHttp\\Psr7\\": "src/"
-                },
                 "files": [
                     "src/functions_include.php"
-                ]
+                ],
+                "psr-4": {
+                    "GuzzleHttp\\Psr7\\": "src/"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "MIT"
             ],
             "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                },
                 {
                     "name": "Michael Dowling",
                     "email": "mtdowling@gmail.com",
                     "homepage": "https://github.com/mtdowling"
                 },
+                {
+                    "name": "George Mponos",
+                    "email": "gmponos@gmail.com",
+                    "homepage": "https://github.com/gmponos"
+                },
+                {
+                    "name": "Tobias Nyholm",
+                    "email": "tobias.nyholm@gmail.com",
+                    "homepage": "https://github.com/Nyholm"
+                },
+                {
+                    "name": "Márk Sági-Kazár",
+                    "email": "mark.sagikazar@gmail.com",
+                    "homepage": "https://github.com/sagikazarmark"
+                },
                 {
                     "name": "Tobias Schultze",
+                    "email": "webmaster@tubo-world.de",
                     "homepage": "https://github.com/Tobion"
                 }
             ],
@@ -447,9 +495,23 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/1.8.1"
+                "source": "https://github.com/guzzle/psr7/tree/1.9.1"
             },
-            "time": "2021-03-21T16:25:00+00:00"
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/Nyholm",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/guzzlehttp/psr7",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2023-04-17T16:00:37+00:00"
         },
         {
             "name": "illuminate/container",
@@ -690,12 +752,12 @@
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Illuminate\\Support\\": ""
-                },
                 "files": [
                     "helpers.php"
-                ]
+                ],
+                "psr-4": {
+                    "Illuminate\\Support\\": ""
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -889,34 +951,33 @@
         },
         {
             "name": "laminas/laminas-escaper",
-            "version": "2.7.0",
+            "version": "2.12.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laminas/laminas-escaper.git",
-                "reference": "5e04bc5ae5990b17159d79d331055e2c645e5cc5"
+                "reference": "ee7a4c37bf3d0e8c03635d5bddb5bb3184ead490"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laminas/laminas-escaper/zipball/5e04bc5ae5990b17159d79d331055e2c645e5cc5",
-                "reference": "5e04bc5ae5990b17159d79d331055e2c645e5cc5",
+                "url": "https://api.github.com/repos/laminas/laminas-escaper/zipball/ee7a4c37bf3d0e8c03635d5bddb5bb3184ead490",
+                "reference": "ee7a4c37bf3d0e8c03635d5bddb5bb3184ead490",
                 "shasum": ""
             },
             "require": {
-                "laminas/laminas-zendframework-bridge": "^1.0",
-                "php": "^7.3 || ~8.0.0"
+                "ext-ctype": "*",
+                "ext-mbstring": "*",
+                "php": "^7.4 || ~8.0.0 || ~8.1.0 || ~8.2.0"
             },
-            "replace": {
-                "zendframework/zend-escaper": "^2.6.1"
+            "conflict": {
+                "zendframework/zend-escaper": "*"
             },
             "require-dev": {
-                "laminas/laminas-coding-standard": "~1.0.0",
-                "phpunit/phpunit": "^9.3",
-                "psalm/plugin-phpunit": "^0.12.2",
-                "vimeo/psalm": "^3.16"
-            },
-            "suggest": {
-                "ext-iconv": "*",
-                "ext-mbstring": "*"
+                "infection/infection": "^0.26.6",
+                "laminas/laminas-coding-standard": "~2.4.0",
+                "maglnet/composer-require-checker": "^3.8.0",
+                "phpunit/phpunit": "^9.5.18",
+                "psalm/plugin-phpunit": "^0.17.0",
+                "vimeo/psalm": "^4.22.0"
             },
             "type": "library",
             "autoload": {
@@ -948,33 +1009,126 @@
                     "type": "community_bridge"
                 }
             ],
-            "time": "2020-11-17T21:26:43+00:00"
+            "time": "2022-10-10T10:11:09+00:00"
+        },
+        {
+            "name": "laminas/laminas-servicemanager",
+            "version": "3.17.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/laminas/laminas-servicemanager.git",
+                "reference": "360be5f16955dd1edbcce1cfaa98ed82a17f02ec"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/laminas/laminas-servicemanager/zipball/360be5f16955dd1edbcce1cfaa98ed82a17f02ec",
+                "reference": "360be5f16955dd1edbcce1cfaa98ed82a17f02ec",
+                "shasum": ""
+            },
+            "require": {
+                "laminas/laminas-stdlib": "^3.2.1",
+                "php": "~7.4.0 || ~8.0.0 || ~8.1.0",
+                "psr/container": "^1.0"
+            },
+            "conflict": {
+                "ext-psr": "*",
+                "laminas/laminas-code": "<3.3.1",
+                "zendframework/zend-code": "<3.3.1",
+                "zendframework/zend-servicemanager": "*"
+            },
+            "provide": {
+                "psr/container-implementation": "^1.0"
+            },
+            "replace": {
+                "container-interop/container-interop": "^1.2.0"
+            },
+            "require-dev": {
+                "composer/package-versions-deprecated": "^1.0",
+                "laminas/laminas-coding-standard": "~2.4.0",
+                "laminas/laminas-container-config-test": "^0.7",
+                "laminas/laminas-dependency-plugin": "^2.1.2",
+                "mikey179/vfsstream": "^1.6.10@alpha",
+                "ocramius/proxy-manager": "^2.11",
+                "phpbench/phpbench": "^1.1",
+                "phpspec/prophecy-phpunit": "^2.0",
+                "phpunit/phpunit": "^9.5.5",
+                "psalm/plugin-phpunit": "^0.17.0",
+                "vimeo/psalm": "^4.8"
+            },
+            "suggest": {
+                "ocramius/proxy-manager": "ProxyManager ^2.1.1 to handle lazy initialization of services"
+            },
+            "bin": [
+                "bin/generate-deps-for-config-factory",
+                "bin/generate-factory-for-class"
+            ],
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "src/autoload.php"
+                ],
+                "psr-4": {
+                    "Laminas\\ServiceManager\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "description": "Factory-Driven Dependency Injection Container",
+            "homepage": "https://laminas.dev",
+            "keywords": [
+                "PSR-11",
+                "dependency-injection",
+                "di",
+                "dic",
+                "laminas",
+                "service-manager",
+                "servicemanager"
+            ],
+            "support": {
+                "chat": "https://laminas.dev/chat",
+                "docs": "https://docs.laminas.dev/laminas-servicemanager/",
+                "forum": "https://discourse.laminas.dev",
+                "issues": "https://github.com/laminas/laminas-servicemanager/issues",
+                "rss": "https://github.com/laminas/laminas-servicemanager/releases.atom",
+                "source": "https://github.com/laminas/laminas-servicemanager"
+            },
+            "funding": [
+                {
+                    "url": "https://funding.communitybridge.org/projects/laminas-project",
+                    "type": "community_bridge"
+                }
+            ],
+            "time": "2022-09-22T11:33:46+00:00"
         },
         {
             "name": "laminas/laminas-stdlib",
-            "version": "3.3.1",
+            "version": "3.13.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laminas/laminas-stdlib.git",
-                "reference": "d81c7ffe602ed0e6ecb18691019111c0f4bf1efe"
+                "reference": "66a6d03c381f6c9f1dd988bf8244f9afb9380d76"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laminas/laminas-stdlib/zipball/d81c7ffe602ed0e6ecb18691019111c0f4bf1efe",
-                "reference": "d81c7ffe602ed0e6ecb18691019111c0f4bf1efe",
+                "url": "https://api.github.com/repos/laminas/laminas-stdlib/zipball/66a6d03c381f6c9f1dd988bf8244f9afb9380d76",
+                "reference": "66a6d03c381f6c9f1dd988bf8244f9afb9380d76",
                 "shasum": ""
             },
             "require": {
-                "laminas/laminas-zendframework-bridge": "^1.0",
-                "php": "^7.3 || ^8.0"
+                "php": "^7.4 || ~8.0.0 || ~8.1.0"
             },
-            "replace": {
-                "zendframework/zend-stdlib": "^3.2.1"
+            "conflict": {
+                "zendframework/zend-stdlib": "*"
             },
             "require-dev": {
-                "laminas/laminas-coding-standard": "~1.0.0",
-                "phpbench/phpbench": "^0.17.1",
-                "phpunit/phpunit": "~9.3.7"
+                "laminas/laminas-coding-standard": "~2.3.0",
+                "phpbench/phpbench": "^1.2.6",
+                "phpstan/phpdoc-parser": "^0.5.4",
+                "phpunit/phpunit": "^9.5.23",
+                "psalm/plugin-phpunit": "^0.17.0",
+                "vimeo/psalm": "^4.26"
             },
             "type": "library",
             "autoload": {
@@ -1006,34 +1160,33 @@
                     "type": "community_bridge"
                 }
             ],
-            "time": "2020-11-19T20:18:59+00:00"
+            "time": "2022-08-24T13:56:50+00:00"
         },
         {
             "name": "laminas/laminas-uri",
-            "version": "2.8.1",
+            "version": "2.9.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laminas/laminas-uri.git",
-                "reference": "79bd4c614c8cf9a6ba715a49fca8061e84933d87"
+                "reference": "7e837dc15c8fd3949df7d1213246fd7c8640032b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laminas/laminas-uri/zipball/79bd4c614c8cf9a6ba715a49fca8061e84933d87",
-                "reference": "79bd4c614c8cf9a6ba715a49fca8061e84933d87",
+                "url": "https://api.github.com/repos/laminas/laminas-uri/zipball/7e837dc15c8fd3949df7d1213246fd7c8640032b",
+                "reference": "7e837dc15c8fd3949df7d1213246fd7c8640032b",
                 "shasum": ""
             },
             "require": {
-                "laminas/laminas-escaper": "^2.5",
-                "laminas/laminas-validator": "^2.10",
-                "laminas/laminas-zendframework-bridge": "^1.0",
-                "php": "^7.3 || ~8.0.0"
+                "laminas/laminas-escaper": "^2.9",
+                "laminas/laminas-validator": "^2.15",
+                "php": "^7.3 || ~8.0.0 || ~8.1.0"
             },
-            "replace": {
-                "zendframework/zend-uri": "^2.7.1"
+            "conflict": {
+                "zendframework/zend-uri": "*"
             },
             "require-dev": {
-                "laminas/laminas-coding-standard": "^2.1",
-                "phpunit/phpunit": "^9.3"
+                "laminas/laminas-coding-standard": "~2.2.1",
+                "phpunit/phpunit": "^9.5.5"
             },
             "type": "library",
             "autoload": {
@@ -1065,57 +1218,51 @@
                     "type": "community_bridge"
                 }
             ],
-            "time": "2021-02-17T21:53:05+00:00"
+            "time": "2021-09-09T18:37:15+00:00"
         },
         {
             "name": "laminas/laminas-validator",
-            "version": "2.14.4",
+            "version": "2.25.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laminas/laminas-validator.git",
-                "reference": "e370c4695db1c81e6dfad38d8c4dbdb37b23d776"
+                "reference": "42de39b78e73b321db7d948cf8530a2764f8b9aa"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laminas/laminas-validator/zipball/e370c4695db1c81e6dfad38d8c4dbdb37b23d776",
-                "reference": "e370c4695db1c81e6dfad38d8c4dbdb37b23d776",
+                "url": "https://api.github.com/repos/laminas/laminas-validator/zipball/42de39b78e73b321db7d948cf8530a2764f8b9aa",
+                "reference": "42de39b78e73b321db7d948cf8530a2764f8b9aa",
                 "shasum": ""
             },
             "require": {
-                "container-interop/container-interop": "^1.1",
-                "laminas/laminas-stdlib": "^3.3",
-                "laminas/laminas-zendframework-bridge": "^1.0",
-                "php": "^7.3 || ~8.0.0"
+                "laminas/laminas-servicemanager": "^3.12.0",
+                "laminas/laminas-stdlib": "^3.13",
+                "php": "^7.4 || ~8.0.0 || ~8.1.0"
             },
-            "replace": {
-                "zendframework/zend-validator": "^2.13.0"
+            "conflict": {
+                "zendframework/zend-validator": "*"
             },
             "require-dev": {
-                "laminas/laminas-cache": "^2.6.1",
-                "laminas/laminas-coding-standard": "~1.0.0",
-                "laminas/laminas-config": "^2.6",
-                "laminas/laminas-db": "^2.7",
-                "laminas/laminas-filter": "^2.6",
-                "laminas/laminas-http": "^2.14.2",
-                "laminas/laminas-i18n": "^2.6",
-                "laminas/laminas-math": "^2.6",
-                "laminas/laminas-servicemanager": "^2.7.11 || ^3.0.3",
-                "laminas/laminas-session": "^2.8",
-                "laminas/laminas-uri": "^2.7",
+                "laminas/laminas-coding-standard": "^2.4.0",
+                "laminas/laminas-db": "^2.15.0",
+                "laminas/laminas-filter": "^2.18.0",
+                "laminas/laminas-http": "^2.16.0",
+                "laminas/laminas-i18n": "^2.17.0",
+                "laminas/laminas-session": "^2.13.0",
+                "laminas/laminas-uri": "^2.9.1",
                 "phpspec/prophecy-phpunit": "^2.0",
-                "phpunit/phpunit": "^9.3",
-                "psalm/plugin-phpunit": "^0.15.0",
+                "phpunit/phpunit": "^9.5.24",
+                "psalm/plugin-phpunit": "^0.17.0",
                 "psr/http-client": "^1.0",
                 "psr/http-factory": "^1.0",
                 "psr/http-message": "^1.0",
-                "vimeo/psalm": "^4.3"
+                "vimeo/psalm": "^4.27.0"
             },
             "suggest": {
                 "laminas/laminas-db": "Laminas\\Db component, required by the (No)RecordExists validator",
                 "laminas/laminas-filter": "Laminas\\Filter component, required by the Digits validator",
                 "laminas/laminas-i18n": "Laminas\\I18n component to allow translation of validation error messages",
                 "laminas/laminas-i18n-resources": "Translations of validator messages",
-                "laminas/laminas-math": "Laminas\\Math component, required by the Csrf validator",
                 "laminas/laminas-servicemanager": "Laminas\\ServiceManager component to allow using the ValidatorPluginManager and validator chains",
                 "laminas/laminas-session": "Laminas\\Session component, ^2.8; required by the Csrf validator",
                 "laminas/laminas-uri": "Laminas\\Uri component, required by the Uri and Sitemap\\Loc validators",
@@ -1157,86 +1304,24 @@
                     "type": "community_bridge"
                 }
             ],
-            "time": "2021-01-24T20:45:49+00:00"
-        },
-        {
-            "name": "laminas/laminas-zendframework-bridge",
-            "version": "1.2.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/laminas/laminas-zendframework-bridge.git",
-                "reference": "6cccbddfcfc742eb02158d6137ca5687d92cee32"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/laminas/laminas-zendframework-bridge/zipball/6cccbddfcfc742eb02158d6137ca5687d92cee32",
-                "reference": "6cccbddfcfc742eb02158d6137ca5687d92cee32",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^7.3 || ^8.0"
-            },
-            "require-dev": {
-                "phpunit/phpunit": "^5.7 || ^6.5 || ^7.5 || ^8.1 || ^9.3",
-                "psalm/plugin-phpunit": "^0.15.1",
-                "squizlabs/php_codesniffer": "^3.5",
-                "vimeo/psalm": "^4.6"
-            },
-            "type": "library",
-            "extra": {
-                "laminas": {
-                    "module": "Laminas\\ZendFrameworkBridge"
-                }
-            },
-            "autoload": {
-                "files": [
-                    "src/autoload.php"
-                ],
-                "psr-4": {
-                    "Laminas\\ZendFrameworkBridge\\": "src//"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "BSD-3-Clause"
-            ],
-            "description": "Alias legacy ZF class names to Laminas Project equivalents.",
-            "keywords": [
-                "ZendFramework",
-                "autoloading",
-                "laminas",
-                "zf"
-            ],
-            "support": {
-                "forum": "https://discourse.laminas.dev/",
-                "issues": "https://github.com/laminas/laminas-zendframework-bridge/issues",
-                "rss": "https://github.com/laminas/laminas-zendframework-bridge/releases.atom",
-                "source": "https://github.com/laminas/laminas-zendframework-bridge"
-            },
-            "funding": [
-                {
-                    "url": "https://funding.communitybridge.org/projects/laminas-project",
-                    "type": "community_bridge"
-                }
-            ],
-            "time": "2021-02-25T21:54:58+00:00"
+            "time": "2022-09-20T11:33:19+00:00"
         },
         {
             "name": "league/event",
-            "version": "2.2.0",
+            "version": "2.3.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/event.git",
-                "reference": "d2cc124cf9a3fab2bb4ff963307f60361ce4d119"
+                "reference": "062ebb450efbe9a09bc2478e89b7c933875b0935"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/event/zipball/d2cc124cf9a3fab2bb4ff963307f60361ce4d119",
-                "reference": "d2cc124cf9a3fab2bb4ff963307f60361ce4d119",
+                "url": "https://api.github.com/repos/thephpleague/event/zipball/062ebb450efbe9a09bc2478e89b7c933875b0935",
+                "reference": "062ebb450efbe9a09bc2478e89b7c933875b0935",
                 "shasum": ""
             },
             "require": {
-                "php": ">=5.4.0"
+                "php": ">=7.1.0"
             },
             "require-dev": {
                 "henrikbjorn/phpspec-code-coverage": "~1.0.1",
@@ -1271,9 +1356,9 @@
             ],
             "support": {
                 "issues": "https://github.com/thephpleague/event/issues",
-                "source": "https://github.com/thephpleague/event/tree/master"
+                "source": "https://github.com/thephpleague/event/tree/2.3.0"
             },
-            "time": "2018-11-26T11:52:41+00:00"
+            "time": "2025-03-14T19:51:10+00:00"
         },
         {
             "name": "league/oauth2-client",
@@ -1505,12 +1590,12 @@
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "League\\Uri\\": "src"
-                },
                 "files": [
                     "src/functions_include.php"
-                ]
+                ],
+                "psr-4": {
+                    "League\\Uri\\": "src"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -1537,30 +1622,29 @@
                 "issues": "https://github.com/thephpleague/uri-parser/issues",
                 "source": "https://github.com/thephpleague/uri-parser/tree/master"
             },
+            "abandoned": "league/uri-interfaces",
             "time": "2018-11-22T07:55:51+00:00"
         },
         {
             "name": "masterminds/html5",
-            "version": "2.7.4",
+            "version": "2.10.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Masterminds/html5-php.git",
-                "reference": "9227822783c75406cfe400984b2f095cdf03d417"
+                "reference": "fcf91eb64359852f00d921887b219479b4f21251"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Masterminds/html5-php/zipball/9227822783c75406cfe400984b2f095cdf03d417",
-                "reference": "9227822783c75406cfe400984b2f095cdf03d417",
+                "url": "https://api.github.com/repos/Masterminds/html5-php/zipball/fcf91eb64359852f00d921887b219479b4f21251",
+                "reference": "fcf91eb64359852f00d921887b219479b4f21251",
                 "shasum": ""
             },
             "require": {
-                "ext-ctype": "*",
                 "ext-dom": "*",
-                "ext-libxml": "*",
                 "php": ">=5.3.0"
             },
             "require-dev": {
-                "phpunit/phpunit": "^4.8.35"
+                "phpunit/phpunit": "^4.8.35 || ^5.7.21 || ^6 || ^7 || ^8 || ^9"
             },
             "type": "library",
             "extra": {
@@ -1604,21 +1688,21 @@
             ],
             "support": {
                 "issues": "https://github.com/Masterminds/html5-php/issues",
-                "source": "https://github.com/Masterminds/html5-php/tree/2.7.4"
+                "source": "https://github.com/Masterminds/html5-php/tree/2.10.0"
             },
-            "time": "2020-10-01T13:52:52+00:00"
+            "time": "2025-07-25T09:04:22+00:00"
         },
         {
             "name": "nesbot/carbon",
             "version": "1.39.1",
             "source": {
                 "type": "git",
-                "url": "https://github.com/briannesbitt/Carbon.git",
+                "url": "https://github.com/CarbonPHP/carbon.git",
                 "reference": "4be0c005164249208ce1b5ca633cd57bdd42ff33"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/briannesbitt/Carbon/zipball/4be0c005164249208ce1b5ca633cd57bdd42ff33",
+                "url": "https://api.github.com/repos/CarbonPHP/carbon/zipball/4be0c005164249208ce1b5ca633cd57bdd42ff33",
                 "reference": "4be0c005164249208ce1b5ca633cd57bdd42ff33",
                 "shasum": ""
             },
@@ -1637,12 +1721,12 @@
             ],
             "type": "library",
             "extra": {
-                "update-helper": "Carbon\\Upgrade",
                 "laravel": {
                     "providers": [
                         "Carbon\\Laravel\\ServiceProvider"
                     ]
-                }
+                },
+                "update-helper": "Carbon\\Upgrade"
             },
             "autoload": {
                 "psr-4": {
@@ -1671,6 +1755,20 @@
                 "issues": "https://github.com/briannesbitt/Carbon/issues",
                 "source": "https://github.com/briannesbitt/Carbon"
             },
+            "funding": [
+                {
+                    "url": "https://github.com/kylekatarnls",
+                    "type": "github"
+                },
+                {
+                    "url": "https://opencollective.com/Carbon",
+                    "type": "open_collective"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/nesbot/carbon",
+                    "type": "tidelift"
+                }
+            ],
             "time": "2019-10-14T05:51:36+00:00"
         },
         {
@@ -1728,20 +1826,20 @@
         },
         {
             "name": "psr/container",
-            "version": "1.1.1",
+            "version": "1.1.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/php-fig/container.git",
-                "reference": "8622567409010282b7aeebe4bb841fe98b58dcaf"
+                "reference": "513e0666f7216c7459170d56df27dfcefe1689ea"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/php-fig/container/zipball/8622567409010282b7aeebe4bb841fe98b58dcaf",
-                "reference": "8622567409010282b7aeebe4bb841fe98b58dcaf",
+                "url": "https://api.github.com/repos/php-fig/container/zipball/513e0666f7216c7459170d56df27dfcefe1689ea",
+                "reference": "513e0666f7216c7459170d56df27dfcefe1689ea",
                 "shasum": ""
             },
             "require": {
-                "php": ">=7.2.0"
+                "php": ">=7.4.0"
             },
             "type": "library",
             "autoload": {
@@ -1770,31 +1868,31 @@
             ],
             "support": {
                 "issues": "https://github.com/php-fig/container/issues",
-                "source": "https://github.com/php-fig/container/tree/1.1.1"
+                "source": "https://github.com/php-fig/container/tree/1.1.2"
             },
-            "time": "2021-03-05T17:36:06+00:00"
+            "time": "2021-11-05T16:50:12+00:00"
         },
         {
             "name": "psr/http-message",
-            "version": "1.0.1",
+            "version": "1.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/php-fig/http-message.git",
-                "reference": "f6561bf28d520154e4b0ec72be95418abe6d9363"
+                "reference": "cb6ce4845ce34a8ad9e68117c10ee90a29919eba"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/php-fig/http-message/zipball/f6561bf28d520154e4b0ec72be95418abe6d9363",
-                "reference": "f6561bf28d520154e4b0ec72be95418abe6d9363",
+                "url": "https://api.github.com/repos/php-fig/http-message/zipball/cb6ce4845ce34a8ad9e68117c10ee90a29919eba",
+                "reference": "cb6ce4845ce34a8ad9e68117c10ee90a29919eba",
                 "shasum": ""
             },
             "require": {
-                "php": ">=5.3.0"
+                "php": "^7.2 || ^8.0"
             },
             "type": "library",
             "extra": {
                 "branch-alias": {
-                    "dev-master": "1.0.x-dev"
+                    "dev-master": "1.1.x-dev"
                 }
             },
             "autoload": {
@@ -1823,22 +1921,22 @@
                 "response"
             ],
             "support": {
-                "source": "https://github.com/php-fig/http-message/tree/master"
+                "source": "https://github.com/php-fig/http-message/tree/1.1"
             },
-            "time": "2016-08-06T14:39:51+00:00"
+            "time": "2023-04-04T09:50:52+00:00"
         },
         {
             "name": "psr/log",
-            "version": "1.1.3",
+            "version": "1.1.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/php-fig/log.git",
-                "reference": "0f73288fd15629204f9d42b7055f72dacbe811fc"
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/php-fig/log/zipball/0f73288fd15629204f9d42b7055f72dacbe811fc",
-                "reference": "0f73288fd15629204f9d42b7055f72dacbe811fc",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
                 "shasum": ""
             },
             "require": {
@@ -1862,7 +1960,7 @@
             "authors": [
                 {
                     "name": "PHP-FIG",
-                    "homepage": "http://www.php-fig.org/"
+                    "homepage": "https://www.php-fig.org/"
                 }
             ],
             "description": "Common interface for logging libraries",
@@ -1873,9 +1971,9 @@
                 "psr-3"
             ],
             "support": {
-                "source": "https://github.com/php-fig/log/tree/1.1.3"
+                "source": "https://github.com/php-fig/log/tree/1.1.4"
             },
-            "time": "2020-03-23T09:12:05+00:00"
+            "time": "2021-05-03T11:20:27+00:00"
         },
         {
             "name": "ralouphie/getallheaders",
@@ -2081,6 +2179,7 @@
                 "issues": "https://github.com/swiftmailer/swiftmailer/issues",
                 "source": "https://github.com/swiftmailer/swiftmailer/tree/v5.4.12"
             },
+            "abandoned": "symfony/mailer",
             "time": "2018-07-31T09:26:32+00:00"
         },
         {
@@ -2151,41 +2250,41 @@
         },
         {
             "name": "symfony/polyfill-ctype",
-            "version": "v1.22.1",
+            "version": "v1.33.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-ctype.git",
-                "reference": "c6c942b1ac76c82448322025e084cadc56048b4e"
+                "reference": "a3cc8b044a6ea513310cbd48ef7333b384945638"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/c6c942b1ac76c82448322025e084cadc56048b4e",
-                "reference": "c6c942b1ac76c82448322025e084cadc56048b4e",
+                "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/a3cc8b044a6ea513310cbd48ef7333b384945638",
+                "reference": "a3cc8b044a6ea513310cbd48ef7333b384945638",
                 "shasum": ""
             },
             "require": {
-                "php": ">=7.1"
+                "php": ">=7.2"
+            },
+            "provide": {
+                "ext-ctype": "*"
             },
             "suggest": {
                 "ext-ctype": "For best performance"
             },
             "type": "library",
             "extra": {
-                "branch-alias": {
-                    "dev-main": "1.22-dev"
-                },
                 "thanks": {
-                    "name": "symfony/polyfill",
-                    "url": "https://github.com/symfony/polyfill"
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Symfony\\Polyfill\\Ctype\\": ""
-                },
                 "files": [
                     "bootstrap.php"
-                ]
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Ctype\\": ""
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -2210,7 +2309,7 @@
                 "portable"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.22.1"
+                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.33.0"
             },
             "funding": [
                 {
@@ -2221,52 +2320,52 @@
                     "url": "https://github.com/fabpot",
                     "type": "github"
                 },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
                 {
                     "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-01-07T16:49:33+00:00"
+            "time": "2024-09-09T11:45:10+00:00"
         },
         {
             "name": "symfony/polyfill-intl-idn",
-            "version": "v1.22.1",
+            "version": "v1.33.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-intl-idn.git",
-                "reference": "2d63434d922daf7da8dd863e7907e67ee3031483"
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-idn/zipball/2d63434d922daf7da8dd863e7907e67ee3031483",
-                "reference": "2d63434d922daf7da8dd863e7907e67ee3031483",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-idn/zipball/9614ac4d8061dc257ecc64cba1b140873dce8ad3",
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3",
                 "shasum": ""
             },
             "require": {
-                "php": ">=7.1",
-                "symfony/polyfill-intl-normalizer": "^1.10",
-                "symfony/polyfill-php72": "^1.10"
+                "php": ">=7.2",
+                "symfony/polyfill-intl-normalizer": "^1.10"
             },
             "suggest": {
                 "ext-intl": "For best performance"
             },
             "type": "library",
             "extra": {
-                "branch-alias": {
-                    "dev-main": "1.22-dev"
-                },
                 "thanks": {
-                    "name": "symfony/polyfill",
-                    "url": "https://github.com/symfony/polyfill"
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Symfony\\Polyfill\\Intl\\Idn\\": ""
-                },
                 "files": [
                     "bootstrap.php"
-                ]
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Intl\\Idn\\": ""
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -2297,7 +2396,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.22.1"
+                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.33.0"
             },
             "funding": [
                 {
@@ -2308,50 +2407,51 @@
                     "url": "https://github.com/fabpot",
                     "type": "github"
                 },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
                 {
                     "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-01-22T09:19:47+00:00"
+            "time": "2024-09-10T14:38:51+00:00"
         },
         {
             "name": "symfony/polyfill-intl-normalizer",
-            "version": "v1.22.1",
+            "version": "v1.33.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-intl-normalizer.git",
-                "reference": "43a0283138253ed1d48d352ab6d0bdb3f809f248"
+                "reference": "3833d7255cc303546435cb650316bff708a1c75c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-normalizer/zipball/43a0283138253ed1d48d352ab6d0bdb3f809f248",
-                "reference": "43a0283138253ed1d48d352ab6d0bdb3f809f248",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-normalizer/zipball/3833d7255cc303546435cb650316bff708a1c75c",
+                "reference": "3833d7255cc303546435cb650316bff708a1c75c",
                 "shasum": ""
             },
             "require": {
-                "php": ">=7.1"
+                "php": ">=7.2"
             },
             "suggest": {
                 "ext-intl": "For best performance"
             },
             "type": "library",
             "extra": {
-                "branch-alias": {
-                    "dev-main": "1.22-dev"
-                },
                 "thanks": {
-                    "name": "symfony/polyfill",
-                    "url": "https://github.com/symfony/polyfill"
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Symfony\\Polyfill\\Intl\\Normalizer\\": ""
-                },
                 "files": [
                     "bootstrap.php"
                 ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Intl\\Normalizer\\": ""
+                },
                 "classmap": [
                     "Resources/stubs"
                 ]
@@ -2381,7 +2481,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.22.1"
+                "source": "https://github.com/symfony/polyfill-intl-normalizer/tree/v1.33.0"
             },
             "funding": [
                 {
@@ -2392,50 +2492,55 @@
                     "url": "https://github.com/fabpot",
                     "type": "github"
                 },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
                 {
                     "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-01-22T09:19:47+00:00"
+            "time": "2024-09-09T11:45:10+00:00"
         },
         {
             "name": "symfony/polyfill-mbstring",
-            "version": "v1.22.1",
+            "version": "v1.33.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-mbstring.git",
-                "reference": "5232de97ee3b75b0360528dae24e73db49566ab1"
+                "reference": "6d857f4d76bd4b343eac26d6b539585d2bc56493"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/5232de97ee3b75b0360528dae24e73db49566ab1",
-                "reference": "5232de97ee3b75b0360528dae24e73db49566ab1",
+                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/6d857f4d76bd4b343eac26d6b539585d2bc56493",
+                "reference": "6d857f4d76bd4b343eac26d6b539585d2bc56493",
                 "shasum": ""
             },
             "require": {
-                "php": ">=7.1"
+                "ext-iconv": "*",
+                "php": ">=7.2"
+            },
+            "provide": {
+                "ext-mbstring": "*"
             },
             "suggest": {
                 "ext-mbstring": "For best performance"
             },
             "type": "library",
             "extra": {
-                "branch-alias": {
-                    "dev-main": "1.22-dev"
-                },
                 "thanks": {
-                    "name": "symfony/polyfill",
-                    "url": "https://github.com/symfony/polyfill"
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Symfony\\Polyfill\\Mbstring\\": ""
-                },
                 "files": [
                     "bootstrap.php"
-                ]
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Mbstring\\": ""
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -2461,7 +2566,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.22.1"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.33.0"
             },
             "funding": [
                 {
@@ -2472,12 +2577,16 @@
                     "url": "https://github.com/fabpot",
                     "type": "github"
                 },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
                 {
                     "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-01-22T09:19:47+00:00"
+            "time": "2024-12-23T08:48:59+00:00"
         },
         {
             "name": "symfony/polyfill-php70",
@@ -2498,12 +2607,12 @@
             },
             "type": "metapackage",
             "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                },
                 "branch-alias": {
                     "dev-main": "1.20-dev"
-                },
-                "thanks": {
-                    "name": "symfony/polyfill",
-                    "url": "https://github.com/symfony/polyfill"
                 }
             },
             "notification-url": "https://packagist.org/downloads/",
@@ -2548,38 +2657,38 @@
             "time": "2020-10-23T14:02:19+00:00"
         },
         {
-            "name": "symfony/polyfill-php72",
-            "version": "v1.22.1",
+            "name": "symfony/polyfill-php80",
+            "version": "v1.33.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/symfony/polyfill-php72.git",
-                "reference": "cc6e6f9b39fe8075b3dabfbaf5b5f645ae1340c9"
+                "url": "https://github.com/symfony/polyfill-php80.git",
+                "reference": "0cc9dd0f17f61d8131e7df6b84bd344899fe2608"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php72/zipball/cc6e6f9b39fe8075b3dabfbaf5b5f645ae1340c9",
-                "reference": "cc6e6f9b39fe8075b3dabfbaf5b5f645ae1340c9",
+                "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/0cc9dd0f17f61d8131e7df6b84bd344899fe2608",
+                "reference": "0cc9dd0f17f61d8131e7df6b84bd344899fe2608",
                 "shasum": ""
             },
             "require": {
-                "php": ">=7.1"
+                "php": ">=7.2"
             },
             "type": "library",
             "extra": {
-                "branch-alias": {
-                    "dev-main": "1.22-dev"
-                },
                 "thanks": {
-                    "name": "symfony/polyfill",
-                    "url": "https://github.com/symfony/polyfill"
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Symfony\\Polyfill\\Php72\\": ""
-                },
                 "files": [
                     "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Php80\\": ""
+                },
+                "classmap": [
+                    "Resources/stubs"
                 ]
             },
             "notification-url": "https://packagist.org/downloads/",
@@ -2587,6 +2696,10 @@
                 "MIT"
             ],
             "authors": [
+                {
+                    "name": "Ion Bazan",
+                    "email": "ion.bazan@gmail.com"
+                },
                 {
                     "name": "Nicolas Grekas",
                     "email": "p@tchwork.com"
@@ -2596,7 +2709,7 @@
                     "homepage": "https://symfony.com/contributors"
                 }
             ],
-            "description": "Symfony polyfill backporting some PHP 7.2+ features to lower PHP versions",
+            "description": "Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions",
             "homepage": "https://symfony.com",
             "keywords": [
                 "compatibility",
@@ -2605,7 +2718,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php72/tree/v1.22.1"
+                "source": "https://github.com/symfony/polyfill-php80/tree/v1.33.0"
             },
             "funding": [
                 {
@@ -2616,30 +2729,35 @@
                     "url": "https://github.com/fabpot",
                     "type": "github"
                 },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
                 {
                     "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-01-07T16:49:33+00:00"
+            "time": "2025-01-02T08:10:11+00:00"
         },
         {
             "name": "symfony/translation",
-            "version": "v4.4.21",
+            "version": "v4.4.47",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/translation.git",
-                "reference": "eb8f5428cc3b40d6dffe303b195b084f1c5fbd14"
+                "reference": "45036b1d53accc48fe9bab71ccd86d57eba0dd94"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/translation/zipball/eb8f5428cc3b40d6dffe303b195b084f1c5fbd14",
-                "reference": "eb8f5428cc3b40d6dffe303b195b084f1c5fbd14",
+                "url": "https://api.github.com/repos/symfony/translation/zipball/45036b1d53accc48fe9bab71ccd86d57eba0dd94",
+                "reference": "45036b1d53accc48fe9bab71ccd86d57eba0dd94",
                 "shasum": ""
             },
             "require": {
                 "php": ">=7.1.3",
                 "symfony/polyfill-mbstring": "~1.0",
+                "symfony/polyfill-php80": "^1.16",
                 "symfony/translation-contracts": "^1.1.6|^2"
             },
             "conflict": {
@@ -2652,7 +2770,7 @@
                 "symfony/translation-implementation": "1.0|2.0"
             },
             "require-dev": {
-                "psr/log": "~1.0",
+                "psr/log": "^1|^2|^3",
                 "symfony/config": "^3.4|^4.0|^5.0",
                 "symfony/console": "^3.4|^4.0|^5.0",
                 "symfony/dependency-injection": "^3.4|^4.0|^5.0",
@@ -2693,7 +2811,7 @@
             "description": "Provides tools to internationalize your application",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/translation/tree/v4.4.21"
+                "source": "https://github.com/symfony/translation/tree/v4.4.47"
             },
             "funding": [
                 {
@@ -2709,20 +2827,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-03-23T16:25:01+00:00"
+            "time": "2022-10-03T15:15:11+00:00"
         },
         {
             "name": "symfony/translation-contracts",
-            "version": "v2.3.0",
+            "version": "v2.5.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/translation-contracts.git",
-                "reference": "e2eaa60b558f26a4b0354e1bbb25636efaaad105"
+                "reference": "450d4172653f38818657022252f9d81be89ee9a8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/translation-contracts/zipball/e2eaa60b558f26a4b0354e1bbb25636efaaad105",
-                "reference": "e2eaa60b558f26a4b0354e1bbb25636efaaad105",
+                "url": "https://api.github.com/repos/symfony/translation-contracts/zipball/450d4172653f38818657022252f9d81be89ee9a8",
+                "reference": "450d4172653f38818657022252f9d81be89ee9a8",
                 "shasum": ""
             },
             "require": {
@@ -2733,12 +2851,12 @@
             },
             "type": "library",
             "extra": {
-                "branch-alias": {
-                    "dev-master": "2.3-dev"
-                },
                 "thanks": {
-                    "name": "symfony/contracts",
-                    "url": "https://github.com/symfony/contracts"
+                    "url": "https://github.com/symfony/contracts",
+                    "name": "symfony/contracts"
+                },
+                "branch-alias": {
+                    "dev-main": "2.5-dev"
                 }
             },
             "autoload": {
@@ -2771,7 +2889,7 @@
                 "standards"
             ],
             "support": {
-                "source": "https://github.com/symfony/translation-contracts/tree/v2.3.0"
+                "source": "https://github.com/symfony/translation-contracts/tree/v2.5.4"
             },
             "funding": [
                 {
@@ -2787,20 +2905,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2020-09-28T13:05:58+00:00"
+            "time": "2024-09-25T14:11:13+00:00"
         },
         {
             "name": "tgalopin/html-sanitizer",
-            "version": "1.4.0",
+            "version": "1.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/tgalopin/html-sanitizer.git",
-                "reference": "56cca6b48de4e50d16a4f549e3e677ae0d561e91"
+                "reference": "5d02dcb6f2ea4f505731eac440798caa1b3b0913"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/tgalopin/html-sanitizer/zipball/56cca6b48de4e50d16a4f549e3e677ae0d561e91",
-                "reference": "56cca6b48de4e50d16a4f549e3e677ae0d561e91",
+                "url": "https://api.github.com/repos/tgalopin/html-sanitizer/zipball/5d02dcb6f2ea4f505731eac440798caa1b3b0913",
+                "reference": "5d02dcb6f2ea4f505731eac440798caa1b3b0913",
                 "shasum": ""
             },
             "require": {
@@ -2808,7 +2926,7 @@
                 "league/uri-parser": "^1.4.1",
                 "masterminds/html5": "^2.4",
                 "php": ">=7.1",
-                "psr/log": "^1.0"
+                "psr/log": "^1.0|^2.0|^3.0"
             },
             "require-dev": {
                 "phpunit/phpunit": "^7.4",
@@ -2833,22 +2951,23 @@
             "description": "Sanitize untrustworthy HTML user input",
             "support": {
                 "issues": "https://github.com/tgalopin/html-sanitizer/issues",
-                "source": "https://github.com/tgalopin/html-sanitizer/tree/master"
+                "source": "https://github.com/tgalopin/html-sanitizer/tree/1.5.0"
             },
-            "time": "2020-02-03T16:51:08+00:00"
+            "abandoned": "symfony/html-sanitizer",
+            "time": "2021-09-14T08:27:50+00:00"
         },
         {
             "name": "twig/twig",
-            "version": "v1.44.2",
+            "version": "v1.44.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/twigphp/Twig.git",
-                "reference": "138c493c5b8ee7cff3821f80b8896d371366b5fe"
+                "reference": "b1f009c449e435a0384814e67205d9190a4d050e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/twigphp/Twig/zipball/138c493c5b8ee7cff3821f80b8896d371366b5fe",
-                "reference": "138c493c5b8ee7cff3821f80b8896d371366b5fe",
+                "url": "https://api.github.com/repos/twigphp/Twig/zipball/b1f009c449e435a0384814e67205d9190a4d050e",
+                "reference": "b1f009c449e435a0384814e67205d9190a4d050e",
                 "shasum": ""
             },
             "require": {
@@ -2901,7 +3020,7 @@
             ],
             "support": {
                 "issues": "https://github.com/twigphp/Twig/issues",
-                "source": "https://github.com/twigphp/Twig/tree/v1.44.2"
+                "source": "https://github.com/twigphp/Twig/tree/v1.44.8"
             },
             "funding": [
                 {
@@ -2913,26 +3032,2027 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2021-01-05T10:10:05+00:00"
+            "time": "2024-09-09T17:17:16+00:00"
         }
     ],
-    "packages-dev": [],
-    "aliases": [],
-    "minimum-stability": "stable",
-    "stability-flags": [],
-    "prefer-stable": false,
-    "prefer-lowest": false,
-    "platform": {
-        "php": "^7.4",
-        "ext-pdo": "*",
-        "ext-curl": "*",
-        "ext-dom": "*",
-        "ext-json": "*",
-        "ext-libxml": "*",
-        "ext-mbstring": "*",
-        "ext-pdo_mysql": "*",
-        "ext-simplexml": "*"
+    "packages-dev": [
+        {
+            "name": "doctrine/instantiator",
+            "version": "1.5.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/doctrine/instantiator.git",
+                "reference": "0a0fa9780f5d4e507415a065172d26a98d02047b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/doctrine/instantiator/zipball/0a0fa9780f5d4e507415a065172d26a98d02047b",
+                "reference": "0a0fa9780f5d4e507415a065172d26a98d02047b",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.1 || ^8.0"
+            },
+            "require-dev": {
+                "doctrine/coding-standard": "^9 || ^11",
+                "ext-pdo": "*",
+                "ext-phar": "*",
+                "phpbench/phpbench": "^0.16 || ^1",
+                "phpstan/phpstan": "^1.4",
+                "phpstan/phpstan-phpunit": "^1",
+                "phpunit/phpunit": "^7.5 || ^8.5 || ^9.5",
+                "vimeo/psalm": "^4.30 || ^5.4"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Doctrine\\Instantiator\\": "src/Doctrine/Instantiator/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Marco Pivetta",
+                    "email": "ocramius@gmail.com",
+                    "homepage": "https://ocramius.github.io/"
+                }
+            ],
+            "description": "A small, lightweight utility to instantiate objects in PHP without invoking their constructors",
+            "homepage": "https://www.doctrine-project.org/projects/instantiator.html",
+            "keywords": [
+                "constructor",
+                "instantiate"
+            ],
+            "support": {
+                "issues": "https://github.com/doctrine/instantiator/issues",
+                "source": "https://github.com/doctrine/instantiator/tree/1.5.0"
+            },
+            "funding": [
+                {
+                    "url": "https://www.doctrine-project.org/sponsorship.html",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://www.patreon.com/phpdoctrine",
+                    "type": "patreon"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/doctrine%2Finstantiator",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2022-12-30T00:15:36+00:00"
+        },
+        {
+            "name": "hamcrest/hamcrest-php",
+            "version": "v2.1.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/hamcrest/hamcrest-php.git",
+                "reference": "f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/hamcrest/hamcrest-php/zipball/f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487",
+                "reference": "f8b1c0173b22fa6ec77a81fe63e5b01eba7e6487",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.4|^8.0"
+            },
+            "replace": {
+                "cordoval/hamcrest-php": "*",
+                "davedevelopment/hamcrest-php": "*",
+                "kodova/hamcrest-php": "*"
+            },
+            "require-dev": {
+                "phpunit/php-file-iterator": "^1.4 || ^2.0 || ^3.0",
+                "phpunit/phpunit": "^4.8.36 || ^5.7 || ^6.5 || ^7.0 || ^8.0 || ^9.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.1-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "hamcrest"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "description": "This is the PHP port of Hamcrest Matchers",
+            "keywords": [
+                "test"
+            ],
+            "support": {
+                "issues": "https://github.com/hamcrest/hamcrest-php/issues",
+                "source": "https://github.com/hamcrest/hamcrest-php/tree/v2.1.1"
+            },
+            "time": "2025-04-30T06:54:44+00:00"
+        },
+        {
+            "name": "mockery/mockery",
+            "version": "1.6.12",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/mockery/mockery.git",
+                "reference": "1f4efdd7d3beafe9807b08156dfcb176d18f1699"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/mockery/mockery/zipball/1f4efdd7d3beafe9807b08156dfcb176d18f1699",
+                "reference": "1f4efdd7d3beafe9807b08156dfcb176d18f1699",
+                "shasum": ""
+            },
+            "require": {
+                "hamcrest/hamcrest-php": "^2.0.1",
+                "lib-pcre": ">=7.0",
+                "php": ">=7.3"
+            },
+            "conflict": {
+                "phpunit/phpunit": "<8.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^8.5 || ^9.6.17",
+                "symplify/easy-coding-standard": "^12.1.14"
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "library/helpers.php",
+                    "library/Mockery.php"
+                ],
+                "psr-4": {
+                    "Mockery\\": "library/Mockery"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Pádraic Brady",
+                    "email": "padraic.brady@gmail.com",
+                    "homepage": "https://github.com/padraic",
+                    "role": "Author"
+                },
+                {
+                    "name": "Dave Marshall",
+                    "email": "dave.marshall@atstsolutions.co.uk",
+                    "homepage": "https://davedevelopment.co.uk",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Nathanael Esayeas",
+                    "email": "nathanael.esayeas@protonmail.com",
+                    "homepage": "https://github.com/ghostwriter",
+                    "role": "Lead Developer"
+                }
+            ],
+            "description": "Mockery is a simple yet flexible PHP mock object framework",
+            "homepage": "https://github.com/mockery/mockery",
+            "keywords": [
+                "BDD",
+                "TDD",
+                "library",
+                "mock",
+                "mock objects",
+                "mockery",
+                "stub",
+                "test",
+                "test double",
+                "testing"
+            ],
+            "support": {
+                "docs": "https://docs.mockery.io/",
+                "issues": "https://github.com/mockery/mockery/issues",
+                "rss": "https://github.com/mockery/mockery/releases.atom",
+                "security": "https://github.com/mockery/mockery/security/advisories",
+                "source": "https://github.com/mockery/mockery"
+            },
+            "time": "2024-05-16T03:13:13+00:00"
+        },
+        {
+            "name": "myclabs/deep-copy",
+            "version": "1.13.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/myclabs/DeepCopy.git",
+                "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a",
+                "reference": "07d290f0c47959fd5eed98c95ee5602db07e0b6a",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.1 || ^8.0"
+            },
+            "conflict": {
+                "doctrine/collections": "<1.6.8",
+                "doctrine/common": "<2.13.3 || >=3 <3.2.2"
+            },
+            "require-dev": {
+                "doctrine/collections": "^1.6.8",
+                "doctrine/common": "^2.13.3 || ^3.2.2",
+                "phpspec/prophecy": "^1.10",
+                "phpunit/phpunit": "^7.5.20 || ^8.5.23 || ^9.5.13"
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "src/DeepCopy/deep_copy.php"
+                ],
+                "psr-4": {
+                    "DeepCopy\\": "src/DeepCopy/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "Create deep copies (clones) of your objects",
+            "keywords": [
+                "clone",
+                "copy",
+                "duplicate",
+                "object",
+                "object graph"
+            ],
+            "support": {
+                "issues": "https://github.com/myclabs/DeepCopy/issues",
+                "source": "https://github.com/myclabs/DeepCopy/tree/1.13.4"
+            },
+            "funding": [
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/myclabs/deep-copy",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-08-01T08:46:24+00:00"
+        },
+        {
+            "name": "nikic/php-parser",
+            "version": "v5.7.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/nikic/PHP-Parser.git",
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/dca41cd15c2ac9d055ad70dbfd011130757d1f82",
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82",
+                "shasum": ""
+            },
+            "require": {
+                "ext-ctype": "*",
+                "ext-json": "*",
+                "ext-tokenizer": "*",
+                "php": ">=7.4"
+            },
+            "require-dev": {
+                "ircmaxell/php-yacc": "^0.0.7",
+                "phpunit/phpunit": "^9.0"
+            },
+            "bin": [
+                "bin/php-parse"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "5.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PhpParser\\": "lib/PhpParser"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Nikita Popov"
+                }
+            ],
+            "description": "A PHP parser written in PHP",
+            "keywords": [
+                "parser",
+                "php"
+            ],
+            "support": {
+                "issues": "https://github.com/nikic/PHP-Parser/issues",
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.7.0"
+            },
+            "time": "2025-12-06T11:56:16+00:00"
+        },
+        {
+            "name": "phar-io/manifest",
+            "version": "2.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/phar-io/manifest.git",
+                "reference": "54750ef60c58e43759730615a392c31c80e23176"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/phar-io/manifest/zipball/54750ef60c58e43759730615a392c31c80e23176",
+                "reference": "54750ef60c58e43759730615a392c31c80e23176",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-libxml": "*",
+                "ext-phar": "*",
+                "ext-xmlwriter": "*",
+                "phar-io/version": "^3.0.1",
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0.x-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Arne Blankerts",
+                    "email": "arne@blankerts.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Heuer",
+                    "email": "sebastian@phpeople.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Component for reading phar.io manifest information from a PHP Archive (PHAR)",
+            "support": {
+                "issues": "https://github.com/phar-io/manifest/issues",
+                "source": "https://github.com/phar-io/manifest/tree/2.0.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/theseer",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-03T12:33:53+00:00"
+        },
+        {
+            "name": "phar-io/version",
+            "version": "3.2.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/phar-io/version.git",
+                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
+                "reference": "4f7fd7836c6f332bb2933569e566a0d6c4cbed74",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Arne Blankerts",
+                    "email": "arne@blankerts.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Heuer",
+                    "email": "sebastian@phpeople.de",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Library for handling version information and constraints",
+            "support": {
+                "issues": "https://github.com/phar-io/version/issues",
+                "source": "https://github.com/phar-io/version/tree/3.2.1"
+            },
+            "time": "2022-02-21T01:04:05+00:00"
+        },
+        {
+            "name": "phpunit/php-code-coverage",
+            "version": "9.2.32",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-code-coverage.git",
+                "reference": "85402a822d1ecf1db1096959413d35e1c37cf1a5"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/85402a822d1ecf1db1096959413d35e1c37cf1a5",
+                "reference": "85402a822d1ecf1db1096959413d35e1c37cf1a5",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-libxml": "*",
+                "ext-xmlwriter": "*",
+                "nikic/php-parser": "^4.19.1 || ^5.1.0",
+                "php": ">=7.3",
+                "phpunit/php-file-iterator": "^3.0.6",
+                "phpunit/php-text-template": "^2.0.4",
+                "sebastian/code-unit-reverse-lookup": "^2.0.3",
+                "sebastian/complexity": "^2.0.3",
+                "sebastian/environment": "^5.1.5",
+                "sebastian/lines-of-code": "^1.0.4",
+                "sebastian/version": "^3.0.2",
+                "theseer/tokenizer": "^1.2.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.6"
+            },
+            "suggest": {
+                "ext-pcov": "PHP extension that provides line coverage",
+                "ext-xdebug": "PHP extension that provides line coverage as well as branch and path coverage"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "9.2.x-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library that provides collection, processing, and rendering functionality for PHP code coverage information.",
+            "homepage": "https://github.com/sebastianbergmann/php-code-coverage",
+            "keywords": [
+                "coverage",
+                "testing",
+                "xunit"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-code-coverage/issues",
+                "security": "https://github.com/sebastianbergmann/php-code-coverage/security/policy",
+                "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/9.2.32"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-08-22T04:23:01+00:00"
+        },
+        {
+            "name": "phpunit/php-file-iterator",
+            "version": "3.0.6",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-file-iterator.git",
+                "reference": "cf1c2e7c203ac650e352f4cc675a7021e7d1b3cf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/cf1c2e7c203ac650e352f4cc675a7021e7d1b3cf",
+                "reference": "cf1c2e7c203ac650e352f4cc675a7021e7d1b3cf",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "3.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "FilterIterator implementation that filters files based on a list of suffixes.",
+            "homepage": "https://github.com/sebastianbergmann/php-file-iterator/",
+            "keywords": [
+                "filesystem",
+                "iterator"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-file-iterator/issues",
+                "source": "https://github.com/sebastianbergmann/php-file-iterator/tree/3.0.6"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2021-12-02T12:48:52+00:00"
+        },
+        {
+            "name": "phpunit/php-invoker",
+            "version": "3.1.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-invoker.git",
+                "reference": "5a10147d0aaf65b58940a0b72f71c9ac0423cc67"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-invoker/zipball/5a10147d0aaf65b58940a0b72f71c9ac0423cc67",
+                "reference": "5a10147d0aaf65b58940a0b72f71c9ac0423cc67",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "ext-pcntl": "*",
+                "phpunit/phpunit": "^9.3"
+            },
+            "suggest": {
+                "ext-pcntl": "*"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "3.1-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Invoke callables with a timeout",
+            "homepage": "https://github.com/sebastianbergmann/php-invoker/",
+            "keywords": [
+                "process"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-invoker/issues",
+                "source": "https://github.com/sebastianbergmann/php-invoker/tree/3.1.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-09-28T05:58:55+00:00"
+        },
+        {
+            "name": "phpunit/php-text-template",
+            "version": "2.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-text-template.git",
+                "reference": "5da5f67fc95621df9ff4c4e5a84d6a8a2acf7c28"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/5da5f67fc95621df9ff4c4e5a84d6a8a2acf7c28",
+                "reference": "5da5f67fc95621df9ff4c4e5a84d6a8a2acf7c28",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Simple template engine.",
+            "homepage": "https://github.com/sebastianbergmann/php-text-template/",
+            "keywords": [
+                "template"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-text-template/issues",
+                "source": "https://github.com/sebastianbergmann/php-text-template/tree/2.0.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-10-26T05:33:50+00:00"
+        },
+        {
+            "name": "phpunit/php-timer",
+            "version": "5.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/php-timer.git",
+                "reference": "5a63ce20ed1b5bf577850e2c4e87f4aa902afbd2"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/php-timer/zipball/5a63ce20ed1b5bf577850e2c4e87f4aa902afbd2",
+                "reference": "5a63ce20ed1b5bf577850e2c4e87f4aa902afbd2",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "5.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Utility class for timing",
+            "homepage": "https://github.com/sebastianbergmann/php-timer/",
+            "keywords": [
+                "timer"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/php-timer/issues",
+                "source": "https://github.com/sebastianbergmann/php-timer/tree/5.0.3"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-10-26T13:16:10+00:00"
+        },
+        {
+            "name": "phpunit/phpunit",
+            "version": "9.6.34",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/phpunit.git",
+                "reference": "b36f02317466907a230d3aa1d34467041271ef4a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/b36f02317466907a230d3aa1d34467041271ef4a",
+                "reference": "b36f02317466907a230d3aa1d34467041271ef4a",
+                "shasum": ""
+            },
+            "require": {
+                "doctrine/instantiator": "^1.5.0 || ^2",
+                "ext-dom": "*",
+                "ext-json": "*",
+                "ext-libxml": "*",
+                "ext-mbstring": "*",
+                "ext-xml": "*",
+                "ext-xmlwriter": "*",
+                "myclabs/deep-copy": "^1.13.4",
+                "phar-io/manifest": "^2.0.4",
+                "phar-io/version": "^3.2.1",
+                "php": ">=7.3",
+                "phpunit/php-code-coverage": "^9.2.32",
+                "phpunit/php-file-iterator": "^3.0.6",
+                "phpunit/php-invoker": "^3.1.1",
+                "phpunit/php-text-template": "^2.0.4",
+                "phpunit/php-timer": "^5.0.3",
+                "sebastian/cli-parser": "^1.0.2",
+                "sebastian/code-unit": "^1.0.8",
+                "sebastian/comparator": "^4.0.10",
+                "sebastian/diff": "^4.0.6",
+                "sebastian/environment": "^5.1.5",
+                "sebastian/exporter": "^4.0.8",
+                "sebastian/global-state": "^5.0.8",
+                "sebastian/object-enumerator": "^4.0.4",
+                "sebastian/resource-operations": "^3.0.4",
+                "sebastian/type": "^3.2.1",
+                "sebastian/version": "^3.0.2"
+            },
+            "suggest": {
+                "ext-soap": "To be able to generate mocks based on WSDL files",
+                "ext-xdebug": "PHP extension that provides line coverage as well as branch and path coverage"
+            },
+            "bin": [
+                "phpunit"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "9.6-dev"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "src/Framework/Assert/Functions.php"
+                ],
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "The PHP Unit Testing framework.",
+            "homepage": "https://phpunit.de/",
+            "keywords": [
+                "phpunit",
+                "testing",
+                "xunit"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
+                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/9.6.34"
+            },
+            "funding": [
+                {
+                    "url": "https://phpunit.de/sponsors.html",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/phpunit/phpunit",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-01-27T05:45:00+00:00"
+        },
+        {
+            "name": "sebastian/cli-parser",
+            "version": "1.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/cli-parser.git",
+                "reference": "2b56bea83a09de3ac06bb18b92f068e60cc6f50b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/cli-parser/zipball/2b56bea83a09de3ac06bb18b92f068e60cc6f50b",
+                "reference": "2b56bea83a09de3ac06bb18b92f068e60cc6f50b",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library for parsing CLI options",
+            "homepage": "https://github.com/sebastianbergmann/cli-parser",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/cli-parser/issues",
+                "source": "https://github.com/sebastianbergmann/cli-parser/tree/1.0.2"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-02T06:27:43+00:00"
+        },
+        {
+            "name": "sebastian/code-unit",
+            "version": "1.0.8",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/code-unit.git",
+                "reference": "1fc9f64c0927627ef78ba436c9b17d967e68e120"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/code-unit/zipball/1fc9f64c0927627ef78ba436c9b17d967e68e120",
+                "reference": "1fc9f64c0927627ef78ba436c9b17d967e68e120",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Collection of value objects that represent the PHP code units",
+            "homepage": "https://github.com/sebastianbergmann/code-unit",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/code-unit/issues",
+                "source": "https://github.com/sebastianbergmann/code-unit/tree/1.0.8"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-10-26T13:08:54+00:00"
+        },
+        {
+            "name": "sebastian/code-unit-reverse-lookup",
+            "version": "2.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/code-unit-reverse-lookup.git",
+                "reference": "ac91f01ccec49fb77bdc6fd1e548bc70f7faa3e5"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/ac91f01ccec49fb77bdc6fd1e548bc70f7faa3e5",
+                "reference": "ac91f01ccec49fb77bdc6fd1e548bc70f7faa3e5",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Looks up which function or method a line of code belongs to",
+            "homepage": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/issues",
+                "source": "https://github.com/sebastianbergmann/code-unit-reverse-lookup/tree/2.0.3"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-09-28T05:30:19+00:00"
+        },
+        {
+            "name": "sebastian/comparator",
+            "version": "4.0.10",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/comparator.git",
+                "reference": "e4df00b9b3571187db2831ae9aada2c6efbd715d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/e4df00b9b3571187db2831ae9aada2c6efbd715d",
+                "reference": "e4df00b9b3571187db2831ae9aada2c6efbd715d",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3",
+                "sebastian/diff": "^4.0",
+                "sebastian/exporter": "^4.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Jeff Welch",
+                    "email": "whatthejeff@gmail.com"
+                },
+                {
+                    "name": "Volker Dusch",
+                    "email": "github@wallbash.com"
+                },
+                {
+                    "name": "Bernhard Schussek",
+                    "email": "bschussek@2bepublished.at"
+                }
+            ],
+            "description": "Provides the functionality to compare PHP values for equality",
+            "homepage": "https://github.com/sebastianbergmann/comparator",
+            "keywords": [
+                "comparator",
+                "compare",
+                "equality"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/comparator/issues",
+                "source": "https://github.com/sebastianbergmann/comparator/tree/4.0.10"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/comparator",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-01-24T09:22:56+00:00"
+        },
+        {
+            "name": "sebastian/complexity",
+            "version": "2.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/complexity.git",
+                "reference": "25f207c40d62b8b7aa32f5ab026c53561964053a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/complexity/zipball/25f207c40d62b8b7aa32f5ab026c53561964053a",
+                "reference": "25f207c40d62b8b7aa32f5ab026c53561964053a",
+                "shasum": ""
+            },
+            "require": {
+                "nikic/php-parser": "^4.18 || ^5.0",
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library for calculating the complexity of PHP code units",
+            "homepage": "https://github.com/sebastianbergmann/complexity",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/complexity/issues",
+                "source": "https://github.com/sebastianbergmann/complexity/tree/2.0.3"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-12-22T06:19:30+00:00"
+        },
+        {
+            "name": "sebastian/diff",
+            "version": "4.0.6",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/diff.git",
+                "reference": "ba01945089c3a293b01ba9badc29ad55b106b0bc"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/ba01945089c3a293b01ba9badc29ad55b106b0bc",
+                "reference": "ba01945089c3a293b01ba9badc29ad55b106b0bc",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3",
+                "symfony/process": "^4.2 || ^5"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Kore Nordmann",
+                    "email": "mail@kore-nordmann.de"
+                }
+            ],
+            "description": "Diff implementation",
+            "homepage": "https://github.com/sebastianbergmann/diff",
+            "keywords": [
+                "diff",
+                "udiff",
+                "unidiff",
+                "unified diff"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/diff/issues",
+                "source": "https://github.com/sebastianbergmann/diff/tree/4.0.6"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-02T06:30:58+00:00"
+        },
+        {
+            "name": "sebastian/environment",
+            "version": "5.1.5",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/environment.git",
+                "reference": "830c43a844f1f8d5b7a1f6d6076b784454d8b7ed"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/environment/zipball/830c43a844f1f8d5b7a1f6d6076b784454d8b7ed",
+                "reference": "830c43a844f1f8d5b7a1f6d6076b784454d8b7ed",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "suggest": {
+                "ext-posix": "*"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "5.1-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Provides functionality to handle HHVM/PHP environments",
+            "homepage": "http://www.github.com/sebastianbergmann/environment",
+            "keywords": [
+                "Xdebug",
+                "environment",
+                "hhvm"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/environment/issues",
+                "source": "https://github.com/sebastianbergmann/environment/tree/5.1.5"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T06:03:51+00:00"
+        },
+        {
+            "name": "sebastian/exporter",
+            "version": "4.0.8",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/exporter.git",
+                "reference": "14c6ba52f95a36c3d27c835d65efc7123c446e8c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/14c6ba52f95a36c3d27c835d65efc7123c446e8c",
+                "reference": "14c6ba52f95a36c3d27c835d65efc7123c446e8c",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3",
+                "sebastian/recursion-context": "^4.0"
+            },
+            "require-dev": {
+                "ext-mbstring": "*",
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Jeff Welch",
+                    "email": "whatthejeff@gmail.com"
+                },
+                {
+                    "name": "Volker Dusch",
+                    "email": "github@wallbash.com"
+                },
+                {
+                    "name": "Adam Harvey",
+                    "email": "aharvey@php.net"
+                },
+                {
+                    "name": "Bernhard Schussek",
+                    "email": "bschussek@gmail.com"
+                }
+            ],
+            "description": "Provides the functionality to export PHP variables for visualization",
+            "homepage": "https://www.github.com/sebastianbergmann/exporter",
+            "keywords": [
+                "export",
+                "exporter"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/exporter/issues",
+                "source": "https://github.com/sebastianbergmann/exporter/tree/4.0.8"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/exporter",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-09-24T06:03:27+00:00"
+        },
+        {
+            "name": "sebastian/global-state",
+            "version": "5.0.8",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/global-state.git",
+                "reference": "b6781316bdcd28260904e7cc18ec983d0d2ef4f6"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/global-state/zipball/b6781316bdcd28260904e7cc18ec983d0d2ef4f6",
+                "reference": "b6781316bdcd28260904e7cc18ec983d0d2ef4f6",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3",
+                "sebastian/object-reflector": "^2.0",
+                "sebastian/recursion-context": "^4.0"
+            },
+            "require-dev": {
+                "ext-dom": "*",
+                "phpunit/phpunit": "^9.3"
+            },
+            "suggest": {
+                "ext-uopz": "*"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "5.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Snapshotting of global state",
+            "homepage": "http://www.github.com/sebastianbergmann/global-state",
+            "keywords": [
+                "global state"
+            ],
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/global-state/issues",
+                "source": "https://github.com/sebastianbergmann/global-state/tree/5.0.8"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/global-state",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-08-10T07:10:35+00:00"
+        },
+        {
+            "name": "sebastian/lines-of-code",
+            "version": "1.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/lines-of-code.git",
+                "reference": "e1e4a170560925c26d424b6a03aed157e7dcc5c5"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/e1e4a170560925c26d424b6a03aed157e7dcc5c5",
+                "reference": "e1e4a170560925c26d424b6a03aed157e7dcc5c5",
+                "shasum": ""
+            },
+            "require": {
+                "nikic/php-parser": "^4.18 || ^5.0",
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library for counting the lines of code in PHP source code",
+            "homepage": "https://github.com/sebastianbergmann/lines-of-code",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/lines-of-code/issues",
+                "source": "https://github.com/sebastianbergmann/lines-of-code/tree/1.0.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-12-22T06:20:34+00:00"
+        },
+        {
+            "name": "sebastian/object-enumerator",
+            "version": "4.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/object-enumerator.git",
+                "reference": "5c9eeac41b290a3712d88851518825ad78f45c71"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/object-enumerator/zipball/5c9eeac41b290a3712d88851518825ad78f45c71",
+                "reference": "5c9eeac41b290a3712d88851518825ad78f45c71",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3",
+                "sebastian/object-reflector": "^2.0",
+                "sebastian/recursion-context": "^4.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Traverses array structures and object graphs to enumerate all referenced objects",
+            "homepage": "https://github.com/sebastianbergmann/object-enumerator/",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/object-enumerator/issues",
+                "source": "https://github.com/sebastianbergmann/object-enumerator/tree/4.0.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-10-26T13:12:34+00:00"
+        },
+        {
+            "name": "sebastian/object-reflector",
+            "version": "2.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/object-reflector.git",
+                "reference": "b4f479ebdbf63ac605d183ece17d8d7fe49c15c7"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/object-reflector/zipball/b4f479ebdbf63ac605d183ece17d8d7fe49c15c7",
+                "reference": "b4f479ebdbf63ac605d183ece17d8d7fe49c15c7",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Allows reflection of object attributes, including inherited and non-public ones",
+            "homepage": "https://github.com/sebastianbergmann/object-reflector/",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/object-reflector/issues",
+                "source": "https://github.com/sebastianbergmann/object-reflector/tree/2.0.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-10-26T13:14:26+00:00"
+        },
+        {
+            "name": "sebastian/recursion-context",
+            "version": "4.0.6",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/recursion-context.git",
+                "reference": "539c6691e0623af6dc6f9c20384c120f963465a0"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/539c6691e0623af6dc6f9c20384c120f963465a0",
+                "reference": "539c6691e0623af6dc6f9c20384c120f963465a0",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "4.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                },
+                {
+                    "name": "Jeff Welch",
+                    "email": "whatthejeff@gmail.com"
+                },
+                {
+                    "name": "Adam Harvey",
+                    "email": "aharvey@php.net"
+                }
+            ],
+            "description": "Provides functionality to recursively process PHP variables",
+            "homepage": "https://github.com/sebastianbergmann/recursion-context",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/recursion-context/issues",
+                "source": "https://github.com/sebastianbergmann/recursion-context/tree/4.0.6"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                },
+                {
+                    "url": "https://liberapay.com/sebastianbergmann",
+                    "type": "liberapay"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/sebastianbergmann",
+                    "type": "thanks_dev"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/sebastian/recursion-context",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-08-10T06:57:39+00:00"
+        },
+        {
+            "name": "sebastian/resource-operations",
+            "version": "3.0.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/resource-operations.git",
+                "reference": "05d5692a7993ecccd56a03e40cd7e5b09b1d404e"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/resource-operations/zipball/05d5692a7993ecccd56a03e40cd7e5b09b1d404e",
+                "reference": "05d5692a7993ecccd56a03e40cd7e5b09b1d404e",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de"
+                }
+            ],
+            "description": "Provides a list of PHP built-in functions that operate on resources",
+            "homepage": "https://www.github.com/sebastianbergmann/resource-operations",
+            "support": {
+                "source": "https://github.com/sebastianbergmann/resource-operations/tree/3.0.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2024-03-14T16:00:52+00:00"
+        },
+        {
+            "name": "sebastian/type",
+            "version": "3.2.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/type.git",
+                "reference": "75e2c2a32f5e0b3aef905b9ed0b179b953b3d7c7"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/type/zipball/75e2c2a32f5e0b3aef905b9ed0b179b953b3d7c7",
+                "reference": "75e2c2a32f5e0b3aef905b9ed0b179b953b3d7c7",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^9.5"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "3.2-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Collection of value objects that represent the types of the PHP type system",
+            "homepage": "https://github.com/sebastianbergmann/type",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/type/issues",
+                "source": "https://github.com/sebastianbergmann/type/tree/3.2.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-02-03T06:13:03+00:00"
+        },
+        {
+            "name": "sebastian/version",
+            "version": "3.0.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/sebastianbergmann/version.git",
+                "reference": "c6c1022351a901512170118436c764e473f6de8c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/sebastianbergmann/version/zipball/c6c1022351a901512170118436c764e473f6de8c",
+                "reference": "c6c1022351a901512170118436c764e473f6de8c",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "3.0-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Sebastian Bergmann",
+                    "email": "sebastian@phpunit.de",
+                    "role": "lead"
+                }
+            ],
+            "description": "Library that helps with managing the version number of Git-hosted PHP projects",
+            "homepage": "https://github.com/sebastianbergmann/version",
+            "support": {
+                "issues": "https://github.com/sebastianbergmann/version/issues",
+                "source": "https://github.com/sebastianbergmann/version/tree/3.0.2"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sebastianbergmann",
+                    "type": "github"
+                }
+            ],
+            "time": "2020-09-28T06:39:44+00:00"
+        },
+        {
+            "name": "symfony/process",
+            "version": "v5.4.51",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/process.git",
+                "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/process/zipball/467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
+                "reference": "467bfc56f18f5ef6d5ccb09324d7e988c1c0a98f",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2.5",
+                "symfony/polyfill-php80": "^1.16"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\Process\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Fabien Potencier",
+                    "email": "fabien@symfony.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Executes commands in sub-processes",
+            "homepage": "https://symfony.com",
+            "support": {
+                "source": "https://github.com/symfony/process/tree/v5.4.51"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-01-26T15:53:37+00:00"
+        },
+        {
+            "name": "theseer/tokenizer",
+            "version": "1.3.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/theseer/tokenizer.git",
+                "reference": "b7489ce515e168639d17feec34b8847c326b0b3c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/theseer/tokenizer/zipball/b7489ce515e168639d17feec34b8847c326b0b3c",
+                "reference": "b7489ce515e168639d17feec34b8847c326b0b3c",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-tokenizer": "*",
+                "ext-xmlwriter": "*",
+                "php": "^7.2 || ^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "classmap": [
+                    "src/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Arne Blankerts",
+                    "email": "arne@blankerts.de",
+                    "role": "Developer"
+                }
+            ],
+            "description": "A small library for converting tokenized PHP source code into XML and potentially other formats",
+            "support": {
+                "issues": "https://github.com/theseer/tokenizer/issues",
+                "source": "https://github.com/theseer/tokenizer/tree/1.3.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/theseer",
+                    "type": "github"
+                }
+            ],
+            "time": "2025-11-17T20:03:58+00:00"
+        }
+    ],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": {},
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": {
+        "php": "^7.4",
+        "ext-pdo": "*",
+        "ext-curl": "*",
+        "ext-dom": "*",
+        "ext-json": "*",
+        "ext-libxml": "*",
+        "ext-mbstring": "*",
+        "ext-pdo_mysql": "*",
+        "ext-simplexml": "*"
+    },
+    "platform-dev": {},
+    "platform-overrides": {
+        "php": "7.4.0"
     },
-    "platform-dev": [],
-    "plugin-api-version": "2.0.0"
+    "plugin-api-version": "2.6.0"
 }
diff --git a/api/config.e2e.php b/api/config.e2e.php
new file mode 100644
index 00000000..4428c3a7
--- /dev/null
+++ b/api/config.e2e.php
@@ -0,0 +1,36 @@
+<?php
+
+/**
+ * E2E test configuration.
+ * Reads DB credentials from the same TEST_DB_* env vars as the functional config.
+ */
+
+$config = [
+    'db_settings' => [
+        'driver'    => 'mysql',
+        'host'      => getenv('TEST_DB_HOST') ?: 'localhost',
+        'database'  => getenv('TEST_DB_NAME') ?: 'glpi_plugins_e2e',
+        'username'  => getenv('TEST_DB_USER') ?: 'glpi',
+        'password'  => getenv('TEST_DB_PASS') ?: 'glpi',
+        'charset'   => 'utf8mb4',
+        'collation' => 'utf8mb4_unicode_ci',
+        'prefix'    => '',
+        'strict'    => false,
+    ],
+    'log_queries'                            => false,
+    'default_number_of_models_per_page'      => 15,
+    'recaptcha_secret'                       => 'test_recaptcha_secret',
+    'client_url'                             => 'http://localhost:4200',
+    'api_url'                                => 'http://localhost:4200/api',
+    'plugin_max_consecutive_xml_fetch_fails' => 4,
+    'glpi_plugin_directory_user_agent'       => 'GlpiPluginDirectory/e2e',
+    'msg_alerts' => [
+        'transport'      => 'mail',
+        'local_admins'   => ['admin@example.com' => 'Admin'],
+        'from'           => ['noreply@example.com' => 'GLPi Plugins'],
+        'subject_prefix' => '[E2E]',
+    ],
+    'oauth' => [
+        'github' => ['clientId' => 'test_id', 'clientSecret' => 'test_secret'],
+    ],
+];
diff --git a/api/phpunit.xml b/api/phpunit.xml
new file mode 100644
index 00000000..c468d788
--- /dev/null
+++ b/api/phpunit.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         bootstrap="tests/bootstrap.php"
+         colors="true"
+         failOnWarning="true">
+
+    <testsuites>
+        <testsuite name="Functional">
+            <directory>tests/Functional</directory>
+        </testsuite>
+    </testsuites>
+
+    <coverage>
+        <include>
+            <directory>src</directory>
+        </include>
+    </coverage>
+</phpunit>
diff --git a/api/src/core/Tool.php b/api/src/core/Tool.php
index 66d8032c..f670b028 100644
--- a/api/src/core/Tool.php
+++ b/api/src/core/Tool.php
@@ -46,7 +46,13 @@ public static function endWithJson($_payload, $code = 200) {
 
       $payload = self::getPayload($_payload);
       $app->response->headers->set('Content-Type', 'application/json');
-      $app->halt($code, json_encode($payload));
+      // If the payload is a PaginatedCollection, getPayload() already called
+      // setStatus() on $app->response (e.g. 206 for partial range, 400 for
+      // out-of-range start). Respect that status instead of always using 200.
+      $effectiveCode = ($_payload instanceof \API\Core\PaginatedCollection)
+                       ? $app->response->status()
+                       : $code;
+      $app->halt($effectiveCode, json_encode($payload));
    }
 
    /**
@@ -105,7 +111,7 @@ public static function endWithRSS($_payload, $feed_title = '', $code = 200) {
                   break;
                }
             }
-            if (empty($description)) {
+            if (empty($description) && count($plugin['descriptions']) > 0) {
                $description = $plugin['descriptions'][0]['long_description'];
             }
 
@@ -160,7 +166,7 @@ public static function makeEndpoint($callable) {
             try {
                call_user_func_array($callable, $args);
             }
-            catch (\Exception $e) {
+            catch (\Throwable $e) {
                global $app;
                if (!preg_match('/^API\\\\Exception/', get_class($e))) {
                   switch (get_class($e)) {
@@ -316,7 +322,8 @@ public static function getRequestLang() {
    public static $config = null;
    public static function getConfig() {
       if (!self::$config) {
-         require dirname(__FILE__) . '/../../config.php';
+         $configFile = getenv('APP_CONFIG_FILE') ?: dirname(__FILE__) . '/../../config.php';
+         require $configFile;
          self::$config = $config;
       }
       return self::$config;
diff --git a/api/src/endpoints/App.php b/api/src/endpoints/App.php
index af7711e9..3db3b1d3 100644
--- a/api/src/endpoints/App.php
+++ b/api/src/endpoints/App.php
@@ -68,7 +68,7 @@
       throw new InvalidField('name');
    } else if (App::where('user_id', '=', $user_id)
                  ->where('name', '=', $body->name)->first() != null) {
-      throw new UnavailableName('app', $name);
+      throw new UnavailableName('app', $body->name);
    }
    else {
      $app->name = $body->name;
diff --git a/api/src/endpoints/Author.php b/api/src/endpoints/Author.php
index d7f25fd4..1001f9c9 100644
--- a/api/src/endpoints/Author.php
+++ b/api/src/endpoints/Author.php
@@ -74,6 +74,7 @@
                                        ->withAverageNote()
                                        ->descWithLang(Tool::getRequestLang())
                                        ->whereAuthor($author->id)
+                                       ->where('active', '=', 1)
                      )
    );
 });
diff --git a/api/src/endpoints/Message.php b/api/src/endpoints/Message.php
index 45123b85..c00b29ff 100644
--- a/api/src/endpoints/Message.php
+++ b/api/src/endpoints/Message.php
@@ -22,8 +22,6 @@
 use \API\Exception\MissingField;
 use \API\Exception\InvalidRecaptcha;
 
-require dirname(__FILE__) . '/../../config.php';
-
 $send = Tool::makeEndpoint(function() use($app) {
    OAuthHelper::needsScopes(['message']);
 
@@ -32,7 +30,7 @@
    $fields = ['firstname', 'lastname', 'email', 'subject', 'message'];
 
    $recaptcha = new ReCaptcha(Tool::getConfig()['recaptcha_secret']);
-   $resp = $recaptcha->verify($body->recaptcha_response);
+   $resp = $recaptcha->verify($body->recaptcha_response ?? null);
    if (!$resp->isSuccess()) {
       throw new InvalidRecaptcha();
    }
diff --git a/api/src/endpoints/Plugin.php b/api/src/endpoints/Plugin.php
index 58c86c28..e3aa716b 100644
--- a/api/src/endpoints/Plugin.php
+++ b/api/src/endpoints/Plugin.php
@@ -146,7 +146,7 @@
    if (isset($body->xml_url)) {
       // We check if the URL is a correct URI
       if (!filter_var($body->xml_url, FILTER_VALIDATE_URL)) {
-         throw new InvalidField;
+         throw new InvalidField('xml_url');
       }
 
       // We check if we can fetch the file via HTTP
@@ -530,7 +530,7 @@
    $body = Tool::getBody();
 
    $recaptcha = new ReCaptcha(Tool::getConfig()['recaptcha_secret']);
-   $resp = $recaptcha->verify($body->recaptcha_response);
+   $resp = $recaptcha->verify($body->recaptcha_response ?? null);
    if (!$resp->isSuccess()) {
       throw new InvalidRecaptcha;
    }
diff --git a/api/src/endpoints/User.php b/api/src/endpoints/User.php
index 2ea6ccee..10c9cb99 100644
--- a/api/src/endpoints/User.php
+++ b/api/src/endpoints/User.php
@@ -34,6 +34,8 @@
 use API\Exception\InvalidCredentials;
 use API\Exception\InvalidXML;
 use API\Exception\WrongPasswordResetToken;
+use API\Exception\AccountNotFound;
+use API\Exception\ResourceNotFound;
 
 use League\OAuth2\Server\Util\SecureKey;
 use API\OAuthServer\AuthorizationServer;
@@ -471,7 +473,7 @@
     $user->setPassword($body->password);
     $user->save();
     // Deleting the ResetPasswordToken objects for this user
-    $user->passwordResetTokens()->truncate();
+    $user->passwordResetTokens()->delete();
     $app->halt(200);
 });
 
diff --git a/api/src/endpoints/Version.php b/api/src/endpoints/Version.php
index aba840a5..16aa1571 100644
--- a/api/src/endpoints/Version.php
+++ b/api/src/endpoints/Version.php
@@ -1,21 +1,15 @@
 <?php
-
-use \Illuminate\Database\Capsule\Manager as DB;
 use \API\Core\Tool;
 use \API\Model\Plugin;
-
 use \API\OAuthServer\OAuthHelper;
-
 $version_plugins = Tool::makeEndpoint(function($version) {
    OAuthHelper::needsScopes(['version', 'plugins']);
-
    $plugins = Tool::paginateCollection(Plugin::short()
-                                             ->with('authors', 'versions', 'descriptions')
-                                             ->withAverageNote()
-                                             ->descWithLang(Tool::getRequestLang())
-                                             ->withGlpiVersion($version));
+                                         ->with('authors', 'versions', 'descriptions')
+                                         ->withAverageNote()
+                                         ->descWithLang(Tool::getRequestLang())
+                                         ->withGlpiVersion($version));
    Tool::endWithJson($plugins);
 });
-
-$app->get('/version/:version/plugin', $version_plugins);
-$app->options('/version/:version/plugin', function() {});
+$app->get("/version/:version/plugin", $version_plugins);
+$app->options("/version/:version/plugin", function() {});
diff --git a/api/src/oauthserver/AuthorizationServer.php b/api/src/oauthserver/AuthorizationServer.php
index 60ce03c4..a9367b36 100644
--- a/api/src/oauthserver/AuthorizationServer.php
+++ b/api/src/oauthserver/AuthorizationServer.php
@@ -53,6 +53,9 @@ public function __construct() {
             return false;
          } else {
             $user = $user->first();
+            if (!$user->active) {
+               return false;
+            }
             if ($user->assertPasswordIs($password)) {
                return $user->id;
             } else {
diff --git a/api/tests/E2E/fixtures/fields-updated.xml b/api/tests/E2E/fixtures/fields-updated.xml
new file mode 100644
index 00000000..2d161154
--- /dev/null
+++ b/api/tests/E2E/fixtures/fields-updated.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<root>
+  <name>Fields</name>
+  <key>fields</key>
+  <state>stable</state>
+  <description>
+    <short>
+      <lang name="en">Add custom fields to GLPI objects.</lang>
+    </short>
+    <long>
+      <lang name="en">Updated Fields plugin metadata for E2E panel save coverage.</lang>
+    </long>
+  </description>
+  <homepage>https://example.com/fields</homepage>
+  <download>https://example.com/fields/download</download>
+  <authors>
+    <author>Plugin Author</author>
+  </authors>
+  <versions>
+    <version>
+      <num>1.2.0</num>
+      <compatibility>10.0</compatibility>
+      <download_url>https://example.com/fields/1.2.0</download_url>
+    </version>
+  </versions>
+  <langs>
+    <lang>en</lang>
+  </langs>
+  <license>GPL-2.0</license>
+  <tags>
+    <en>
+      <tag>inventory</tag>
+    </en>
+  </tags>
+</root>
\ No newline at end of file
diff --git a/api/tests/E2E/seeds.sql b/api/tests/E2E/seeds.sql
new file mode 100644
index 00000000..dcbc7ccb
--- /dev/null
+++ b/api/tests/E2E/seeds.sql
@@ -0,0 +1,68 @@
+-- E2E seed data
+-- Applied once when the stack starts. Provides enough content for all frontend suites.
+
+-- OAuth clients and scopes (same as functional seeds)
+INSERT INTO `apps` (`id`, `name`, `secret`) VALUES
+  ('webapp',      'Web App',      ''),
+  ('glpidefault', 'GLPI Default', '');
+
+INSERT INTO `scopes` (`identifier`, `description`) VALUES
+  ('plugins',               'Browse plugin list'),
+  ('plugins:search',        'Search plugins'),
+  ('plugin:card',           'Read single plugin details'),
+  ('plugin:star',           'Rate a plugin'),
+  ('plugin:submit',         'Submit a new plugin'),
+  ('plugin:download',       'Download a plugin'),
+  ('tags',                  'Browse tag list'),
+  ('tag',                   'Read single tag'),
+  ('authors',               'Browse author list'),
+  ('author',                'Read single author'),
+  ('version',               'Filter by GLPI version'),
+  ('user',                  'Read/edit own profile'),
+  ('user:apps',             'Manage own API apps'),
+  ('user:externalaccounts', 'Manage linked OAuth accounts'),
+  ('users:search',          'Search users'),
+  ('message',               'Send contact message');
+
+-- Authors
+INSERT INTO `author` (`id`, `name`) VALUES
+  (1, 'Plugin Author');
+
+-- Active plugins
+INSERT INTO `plugin`
+  (`id`, `name`, `key`, `xml_url`, `download_url`, `active`, `download_count`, `date_added`, `date_updated`, `xml_state`)
+VALUES
+  (1, 'Fields',       'fields',       'http://example.com/fields.xml',       'http://example.com/fields.zip',       1, 120, NOW(), NOW(), 'passing'),
+  (2, 'Form Creator', 'formcreator',  'http://example.com/formcreator.xml',  'http://example.com/formcreator.zip',  1,  80, NOW(), NOW(), 'passing');
+
+INSERT INTO `plugin_author` (`plugin_id`, `author_id`) VALUES (1, 1), (2, 1);
+
+INSERT INTO `plugin_description` (`plugin_id`, `lang`, `short_description`, `long_description`) VALUES
+  (1, 'en', 'Add custom fields to GLPI objects.',    '# Fields\n\nAdd custom fields to any GLPI object type.'),
+  (2, 'en', 'Create custom forms in GLPI.',          '# Form Creator\n\nCreate and manage custom forms.');
+
+INSERT INTO `plugin_version` (`plugin_id`, `num`, `compatibility`) VALUES
+  (1, '1.0.0', '9.5'),
+  (1, '1.1.0', '10.0'),
+  (2, '2.0.0', '9.5');
+
+-- Tags
+INSERT INTO `tag` (`id`, `key`, `lang`, `tag`) VALUES
+  (1, 'inventory', 'en', 'Inventory'),
+  (2, 'forms',     'en', 'Forms');
+
+INSERT INTO `plugin_tags` (`plugin_id`, `tag_id`) VALUES (1, 1), (2, 2);
+
+-- Test user (password: Password1)
+INSERT INTO `user` (`id`, `username`, `email`, `password`, `realname`, `active`, `author_id`) VALUES
+  (1, 'testuser', 'testuser@example.com',
+   '$2y$12$1PbuQOawaJYZsLP/39w0juPu6sFG9Vn8aE17PSgBHXHpnWD6eJ.VW',
+   'Test User', 1, 1);
+
+-- testuser has admin rights on the Fields plugin
+INSERT INTO `plugin_permission` (`plugin_id`, `user_id`, `admin`) VALUES (1, 1, 1);
+
+-- Recent downloads so both plugins appear in the trending list
+INSERT INTO `plugin_download` (`plugin_id`, `downloaded_at`) VALUES
+  (1, NOW()), (1, NOW()), (1, NOW()),
+  (2, NOW()), (2, NOW());
diff --git a/api/tests/Functional/Auth/OAuthTest.php b/api/tests/Functional/Auth/OAuthTest.php
new file mode 100644
index 00000000..d46dea17
--- /dev/null
+++ b/api/tests/Functional/Auth/OAuthTest.php
@@ -0,0 +1,226 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Auth;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for POST /oauth/authorize.
+ *
+ * The authorize endpoint delegates to League\OAuth2\Server (v4) which reads
+ * request parameters from $_POST (application/x-www-form-urlencoded), not
+ * from the JSON body.  Guzzle's `form_params` option sets the correct
+ * Content-Type automatically.
+ */
+class OAuthTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        // Truncate per-test mutable tables so each test starts with a clean slate.
+        // apps and scopes are re-seeded by setUpBeforeClass; keep them intact.
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+            'user_validation_token', 'user_resetpassword_token',
+        ] as $table) {
+            $pdo->exec("TRUNCATE TABLE `{$table}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    // -------------------------------------------------------------------------
+    // Password grant — success
+    // -------------------------------------------------------------------------
+
+    public function testPasswordGrantReturns200WithTokens(): void
+    {
+        $this->createUser();
+
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type' => 'password',
+                'client_id'  => 'webapp',
+                'username'   => 'testuser',
+                'password'   => 'Password1',
+                'scope'      => 'plugins user',
+            ],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertArrayHasKey('access_token', $body);
+        $this->assertArrayHasKey('refresh_token', $body);
+        $this->assertNotEmpty($body['access_token']);
+        $this->assertNotEmpty($body['refresh_token']);
+    }
+
+    public function testPasswordGrantTokenIsPersistedInDatabase(): void
+    {
+        $this->createUser();
+        $token = $this->getAccessToken('testuser', 'Password1');
+
+        $this->assertNotNull($token, 'getAccessToken() must succeed');
+
+        $stmt = $this->db()->prepare('SELECT id FROM access_tokens WHERE token = ?');
+        $stmt->execute([$token]);
+        $this->assertNotFalse($stmt->fetch(), 'Issued token must be stored in access_tokens');
+    }
+
+    public function testPasswordGrantCanLoginByEmail(): void
+    {
+        $this->createUser(['username' => 'byemail', 'email' => 'byemail@example.com']);
+
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type' => 'password',
+                'client_id'  => 'webapp',
+                'username'   => 'byemail@example.com',  // use email as login
+                'password'   => 'Password1',
+                'scope'      => 'plugins',
+            ],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Password grant — failures
+    // -------------------------------------------------------------------------
+
+    public function testWrongPasswordReturnsErrorStatus(): void
+    {
+        $this->createUser();
+
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type' => 'password',
+                'client_id'  => 'webapp',
+                'username'   => 'testuser',
+                'password'   => 'WrongPassword',
+                'scope'      => 'plugins',
+            ],
+        ]);
+
+        $this->assertGreaterThanOrEqual(400, $response->getStatusCode());
+    }
+
+    public function testInactiveAccountReturnsErrorStatus(): void
+    {
+        $this->createUser(['active' => 0]);
+
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type' => 'password',
+                'client_id'  => 'webapp',
+                'username'   => 'testuser',
+                'password'   => 'Password1',
+                'scope'      => 'plugins',
+            ],
+        ]);
+
+        $this->assertGreaterThanOrEqual(400, $response->getStatusCode());
+    }
+
+    public function testUnknownUsernameReturnsErrorStatus(): void
+    {
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type' => 'password',
+                'client_id'  => 'webapp',
+                'username'   => 'nobody',
+                'password'   => 'Password1',
+                'scope'      => 'plugins',
+            ],
+        ]);
+
+        $this->assertGreaterThanOrEqual(400, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Refresh token grant
+    // -------------------------------------------------------------------------
+
+    public function testRefreshTokenGrantIssuesNewTokens(): void
+    {
+        $this->createUser();
+
+        $first = json_decode((string) self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type' => 'password',
+                'client_id'  => 'webapp',
+                'username'   => 'testuser',
+                'password'   => 'Password1',
+                'scope'      => 'plugins',
+            ],
+        ])->getBody(), true);
+
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type'    => 'refresh_token',
+                'client_id'     => 'webapp',
+                'refresh_token' => $first['refresh_token'],
+            ],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $second = json_decode((string) $response->getBody(), true);
+        $this->assertArrayHasKey('access_token', $second);
+        $this->assertNotSame($first['access_token'], $second['access_token']);
+    }
+
+    public function testInvalidRefreshTokenReturnsErrorStatus(): void
+    {
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type'    => 'refresh_token',
+                'client_id'     => 'webapp',
+                'refresh_token' => 'completely_invalid_token',
+            ],
+        ]);
+
+        $this->assertGreaterThanOrEqual(400, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Client credentials grant
+    // -------------------------------------------------------------------------
+
+    public function testClientCredentialsGrantReturnsToken(): void
+    {
+        $this->db()->exec(
+            "INSERT INTO `apps` (`id`, `name`, `secret`) VALUES ('testapp0000000000001', 'Test App', 'appsecret')"
+        );
+
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type'    => 'client_credentials',
+                'client_id'     => 'testapp0000000000001',
+                'client_secret' => 'appsecret',
+                'scope'         => 'plugins',
+            ],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertArrayHasKey('access_token', $body);
+    }
+
+    public function testClientCredentialsWithUnknownClientReturnsError(): void
+    {
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type'    => 'client_credentials',
+                'client_id'     => 'does_not_exist',
+                'client_secret' => 'wrong',
+                'scope'         => 'plugins',
+            ],
+        ]);
+
+        $this->assertGreaterThanOrEqual(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/Author/AuthorTest.php b/api/tests/Functional/Author/AuthorTest.php
new file mode 100644
index 00000000..0d82f7be
--- /dev/null
+++ b/api/tests/Functional/Author/AuthorTest.php
@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Author;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for author endpoints (§12).
+ *
+ * GET /author
+ * GET /author/top
+ * GET /author/:id
+ * GET /author/:id/plugin
+ */
+class AuthorTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'author', 'plugin', 'plugin_author', 'plugin_description', 'plugin_stars',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    private function authedToken(array $scopes): string
+    {
+        $user = $this->createUser();
+        return $this->getAccessToken($user['username'], $user['plain_password'], $scopes);
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /author (§12.1) — only authors with plugins
+    // -------------------------------------------------------------------------
+
+    public function testListAuthorsReturns200(): void
+    {
+        $token = $this->authedToken(['authors']);
+
+        $response = self::$http->get('/author', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testListAuthorsExcludesAuthorsWithNoPlugins(): void
+    {
+        $this->createAuthor('NoPluginsAuthor');
+        $token = $this->authedToken(['authors']);
+
+        $response = self::$http->get('/author', ['headers' => $this->bearer($token)]);
+
+        $body    = json_decode((string) $response->getBody(), true);
+        $names   = array_column($body, 'name');
+        $this->assertNotContains('NoPluginsAuthor', $names);
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /author/:id (§12.2)
+    // -------------------------------------------------------------------------
+
+    public function testGetSingleAuthorReturns200(): void
+    {
+        $author = $this->createAuthor('Solo Author');
+        $token  = $this->authedToken(['author']);
+
+        $response = self::$http->get("/author/{$author['id']}", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertSame('Solo Author', $body['name']);
+    }
+
+    public function testGetAuthorLinkedToUserIncludesUsernameAndGravatar(): void
+    {
+        $user   = $this->createUser(['username' => 'linkeduser', 'email' => 'linked@example.com']);
+        $author = $this->createAuthor('Linked Author');
+        // link user to author
+        $this->db()->prepare("UPDATE `user` SET author_id = ? WHERE id = ?")->execute([$author['id'], $user['id']]);
+        $this->db()->prepare("UPDATE `author` SET username = ? WHERE id = ?")->execute([$user['username'], $author['id']]);
+        $token  = $this->authedToken(['author']);
+
+        $response = self::$http->get("/author/{$author['id']}", ['headers' => $this->bearer($token)]);
+
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertArrayHasKey('username', $body);
+        $this->assertArrayHasKey('gravatar', $body);
+    }
+
+    public function testGetUnknownAuthorReturns404(): void
+    {
+        $token = $this->authedToken(['author']);
+
+        $response = self::$http->get('/author/99999', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /author/:id/plugin (§12.3)
+    // -------------------------------------------------------------------------
+
+    public function testGetAuthorPluginsReturnsOnlyActivePlugins(): void
+    {
+        $author      = $this->createAuthor('Plugin Author');
+        $activePlugin   = $this->createPlugin(['key' => 'authoractive',   'name' => 'Author Active',   'active' => 1]);
+        $inactivePlugin = $this->createPlugin(['key' => 'authorinactive', 'name' => 'Author Inactive', 'active' => 0]);
+
+        $this->db()->prepare("INSERT INTO `plugin_author` (`plugin_id`, `author_id`) VALUES (?, ?)")
+                   ->execute([$activePlugin['id'], $author['id']]);
+        $this->db()->prepare("INSERT INTO `plugin_author` (`plugin_id`, `author_id`) VALUES (?, ?)")
+                   ->execute([$inactivePlugin['id'], $author['id']]);
+
+        $token = $this->authedToken(['author', 'plugins']);
+
+        $response = self::$http->get("/author/{$author['id']}/plugin", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertContains('authoractive', $keys);
+        $this->assertNotContains('authorinactive', $keys);
+    }
+}
diff --git a/api/tests/Functional/FunctionalTestCase.php b/api/tests/Functional/FunctionalTestCase.php
new file mode 100644
index 00000000..fb878722
--- /dev/null
+++ b/api/tests/Functional/FunctionalTestCase.php
@@ -0,0 +1,296 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional;
+
+use GuzzleHttp\Client;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Process\Process;
+
+/**
+ * Base class for functional tests.
+ *
+ * Starts a PHP built-in server once per PHP process (shared across all
+ * subclasses via static properties on this parent class).  Each test class
+ * gets a clean database: tables are truncated and re-seeded in
+ * setUpBeforeClass() so test classes are isolated from each other.
+ *
+ * Prerequisites:
+ *  - Configure tests/Functional/config.functional.php with test DB credentials.
+ *  - The test DB must be reachable from the CLI (the DB is created
+ *    automatically if it does not yet exist).
+ *  - pdo_mysql extension must be loaded.
+ */
+abstract class FunctionalTestCase extends TestCase
+{
+    private const PORT = 8099;
+
+    // Statics on this class are effectively shared across all subclasses
+    // because this class's methods always access them via self::.
+    private static ?Process $server  = null;
+    private static ?\PDO    $pdo     = null;
+    private static string   $apiUrl  = '';
+
+    protected static ?Client $http = null;
+
+    // -------------------------------------------------------------------------
+    // PHPUnit lifecycle
+    // -------------------------------------------------------------------------
+
+    public static function setUpBeforeClass(): void
+    {
+        // One-time bootstrap for the whole PHP process
+        if (self::$pdo === null) {
+            static::connectDatabase();
+            static::createSchema();
+
+            $envUrl = getenv('TEST_API_URL');
+            if ($envUrl !== false && $envUrl !== '') {
+                self::$apiUrl = rtrim($envUrl, '/');
+            } else {
+                static::startServer();
+                self::$apiUrl = 'http://localhost:' . self::PORT;
+            }
+
+            register_shutdown_function(static function () {
+                if (self::$server !== null) {
+                    self::$server->stop();
+                }
+            });
+        }
+
+        // Per-test-class isolation: wipe + re-seed
+        static::cleanDatabase();
+        static::seedDatabase();
+
+        self::$http = new Client([
+            'base_uri'        => self::$apiUrl,
+            'http_errors'     => false,   // let tests assert on 4xx/5xx themselves
+            'allow_redirects' => false,   // let tests assert on 3xx redirects
+        ]);
+    }
+
+    // -------------------------------------------------------------------------
+    // Infrastructure
+    // -------------------------------------------------------------------------
+
+    private static function configFile(): string
+    {
+        return __DIR__ . '/config.functional.php';
+    }
+
+    private static function connectDatabase(): void
+    {
+        require static::configFile();
+        /** @var array $config */
+        $db = $config['db_settings'];
+
+        self::$pdo = new \PDO(
+            "mysql:host={$db['host']};charset=utf8",
+            $db['username'],
+            $db['password'],
+            [\PDO::ATTR_ERRMODE => \PDO::ERRMODE_EXCEPTION]
+        );
+
+        $name = $db['database'];
+        self::$pdo->exec(
+            "CREATE DATABASE IF NOT EXISTS `{$name}` CHARACTER SET utf8 COLLATE utf8_general_ci"
+        );
+        self::$pdo->exec("USE `{$name}`");
+    }
+
+    private static function createSchema(): void
+    {
+        static::execSqlFile(__DIR__ . '/schema.sql');
+    }
+
+    private static function startServer(): void
+    {
+        $apiRoot = dirname(__DIR__, 2);
+
+        self::$server = new Process(
+            ['php', '-S', 'localhost:' . self::PORT, 'index.php'],
+            $apiRoot,
+            ['APP_CONFIG_FILE' => static::configFile()]
+        );
+        self::$server->start();
+
+        // Poll until the port accepts connections (max 3 s)
+        $deadline = microtime(true) + 3.0;
+        while (microtime(true) < $deadline) {
+            $sock = @fsockopen('localhost', self::PORT, $errno, $errstr, 0.1);
+            if ($sock !== false) {
+                fclose($sock);
+                return;
+            }
+            usleep(50_000);
+        }
+
+        throw new \RuntimeException(
+            "PHP built-in server did not start in time.\nServer output:\n" .
+            self::$server->getOutput() . self::$server->getErrorOutput()
+        );
+    }
+
+    protected static function seedDatabase(): void
+    {
+        static::execSqlFile(__DIR__ . '/seeds.sql');
+    }
+
+    protected static function cleanDatabase(): void
+    {
+        self::$pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach (static::truncatableTables() as $table) {
+            self::$pdo->exec("TRUNCATE TABLE `{$table}`");
+        }
+        self::$pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    /**
+     * Tables wiped before every test class.  Static reference data (scopes,
+     * apps) is re-inserted by seedDatabase() right after.
+     */
+    protected static function truncatableTables(): array
+    {
+        return [
+            'apps', 'scopes',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+            'user_validation_token', 'user_resetpassword_token',
+            'user_external_account',
+            'author', 'plugin', 'plugin_author', 'plugin_description',
+            'plugin_download', 'plugin_permission', 'plugin_screenshot',
+            'plugin_stars', 'plugin_version', 'plugin_xml_fetch_fails',
+            'plugin_plugin_lang', 'plugin_tags', 'user_plugin_watch',
+            'tag', 'auth_codes', 'message',
+        ];
+    }
+
+    private static function execSqlFile(string $path): void
+    {
+        $sql = file_get_contents($path);
+        foreach (array_filter(array_map('trim', explode(';', $sql))) as $stmt) {
+            self::$pdo->exec($stmt);
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // Test helpers
+    // -------------------------------------------------------------------------
+
+    protected function db(): \PDO
+    {
+        return self::$pdo;
+    }
+
+    /**
+     * Insert a plugin row directly (bypasses XML fetch/validation).
+     * Returns the inserted data plus `id`.
+     */
+    protected function createPlugin(array $overrides = []): array
+    {
+        $defaults = [
+            'name'           => 'Test Plugin',
+            'key'            => 'testplugin',
+            'xml_url'        => 'http://example.com/plugin.xml',
+            'download_url'   => 'http://example.com/plugin.zip',
+            'active'         => 1,
+            'download_count' => 0,
+            'date_added'     => date('Y-m-d H:i:s'),
+        ];
+        $data = array_merge($defaults, $overrides);
+
+        $cols = implode(', ', array_map(static fn ($k) => "`{$k}`", array_keys($data)));
+        $vals = implode(', ', array_fill(0, count($data), '?'));
+        self::$pdo->prepare("INSERT INTO `plugin` ({$cols}) VALUES ({$vals})")
+                  ->execute(array_values($data));
+
+        return array_merge($data, ['id' => (int) self::$pdo->lastInsertId()]);
+    }
+
+    /** Insert an author row directly. Returns `id` and `name`. */
+    protected function createAuthor(string $name): array
+    {
+        self::$pdo->prepare("INSERT INTO `author` (`name`) VALUES (?)")->execute([$name]);
+        return ['id' => (int) self::$pdo->lastInsertId(), 'name' => $name];
+    }
+
+    /** Insert a tag row directly. Returns the inserted data plus `id`. */
+    protected function createTag(string $key, string $tag, string $lang = 'en'): array
+    {
+        self::$pdo->prepare("INSERT INTO `tag` (`key`, `tag`, `lang`) VALUES (?, ?, ?)")
+                  ->execute([$key, $tag, $lang]);
+        return ['id' => (int) self::$pdo->lastInsertId(), 'key' => $key, 'tag' => $tag, 'lang' => $lang];
+    }
+
+    /** Grant a plugin permission to a user directly. */
+    protected function grantPermission(int $pluginId, int $userId, bool $admin = false): void
+    {
+        self::$pdo->prepare(
+            "INSERT INTO `plugin_permission` (`plugin_id`, `user_id`, `admin`) VALUES (?, ?, ?)"
+        )->execute([$pluginId, $userId, $admin ? 1 : 0]);
+    }
+
+    /**
+     * Insert a user row directly (bypasses validation and email sending).
+     * Returns the inserted data plus `id` and `plain_password`.
+     */
+    protected function createUser(array $overrides = []): array
+    {
+        $plainPassword = $overrides['plain_password'] ?? 'Password1';
+        unset($overrides['plain_password']);
+
+        $defaults = [
+            'username' => 'testuser',
+            'email'    => 'testuser@example.com',
+            'password' => password_hash($plainPassword, PASSWORD_BCRYPT),
+            'realname' => 'Test User',
+            'active'   => 1,
+        ];
+        $data = array_merge($defaults, $overrides);
+
+        $cols = implode(', ', array_map(static fn ($k) => "`{$k}`", array_keys($data)));
+        $vals = implode(', ', array_fill(0, count($data), '?'));
+        self::$pdo->prepare("INSERT INTO `user` ({$cols}) VALUES ({$vals})")
+            ->execute(array_values($data));
+
+        return array_merge($data, [
+            'id'             => (int) self::$pdo->lastInsertId(),
+            'plain_password' => $plainPassword,
+        ]);
+    }
+
+    /**
+     * Obtain a Bearer token via the password grant.
+     * Returns the access_token string, or null if authentication failed.
+     */
+    protected function getAccessToken(
+        string $username,
+        string $password,
+        array  $scopes = ['plugins', 'user']
+    ): ?string {
+        $response = self::$http->post('/oauth/authorize', [
+            'form_params' => [
+                'grant_type' => 'password',
+                'client_id'  => 'webapp',
+                'username'   => $username,
+                'password'   => $password,
+                'scope'      => implode(' ', $scopes),
+            ],
+        ]);
+
+        if ($response->getStatusCode() !== 200) {
+            return null;
+        }
+
+        $body = json_decode((string) $response->getBody(), true);
+        return $body['access_token'] ?? null;
+    }
+
+    /** Return an Authorization header array for the given Bearer token. */
+    protected function bearer(string $token): array
+    {
+        return ['Authorization' => 'Bearer ' . $token];
+    }
+}
diff --git a/api/tests/Functional/MessageTest.php b/api/tests/Functional/MessageTest.php
new file mode 100644
index 00000000..644acdb0
--- /dev/null
+++ b/api/tests/Functional/MessageTest.php
@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional;
+
+/**
+ * Functional tests for POST /message (§20).
+ *
+ * NOTE: The endpoint validates reCAPTCHA before checking required fields.
+ * All authenticated requests without a valid reCAPTCHA will receive 400
+ * (InvalidRecaptcha). Tests therefore assert status 400 without checking the
+ * specific error payload for field-validation cases.
+ */
+class MessageTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    public function testMessageWithoutTokenReturns401(): void
+    {
+        $response = self::$http->post('/message', [
+            'json' => [
+                'firstname' => 'John',
+                'lastname'  => 'Doe',
+                'email'     => 'john@example.com',
+                'subject'   => 'Hello',
+                'message'   => 'Test message',
+            ],
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    public function testMessageWithoutMessageScopeReturns401(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['plugins']);
+
+        $response = self::$http->post('/message', [
+            'headers' => $this->bearer($token),
+            'json'    => ['firstname' => 'John', 'email' => 'john@example.com'],
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    public function testMessageWithScopeButNoRecaptchaReturns400(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['message']);
+
+        $response = self::$http->post('/message', [
+            'headers' => $this->bearer($token),
+            'json'    => [
+                'firstname' => 'John',
+                'lastname'  => 'Doe',
+                'email'     => 'john@example.com',
+                'subject'   => 'Hello',
+                'message'   => 'Test message body',
+            ],
+        ]);
+
+        // 400: either InvalidRecaptcha (recaptcha_response missing/invalid) or
+        // a field error — both are correct 400 responses
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/Plugin/DownloadTest.php b/api/tests/Functional/Plugin/DownloadTest.php
new file mode 100644
index 00000000..0b49f3f9
--- /dev/null
+++ b/api/tests/Functional/Plugin/DownloadTest.php
@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Plugin;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for GET /plugin/:key/download (§9).
+ */
+class DownloadTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_download',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    public function testDownloadIncrementsDownloadCount(): void
+    {
+        $plugin = $this->createPlugin([
+            'key'            => 'dlplugin',
+            'name'           => 'Download Plugin',
+            'active'         => 1,
+            'download_count' => 5,
+            'download_url'   => 'http://example.com/plugin.zip',
+        ]);
+
+        self::$http->get("/plugin/{$plugin['key']}/download", [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        $stmt = $this->db()->prepare('SELECT download_count FROM `plugin` WHERE id = ?');
+        $stmt->execute([$plugin['id']]);
+        $this->assertSame(6, (int) $stmt->fetchColumn());
+    }
+
+    public function testDownloadCreatesPluginDownloadRecord(): void
+    {
+        $plugin = $this->createPlugin([
+            'key'          => 'dlrecordplugin',
+            'name'         => 'DL Record Plugin',
+            'active'       => 1,
+            'download_url' => 'http://example.com/plugin.zip',
+        ]);
+
+        self::$http->get("/plugin/{$plugin['key']}/download", [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        $stmt = $this->db()->prepare('SELECT COUNT(*) FROM `plugin_download` WHERE plugin_id = ?');
+        $stmt->execute([$plugin['id']]);
+        $this->assertSame(1, (int) $stmt->fetchColumn());
+    }
+
+    public function testDownloadWithJsonAcceptReturns200WithoutRedirect(): void
+    {
+        $plugin = $this->createPlugin([
+            'key'          => 'jsondownload',
+            'name'         => 'JSON Download Plugin',
+            'active'       => 1,
+            'download_url' => 'http://example.com/plugin.zip',
+        ]);
+
+        $response = self::$http->get("/plugin/{$plugin['key']}/download", [
+            'headers' => ['Accept' => 'application/json'],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testDownloadWithoutJsonAcceptRedirectsWith301(): void
+    {
+        $plugin = $this->createPlugin([
+            'key'          => 'redirectdownload',
+            'name'         => 'Redirect Download Plugin',
+            'active'       => 1,
+            'download_url' => 'http://example.com/plugin.zip',
+        ]);
+
+        $response = self::$http->get("/plugin/{$plugin['key']}/download");
+
+        $this->assertSame(301, $response->getStatusCode());
+        $this->assertSame('http://example.com/plugin.zip', $response->getHeaderLine('Location'));
+    }
+}
diff --git a/api/tests/Functional/Plugin/ListingTest.php b/api/tests/Functional/Plugin/ListingTest.php
new file mode 100644
index 00000000..9e542705
--- /dev/null
+++ b/api/tests/Functional/Plugin/ListingTest.php
@@ -0,0 +1,210 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Plugin;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for plugin listing endpoints (§6).
+ *
+ * GET /plugin
+ * GET /plugin/popular, /plugin/new, /plugin/trending, /plugin/updated
+ * GET /plugin/:key
+ * GET /plugin/rss_new, /plugin/rss_updated
+ */
+class ListingTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_author', 'plugin_description', 'plugin_version',
+            'plugin_download', 'plugin_stars', 'plugin_tags', 'plugin_screenshot',
+            'plugin_permission', 'user_plugin_watch',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    private function authedToken(array $scopes = ['plugins']): string
+    {
+        $user = $this->createUser();
+        return $this->getAccessToken($user['username'], $user['plain_password'], $scopes);
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /plugin (§6.1)
+    // -------------------------------------------------------------------------
+
+    public function testListReturnsOnlyActivePlugins(): void
+    {
+        $this->createPlugin(['key' => 'activeplug',   'name' => 'Active Plugin',   'active' => 1]);
+        $this->createPlugin(['key' => 'inactiveplug', 'name' => 'Inactive Plugin', 'active' => 0]);
+        $token = $this->authedToken(['plugins']);
+
+        $response = self::$http->get('/plugin', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertContains('activeplug', $keys);
+        $this->assertNotContains('inactiveplug', $keys);
+    }
+
+    public function testListWithoutTokenReturns401(): void
+    {
+        $response = self::$http->get('/plugin');
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    public function testListResponseHasPaginationHeaders(): void
+    {
+        $this->createPlugin(['key' => 'pagplug', 'name' => 'Pag Plugin', 'active' => 1]);
+        $token = $this->authedToken(['plugins']);
+
+        $response = self::$http->get('/plugin', ['headers' => $this->bearer($token)]);
+
+        $this->assertTrue($response->hasHeader('accept-range'), 'accept-range header must be present');
+        $this->assertTrue($response->hasHeader('content-range'), 'content-range header must be present');
+    }
+
+    public function testXRangeHeaderRestrictsResults(): void
+    {
+        for ($i = 1; $i <= 5; $i++) {
+            $this->createPlugin(['key' => "rangeplug{$i}", 'name' => "Range Plugin {$i}", 'active' => 1]);
+        }
+        $token = $this->authedToken(['plugins']);
+
+        $response = self::$http->get('/plugin', [
+            'headers' => array_merge($this->bearer($token), ['x-range' => '0-1']),
+        ]);
+
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertCount(2, $body, 'x-range: 0-1 should return 2 items');
+        $this->assertSame(206, $response->getStatusCode());
+    }
+
+    public function testRangeStartingBeyondTotalReturns400(): void
+    {
+        $this->createPlugin(['key' => 'onlyone', 'name' => 'Only One', 'active' => 1]);
+        $token = $this->authedToken(['plugins']);
+
+        $response = self::$http->get('/plugin', [
+            'headers' => array_merge($this->bearer($token), ['x-range' => '999-1000']),
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /plugin/popular, /plugin/new, /plugin/updated (§6.2)
+    // -------------------------------------------------------------------------
+
+    public function testPopularReturnsOnlyActivePlugins(): void
+    {
+        $this->createPlugin(['key' => 'activepop',   'name' => 'Active Popular',   'active' => 1, 'download_count' => 100]);
+        $this->createPlugin(['key' => 'inactivepop', 'name' => 'Inactive Popular', 'active' => 0, 'download_count' => 200]);
+        $token = $this->authedToken(['plugins']);
+
+        $response = self::$http->get('/plugin/popular', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertNotContains('inactivepop', $keys);
+    }
+
+    public function testNewReturnsOnlyActivePlugins(): void
+    {
+        $this->createPlugin(['key' => 'activenew',   'name' => 'Active New',   'active' => 1]);
+        $this->createPlugin(['key' => 'inactivenew', 'name' => 'Inactive New', 'active' => 0]);
+        $token = $this->authedToken(['plugins']);
+
+        $response = self::$http->get('/plugin/new', ['headers' => $this->bearer($token)]);
+
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertNotContains('inactivenew', $keys);
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /plugin/:key (§6.3)
+    // -------------------------------------------------------------------------
+
+    public function testGetSinglePluginReturns200(): void
+    {
+        $plugin = $this->createPlugin(['key' => 'singleplug', 'name' => 'Single Plugin', 'active' => 1]);
+        $token  = $this->authedToken(['plugin:card']);
+
+        $response = self::$http->get("/plugin/{$plugin['key']}", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertSame('singleplug', $body['key']);
+    }
+
+    public function testGetInactivePluginReturns404(): void
+    {
+        $plugin = $this->createPlugin(['key' => 'inactivesingle', 'name' => 'Inactive Single', 'active' => 0]);
+        $token  = $this->authedToken(['plugin:card']);
+
+        $response = self::$http->get("/plugin/{$plugin['key']}", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    public function testGetUnknownPluginReturns404(): void
+    {
+        $token = $this->authedToken(['plugin:card']);
+
+        $response = self::$http->get('/plugin/no_such_plugin', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    public function testGetSinglePluginIncludesWatchedFlagForWatcher(): void
+    {
+        $plugin = $this->createPlugin(['key' => 'watchedplug', 'name' => 'Watched Plugin', 'active' => 1]);
+        $user   = $this->createUser();
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['plugin:card', 'user', 'plugins']);
+
+        // Watch the plugin
+        self::$http->post('/user/watchs', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_key' => $plugin['key']],
+        ]);
+
+        $response = self::$http->get("/plugin/{$plugin['key']}", ['headers' => $this->bearer($token)]);
+        $body     = json_decode((string) $response->getBody(), true);
+
+        $this->assertTrue($body['watched'], 'watched flag must be true for a watching user');
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /plugin/rss_new and /plugin/rss_updated (§6.4)
+    // -------------------------------------------------------------------------
+
+    public function testRssNewReturnsXmlWithoutAuth(): void
+    {
+        $this->createPlugin(['key' => 'rssplugin', 'name' => 'RSS Plugin', 'active' => 1]);
+
+        $response = self::$http->get('/plugin/rss_new');
+
+        $this->assertSame(200, $response->getStatusCode());
+        $this->assertStringContainsString('<?xml', (string) $response->getBody());
+    }
+
+    public function testRssUpdatedReturnsXmlWithoutAuth(): void
+    {
+        $response = self::$http->get('/plugin/rss_updated');
+
+        $this->assertSame(200, $response->getStatusCode());
+        $this->assertStringContainsString('<?xml', (string) $response->getBody());
+    }
+}
diff --git a/api/tests/Functional/Plugin/PanelTest.php b/api/tests/Functional/Plugin/PanelTest.php
new file mode 100644
index 00000000..7f11c30b
--- /dev/null
+++ b/api/tests/Functional/Plugin/PanelTest.php
@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Plugin;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for the author panel endpoints (§11).
+ *
+ * GET  /panel/plugin/:key  — view card + statistics
+ * POST /panel/plugin/:key  — update xml_url (XML-URL update tests are skipped:
+ *                            they require a live HTTP endpoint to serve valid XML)
+ */
+class PanelTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_permission', 'plugin_description', 'plugin_version',
+            'plugin_stars', 'plugin_screenshot', 'plugin_tags', 'plugin_author',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /panel/plugin/:key (§11.1)
+    // -------------------------------------------------------------------------
+
+    public function testAdminUserCanViewPanel(): void
+    {
+        $admin  = $this->createUser();
+        $plugin = $this->createPlugin(['key' => 'panelplug', 'name' => 'Panel Plugin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['plugin:card', 'user']);
+
+        $response = self::$http->get("/panel/plugin/{$plugin['key']}", [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertArrayHasKey('card', $body);
+        $this->assertArrayHasKey('statistics', $body);
+    }
+
+    public function testUserWithoutPermissionCannotViewPanel(): void
+    {
+        $user   = $this->createUser();
+        $plugin = $this->createPlugin(['key' => 'panelnoperm', 'name' => 'Panel No Perm', 'active' => 1]);
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['plugin:card', 'user']);
+
+        $response = self::$http->get("/panel/plugin/{$plugin['key']}", [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // POST /panel/plugin/:key (§11.2)
+    // -------------------------------------------------------------------------
+
+    public function testUpdateWithNonUrlStringReturns400(): void
+    {
+        $admin  = $this->createUser();
+        $plugin = $this->createPlugin(['key' => 'paneledit', 'name' => 'Panel Edit', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->post("/panel/plugin/{$plugin['key']}", [
+            'headers' => $this->bearer($token),
+            'json'    => ['xml_url' => 'not-a-url'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testUpdateWithUnfetchableUrlReturns400(): void
+    {
+        $admin  = $this->createUser();
+        $plugin = $this->createPlugin(['key' => 'panelunfetch', 'name' => 'Panel Unfetch', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->post("/panel/plugin/{$plugin['key']}", [
+            'headers' => $this->bearer($token),
+            'json'    => ['xml_url' => 'http://localhost:19999/nonexistent.xml'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/Plugin/PermissionsTest.php b/api/tests/Functional/Plugin/PermissionsTest.php
new file mode 100644
index 00000000..cd37d15f
--- /dev/null
+++ b/api/tests/Functional/Plugin/PermissionsTest.php
@@ -0,0 +1,237 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Plugin;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for plugin permission endpoints (§10).
+ *
+ * GET    /plugin/:key/permissions
+ * POST   /plugin/:key/permissions
+ * DELETE /plugin/:key/permissions/:username
+ * PATCH  /plugin/:key/permissions/:username
+ */
+class PermissionsTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_permission',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /plugin/:key/permissions (§10.1)
+    // -------------------------------------------------------------------------
+
+    public function testAdminCanViewPermissions(): void
+    {
+        $admin  = $this->createUser();
+        $plugin = $this->createPlugin(['key' => 'permplug', 'name' => 'Perm Plugin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->get("/plugin/{$plugin['key']}/permissions", [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testNonAdminCannotViewPermissions(): void
+    {
+        $user   = $this->createUser();
+        $plugin = $this->createPlugin(['key' => 'permplug2', 'name' => 'Perm Plugin 2', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $user['id'], false);
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->get("/plugin/{$plugin['key']}/permissions", [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // POST /plugin/:key/permissions (§10.2)
+    // -------------------------------------------------------------------------
+
+    public function testAdminCanAddPermission(): void
+    {
+        $admin  = $this->createUser(['username' => 'adminuser', 'email' => 'admin@example.com']);
+        $target = $this->createUser(['username' => 'targetuser', 'email' => 'target@example.com']);
+        $plugin = $this->createPlugin(['key' => 'addpermplug', 'name' => 'Add Perm Plugin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->post("/plugin/{$plugin['key']}/permissions", [
+            'headers' => $this->bearer($token),
+            'json'    => ['username' => $target['username']],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testAddPermissionForNonExistentUserReturns404(): void
+    {
+        $admin  = $this->createUser();
+        $plugin = $this->createPlugin(['key' => 'addperm404', 'name' => 'Add Perm 404', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->post("/plugin/{$plugin['key']}/permissions", [
+            'headers' => $this->bearer($token),
+            'json'    => ['username' => 'nobody_here'],
+        ]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    public function testAddPermissionAlreadyExistsReturns400(): void
+    {
+        $admin  = $this->createUser(['username' => 'admindup', 'email' => 'admindup@example.com']);
+        $target = $this->createUser(['username' => 'targetdup', 'email' => 'targetdup@example.com']);
+        $plugin = $this->createPlugin(['key' => 'addpermdup', 'name' => 'Add Perm Dup', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $this->grantPermission($plugin['id'], $target['id'], false);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->post("/plugin/{$plugin['key']}/permissions", [
+            'headers' => $this->bearer($token),
+            'json'    => ['username' => $target['username']],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testNonAdminCannotAddPermission(): void
+    {
+        $user   = $this->createUser();
+        $target = $this->createUser(['username' => 'targetna', 'email' => 'targetna@example.com']);
+        $plugin = $this->createPlugin(['key' => 'addpermna', 'name' => 'Add Perm NA', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $user['id'], false);
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->post("/plugin/{$plugin['key']}/permissions", [
+            'headers' => $this->bearer($token),
+            'json'    => ['username' => $target['username']],
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // DELETE /plugin/:key/permissions/:username (§10.3)
+    // -------------------------------------------------------------------------
+
+    public function testNonAdminCanRemoveOwnPermission(): void
+    {
+        $admin  = $this->createUser(['username' => 'admindel', 'email' => 'admindel@example.com']);
+        $user   = $this->createUser(['username' => 'selfremove', 'email' => 'selfremove@example.com']);
+        $plugin = $this->createPlugin(['key' => 'delpermplug', 'name' => 'Del Perm Plugin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $this->grantPermission($plugin['id'], $user['id'], false);
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->delete("/plugin/{$plugin['key']}/permissions/{$user['username']}", [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testCannotDeleteAdminPermissionReturns401(): void
+    {
+        $admin  = $this->createUser(['username' => 'adminnd', 'email' => 'adminnd@example.com']);
+        $other  = $this->createUser(['username' => 'otheradmin', 'email' => 'otheradmin@example.com']);
+        $plugin = $this->createPlugin(['key' => 'nodeladminplug', 'name' => 'No Del Admin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $this->grantPermission($plugin['id'], $other['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->delete("/plugin/{$plugin['key']}/permissions/{$other['username']}", [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    public function testDeleteNonExistentPermissionReturns400(): void
+    {
+        $admin  = $this->createUser(['username' => 'adminnoperm', 'email' => 'adminnoperm@example.com']);
+        $plugin = $this->createPlugin(['key' => 'delperm404', 'name' => 'Del Perm 404', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->delete("/plugin/{$plugin['key']}/permissions/nobody", [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // PATCH /plugin/:key/permissions/:username (§10.4)
+    // -------------------------------------------------------------------------
+
+    public function testAdminCanModifyPermissionFlag(): void
+    {
+        $admin  = $this->createUser(['username' => 'adminmod', 'email' => 'adminmod@example.com']);
+        $target = $this->createUser(['username' => 'targetmod', 'email' => 'targetmod@example.com']);
+        $plugin = $this->createPlugin(['key' => 'modpermplug', 'name' => 'Mod Perm Plugin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $this->grantPermission($plugin['id'], $target['id'], false);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->patch("/plugin/{$plugin['key']}/permissions/{$target['username']}", [
+            'headers' => $this->bearer($token),
+            'json'    => ['right' => 'allowed_refresh_xml', 'set' => true],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testInvalidRightValueReturns400(): void
+    {
+        $admin  = $this->createUser(['username' => 'adminbadright', 'email' => 'adminbadright@example.com']);
+        $target = $this->createUser(['username' => 'targetbadright', 'email' => 'targetbadright@example.com']);
+        $plugin = $this->createPlugin(['key' => 'badrightplug', 'name' => 'Bad Right Plugin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $this->grantPermission($plugin['id'], $target['id'], false);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->patch("/plugin/{$plugin['key']}/permissions/{$target['username']}", [
+            'headers' => $this->bearer($token),
+            'json'    => ['right' => 'nonexistent_right', 'set' => true],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testMissingSetFieldReturns400(): void
+    {
+        $admin  = $this->createUser(['username' => 'adminnoset', 'email' => 'adminnoset@example.com']);
+        $target = $this->createUser(['username' => 'targetnoset', 'email' => 'targetnoset@example.com']);
+        $plugin = $this->createPlugin(['key' => 'nosetplug', 'name' => 'No Set Plugin', 'active' => 1]);
+        $this->grantPermission($plugin['id'], $admin['id'], true);
+        $this->grantPermission($plugin['id'], $target['id'], false);
+        $token  = $this->getAccessToken($admin['username'], $admin['plain_password'], ['user', 'plugin:card']);
+
+        $response = self::$http->patch("/plugin/{$plugin['key']}/permissions/{$target['username']}", [
+            'headers' => $this->bearer($token),
+            'json'    => ['right' => 'allowed_refresh_xml'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/Plugin/StarTest.php b/api/tests/Functional/Plugin/StarTest.php
new file mode 100644
index 00000000..e89bbcfc
--- /dev/null
+++ b/api/tests/Functional/Plugin/StarTest.php
@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Plugin;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for POST /plugin/star (§8).
+ */
+class StarTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_stars',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    public function testStarPluginCreatesRecordAndReturnsNewAverage(): void
+    {
+        $plugin = $this->createPlugin(['key' => 'starplugin', 'name' => 'Star Plugin', 'active' => 1]);
+        $user   = $this->createUser();
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['plugin:star']);
+
+        $response = self::$http->post('/plugin/star', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_id' => $plugin['id'], 'note' => 4],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertArrayHasKey('new_average', $body);
+        $this->assertEquals(4.0, (float) $body['new_average'], '', 0.01);
+
+        $stmt = $this->db()->prepare('SELECT COUNT(*) FROM `plugin_stars` WHERE plugin_id = ?');
+        $stmt->execute([$plugin['id']]);
+        $this->assertSame(1, (int) $stmt->fetchColumn());
+    }
+
+    public function testNonNumericPluginIdReturns400(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['plugin:star']);
+
+        $response = self::$http->post('/plugin/star', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_id' => 'abc', 'note' => 3],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testNonExistentPluginReturns400(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['plugin:star']);
+
+        $response = self::$http->post('/plugin/star', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_id' => 99999, 'note' => 3],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testMissingScopeReturns401(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['plugins']);
+
+        $response = self::$http->post('/plugin/star', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_id' => 1, 'note' => 3],
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/Plugin/SubmitTest.php b/api/tests/Functional/Plugin/SubmitTest.php
new file mode 100644
index 00000000..7a4278ea
--- /dev/null
+++ b/api/tests/Functional/Plugin/SubmitTest.php
@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Plugin;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for POST /plugin (plugin submission, §7).
+ *
+ * NOTE: The submission endpoint validates reCAPTCHA before checking other
+ * fields, so all authenticated requests without a valid reCAPTCHA will receive
+ * a 400 (InvalidRecaptcha).  Tests that exercise per-field validation therefore
+ * assert status 400 without checking the specific error payload.
+ *
+ * The full success path (§7.2) is not tested here because it requires:
+ *  - A live HTTP server that serves a valid plugin XML file
+ *  - A valid reCAPTCHA token (requires Google network access)
+ */
+class SubmitTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_permission',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    public function testSubmitWithoutTokenReturns401(): void
+    {
+        $response = self::$http->post('/plugin', [
+            'json' => ['plugin_url' => 'http://example.com/plugin.xml'],
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    public function testSubmitWithoutSubmitScopeReturns401(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['plugins']);
+
+        $response = self::$http->post('/plugin', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_url' => 'http://example.com/plugin.xml'],
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    public function testSubmitWithMissingPluginUrlReturns400(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['plugin:submit']);
+
+        $response = self::$http->post('/plugin', [
+            'headers' => $this->bearer($token),
+            'json'    => [],
+        ]);
+
+        // 400 returned — either InvalidRecaptcha (checked first) or InvalidField
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testSubmitWithDuplicateXmlUrlReturns400(): void
+    {
+        $this->createPlugin(['xml_url' => 'http://example.com/existing.xml']);
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['plugin:submit']);
+
+        $response = self::$http->post('/plugin', [
+            'headers' => $this->bearer($token),
+            'json'    => [
+                'plugin_url'       => 'http://example.com/existing.xml',
+                'recaptcha_response' => 'dummy',
+            ],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/SearchTest.php b/api/tests/Functional/SearchTest.php
new file mode 100644
index 00000000..105d08ee
--- /dev/null
+++ b/api/tests/Functional/SearchTest.php
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional;
+
+/**
+ * Functional tests for POST /search (§14).
+ */
+class SearchTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_description', 'plugin_stars',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    private function authedToken(): string
+    {
+        $user = $this->createUser();
+        return $this->getAccessToken($user['username'], $user['plain_password'], ['plugins:search']);
+    }
+
+    public function testSearchMatchesOnPluginName(): void
+    {
+        $this->createPlugin(['key' => 'uniquepluginname', 'name' => 'UniquePluginName', 'active' => 1]);
+        $token = $this->authedToken();
+
+        $response = self::$http->post('/search', [
+            'headers' => $this->bearer($token),
+            'json'    => ['query_string' => 'UniquePlugin'],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertContains('uniquepluginname', $keys);
+    }
+
+    public function testSearchMatchesOnPluginKey(): void
+    {
+        $this->createPlugin(['key' => 'searchbykey', 'name' => 'Search By Key Plugin', 'active' => 1]);
+        $token = $this->authedToken();
+
+        $response = self::$http->post('/search', [
+            'headers' => $this->bearer($token),
+            'json'    => ['query_string' => 'searchbykey'],
+        ]);
+
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertContains('searchbykey', $keys);
+    }
+
+    public function testSearchExcludesInactivePlugins(): void
+    {
+        $this->createPlugin(['key' => 'inactivesearch', 'name' => 'InactiveSearchPlugin', 'active' => 0]);
+        $token = $this->authedToken();
+
+        $response = self::$http->post('/search', [
+            'headers' => $this->bearer($token),
+            'json'    => ['query_string' => 'InactiveSearch'],
+        ]);
+
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertNotContains('inactivesearch', $keys);
+    }
+
+    public function testShortQueryReturns400(): void
+    {
+        $token = $this->authedToken();
+
+        $response = self::$http->post('/search', [
+            'headers' => $this->bearer($token),
+            'json'    => ['query_string' => 'a'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testMissingQueryStringReturns400(): void
+    {
+        $token = $this->authedToken();
+
+        $response = self::$http->post('/search', [
+            'headers' => $this->bearer($token),
+            'json'    => [],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/Tags/TagsTest.php b/api/tests/Functional/Tags/TagsTest.php
new file mode 100644
index 00000000..8d2d734c
--- /dev/null
+++ b/api/tests/Functional/Tags/TagsTest.php
@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\Tags;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for tag endpoints (§13).
+ *
+ * GET /tags
+ * GET /tags/top
+ * GET /tags/:id
+ * GET /tags/:id/plugin
+ */
+class TagsTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'tag', 'plugin', 'plugin_tags', 'plugin_description', 'plugin_stars',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    private function authedToken(array $scopes): string
+    {
+        $user = $this->createUser();
+        return $this->getAccessToken($user['username'], $user['plain_password'], $scopes);
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /tags and GET /tags/top (§13.1)
+    // -------------------------------------------------------------------------
+
+    public function testListTagsReturns200(): void
+    {
+        $this->createTag('network', 'Network', 'en');
+        $token = $this->authedToken(['tags']);
+
+        $response = self::$http->get('/tags', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testTopTagsReturns200(): void
+    {
+        $this->createTag('inventory', 'Inventory', 'en');
+        $token = $this->authedToken(['tags']);
+
+        $response = self::$http->get('/tags/top', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /tags/:id (§13.2)
+    // -------------------------------------------------------------------------
+
+    public function testGetSingleTagReturns200(): void
+    {
+        $tag   = $this->createTag('security', 'Security', 'en');
+        $token = $this->authedToken(['tag']);
+
+        $response = self::$http->get("/tags/{$tag['key']}", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertSame('security', $body['key']);
+    }
+
+    public function testGetUnknownTagReturns404(): void
+    {
+        $token = $this->authedToken(['tag']);
+
+        $response = self::$http->get('/tags/no_such_tag', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /tags/:id/plugin (§13.3)
+    // -------------------------------------------------------------------------
+
+    public function testTagPluginsReturnsPluginsWithThatTag(): void
+    {
+        $tag    = $this->createTag('reporting', 'Reporting', 'en');
+        $plugin = $this->createPlugin(['key' => 'taggedplug', 'name' => 'Tagged Plugin', 'active' => 1]);
+        $this->db()->prepare("INSERT INTO `plugin_tags` (`plugin_id`, `tag_id`) VALUES (?, ?)")
+                   ->execute([$plugin['id'], $tag['id']]);
+        $token  = $this->authedToken(['tag', 'plugins']);
+
+        $response = self::$http->get("/tags/{$tag['key']}/plugin", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $keys = array_column($body, 'key');
+        $this->assertContains('taggedplug', $keys);
+    }
+}
diff --git a/api/tests/Functional/User/AppsTest.php b/api/tests/Functional/User/AppsTest.php
new file mode 100644
index 00000000..33992b53
--- /dev/null
+++ b/api/tests/Functional/User/AppsTest.php
@@ -0,0 +1,187 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\User;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for user app (OAuth client) endpoints (§19).
+ *
+ * POST   /user/apps
+ * GET    /user/apps
+ * GET    /user/apps/:id
+ * PUT    /user/apps/:id
+ * DELETE /user/apps/:id
+ */
+class AppsTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach (['user', 'sessions', 'access_tokens', 'access_tokens_scopes', 'refresh_tokens', 'sessions_scopes'] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        // Remove user-owned apps (keep webapp/glpidefault which have no user_id)
+        $pdo->exec("DELETE FROM `apps` WHERE `user_id` IS NOT NULL");
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    // -------------------------------------------------------------------------
+    // POST /user/apps (§19.1)
+    // -------------------------------------------------------------------------
+
+    public function testCreateAppReturns200(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        $response = self::$http->post('/user/apps', [
+            'headers' => $this->bearer($token),
+            'json'    => ['name' => 'My Test App'],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testCreatedAppHasRandomClientIdAndSecret(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        self::$http->post('/user/apps', [
+            'headers' => $this->bearer($token),
+            'json'    => ['name' => 'SecretApp'],
+        ]);
+
+        $stmt = $this->db()->prepare(
+            "SELECT id, secret FROM `apps` WHERE user_id = ? AND name = 'SecretApp'"
+        );
+        $stmt->execute([$user['id']]);
+        $row = $stmt->fetch(\PDO::FETCH_ASSOC);
+        $this->assertNotFalse($row);
+        $this->assertNotEmpty($row['id']);
+        $this->assertNotEmpty($row['secret']);
+    }
+
+    public function testDuplicateAppNameReturns400(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        self::$http->post('/user/apps', ['headers' => $this->bearer($token), 'json' => ['name' => 'DupApp']]);
+        $response = self::$http->post('/user/apps', ['headers' => $this->bearer($token), 'json' => ['name' => 'DupApp']]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testInvalidAppNameReturns400(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        $response = self::$http->post('/user/apps', [
+            'headers' => $this->bearer($token),
+            'json'    => ['name' => 'ab'],   // too short (< 4 chars)
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /user/apps and GET /user/apps/:id (§19.2)
+    // -------------------------------------------------------------------------
+
+    public function testListAppsReturnsOnlyOwnApps(): void
+    {
+        $user  = $this->createUser();
+        $other = $this->createUser(['username' => 'otheruser', 'email' => 'other@example.com']);
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        self::$http->post('/user/apps', ['headers' => $this->bearer($token), 'json' => ['name' => 'OwnApp']]);
+
+        $response = self::$http->get('/user/apps', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        foreach ($body as $app) {
+            $stmt = $this->db()->prepare('SELECT user_id FROM `apps` WHERE id = ?');
+            $stmt->execute([$app['id']]);
+            $this->assertSame($user['id'], (int) $stmt->fetchColumn(), 'Must only return own apps');
+        }
+    }
+
+    public function testGetSingleAppReturns200(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        self::$http->post('/user/apps', ['headers' => $this->bearer($token), 'json' => ['name' => 'SingleApp']]);
+        $stmt = $this->db()->prepare("SELECT id FROM `apps` WHERE name = 'SingleApp'");
+        $stmt->execute();
+        $id = $stmt->fetchColumn();
+
+        $response = self::$http->get("/user/apps/{$id}", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testGetUnknownAppReturns404(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        $response = self::$http->get('/user/apps/99999', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // PUT /user/apps/:id (§19.3)
+    // -------------------------------------------------------------------------
+
+    public function testUpdateAppPersistsChanges(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        self::$http->post('/user/apps', ['headers' => $this->bearer($token), 'json' => ['name' => 'UpdateMe']]);
+        $stmt = $this->db()->prepare("SELECT id FROM `apps` WHERE name = 'UpdateMe'");
+        $stmt->execute();
+        $id = $stmt->fetchColumn();
+
+        $response = self::$http->put("/user/apps/{$id}", [
+            'headers' => $this->bearer($token),
+            'json'    => ['name' => 'UpdatedName'],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $stmt = $this->db()->prepare("SELECT name FROM `apps` WHERE id = ?");
+        $stmt->execute([$id]);
+        $this->assertSame('UpdatedName', $stmt->fetchColumn());
+    }
+
+    // -------------------------------------------------------------------------
+    // DELETE /user/apps/:id (§19.4)
+    // -------------------------------------------------------------------------
+
+    public function testDeleteAppRemovesRecord(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'user:apps']);
+
+        self::$http->post('/user/apps', ['headers' => $this->bearer($token), 'json' => ['name' => 'DeleteMe']]);
+        $stmt = $this->db()->prepare("SELECT id FROM `apps` WHERE name = 'DeleteMe'");
+        $stmt->execute();
+        $id = $stmt->fetchColumn();
+
+        $response = self::$http->delete("/user/apps/{$id}", ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $stmt = $this->db()->prepare("SELECT COUNT(*) FROM `apps` WHERE id = ?");
+        $stmt->execute([$id]);
+        $this->assertSame(0, (int) $stmt->fetchColumn());
+    }
+}
diff --git a/api/tests/Functional/User/EmailValidationTest.php b/api/tests/Functional/User/EmailValidationTest.php
new file mode 100644
index 00000000..5e089f22
--- /dev/null
+++ b/api/tests/Functional/User/EmailValidationTest.php
@@ -0,0 +1,77 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\User;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for GET /user/validatemail/:token (§3.3).
+ */
+class EmailValidationTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach (['user', 'user_validation_token', 'sessions', 'access_tokens', 'access_tokens_scopes', 'refresh_tokens', 'sessions_scopes'] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    public function testValidTokenActivatesUserAndReturnsAccessToken(): void
+    {
+        $user = $this->createUser(['active' => 0]);
+        $token = 'validtoken123';
+        $this->db()->prepare(
+            "INSERT INTO `user_validation_token` (`token`, `user_id`) VALUES (?, ?)"
+        )->execute([$token, $user['id']]);
+
+        $response = self::$http->get("/user/validatemail/{$token}");
+
+        $this->assertSame(200, $response->getStatusCode());
+
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertArrayHasKey('access_token', $body);
+        $this->assertNotEmpty($body['access_token']);
+    }
+
+    public function testValidTokenActivatesUserInDatabase(): void
+    {
+        $user = $this->createUser(['active' => 0]);
+        $token = 'activatetoken456';
+        $this->db()->prepare(
+            "INSERT INTO `user_validation_token` (`token`, `user_id`) VALUES (?, ?)"
+        )->execute([$token, $user['id']]);
+
+        self::$http->get("/user/validatemail/{$token}");
+
+        $stmt = $this->db()->prepare('SELECT active FROM `user` WHERE id = ?');
+        $stmt->execute([$user['id']]);
+        $this->assertSame(1, (int) $stmt->fetchColumn(), 'User must be active after email validation');
+    }
+
+    public function testValidTokenIsDeletedAfterUse(): void
+    {
+        $user = $this->createUser(['active' => 0]);
+        $token = 'deletetoken789';
+        $this->db()->prepare(
+            "INSERT INTO `user_validation_token` (`token`, `user_id`) VALUES (?, ?)"
+        )->execute([$token, $user['id']]);
+
+        self::$http->get("/user/validatemail/{$token}");
+
+        $stmt = $this->db()->prepare('SELECT COUNT(*) FROM `user_validation_token` WHERE token = ?');
+        $stmt->execute([$token]);
+        $this->assertSame(0, (int) $stmt->fetchColumn(), 'Token must be deleted after use');
+    }
+
+    public function testInvalidTokenReturns400(): void
+    {
+        $response = self::$http->get('/user/validatemail/no_such_token');
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/User/PasswordResetTest.php b/api/tests/Functional/User/PasswordResetTest.php
new file mode 100644
index 00000000..279bae4e
--- /dev/null
+++ b/api/tests/Functional/User/PasswordResetTest.php
@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\User;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for POST /user/sendpasswordresetlink and PUT /user/password (§5).
+ */
+class PasswordResetTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach (['user', 'user_resetpassword_token', 'sessions', 'access_tokens', 'access_tokens_scopes', 'refresh_tokens', 'sessions_scopes'] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    // -------------------------------------------------------------------------
+    // Send reset link (§5.1)
+    // -------------------------------------------------------------------------
+
+    public function testKnownEmailCreatesResetTokenAndReturns200(): void
+    {
+        $user = $this->createUser();
+
+        $response = self::$http->post('/user/sendpasswordresetlink', [
+            'json' => ['email' => $user['email']],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+
+        $stmt = $this->db()->prepare('SELECT COUNT(*) FROM `user_resetpassword_token` WHERE user_id = ?');
+        $stmt->execute([$user['id']]);
+        $this->assertSame(1, (int) $stmt->fetchColumn(), 'A reset token must be created');
+    }
+
+    public function testUnknownEmailReturns404(): void
+    {
+        $response = self::$http->post('/user/sendpasswordresetlink', [
+            'json' => ['email' => 'nobody@example.com'],
+        ]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    public function testMissingEmailFieldReturns400(): void
+    {
+        $response = self::$http->post('/user/sendpasswordresetlink', [
+            'json' => [],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Reset password (§5.2)
+    // -------------------------------------------------------------------------
+
+    public function testValidTokenUpdatesPasswordAndDeletesToken(): void
+    {
+        $user = $this->createUser();
+        $token = 'resettoken123abc';
+        $this->db()->prepare(
+            "INSERT INTO `user_resetpassword_token` (`token`, `user_id`) VALUES (?, ?)"
+        )->execute([$token, $user['id']]);
+
+        $response = self::$http->put('/user/password', [
+            'json' => ['token' => $token, 'password' => 'NewPassword1'],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+
+        // Password hash updated
+        $stmt = $this->db()->prepare('SELECT password FROM `user` WHERE id = ?');
+        $stmt->execute([$user['id']]);
+        $this->assertTrue(password_verify('NewPassword1', $stmt->fetchColumn()));
+
+        // Reset tokens deleted
+        $stmt = $this->db()->prepare('SELECT COUNT(*) FROM `user_resetpassword_token` WHERE user_id = ?');
+        $stmt->execute([$user['id']]);
+        $this->assertSame(0, (int) $stmt->fetchColumn(), 'Reset tokens must be deleted after use');
+    }
+
+    public function testInvalidTokenReturns400(): void
+    {
+        $response = self::$http->put('/user/password', [
+            'json' => ['token' => 'completely_wrong_token', 'password' => 'NewPassword1'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testMissingPasswordReturns400(): void
+    {
+        $user = $this->createUser();
+        $token = 'resettoken456xyz';
+        $this->db()->prepare(
+            "INSERT INTO `user_resetpassword_token` (`token`, `user_id`) VALUES (?, ?)"
+        )->execute([$token, $user['id']]);
+
+        $response = self::$http->put('/user/password', [
+            'json' => ['token' => $token],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/User/ProfileTest.php b/api/tests/Functional/User/ProfileTest.php
new file mode 100644
index 00000000..3bbfce85
--- /dev/null
+++ b/api/tests/Functional/User/ProfileTest.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\User;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for GET /user, PUT /user, POST /user/delete (§4).
+ */
+class ProfileTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach (['user', 'sessions', 'access_tokens', 'access_tokens_scopes', 'refresh_tokens', 'sessions_scopes'] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    // -------------------------------------------------------------------------
+    // View profile (§4.1)
+    // -------------------------------------------------------------------------
+
+    public function testViewProfileReturnsUserFields(): void
+    {
+        $user = $this->createUser(['realname' => 'Test User']);
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user']);
+
+        $response = self::$http->get('/user', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertSame($user['username'], $body['username']);
+        $this->assertArrayHasKey('gravatar', $body);
+    }
+
+    public function testViewProfileWithoutTokenReturns401(): void
+    {
+        $response = self::$http->get('/user');
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Edit profile (§4.2)
+    // -------------------------------------------------------------------------
+
+    public function testEditRealnameIsPersisted(): void
+    {
+        $user = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user']);
+
+        self::$http->put('/user', [
+            'headers' => $this->bearer($token),
+            'json'    => ['realname' => 'Updated Name'],
+        ]);
+
+        $stmt = $this->db()->prepare('SELECT realname FROM `user` WHERE username = ?');
+        $stmt->execute([$user['username']]);
+        $this->assertSame('Updated Name', $stmt->fetchColumn());
+    }
+
+    public function testEditPasswordIsHashedBeforeSaving(): void
+    {
+        $user = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user']);
+
+        self::$http->put('/user', [
+            'headers' => $this->bearer($token),
+            'json'    => ['password' => 'NewPassword1'],
+        ]);
+
+        $stmt = $this->db()->prepare('SELECT password FROM `user` WHERE username = ?');
+        $stmt->execute([$user['username']]);
+        $hash = $stmt->fetchColumn();
+
+        $this->assertNotSame('NewPassword1', $hash, 'Password must not be stored in plain text');
+        $this->assertTrue(password_verify('NewPassword1', $hash), 'Stored hash must match new password');
+    }
+
+    public function testEditProfileWithoutTokenReturns401(): void
+    {
+        $response = self::$http->put('/user', ['json' => ['realname' => 'Nobody']]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Delete account (§4.3)
+    // -------------------------------------------------------------------------
+
+    public function testDeleteAccountWithCorrectPasswordSucceeds(): void
+    {
+        $user = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user']);
+
+        $response = self::$http->post('/user/delete', [
+            'headers' => $this->bearer($token),
+            'json'    => ['password' => $user['plain_password']],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+
+        $stmt = $this->db()->prepare('SELECT COUNT(*) FROM `user` WHERE username = ?');
+        $stmt->execute([$user['username']]);
+        $this->assertSame(0, (int) $stmt->fetchColumn(), 'User record must be deleted');
+    }
+
+    public function testDeleteAccountWithWrongPasswordReturns401(): void
+    {
+        $user = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user']);
+
+        $response = self::$http->post('/user/delete', [
+            'headers' => $this->bearer($token),
+            'json'    => ['password' => 'WrongPass1'],
+        ]);
+
+        $this->assertSame(401, $response->getStatusCode());
+    }
+
+    public function testDeleteAccountWithInvalidPasswordFormatReturns400(): void
+    {
+        $user = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user']);
+
+        $response = self::$http->post('/user/delete', [
+            'headers' => $this->bearer($token),
+            'json'    => ['password' => 'ab'],  // too short
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/User/RegistrationTest.php b/api/tests/Functional/User/RegistrationTest.php
new file mode 100644
index 00000000..91b55efe
--- /dev/null
+++ b/api/tests/Functional/User/RegistrationTest.php
@@ -0,0 +1,149 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\User;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for POST /user (user registration).
+ *
+ * The endpoint:
+ *  - Validates the JSON body
+ *  - Creates a user with active = false
+ *  - Creates a ValidationToken
+ *  - Tries to send a confirmation email (uses 'mail' transport in test config;
+ *    PHP mail() returns false silently in CI but does not throw)
+ */
+class RegistrationTest extends FunctionalTestCase
+{
+    // -------------------------------------------------------------------------
+    // Success
+    // -------------------------------------------------------------------------
+
+    public function testRegistrationReturns200(): void
+    {
+        $response = self::$http->post('/user', [
+            'json' => [
+                'username' => 'newuser',
+                'email'    => 'newuser@example.com',
+                'password' => 'Password1',
+            ],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    public function testRegistrationCreatesInactiveUser(): void
+    {
+        self::$http->post('/user', [
+            'json' => [
+                'username' => 'newuser',
+                'email'    => 'newuser@example.com',
+                'password' => 'Password1',
+            ],
+        ]);
+
+        $stmt = $this->db()->prepare('SELECT active FROM `user` WHERE username = ?');
+        $stmt->execute(['newuser']);
+        $row = $stmt->fetch(\PDO::FETCH_ASSOC);
+
+        $this->assertNotFalse($row, 'User must be created in the database');
+        $this->assertSame(0, (int) $row['active'], 'Newly registered user must be inactive');
+    }
+
+    public function testRegistrationCreatesValidationToken(): void
+    {
+        self::$http->post('/user', [
+            'json' => [
+                'username' => 'newuser',
+                'email'    => 'newuser@example.com',
+                'password' => 'Password1',
+            ],
+        ]);
+
+        $stmt = $this->db()->prepare(
+            'SELECT t.token
+               FROM user_validation_token t
+               JOIN `user` u ON u.id = t.user_id
+              WHERE u.username = ?'
+        );
+        $stmt->execute(['newuser']);
+        $token = $stmt->fetchColumn();
+
+        $this->assertNotFalse($token, 'A validation token must be created for the new user');
+        $this->assertNotEmpty($token);
+    }
+
+    // -------------------------------------------------------------------------
+    // Field validation failures
+    // -------------------------------------------------------------------------
+
+    public function testMissingUsernameReturns400(): void
+    {
+        $response = self::$http->post('/user', [
+            'json' => ['email' => 'test@example.com', 'password' => 'Password1'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testUsernameTooShortReturns400(): void
+    {
+        $response = self::$http->post('/user', [
+            'json' => ['username' => 'ab', 'email' => 'test@example.com', 'password' => 'Password1'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testUsernameWithSpecialCharactersReturns400(): void
+    {
+        $response = self::$http->post('/user', [
+            'json' => ['username' => 'bad!user', 'email' => 'test@example.com', 'password' => 'Password1'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testDuplicateUsernameReturns400(): void
+    {
+        $this->createUser(['username' => 'taken', 'email' => 'taken@example.com']);
+
+        $response = self::$http->post('/user', [
+            'json' => ['username' => 'taken', 'email' => 'other@example.com', 'password' => 'Password1'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testInvalidEmailReturns400(): void
+    {
+        $response = self::$http->post('/user', [
+            'json' => ['username' => 'newuser', 'email' => 'not-an-email', 'password' => 'Password1'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testDuplicateEmailReturns400(): void
+    {
+        $this->createUser(['username' => 'user1', 'email' => 'shared@example.com']);
+
+        $response = self::$http->post('/user', [
+            'json' => ['username' => 'user2', 'email' => 'shared@example.com', 'password' => 'Password1'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    public function testPasswordTooShortReturns400(): void
+    {
+        $response = self::$http->post('/user', [
+            'json' => ['username' => 'newuser', 'email' => 'test@example.com', 'password' => '123'],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/User/UserSearchTest.php b/api/tests/Functional/User/UserSearchTest.php
new file mode 100644
index 00000000..546a85ea
--- /dev/null
+++ b/api/tests/Functional/User/UserSearchTest.php
@@ -0,0 +1,90 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\User;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for POST /user/search (§17).
+ */
+class UserSearchTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach (['user', 'sessions', 'access_tokens', 'access_tokens_scopes', 'refresh_tokens', 'sessions_scopes'] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    public function testSearchMatchesOnUsername(): void
+    {
+        $this->createUser(['username' => 'findme', 'email' => 'findme@example.com', 'realname' => 'Find Me']);
+        $searcher = $this->createUser(['username' => 'searcher', 'email' => 'searcher@example.com']);
+        $token    = $this->getAccessToken($searcher['username'], $searcher['plain_password'], ['users:search']);
+
+        $response = self::$http->post('/user/search', [
+            'headers' => $this->bearer($token),
+            'json'    => ['search' => 'findme'],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $usernames = array_column($body, 'username');
+        $this->assertContains('findme', $usernames);
+    }
+
+    public function testSearchMatchesOnRealname(): void
+    {
+        $this->createUser(['username' => 'jsmith', 'email' => 'jsmith@example.com', 'realname' => 'John Smith']);
+        $searcher = $this->createUser(['username' => 'searcher2', 'email' => 'searcher2@example.com']);
+        $token    = $this->getAccessToken($searcher['username'], $searcher['plain_password'], ['users:search']);
+
+        $response = self::$http->post('/user/search', [
+            'headers' => $this->bearer($token),
+            'json'    => ['search' => 'John'],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $usernames = array_column($body, 'username');
+        $this->assertContains('jsmith', $usernames);
+    }
+
+    public function testResultsContainOnlyUsernameAndRealname(): void
+    {
+        $this->createUser(['username' => 'checkfields', 'email' => 'checkfields@example.com']);
+        $searcher = $this->createUser(['username' => 'searcher3', 'email' => 'searcher3@example.com']);
+        $token    = $this->getAccessToken($searcher['username'], $searcher['plain_password'], ['users:search']);
+
+        $response = self::$http->post('/user/search', [
+            'headers' => $this->bearer($token),
+            'json'    => ['search' => 'checkfields'],
+        ]);
+
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertNotEmpty($body);
+        $result = $body[0];
+        $this->assertArrayHasKey('username', $result);
+        $this->assertArrayHasKey('realname', $result);
+        $this->assertArrayNotHasKey('password', $result);
+        $this->assertArrayNotHasKey('email', $result);
+    }
+
+    public function testMissingSearchFieldReturns400(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['users:search']);
+
+        $response = self::$http->post('/user/search', [
+            'headers' => $this->bearer($token),
+            'json'    => [],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+}
diff --git a/api/tests/Functional/User/WatchesTest.php b/api/tests/Functional/User/WatchesTest.php
new file mode 100644
index 00000000..3230f1b3
--- /dev/null
+++ b/api/tests/Functional/User/WatchesTest.php
@@ -0,0 +1,150 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional\User;
+
+use Tests\Functional\FunctionalTestCase;
+
+/**
+ * Functional tests for user plugin watch endpoints (§16).
+ *
+ * POST  /user/watchs
+ * DELETE /user/watchs/:key
+ * GET   /user/watchs
+ */
+class WatchesTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'user', 'plugin', 'user_plugin_watch',
+            'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    // -------------------------------------------------------------------------
+    // POST /user/watchs (§16.1)
+    // -------------------------------------------------------------------------
+
+    public function testAddWatchCreatesRecord(): void
+    {
+        $user   = $this->createUser();
+        $plugin = $this->createPlugin();
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugins']);
+
+        $response = self::$http->post('/user/watchs', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_key' => $plugin['key']],
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+
+        $stmt = $this->db()->prepare(
+            'SELECT COUNT(*) FROM `user_plugin_watch` WHERE user_id = ? AND plugin_id = ?'
+        );
+        $stmt->execute([$user['id'], $plugin['id']]);
+        $this->assertSame(1, (int) $stmt->fetchColumn());
+    }
+
+    public function testAddWatchForUnknownPluginReturns404(): void
+    {
+        $user  = $this->createUser();
+        $token = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugins']);
+
+        $response = self::$http->post('/user/watchs', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_key' => 'no_such_plugin'],
+        ]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    public function testAddWatchTwiceReturns400(): void
+    {
+        $user   = $this->createUser();
+        $plugin = $this->createPlugin();
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugins']);
+
+        self::$http->post('/user/watchs', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_key' => $plugin['key']],
+        ]);
+        $response = self::$http->post('/user/watchs', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_key' => $plugin['key']],
+        ]);
+
+        $this->assertSame(400, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // DELETE /user/watchs/:key (§16.2)
+    // -------------------------------------------------------------------------
+
+    public function testRemoveWatchDeletesRecord(): void
+    {
+        $user   = $this->createUser();
+        $plugin = $this->createPlugin();
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugins']);
+
+        // Watch first
+        self::$http->post('/user/watchs', [
+            'headers' => $this->bearer($token),
+            'json'    => ['plugin_key' => $plugin['key']],
+        ]);
+
+        $response = self::$http->delete('/user/watchs/' . $plugin['key'], [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(200, $response->getStatusCode());
+
+        $stmt = $this->db()->prepare(
+            'SELECT COUNT(*) FROM `user_plugin_watch` WHERE user_id = ? AND plugin_id = ?'
+        );
+        $stmt->execute([$user['id'], $plugin['id']]);
+        $this->assertSame(0, (int) $stmt->fetchColumn());
+    }
+
+    public function testRemoveNonExistingWatchReturns404(): void
+    {
+        $user   = $this->createUser();
+        $plugin = $this->createPlugin();
+        $token  = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugins']);
+
+        $response = self::$http->delete('/user/watchs/' . $plugin['key'], [
+            'headers' => $this->bearer($token),
+        ]);
+
+        $this->assertSame(404, $response->getStatusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // GET /user/watchs (§16.3)
+    // -------------------------------------------------------------------------
+
+    public function testGetWatchesReturnsPluginKeys(): void
+    {
+        $user    = $this->createUser();
+        $plugin1 = $this->createPlugin(['key' => 'watchplugin1', 'name' => 'Watch Plugin 1']);
+        $plugin2 = $this->createPlugin(['key' => 'watchplugin2', 'name' => 'Watch Plugin 2']);
+        $token   = $this->getAccessToken($user['username'], $user['plain_password'], ['user', 'plugins']);
+
+        self::$http->post('/user/watchs', ['headers' => $this->bearer($token), 'json' => ['plugin_key' => $plugin1['key']]]);
+        self::$http->post('/user/watchs', ['headers' => $this->bearer($token), 'json' => ['plugin_key' => $plugin2['key']]]);
+
+        $response = self::$http->get('/user/watchs', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertContains($plugin1['key'], $body);
+        $this->assertContains($plugin2['key'], $body);
+    }
+}
diff --git a/api/tests/Functional/VersionTest.php b/api/tests/Functional/VersionTest.php
new file mode 100644
index 00000000..f2600783
--- /dev/null
+++ b/api/tests/Functional/VersionTest.php
@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Functional;
+
+/**
+ * Functional tests for GET /version/:version/plugin (§15).
+ */
+class VersionTest extends FunctionalTestCase
+{
+    protected function setUp(): void
+    {
+        $pdo = $this->db();
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 0');
+        foreach ([
+            'plugin', 'plugin_version', 'plugin_description', 'plugin_stars',
+            'user', 'sessions', 'access_tokens', 'access_tokens_scopes',
+            'refresh_tokens', 'sessions_scopes',
+        ] as $t) {
+            $pdo->exec("TRUNCATE TABLE `{$t}`");
+        }
+        $pdo->exec('SET FOREIGN_KEY_CHECKS = 1');
+    }
+
+    private function authedToken(): string
+    {
+        $user = $this->createUser();
+        return $this->getAccessToken($user['username'], $user['plain_password'], ['version', 'plugins']);
+    }
+
+    public function testReturnsPluginsCompatibleWithVersion(): void
+    {
+        $plugin = $this->createPlugin(['key' => 'versionplug', 'name' => 'Version Plugin', 'active' => 1]);
+        $this->db()->prepare(
+            "INSERT INTO `plugin_version` (`plugin_id`, `num`, `compatibility`) VALUES (?, ?, ?)"
+        )->execute([$plugin['id'], '1.0.0', '9.5']);
+        $token = $this->authedToken();
+
+        $response = self::$http->get('/version/9.5/plugin', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertIsArray($body);
+        $keys = array_column($body, 'key');
+        $this->assertContains('versionplug', $keys);
+    }
+
+    public function testReturnsEmptyListWhenNoPluginsMatchVersion(): void
+    {
+        $token = $this->authedToken();
+
+        $response = self::$http->get('/version/0.0.1/plugin', ['headers' => $this->bearer($token)]);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertSame([], $body);
+    }
+
+    public function testDoesNotReturnPluginsForDifferentVersion(): void
+    {
+        $plugin = $this->createPlugin(['key' => 'wrongversionplug', 'name' => 'Wrong Version', 'active' => 1]);
+        $this->db()->prepare(
+            "INSERT INTO `plugin_version` (`plugin_id`, `num`, `compatibility`) VALUES (?, ?, ?)"
+        )->execute([$plugin['id'], '2.0.0', '10.0']);
+        $token = $this->authedToken();
+
+        $response = self::$http->get('/version/9.5/plugin', ['headers' => $this->bearer($token)]);
+
+        $body = json_decode((string) $response->getBody(), true);
+        $this->assertIsArray($body);
+        $keys = array_column($body, 'key');
+        $this->assertNotContains('wrongversionplug', $keys);
+    }
+}
diff --git a/api/tests/Functional/config.functional.php b/api/tests/Functional/config.functional.php
new file mode 100644
index 00000000..1288a4c5
--- /dev/null
+++ b/api/tests/Functional/config.functional.php
@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * Functional test configuration.
+ *
+ * Default credentials match the Docker development database.
+ * Override any value via environment variables (TEST_DB_HOST, TEST_DB_NAME,
+ * TEST_DB_USER, TEST_DB_PASS) for CI or alternative local setups.
+ */
+
+$config = [
+    'db_settings' => [
+        'driver'    => 'mysql',
+        'host'      => getenv('TEST_DB_HOST') ?: 'localhost',
+        'database'  => getenv('TEST_DB_NAME') ?: 'glpi_plugins_functional_test',
+        'username'  => getenv('TEST_DB_USER') ?: 'glpi',
+        'password'  => getenv('TEST_DB_PASS') ?: 'glpi',
+        'charset'   => 'utf8',
+        'collation' => 'utf8_general_ci',
+        'prefix'    => '',
+        'strict'    => false,
+    ],
+    'log_queries'                          => false,
+    'default_number_of_models_per_page'    => 15,
+    'recaptcha_secret'                     => 'test_recaptcha_secret',
+    'client_url'                           => 'http://localhost',
+    'api_url'                              => 'http://localhost/api',
+    'plugin_max_consecutive_xml_fetch_fails' => 4,
+    'glpi_plugin_directory_user_agent'     => 'GlpiPluginDirectory/test',
+    'msg_alerts' => [
+        'transport'      => 'mail',
+        'local_admins'   => ['admin@example.com' => 'Admin'],
+        'from'           => ['noreply@example.com' => 'GLPi Plugins Test'],
+        'subject_prefix' => '[TEST]',
+    ],
+    'oauth' => [
+        'github' => ['clientId' => 'test_id', 'clientSecret' => 'test_secret'],
+    ],
+];
diff --git a/api/tests/Functional/schema.sql b/api/tests/Functional/schema.sql
new file mode 100644
index 00000000..c45fed62
--- /dev/null
+++ b/api/tests/Functional/schema.sql
@@ -0,0 +1,246 @@
+-- Functional test schema
+-- All tables use CREATE TABLE IF NOT EXISTS so re-runs are safe.
+
+CREATE TABLE IF NOT EXISTS `apps` (
+  `id`           varchar(20)  NOT NULL,
+  `name`         varchar(255) NOT NULL,
+  `secret`       varchar(255) NOT NULL DEFAULT '',
+  `redirect_uri` varchar(255) DEFAULT NULL,
+  `description`  text         DEFAULT NULL,
+  `user_id`      int(11)      DEFAULT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `scopes` (
+  `id`          int(11)      NOT NULL AUTO_INCREMENT,
+  `identifier`  varchar(100) NOT NULL,
+  `description` text         DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `identifier` (`identifier`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `user` (
+  `id`        int(11)      NOT NULL AUTO_INCREMENT,
+  `username`  varchar(255) NOT NULL,
+  `email`     varchar(255) NOT NULL,
+  `password`  varchar(255) DEFAULT NULL,
+  `realname`  varchar(255) DEFAULT NULL,
+  `location`  varchar(255) DEFAULT NULL,
+  `website`   varchar(255) DEFAULT NULL,
+  `active`    tinyint(1)   NOT NULL DEFAULT 0,
+  `author_id` int(11)      DEFAULT NULL,
+  `gravatar`  varchar(32)  DEFAULT NULL,
+  `created_at` datetime    DEFAULT NULL,
+  `updated_at` datetime    DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `username` (`username`),
+  UNIQUE KEY `email` (`email`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `sessions` (
+  `id`         int(11)     NOT NULL AUTO_INCREMENT,
+  `owner_type` varchar(50) DEFAULT NULL,
+  `owner_id`   int(11)     DEFAULT NULL,
+  `app_id`     varchar(20) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `access_tokens` (
+  `id`          int(11)      NOT NULL AUTO_INCREMENT,
+  `token`       varchar(255) NOT NULL,
+  `session_id`  int(11)      NOT NULL,
+  `expire_time` int(11)      NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `token` (`token`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `access_tokens_scopes` (
+  `access_token_id` int(11) NOT NULL,
+  `scope_id`        int(11) NOT NULL,
+  PRIMARY KEY (`access_token_id`, `scope_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `refresh_tokens` (
+  `id`              int(11)      NOT NULL AUTO_INCREMENT,
+  `token`           varchar(255) NOT NULL,
+  `access_token_id` int(11)      NOT NULL,
+  `expire_time`     int(11)      NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `token` (`token`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `sessions_scopes` (
+  `session_id` int(11) NOT NULL,
+  `scope_id`   int(11) NOT NULL,
+  PRIMARY KEY (`session_id`, `scope_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `user_validation_token` (
+  `id`      int(11)      NOT NULL AUTO_INCREMENT,
+  `token`   varchar(255) NOT NULL,
+  `user_id` int(11)      NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `token` (`token`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `user_resetpassword_token` (
+  `id`      int(11)      NOT NULL AUTO_INCREMENT,
+  `token`   varchar(255) NOT NULL,
+  `user_id` int(11)      NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `user_external_account` (
+  `id`               int(11)      NOT NULL AUTO_INCREMENT,
+  `user_id`          int(11)      NOT NULL,
+  `service`          varchar(50)  NOT NULL,
+  `external_user_id` varchar(255) NOT NULL,
+  `token`            varchar(255) DEFAULT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `author` (
+  `id`       int(11)      NOT NULL AUTO_INCREMENT,
+  `name`     varchar(255) NOT NULL,
+  `username` varchar(255) DEFAULT NULL,
+  `gravatar` varchar(32)  DEFAULT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin` (
+  `id`             int(11)      NOT NULL AUTO_INCREMENT,
+  `name`           varchar(255) NOT NULL,
+  `key`            varchar(50)  NOT NULL,
+  `logo_url`       varchar(255) DEFAULT NULL,
+  `xml_url`        varchar(255) DEFAULT NULL,
+  `homepage_url`   varchar(255) DEFAULT NULL,
+  `download_url`   varchar(255) DEFAULT NULL,
+  `issues_url`     varchar(255) DEFAULT NULL,
+  `readme_url`     varchar(255) DEFAULT NULL,
+  `changelog_url`  varchar(255) DEFAULT NULL,
+  `license`        varchar(50)  DEFAULT NULL,
+  `date_added`     datetime     DEFAULT NULL,
+  `date_updated`   datetime     DEFAULT NULL,
+  `download_count` int(11)      NOT NULL DEFAULT 0,
+  `xml_state`      varchar(50)  DEFAULT NULL,
+  `active`         tinyint(1)   NOT NULL DEFAULT 0,
+  `note`           float        DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `key` (`key`),
+  KEY `active` (`active`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_author` (
+  `plugin_id` int(11) NOT NULL,
+  `author_id` int(11) NOT NULL,
+  PRIMARY KEY (`plugin_id`, `author_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_permission` (
+  `plugin_id`               int(11)    NOT NULL,
+  `user_id`                 int(11)    NOT NULL,
+  `admin`                   tinyint(1) NOT NULL DEFAULT 0,
+  `allowed_refresh_xml`     tinyint(1) NOT NULL DEFAULT 0,
+  `allowed_change_xml_url`  tinyint(1) NOT NULL DEFAULT 0,
+  `allowed_notifications`   tinyint(1) NOT NULL DEFAULT 0,
+  PRIMARY KEY (`plugin_id`, `user_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_description` (
+  `id`                int(11) NOT NULL AUTO_INCREMENT,
+  `plugin_id`         int(11) NOT NULL,
+  `lang`              varchar(10) NOT NULL,
+  `short_description` text DEFAULT NULL,
+  `long_description`  text DEFAULT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_version` (
+  `id`           int(11)      NOT NULL AUTO_INCREMENT,
+  `plugin_id`    int(11)      NOT NULL,
+  `num`          varchar(50)  NOT NULL,
+  `compatibility` varchar(50) NOT NULL,
+  `download_url` varchar(255) DEFAULT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_download` (
+  `id`            int(11)  NOT NULL AUTO_INCREMENT,
+  `plugin_id`     int(11)  NOT NULL,
+  `downloaded_at` datetime NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_screenshot` (
+  `id`        int(11)      NOT NULL AUTO_INCREMENT,
+  `plugin_id` int(11)      NOT NULL,
+  `url`       varchar(255) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_stars` (
+  `id`        int(11)  NOT NULL AUTO_INCREMENT,
+  `plugin_id` int(11)  NOT NULL,
+  `note`      int(11)  NOT NULL,
+  `date`      datetime DEFAULT NULL,
+  `user_id`   int(11)  DEFAULT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_xml_fetch_fails` (
+  `plugin_id` int(11) NOT NULL,
+  `n`         int(11) NOT NULL DEFAULT 0,
+  PRIMARY KEY (`plugin_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_lang` (
+  `id`   int(11)     NOT NULL AUTO_INCREMENT,
+  `lang` varchar(10) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_plugin_lang` (
+  `plugin_id`      int(11) NOT NULL,
+  `plugin_lang_id` int(11) NOT NULL,
+  PRIMARY KEY (`plugin_id`, `plugin_lang_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `tag` (
+  `id`   int(11)      NOT NULL AUTO_INCREMENT,
+  `key`  varchar(100) NOT NULL,
+  `lang` varchar(10)  NOT NULL,
+  `tag`  varchar(255) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `plugin_tags` (
+  `plugin_id` int(11) NOT NULL,
+  `tag_id`    int(11) NOT NULL,
+  PRIMARY KEY (`plugin_id`, `tag_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `user_plugin_watch` (
+  `id`        int(11) NOT NULL AUTO_INCREMENT,
+  `user_id`   int(11) NOT NULL,
+  `plugin_id` int(11) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `auth_codes` (
+  `id`           int(11)      NOT NULL AUTO_INCREMENT,
+  `code`         varchar(255) NOT NULL,
+  `session_id`   int(11)      NOT NULL,
+  `expire_time`  int(11)      NOT NULL,
+  `redirect_uri` varchar(255) DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `code` (`code`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `message` (
+  `id`      int(11)      NOT NULL AUTO_INCREMENT,
+  `name`    varchar(255) DEFAULT NULL,
+  `email`   varchar(255) DEFAULT NULL,
+  `subject` varchar(255) DEFAULT NULL,
+  `message` text         DEFAULT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
diff --git a/api/tests/Functional/seeds.sql b/api/tests/Functional/seeds.sql
new file mode 100644
index 00000000..78f55dea
--- /dev/null
+++ b/api/tests/Functional/seeds.sql
@@ -0,0 +1,23 @@
+-- Built-in OAuth clients (webapp / glpidefault use empty secret)
+INSERT INTO `apps` (`id`, `name`, `secret`) VALUES
+  ('webapp',      'Web App',      ''),
+  ('glpidefault', 'GLPI Default', '');
+
+-- All API scopes
+INSERT INTO `scopes` (`identifier`, `description`) VALUES
+  ('plugins',              'Browse plugin list'),
+  ('plugins:search',       'Search plugins'),
+  ('plugin:card',          'Read single plugin details'),
+  ('plugin:star',          'Rate a plugin'),
+  ('plugin:submit',        'Submit a new plugin'),
+  ('plugin:download',      'Download a plugin'),
+  ('tags',                 'Browse tag list'),
+  ('tag',                  'Read single tag'),
+  ('authors',              'Browse author list'),
+  ('author',               'Read single author'),
+  ('version',              'Filter by GLPI version'),
+  ('user',                 'Read/edit own profile'),
+  ('user:apps',            'Manage own API apps'),
+  ('user:externalaccounts','Manage linked OAuth accounts'),
+  ('users:search',         'Search users'),
+  ('message',              'Send contact message');
diff --git a/api/tests/bootstrap.php b/api/tests/bootstrap.php
new file mode 100644
index 00000000..b5a92512
--- /dev/null
+++ b/api/tests/bootstrap.php
@@ -0,0 +1,152 @@
+<?php
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../vendor/autoload.php';
+
+// Provide a default config so Tool::getConfig() never loads the real config.php
+API\Core\Tool::$config = [
+    'default_number_of_models_per_page' => 15,
+    'recaptcha_secret'                  => 'test_recaptcha_secret',
+    'client_url'                        => 'http://localhost',
+    'api_url'                           => 'http://localhost/api',
+    'msg_alerts' => [
+        'transport'    => 'mail',
+        'local_admins' => ['admin@example.com' => 'Admin'],
+        'from'         => ['noreply@example.com' => 'GLPi Plugins Test'],
+    ],
+    'oauth' => [
+        'github' => ['clientId' => 'test_id', 'clientSecret' => 'test_secret'],
+    ],
+];
+
+// ---------------------------------------------------------------------------
+// Lightweight Slim-2-compatible mock objects used by Tool and PaginatedCollection
+// ---------------------------------------------------------------------------
+
+/**
+ * Mimics Slim\Helper\Set – supports array-access reads and offsetSet writes,
+ * plus a set() method used by Tool::endWithJson().
+ */
+class MockHeadersSet implements ArrayAccess
+{
+    private array $data;
+
+    public function __construct(array $data = [])
+    {
+        $this->data = array_change_key_case($data, CASE_LOWER);
+    }
+
+    public function set(string $key, string $value): void
+    {
+        $this->data[strtolower($key)] = $value;
+    }
+
+    public function get(string $key)
+    {
+        return $this->data[strtolower($key)] ?? null;
+    }
+
+    public function offsetExists($offset): bool
+    {
+        return isset($this->data[strtolower((string) $offset)]);
+    }
+
+    public function offsetGet($offset)
+    {
+        return $this->data[strtolower((string) $offset)] ?? null;
+    }
+
+    public function offsetSet($offset, $value): void
+    {
+        $this->data[strtolower((string) $offset)] = $value;
+    }
+
+    public function offsetUnset($offset): void
+    {
+        unset($this->data[strtolower((string) $offset)]);
+    }
+
+    public function all(): array
+    {
+        return $this->data;
+    }
+}
+
+class MockSlimRequest
+{
+    public MockHeadersSet $headers;
+    private string $body;
+    private string $method;
+    private string $uri;
+
+    public function __construct(array $headers = [], string $body = '', string $method = 'GET', string $uri = '/')
+    {
+        $this->headers = new MockHeadersSet($headers);
+        $this->body    = $body;
+        $this->method  = $method;
+        $this->uri     = $uri;
+    }
+
+    public function getBody(): string
+    {
+        return $this->body;
+    }
+
+    public function getResourceUri(): string
+    {
+        return $this->uri;
+    }
+
+    public function getMethod(): string
+    {
+        return $this->method;
+    }
+}
+
+class MockSlimResponse
+{
+    public MockHeadersSet $headers;
+    private int $statusCode = 200;
+
+    public function __construct()
+    {
+        $this->headers = new MockHeadersSet();
+    }
+
+    public function status(int $code): void
+    {
+        $this->statusCode = $code;
+    }
+
+    public function getStatus(): int
+    {
+        return $this->statusCode;
+    }
+}
+
+/**
+ * Drop-in replacement for the global $app in unit tests.
+ * halt() stores arguments and throws Slim\Exception\Stop so makeEndpoint()
+ * behaves correctly (it swallows Stop silently).
+ */
+class MockSlimApp
+{
+    public MockSlimRequest  $request;
+    public MockSlimResponse $response;
+
+    /** Set by halt(); null if halt() was never called. */
+    public ?array $halted = null;
+
+    public function __construct(array $requestHeaders = [], string $requestBody = '')
+    {
+        $this->request  = new MockSlimRequest($requestHeaders, $requestBody);
+        $this->response = new MockSlimResponse();
+    }
+
+    public function halt(int $code, string $body = '')
+    {
+        $this->halted = [$code, $body];
+        throw new \Slim\Exception\Stop();
+    }
+}
diff --git a/docker-compose.e2e.yml b/docker-compose.e2e.yml
new file mode 100644
index 00000000..639547c4
--- /dev/null
+++ b/docker-compose.e2e.yml
@@ -0,0 +1,58 @@
+# E2E test stack: Apache/PHP 7.4 API + AngularJS frontend + MySQL 8.0
+#
+# Usage:
+#   docker compose -f docker-compose.e2e.yml up -d
+#   cd frontend/e2e && npm install && npx playwright install chromium
+#   E2E_BASE_URL=http://localhost:4200 npx playwright test
+
+services:
+
+  mysql:
+    image: mysql:8.0
+    environment:
+      MYSQL_ROOT_PASSWORD: root
+      MYSQL_DATABASE: glpi_plugins_e2e
+      MYSQL_USER: e2euser
+      MYSQL_PASSWORD: e2epass
+    volumes:
+      - ./api/tests/Functional/schema.sql:/docker-entrypoint-initdb.d/01-schema.sql
+      - ./api/tests/E2E/seeds.sql:/docker-entrypoint-initdb.d/02-seeds.sql
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  api:
+    # Reuses the same Apache/PHP 7.4 image as the functional test stack
+    build:
+      context: .
+      dockerfile: .docker/test/api/Dockerfile
+    ports:
+      - "8099:80"
+    volumes:
+      - ./api:/var/www/api
+    environment:
+      APP_CONFIG_FILE: /var/www/api/config.e2e.php
+      TEST_DB_HOST: mysql
+      TEST_DB_NAME: glpi_plugins_e2e
+      TEST_DB_USER: e2euser
+      TEST_DB_PASS: e2epass
+    depends_on:
+      mysql:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-s", "-o", "/dev/null", "http://localhost/api/plugin"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  frontend:
+    build:
+      context: .
+      dockerfile: .docker/e2e/frontend/Dockerfile
+    ports:
+      - "4200:80"
+    depends_on:
+      api:
+        condition: service_healthy
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
new file mode 100644
index 00000000..fa0a6371
--- /dev/null
+++ b/docker-compose.test.yml
@@ -0,0 +1,61 @@
+# Functional test stack: Apache/PHP 7.4 + MySQL 8.0
+# Mirrors the production Apache setup — no PHP CLI server quirks.
+#
+# Usage (local or CI):
+#   docker compose -f docker-compose.test.yml run --rm phpunit
+
+services:
+
+  mysql:
+    image: mysql:8.0
+    environment:
+      MYSQL_ROOT_PASSWORD: root
+      MYSQL_DATABASE: glpi_plugins_functional_test
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  api:
+    build:
+      context: .
+      dockerfile: .docker/test/api/Dockerfile
+    volumes:
+      - ./api:/var/www/api
+    environment:
+      APP_CONFIG_FILE: /var/www/api/tests/Functional/config.functional.php
+      TEST_DB_HOST: mysql
+      TEST_DB_NAME: glpi_plugins_functional_test
+      TEST_DB_USER: root
+      TEST_DB_PASS: root
+    depends_on:
+      mysql:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost/"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  phpunit:
+    build:
+      context: .
+      dockerfile: .docker/test/Dockerfile
+    volumes:
+      - ./api:/app
+    working_dir: /app
+    depends_on:
+      api:
+        condition: service_healthy
+      mysql:
+        condition: service_healthy
+    environment:
+      TEST_DB_HOST: mysql
+      TEST_DB_NAME: glpi_plugins_functional_test
+      TEST_DB_USER: root
+      TEST_DB_PASS: root
+      TEST_API_URL: http://api/
+    command: >
+      sh -c "composer install --no-interaction --prefer-dist --ignore-platform-reqs &&
+             vendor/bin/phpunit --configuration phpunit.xml --testsuite Functional"
diff --git a/frontend/app/views/featured.html b/frontend/app/views/featured.html
index 698c9fb4..38ce3a7f 100644
--- a/frontend/app/views/featured.html
+++ b/frontend/app/views/featured.html
@@ -7,7 +7,7 @@
          </md-subheader>
          <span class='legend' translate="TRENDING_SUB"></span>
          <md-list-item ng-repeat="plugin in trending">
-            <md-button ui-sref="plugin({key: plugin.key})">
+            <md-button ui-sref="plugin({key: plugin.key})" data-testid="trending-plugin-item">
                <h4>{{plugin.name}}</h4>
                <md-tooltip md-direction="right">
                   <span translate="DOWNLOADED_N_TIMES" translate-value-n="{{plugin.download_count}}"></span>
@@ -27,7 +27,7 @@ <h4>{{plugin.name}}</h4>
          </md-subheader>
          <span class="legend" translate="NEW_SUB"></span>
          <md-list-item ng-repeat="plugin in new">
-            <md-button ui-sref="plugin({key: plugin.key})">
+            <md-button ui-sref="plugin({key: plugin.key})" data-testid="new-plugin-item">
                <h4>{{plugin.name}}</h4>
                <md-tooltip md-direction="right">
                   <span translate="ADDED_ON_DATE" translate-value-date="{{plugin.date_added}}"></span>
@@ -44,7 +44,7 @@ <h4>{{plugin.name}}</h4>
          </md-subheader>
          <span class='legend' translate="POPULAR_SUB"></span>
          <md-list-item ng-repeat="plugin in popular">
-            <md-button ui-sref="plugin({key: plugin.key})">
+            <md-button ui-sref="plugin({key: plugin.key})" data-testid="popular-plugin-item">
                <h4>{{plugin.name}}</h4>
                <md-tooltip md-direction="right">
                   <span translate="DOWNLOADED_N_TIMES" translate-value-n="{{plugin.download_count}}"></span>
@@ -64,7 +64,7 @@ <h4>{{plugin.name}}</h4>
          </md-subheader>
          <span class='legend' translate="UPDATED_SUB"></span>
          <md-list-item ng-repeat="plugin in updated">
-            <md-button ui-sref="plugin({key: plugin.key})">
+            <md-button ui-sref="plugin({key: plugin.key})" data-testid="updated-plugin-item">
                <h4>{{plugin.name}}</h4>
                <md-tooltip md-direction="right">
                   <span translate="UPDATED_MOMENTS_AGO" translate-value-momentsago="{{fromNow(plugin.date_updated)}}"></span>
diff --git a/frontend/app/views/panel.html b/frontend/app/views/panel.html
index 336a62f2..692f9f09 100644
--- a/frontend/app/views/panel.html
+++ b/frontend/app/views/panel.html
@@ -86,7 +86,7 @@ <h2 translate="PANEL_MY_PLUGINS"></h2>
 
       <md-list>
          <md-list-item ng-repeat="plugin in plugins" layout="column">
-            <h4 class="plugin-name" ui-sref="pluginpanel({key: plugin.key})" eat-click-if="!plugin.pivot.admin && !plugin.pivot.allowed_refresh_xml && !plugin.pivot.allowed_change_xml_url" ng-class="(!plugin.pivot.admin && !plugin.pivot.allowed_refresh_xml && !plugin.pivot.allowed_change_xml_url) ? 'not-admin-of' : ''" ui-sref="pluginpanel({key: plugin.key})">{{plugin.name}}</h4>
+            <h4 class="plugin-name" data-testid="panel-plugin-name" ui-sref="pluginpanel({key: plugin.key})" eat-click-if="!plugin.pivot.admin && !plugin.pivot.allowed_refresh_xml && !plugin.pivot.allowed_change_xml_url" ng-class="(!plugin.pivot.admin && !plugin.pivot.allowed_refresh_xml && !plugin.pivot.allowed_change_xml_url) ? 'not-admin-of' : ''" ui-sref="pluginpanel({key: plugin.key})">{{plugin.name}}</h4>
             <div class="buttons">
                <md-button ng-show="!plugin.pivot.admin" ng-click="openDeleteRelationToPlugin(plugin)">
                   <i class="fa fa-user-times"></i>
diff --git a/frontend/app/views/plugin.html b/frontend/app/views/plugin.html
index ff26ee60..844fa355 100644
--- a/frontend/app/views/plugin.html
+++ b/frontend/app/views/plugin.html
@@ -3,15 +3,15 @@
       <div layout="row" layout-wrap layout-align="start start">
          <img class="icon" src="{{plugin.logo_url}}" />
          <div class='plugin_name' flex-sm="45">
-            <h2>{{plugin.name}}</h2>
-            <h4 class="inline-authors">
+            <h2 data-testid="plugin-name">{{plugin.name}}</h2>
+            <h4 class="inline-authors" data-testid="plugin-authors">
                <span translate="BY"></span>
                <span inline-authors="plugin.authors"></span>
             </h4>
          </div>
          <div flex-sm="45" layout="row" layout-sm="column" layout-align="end end">
             <div class='pills'>
-               <span ng-repeat="version in (unique_versions = (plugin.versions | unique: 'compatibility') | subpart:3)" class="pill bg_lightblue" ui-sref="version({version: version.compatibility})">{{version.compatibility}}</span>
+               <span ng-repeat="version in (unique_versions = (plugin.versions | unique: 'compatibility') | subpart:3)" class="pill bg_lightblue" data-testid="version-badge" ui-sref="version({version: version.compatibility})">{{version.compatibility}}</span>
                <span ng-show="unique_versions.length > 3">
                   ...
                   <md-tooltip class="versions_more">
@@ -41,7 +41,7 @@ <h4 class="inline-authors">
                   {{'DOWNLOAD'|translate}}
                </md-tooltip>
             </md-button>
-            <md-button ng-show="authed" class="md-fab md-primary md-raised watch-button" ng-click="watch()">
+            <md-button ng-show="authed" class="md-fab md-primary md-raised watch-button" ng-click="watch()" data-testid="watch-button">
                <i class="fa fa-2x white" ng-class="plugin.watched ? 'fa-eye-slash' : 'fa-eye'"></i>
                <md-tooltip md-direction="top">
                   <span ng-show="plugin.watched" translate="PLUGIN_UNWATCH"></span>
@@ -61,7 +61,7 @@ <h4 class="inline-authors">
          <md-tabs md-dynamic-height md-selected="selectedIndex">
             <md-tab ng-repeat="description in plugin.descriptions" label="{{description.lang}}">
                <md-content class="md-padding description">
-                  <div btf-markdown="description.long_description" class="markdown"></div>
+                  <div btf-markdown="description.long_description" class="markdown" data-testid="plugin-description"></div>
                </md-content>
             </md-tab>
          </md-tabs>
diff --git a/frontend/app/views/plugin_list.html b/frontend/app/views/plugin_list.html
index 3ffa5647..a96fe6a3 100644
--- a/frontend/app/views/plugin_list.html
+++ b/frontend/app/views/plugin_list.html
@@ -24,7 +24,7 @@
             <img class="icon" ng-src="{{plugin.logo_url}}" />
             <div class='plugin_name' flex='45' flex-sm='30' >
                <h2 class="name">
-                  <a ui-sref="plugin({id: plugin.id, key: plugin.key})">{{plugin.name}}</a>
+                  <a ui-sref="plugin({id: plugin.id, key: plugin.key})" data-testid="search-result-name">{{plugin.name}}</a>
                </h2>
                <h4 class="inline-authors">
                   <span translate="BY"></span>
diff --git a/frontend/app/views/pluginpanel.html b/frontend/app/views/pluginpanel.html
index 3104f11a..9e79a508 100644
--- a/frontend/app/views/pluginpanel.html
+++ b/frontend/app/views/pluginpanel.html
@@ -1,6 +1,6 @@
 <div layout="column" class="pluginpanel">
    <div class="pluginpanel-header">
-      <h2 class="plugin-name">{{plugin.card.name}}</h2>
+      <h2 class="plugin-name" data-testid="plugin-panel-header-name">{{plugin.card.name}}</h2>
       <h2 class="panel-title" translate="PLUGIN_PANEL"></h2>
    </div>
 
@@ -50,7 +50,7 @@ <h3 translate="PLUGIN_PANEL_SUMMARY"></h3>
          <h3 translate="PLUGIN_PANEL_SETTINGS"></h3>
          <md-input-container>
             <label translate="PLUGIN_PANEL_XML_URL"></label>
-            <input type="text" ng-model="plugin.card.xml_url">
+            <input type="text" ng-model="plugin.card.xml_url" data-testid="plugin-xml-url-input">
          </md-input-container>
       </div>
 
@@ -73,7 +73,7 @@ <h3 translate="PLUGIN_PANEL_ACTIONS"></h3>
          </md-list>
       </div>
 
-      <md-content class="xml-errors">
+      <md-content class="xml-errors" data-testid="xml-errors">
          <md-list>
             <md-list-item ng-repeat="error in xml_errors" layout="column">
                <div class="reason">
diff --git a/frontend/app/views/signin.html b/frontend/app/views/signin.html
index 34f765d0..ee6a0716 100644
--- a/frontend/app/views/signin.html
+++ b/frontend/app/views/signin.html
@@ -5,18 +5,18 @@ <h2 translate="SIGNIN_PAGE_TITLE"></h2>
       <form ng-submit="ctrl.loginAttempt()">
          <md-input-container>
             <label translate="SIGNIN_USERNAME_OR_EMAIL"></label>
-            <input type="text" ng-model="login">
+            <input type="text" ng-model="login" data-testid="signin-username-input">
          </md-input-container>
 
          <md-input-container>
             <label translate="SIGNIN_PASSWORD"></label>
-            <input type="password" ng-model="password">
+            <input type="password" ng-model="password" data-testid="signin-password-input">
             <a aria-label="I forgot my password" ng-click="ctrl.iForgotMyPassword($event)" class="i-forgot-my-password">I forgot my password</a>
          </md-input-container>
 
          <div vc-recaptcha theme="light" key="key" on-create="setWidgetId(widgetId)" on-success="setResponse(response)" on-expire="cbExpiration()"></div>
 
-         <md-button class="md-raised md-primary" type="submit" translate="SIGNIN_LOGIN"></md-button>
+         <md-button class="md-raised md-primary" type="submit" translate="SIGNIN_LOGIN" data-testid="signin-submit-button"></md-button>
       </form>
 
 
diff --git a/frontend/app/views/signup.html b/frontend/app/views/signup.html
index c01a44c1..d159ab3a 100644
--- a/frontend/app/views/signup.html
+++ b/frontend/app/views/signup.html
@@ -5,7 +5,7 @@ <h2 translate="SIGNUP_REGISTER_MANUALLY"></h2>
       <form id="signup-form">
          <md-input-container>
             <label translate="SIGNUP_USERNAME"></label>
-            <input ng-model="user.username" type="text">
+            <input ng-model="user.username" type="text" data-testid="signup-username-input">
             <div ng-messages="form_errors.username">
                <div ng-message="required">{{'FIELD_REQUIRED'|translate}}</div>
                <div ng-message="tooshort">{{'SIGNUP_USERNAME_TOOSHORT'|translate:'{n: 4}'}}</div>
@@ -23,7 +23,7 @@ <h2 translate="SIGNUP_REGISTER_MANUALLY"></h2>
          </md-input-container>
          <md-input-container>
             <label>{{'SIGNUP_EMAIL'|translate}}</label>
-            <input ng-model="user.email" type="text">
+            <input ng-model="user.email" type="text" data-testid="signup-email-input">
             <div ng-messages="form_errors.email">
                <div ng-message="required">{{'FIELD_REQUIRED'|translate}}</div>
                <div ng-message="invalid">{{'SIGNUP_EMAIL_INVALID'|translate}}</div>
@@ -31,14 +31,14 @@ <h2 translate="SIGNUP_REGISTER_MANUALLY"></h2>
          </md-input-container>
          <md-input-container>
             <label translate="SIGNUP_WEBSITE"></label>
-            <input ng-model="user.website" type="text">
+            <input ng-model="user.website" type="text" data-testid="signup-website-input">
             <div ng-messages="form_errors.website">
                <div ng-message="invalid">{{'SIGNUP_WEBSITE_INVALID'|translate}}</div>
             </div>
          </md-input-container>
          <md-input-container>
             <label translate="SIGNUP_PASSWORD"></label>
-            <input ng-model="password" type="password">
+            <input ng-model="password" type="password" data-testid="signup-password-input">
             <div ng-messages="form_errors.password">
                <div ng-message="required">{{'FIELD_REQUIRED'|translate}}</div>
                <div ng-message="different">{{'SIGNUP_PASSWORD_DIFFERENT'|translate}}</div>
@@ -48,7 +48,7 @@ <h2 translate="SIGNUP_REGISTER_MANUALLY"></h2>
          </md-input-container>
          <md-input-container>
             <label translate="SIGNUP_CONFIRM_PASSWORD"></label>
-            <input ng-model="password_repeat" type="password">
+            <input ng-model="password_repeat" type="password" data-testid="signup-confirm-password-input">
          </md-input-container>
          <md-button class="md-raised md-primary" ng-click="signUp()" id="signup-button">Sign-Up !</md-button>
       </form>
diff --git a/frontend/e2e/auth.spec.js b/frontend/e2e/auth.spec.js
new file mode 100644
index 00000000..f4955408
--- /dev/null
+++ b/frontend/e2e/auth.spec.js
@@ -0,0 +1,77 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+const { waitForAppReady } = require('./helpers');
+
+test.describe('F4 — Authentication', () => {
+  test('sign up: submitting the form shows a confirmation toast', async ({ page }) => {
+    const uniqueSuffix = `${Date.now()}${Math.floor(Math.random() * 10000)}`;
+    const username = `newuser${uniqueSuffix}`;
+    const email = `${username}@example.com`;
+
+    await page.goto('/#/signup');
+    await waitForAppReady(page);
+
+    await page.locator('[data-testid="signup-username-input"]').fill(username);
+    await page.locator('[data-testid="signup-email-input"]').fill(email);
+    await page.locator('[data-testid="signup-password-input"]').fill('Passw0rd!');
+    await page.locator('[data-testid="signup-website-input"]').fill('https://testwebsite.com');
+    await page.locator('[data-testid="signup-confirm-password-input"]').fill('Passw0rd!');
+
+    await page.getByRole('button', { name: /sign.?up/i }).click();
+
+    // On success the controller shows a toast and redirects to featured.
+    // Check for the toast before the redirect completes so it isn't dismissed.
+    await expect(page.getByText(/check your mailbox/i)).toBeVisible();
+    await expect(page).toHaveURL('/#/');
+  });
+
+  test('sign in: valid credentials log the user in', async ({ page }) => {
+    await page.goto('/#/signin');
+    await waitForAppReady(page);
+
+    await page.locator('[data-testid="signin-username-input"]').fill('testuser');
+    await page.locator('[data-testid="signin-password-input"]').fill('Password1');
+    await page.locator('[data-testid="signin-submit-button"]').click();
+
+    // Auth service shows this toast on success
+    await expect(page.getByText('You are now successfully logged in')).toBeVisible();
+  });
+
+  test('sign in: wrong password shows an error toast', async ({ page }) => {
+    await page.goto('/#/signin');
+    await waitForAppReady(page);
+
+    await page.locator('[data-testid="signin-username-input"]').fill('testuser');
+    await page.locator('[data-testid="signin-password-input"]').fill('wrongpassword');
+    await page.locator('[data-testid="signin-submit-button"]').click();
+
+    // The interceptor translates INVALID_CREDENTIALS and shows it in a toast
+    await expect(page.getByText(/wrong credentials/i)).toBeVisible();
+    // User stays on the sign-in page
+    await expect(page).toHaveURL(/#\/signin/);
+  });
+
+  test('sign out: user name disappears from the header', async ({ page }) => {
+    await page.goto('/#/signin');
+    await waitForAppReady(page);
+
+    await page.locator('[data-testid="signin-username-input"]').fill('testuser');
+    await page.locator('[data-testid="signin-password-input"]').fill('Password1');
+    await page.locator('[data-testid="signin-submit-button"]').click();
+    await expect(page.getByText('You are now successfully logged in')).toBeVisible();
+
+    // Find and click the sign-out control in the user menu
+    await page.getByText('testuser').click();
+    await page.getByText(/sign.?out|log.?out|disconnect/i).click();
+
+    await expect(page.getByText('You are now disconnected')).toBeVisible();
+  });
+
+  test('GitHub OAuth: the GitHub login button is present', async ({ page }) => {
+    await page.goto('/#/signin');
+    await waitForAppReady(page);
+
+    // The button contains a GitHub icon; test its presence only (OAuth flow is external)
+    await expect(page.locator('.fa-github').first()).toBeVisible();
+  });
+});
diff --git a/frontend/e2e/helpers.js b/frontend/e2e/helpers.js
new file mode 100644
index 00000000..014e35a6
--- /dev/null
+++ b/frontend/e2e/helpers.js
@@ -0,0 +1,72 @@
+/**
+ * Shared helpers for E2E tests.
+ *
+ * loginAs() bypasses the UI login form by obtaining a token directly from the
+ * API and injecting it into localStorage — the same keys the Auth service uses.
+ * Use the UI sign-in flow in auth.spec.js; use loginAs() everywhere else.
+ */
+
+
+/**
+ * Obtain an access token via the password grant and inject it into the page's
+ * localStorage so Angular's Auth service treats the session as authenticated.
+ *
+ * @param {import('@playwright/test').Page} page
+ * @param {string} username
+ * @param {string} password
+ */
+async function loginAs(page, username, password) {
+  const baseURL = process.env.E2E_BASE_URL || 'http://localhost:4200';
+
+  const resp = await page.request.post(`${baseURL}/api/oauth/authorize`, {
+    form: {
+      grant_type: 'password',
+      client_id:  'webapp',
+      username,
+      password,
+      scope: [
+        'plugins', 'plugins:search', 'plugin:card', 'plugin:star',
+        'plugin:download', 'tags', 'tag', 'authors', 'author', 'version',
+        'message', 'user', 'user:externalaccounts', 'user:apps',
+        'plugin:submit', 'users:search',
+      ].join(' '),
+    },
+  });
+
+  if (!resp.ok()) {
+    const body = await resp.text();
+    throw new Error(
+      `Auth request failed (${resp.status()}): ${body}`
+    );
+  }
+
+  const { access_token, refresh_token, expires_in } = await resp.json();
+
+  await page.evaluate(
+    ([token, refresh, expiresAt]) => {
+      localStorage.setItem('access_token', token);
+      localStorage.setItem('refresh_token', refresh);
+      localStorage.setItem('access_token_expires_at', expiresAt);
+      localStorage.setItem('authed', 'true');
+    },
+    [access_token, refresh_token, String(Math.floor(Date.now() / 1000) + expires_in)],
+  );
+
+  // Angular's $httpProvider.defaults.headers is set in .config() which runs
+  // only once at bootstrap. Reload so Angular re-bootstraps and picks up the
+  // token from localStorage before any test navigation occurs.
+  await page.reload();
+  await waitForAppReady(page);
+}
+
+/**
+ * Wait until the app has finished loading its initial data (no pending network
+ * requests for 500 ms). Works regardless of frontend framework.
+ *
+ * @param {import('@playwright/test').Page} page
+ */
+async function waitForAppReady(page) {
+  await page.waitForLoadState('networkidle');
+}
+
+module.exports = { loginAs, waitForAppReady };
diff --git a/frontend/e2e/homepage.spec.js b/frontend/e2e/homepage.spec.js
new file mode 100644
index 00000000..99591798
--- /dev/null
+++ b/frontend/e2e/homepage.spec.js
@@ -0,0 +1,38 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+const { waitForAppReady } = require('./helpers');
+
+test.describe('F1 — Homepage', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/');
+    await waitForAppReady(page);
+  });
+
+  test('page title identifies the site', async ({ page }) => {
+    await expect(page).toHaveTitle(/GLPi Plugins/i);
+  });
+
+  test('featured sections are visible', async ({ page }) => {
+    // The featured page shows four lists: Trending, New, Popular, Updated
+    for (const heading of ['Trending', 'New', 'Popular', 'Updated']) {
+      await expect(page.getByText(heading, { exact: true }).first()).toBeVisible();
+    }
+  });
+
+  test('each section contains at least one plugin name', async ({ page }) => {
+    // Seed contains active plugins — they should appear in each list
+    for (const testid of ['trending-plugin-item', 'new-plugin-item', 'popular-plugin-item', 'updated-plugin-item']) {
+      await expect(page.locator(`[data-testid="${testid}"]`).first()).toBeVisible();
+    }
+  });
+
+  test('clicking a plugin name navigates to the plugin detail page', async ({ page }) => {
+    const firstPlugin = page.locator('[data-testid="trending-plugin-item"]').first();
+    const name = (await firstPlugin.textContent()) ?? '';
+    await firstPlugin.click();
+    // URL changes to #/plugin/<key>
+    await expect(page).toHaveURL(/#\/plugin\//);
+    // The plugin name appears in the detail header
+    await expect(page.locator('[data-testid="plugin-name"]').filter({ hasText: name.trim() })).toBeVisible();
+  });
+});
diff --git a/frontend/e2e/package-lock.json b/frontend/e2e/package-lock.json
new file mode 100644
index 00000000..45217324
--- /dev/null
+++ b/frontend/e2e/package-lock.json
@@ -0,0 +1,79 @@
+{
+  "name": "glpi-plugins-e2e",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "glpi-plugins-e2e",
+      "devDependencies": {
+        "@playwright/test": "^1.44.0"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    }
+  }
+}
diff --git a/frontend/e2e/package.json b/frontend/e2e/package.json
new file mode 100644
index 00000000..37794887
--- /dev/null
+++ b/frontend/e2e/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "glpi-plugins-e2e",
+  "private": true,
+  "devDependencies": {
+    "@playwright/test": "^1.44.0"
+  },
+  "scripts": {
+    "test": "playwright test",
+    "test:headed": "playwright test --headed",
+    "test:ui": "playwright test --ui"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}
diff --git a/frontend/e2e/panel.spec.js b/frontend/e2e/panel.spec.js
new file mode 100644
index 00000000..5f9f8716
--- /dev/null
+++ b/frontend/e2e/panel.spec.js
@@ -0,0 +1,82 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+const { loginAs, waitForAppReady } = require('./helpers');
+
+test.describe('F5 — User Panel', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/');
+    await loginAs(page, 'testuser', 'Password1');
+    await page.goto('/#/panel');
+    await waitForAppReady(page);
+  });
+
+  test('authenticated user sees the panel', async ({ page }) => {
+    await expect(page.getByText('My informations')).toBeVisible();
+  });
+
+  test('plugin list shows the user\'s plugins', async ({ page }) => {
+    await expect(page.getByText('My plugins')).toBeVisible();
+    await expect(page.locator('[data-testid="panel-plugin-name"]').filter({ hasText: 'Fields' })).toBeVisible();
+  });
+
+  test('API keys section is reachable', async ({ page }) => {
+    await page.getByText('Manage API Keys', { exact: false }).click();
+    await waitForAppReady(page);
+    await expect(page).toHaveURL(/#\/panel\/apikeys/);
+  });
+});
+
+test.describe('F6 — Plugin Author Panel', () => {
+  const originalXmlUrl = 'http://api/tests/E2E/fixtures/fields.xml';
+  const updatedXmlUrl = 'http://api/tests/E2E/fixtures/fields-updated.xml';
+  // Note: 'http://api' relies on Docker Compose internal DNS — the PHP container
+  // reaches itself via the 'api' service hostname on the shared bridge network.
+
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/');
+    await loginAs(page, 'testuser', 'Password1');
+    await page.goto('/#/panel/plugin/fields');
+    await waitForAppReady(page);
+  });
+
+  test('plugin name is shown in the panel header', async ({ page }) => {
+    await expect(page.locator('[data-testid="plugin-panel-header-name"]')).toHaveText('Fields');
+  });
+
+  test('XML URL field is editable and persists on save', async ({ page }) => {
+    const xmlInput = page.locator('[data-testid="plugin-xml-url-input"]');
+    await xmlInput.click();
+    await xmlInput.fill(updatedXmlUrl);
+    await expect(xmlInput).toHaveValue(updatedXmlUrl);
+
+    await page.getByRole('button', { name: /save/i }).click();
+
+    // Reload and verify the new value is still there
+    await page.reload();
+    await waitForAppReady(page);
+    await expect(xmlInput).toHaveValue(updatedXmlUrl);
+  });
+
+  test.afterAll(async ({ browser }) => {
+    // Reset the XML URL to its original seed value so subsequent test runs are clean.
+    const page = await browser.newPage();
+    await page.goto('/');
+    await loginAs(page, 'testuser', 'Password1');
+    await page.goto('/#/panel/plugin/fields');
+    await waitForAppReady(page);
+    const xmlInput = page.locator('[data-testid="plugin-xml-url-input"]');
+    await xmlInput.fill(originalXmlUrl);
+    await page.getByRole('button', { name: /save/i }).click();
+    await page.close();
+  });
+
+  test('Refresh XML button is visible for admin', async ({ page }) => {
+    await expect(page.getByRole('button', { name: /refresh xml file/i })).toBeVisible();
+  });
+
+  test('Refresh XML button triggers a response', async ({ page }) => {
+    await page.getByRole('button', { name: /refresh xml file/i }).click();
+    // After refresh, xml_errors list updates (may be empty or show errors)
+    await expect(page.locator('[data-testid="xml-errors"]')).toBeVisible();
+  });
+});
diff --git a/frontend/e2e/playwright.config.js b/frontend/e2e/playwright.config.js
new file mode 100644
index 00000000..07d3a3d0
--- /dev/null
+++ b/frontend/e2e/playwright.config.js
@@ -0,0 +1,39 @@
+// @ts-check
+const { defineConfig, devices } = require('@playwright/test');
+
+const path = require('path');
+const COMPOSE_FILE = path.resolve(__dirname, '../../docker-compose.e2e.yml');
+
+module.exports = defineConfig({
+  testDir: '.',
+  testMatch: '**/*.spec.js',
+
+  // Start the Docker stack automatically if E2E_BASE_URL is not already set
+  // (i.e. not pointing at an externally managed server).
+  webServer: process.env.E2E_BASE_URL ? undefined : {
+    command: `docker compose -f ${COMPOSE_FILE} up --build`,
+    url: 'http://localhost:4200',
+    timeout: 300_000,   // frontend image build can take a few minutes
+    reuseExistingServer: true,
+    stdout: 'pipe',
+    stderr: 'pipe',
+  },
+  timeout: 30_000,
+  expect: { timeout: 8_000 },
+  fullyParallel: false,   // AngularJS SPA shares a single backend; run serially
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 1 : 0,
+  reporter: process.env.CI ? [['github'], ['html', { open: 'never' }]] : 'list',
+
+  use: {
+    baseURL: process.env.E2E_BASE_URL || 'http://localhost:4200',
+    trace: 'on-first-retry',
+    // The app uses hash-based routing (#/plugin/fields); no need for JS-aware navigation.
+    // Increase navigation timeout for the first load (Angular bootstrap + anon token fetch).
+    navigationTimeout: 15_000,
+  },
+
+  projects: [
+    { name: 'chromium', use: { ...devices['Desktop Chrome'] } },
+  ],
+});
diff --git a/frontend/e2e/plugin.spec.js b/frontend/e2e/plugin.spec.js
new file mode 100644
index 00000000..11c72b43
--- /dev/null
+++ b/frontend/e2e/plugin.spec.js
@@ -0,0 +1,47 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+const { loginAs, waitForAppReady } = require('./helpers');
+
+test.describe('F2 — Plugin detail page', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/#/plugin/fields');
+    await waitForAppReady(page);
+  });
+
+  test('plugin name is visible in the header', async ({ page }) => {
+    await expect(page.locator('[data-testid="plugin-name"]')).toHaveText('Fields');
+  });
+
+  test('author name is present', async ({ page }) => {
+    await expect(page.locator('[data-testid="plugin-authors"]').first()).toContainText('Plugin Author');
+  });
+
+  test('at least one version compatibility badge is shown', async ({ page }) => {
+    await expect(page.locator('[data-testid="version-badge"]').first()).toBeVisible();
+  });
+
+  test('description tab content is rendered', async ({ page }) => {
+    await expect(page.locator('[data-testid="plugin-description"]').first()).toBeVisible();
+  });
+
+  test('watch button is hidden when not logged in', async ({ page }) => {
+    await expect(page.locator('[data-testid="watch-button"]')).toBeHidden();
+  });
+
+  test('watch button is visible and toggles state when logged in', async ({ page }) => {
+    await loginAs(page, 'testuser', 'Password1');
+    await page.reload();
+    await waitForAppReady(page);
+
+    const watchBtn = page.locator('[data-testid="watch-button"]');
+    await expect(watchBtn).toBeVisible();
+
+    // Click to watch — icon switches from eye to eye-slash
+    await watchBtn.click();
+    await expect(watchBtn.locator('.fa-eye-slash')).toBeVisible();
+
+    // Click again to unwatch
+    await watchBtn.click();
+    await expect(watchBtn.locator('.fa-eye')).toBeVisible();
+  });
+});
diff --git a/frontend/e2e/search.spec.js b/frontend/e2e/search.spec.js
new file mode 100644
index 00000000..88d8ef4d
--- /dev/null
+++ b/frontend/e2e/search.spec.js
@@ -0,0 +1,42 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+const { waitForAppReady } = require('./helpers');
+
+test.describe('F3 — Search', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/');
+    await waitForAppReady(page);
+  });
+
+  test('typing a query shows matching results', async ({ page }) => {
+    const searchBox = page.getByLabel('Search');
+    await searchBox.fill('Fields');
+    await searchBox.press('Enter');
+
+    await waitForAppReady(page);
+    // Results list: each result has a plugin name link
+    const results = page.locator('[data-testid="search-result-name"]');
+    await expect(results.first()).toBeVisible();
+    await expect(results.first()).toContainText(/fields/i);
+  });
+
+  test('each result shows a plugin name linking to the detail page', async ({ page }) => {
+    const searchBox = page.getByLabel('Search');
+    await searchBox.fill('Fields');
+    await searchBox.press('Enter');
+
+    await waitForAppReady(page);
+    const link = page.locator('[data-testid="search-result-name"]').first();
+    await link.click();
+    await expect(page).toHaveURL(/#\/plugin\//);
+  });
+
+  test('a query with no matches shows the empty-state message', async ({ page }) => {
+    const searchBox = page.getByLabel('Search');
+    await searchBox.fill('xyznonexistentplugin');
+    await searchBox.press('Enter');
+
+    await waitForAppReady(page);
+    await expect(page.getByText('No result')).toBeVisible();
+  });
+});
diff --git a/specs/README.md b/specs/README.md
new file mode 100644
index 00000000..8a527c16
--- /dev/null
+++ b/specs/README.md
@@ -0,0 +1,47 @@
+# GLPI Plugin Directory — Modernization Specs
+
+This folder contains specifications for modernizing the GLPI Plugin Directory.
+The project consists of a **Slim 2 PHP REST API** and an **AngularJS 1 frontend**.
+
+## Modernization Roadmap
+
+| Step | Status | Description |
+|------|--------|-------------|
+| 1    | 🔄 In Progress | Add unit, functional, and E2E tests |
+| 2    | ⏳ Planned | Upgrade backend (PHP 8+, Slim 4, modern OAuth) |
+| 3    | ⏳ Planned | Migrate frontend to a modern framework (Vue 3 / React) |
+| 4    | ⏳ Planned | CI/CD pipeline, containerization |
+
+## Repository Layout
+
+```
+plugins/
+├── api/                  # Slim 2 PHP backend
+│   ├── src/
+│   │   ├── core/         # Tool, DB, Mailer, BackgroundTasks, OAuthClient
+│   │   ├── endpoints/    # Route handlers (one file per resource)
+│   │   ├── models/       # Eloquent ORM models
+│   │   ├── exceptions/   # Custom exception hierarchy
+│   │   └── oauthserver/  # OAuth2 server implementation
+│   ├── mailtemplates/    # Twig email templates
+│   └── misc/             # Background task runner scripts
+├── frontend/             # AngularJS 1 SPA
+│   ├── app/
+│   │   ├── scripts/      # Controllers, services, directives, filters
+│   │   └── views/        # HTML templates
+│   └── test/             # Existing Karma/Jasmine specs
+└── specs/                # ← You are here
+    ├── api/
+    │   └── endpoints.md  # Full API endpoint reference
+    └── testing/
+        ├── unit.md       # Unit test specifications
+        ├── functional.md # Functional/integration test specifications
+        └── e2e.md        # End-to-end test specifications
+```
+
+## Specs Index
+
+- [API Endpoint Reference](api/endpoints.md)
+- [Unit Test Specifications](testing/unit.md)
+- [Functional Test Specifications](testing/functional.md)
+- [E2E Test Specifications](testing/e2e.md)
diff --git a/specs/api/endpoints.md b/specs/api/endpoints.md
new file mode 100644
index 00000000..f9ee7119
--- /dev/null
+++ b/specs/api/endpoints.md
@@ -0,0 +1,1033 @@
+# API Endpoint Reference
+
+Base URL: `https://<host>/api`
+
+## Authentication
+
+All authenticated endpoints require a Bearer token in the `Authorization` header:
+
+```
+Authorization: Bearer <access_token>
+```
+
+Tokens are issued by `POST /oauth/authorize` using one of three OAuth2 grant types:
+- `password` — user login (username/password)
+- `client_credentials` — API app key
+- `refresh_token` — token renewal
+
+### Scopes
+
+| Scope | Description |
+|-------|-------------|
+| `plugins` | Browse plugin list |
+| `plugins:search` | Search plugins |
+| `plugin:card` | Read single plugin details |
+| `plugin:star` | Rate a plugin |
+| `plugin:submit` | Submit a new plugin |
+| `plugin:download` | Download a plugin |
+| `tags` | Browse tag list |
+| `tag` | Read single tag |
+| `authors` | Browse author list |
+| `author` | Read single author |
+| `version` | Filter by GLPI version |
+| `user` | Read/edit own profile |
+| `user:apps` | Manage own API apps |
+| `user:externalaccounts` | Manage linked OAuth accounts |
+| `users:search` | Search users |
+| `message` | Send contact message |
+
+### Pagination
+
+Paginated endpoints support range-based pagination via HTTP headers:
+
+**Request header:**
+```
+x-range: 0-14
+```
+
+**Response headers:**
+```
+accept-range: model 100
+content-range: 0-14/100
+```
+
+HTTP status `206 Partial Content` is returned for partial results, `200 OK` for the complete set.
+
+Default page size: **15 items**.
+
+### Language
+
+Include the `x-lang` header to get localized plugin descriptions:
+
+```
+x-lang: fr
+```
+
+Supported values: `en`, `fr`, `es`. Any other value falls back to `en`.
+
+---
+
+## OAuth & Authorization
+
+### `POST /oauth/authorize`
+
+Issue an access token.
+
+**No auth required.**
+
+**Request body (password grant):**
+```json
+{
+  "grant_type": "password",
+  "username": "john",
+  "password": "secret",
+  "client_id": "<app_client_id>",
+  "client_secret": "<app_secret>"
+}
+```
+
+**Request body (refresh_token grant):**
+```json
+{
+  "grant_type": "refresh_token",
+  "refresh_token": "<token>",
+  "client_id": "<app_client_id>",
+  "client_secret": "<app_secret>"
+}
+```
+
+**Request body (client_credentials grant):**
+```json
+{
+  "grant_type": "client_credentials",
+  "client_id": "<app_client_id>",
+  "client_secret": "<app_secret>"
+}
+```
+
+**Response `200`:**
+```json
+{
+  "access_token": "...",
+  "refresh_token": "...",
+  "expires_in": 3600,
+  "token_type": "Bearer"
+}
+```
+
+---
+
+### `GET /oauth/associate/:service`
+
+OAuth2 callback from an external provider (currently: `github`). Handles three flows:
+
+1. **New user** — creates a GLPI account from external account info, returns tokens
+2. **Link account** — links external account to the currently authenticated user (pass `access_token` via cookie)
+3. **Returning user** — logs in and returns tokens if external account is already linked
+
+**No auth required.** Returns an HTML page that posts a `window.postMessage` with the result.
+
+**Path parameter:** `service` = `github`
+
+**Response data (in postMessage payload):**
+```json
+{
+  "access_token": "...",
+  "refresh_token": "...",
+  "access_token_expires_in": 3600,
+  "account_created": true,
+  "external_account_linked": true
+}
+```
+
+---
+
+### `GET /oauth/available_emails`
+
+Returns all email addresses available through the user's linked external accounts.
+
+**Scopes required:** `user`
+
+**Response `200`:**
+```json
+[
+  { "email": "user@example.com", "service": "github" }
+]
+```
+
+---
+
+## Users
+
+### `POST /user`
+
+Register a new account. Sends a confirmation email to the provided address.
+
+**No auth required.**
+
+**Request body:**
+```json
+{
+  "username": "john",
+  "email": "john@example.com",
+  "password": "secret123",
+  "realname": "John Doe",
+  "location": "Paris",
+  "website": "https://example.com"
+}
+```
+
+| Field | Required | Validation |
+|-------|----------|------------|
+| `username` | Yes | 4–28 chars, alphanumeric only |
+| `email` | Yes | Valid email format, unique |
+| `password` | Yes | Must pass `User::isValidPassword()` |
+| `realname` | No | 4+ chars, alphanumeric + spaces |
+| `location` | No | Non-empty string |
+| `website` | No | Valid URL |
+
+**Response `200`:** empty body (email sent)
+
+**Errors:**
+- `400 InvalidField` — invalid username/email/password format
+- `400 UnavailableName` — username or email already taken
+
+---
+
+### `GET /user`
+
+Get the current authenticated user's profile.
+
+**Scopes required:** `user`
+
+**Response `200`:**
+```json
+{
+  "id": 1,
+  "username": "john",
+  "email": "john@example.com",
+  "realname": "John Doe",
+  "location": "Paris",
+  "website": "https://example.com",
+  "gravatar": "<md5_of_email>",
+  "active": true
+}
+```
+
+---
+
+### `PUT /user`
+
+Edit the current user's profile. All fields are optional.
+
+**Scopes required:** `user`
+
+**Request body:**
+```json
+{
+  "email": "newemail@example.com",
+  "password": "newpassword",
+  "realname": "New Name",
+  "website": "https://new-site.com"
+}
+```
+
+Note: changing `email` is only allowed if that address is verified through a linked external account.
+
+**Response `200`:** updated user object
+
+---
+
+### `POST /user/delete`
+
+Delete the current user's account. Requires password confirmation.
+
+**Scopes required:** `user`
+
+**Request body:**
+```json
+{ "password": "current_password" }
+```
+
+**Response `200`:** empty body
+
+**Errors:**
+- `401 InvalidCredentials` — wrong password
+
+---
+
+### `GET /user/validatemail/:token`
+
+Validates the user's email address using the token from the confirmation email. Activates the account and returns an access token.
+
+**No auth required.**
+
+**Path parameter:** `token` — validation token from email
+
+**Response `200`:**
+```json
+{
+  "access_token": "...",
+  "refresh_token": "...",
+  "expires_in": 3600
+}
+```
+
+**Errors:**
+- `400 InvalidValidationToken` — token not found
+
+---
+
+### `POST /user/sendpasswordresetlink`
+
+Sends a password reset link to the provided email address.
+
+**No auth required.**
+
+**Request body:**
+```json
+{ "email": "john@example.com" }
+```
+
+**Response `200`:** empty body
+
+**Errors:**
+- `400 InvalidField` — missing/invalid email
+- `404 AccountNotFound` — no account with that email
+
+---
+
+### `PUT /user/password`
+
+Reset password using a token received by email.
+
+**No auth required.**
+
+**Request body:**
+```json
+{
+  "token": "<reset_token>",
+  "password": "new_password"
+}
+```
+
+**Response `200`:** empty body
+
+**Errors:**
+- `400 WrongPasswordResetToken` — token missing or not found
+- `400 InvalidField` — invalid password
+
+---
+
+### `GET /user/plugins`
+
+List plugins the current user has permissions on (active plugins only).
+
+**Scopes required:** `user`, `plugins`
+
+**Response `200`:** array of plugin objects
+
+---
+
+### `GET /user/watchs`
+
+List plugin keys that the current user is watching.
+
+**Scopes required:** `user`, `plugins`
+
+**Response `200`:**
+```json
+["myplugin", "anotherplugin"]
+```
+
+---
+
+### `POST /user/watchs`
+
+Start watching a plugin.
+
+**Scopes required:** `user`, `plugins`
+
+**Request body:**
+```json
+{ "plugin_key": "myplugin" }
+```
+
+**Response `200`:** empty body
+
+**Errors:**
+- `400 InvalidField` — missing plugin_key
+- `404 ResourceNotFound` — plugin not found
+- `400 AlreadyWatched` — already watching this plugin
+
+---
+
+### `DELETE /user/watchs/:key`
+
+Stop watching a plugin.
+
+**Scopes required:** `user`, `plugins`
+
+**Path parameter:** `key` — plugin key
+
+**Response `200`:** empty body
+**Response `404`:** plugin not found or not watching
+
+---
+
+### `POST /user/search`
+
+Search users by username, realname, or exact email.
+
+**Scopes required:** `users:search`
+
+**Request body:**
+```json
+{ "search": "john" }
+```
+
+**Response `200`:**
+```json
+[
+  { "username": "john", "realname": "John Doe" }
+]
+```
+
+---
+
+### `GET /user/external_accounts`
+
+List all external OAuth accounts linked to the current user.
+
+**Scopes required:** `user:externalaccounts`
+
+**Response `200`:**
+```json
+[
+  { "id": 1, "service": "github", "external_user_id": "12345" }
+]
+```
+
+---
+
+### `DELETE /user/external_accounts/:id`
+
+Unlink an external OAuth account.
+
+**Scopes required:** `user:externalaccounts`
+
+**Path parameter:** `id` — external account ID
+
+**Response `200`:** empty body
+
+**Errors:**
+- `401 NoCredentialsLeft` — cannot remove last external account when no password is set
+
+---
+
+## User Apps (API Keys)
+
+### `GET /user/apps`
+
+List all API applications created by the current user.
+
+**Scopes required:** `user`, `user:apps`
+
+**Response `200`:** array of app objects
+
+---
+
+### `GET /user/apps/:id`
+
+Get details of a specific app.
+
+**Scopes required:** `user`, `user:apps`
+
+**Response `200`:**
+```json
+{
+  "id": 1,
+  "name": "My App",
+  "homepage_url": "https://myapp.com",
+  "description": "A great app",
+  "client_id": "...",
+  "secret": "..."
+}
+```
+
+**Errors:**
+- `404 ResourceNotFound` — app not found
+
+---
+
+### `POST /user/apps`
+
+Create a new API application. Generates a `client_id` and `secret` automatically.
+
+**Scopes required:** `user`, `user:apps`
+
+**Request body:**
+```json
+{
+  "name": "My App",
+  "homepage_url": "https://myapp.com",
+  "description": "A great app"
+}
+```
+
+| Field | Required | Validation |
+|-------|----------|------------|
+| `name` | Yes | Must pass `App::isValidName()`, unique per user |
+| `homepage_url` | No | Valid URL |
+| `description` | No | Must pass `App::isValidDescription()` |
+
+**Errors:**
+- `400 InvalidField` — invalid name/url/description
+- `400 UnavailableName` — app name already taken
+
+---
+
+### `PUT /user/apps/:id`
+
+Update an existing app.
+
+**Scopes required:** `user`, `user:apps`
+
+**Request body:** same optional fields as `POST /user/apps`
+
+**Response `200`:** updated app object
+
+**Errors:**
+- `404 ResourceNotFound` — app not found
+
+---
+
+### `DELETE /user/apps/:id`
+
+Delete an API application.
+
+**Scopes required:** `user`, `user:apps`
+
+**Response `200`:** empty body
+
+**Errors:**
+- `404 ResourceNotFound` — app not found
+
+---
+
+## Plugins
+
+### `GET /plugin`
+
+List all active plugins, paginated. Sorted by default ordering.
+
+**Scopes required:** `plugins`
+
+**Response `206/200`:** paginated array of plugin objects with authors, versions, descriptions
+
+---
+
+### `POST /plugin`
+
+Submit a new plugin for review.
+
+**Scopes required:** `plugin:submit`
+
+**Request body:**
+```json
+{
+  "plugin_url": "https://example.com/plugin.xml",
+  "recaptcha_response": "<recaptcha_token>"
+}
+```
+
+The XML at `plugin_url` is fetched and validated. The plugin `key` must be unique.
+
+**Response `200`:**
+```json
+{ "success": true }
+```
+
+**Errors:**
+- `400 InvalidRecaptcha` — reCAPTCHA failed
+- `400 InvalidField` — missing or invalid plugin_url
+- `400 UnavailableName` — XML URL or plugin key already exists
+- `400 InvalidXML` — XML unreachable or invalid
+
+---
+
+### `GET /plugin/new`
+
+Most recently added plugins, paginated.
+
+**Scopes required:** `plugins`
+
+**Response `206/200`:** paginated array of plugin objects
+
+---
+
+### `GET /plugin/popular`
+
+Most downloaded plugins, paginated.
+
+**Scopes required:** `plugins`
+
+---
+
+### `GET /plugin/trending`
+
+Trending plugins (most downloaded in the last 2 weeks), paginated.
+
+**Scopes required:** `plugins`
+
+---
+
+### `GET /plugin/updated`
+
+Most recently updated plugins, paginated.
+
+**Scopes required:** `plugins`
+
+---
+
+### `GET /plugin/rss_new`
+
+RSS feed of the 30 newest plugins.
+
+**No auth required.** Returns RSS XML.
+
+---
+
+### `GET /plugin/rss_updated`
+
+RSS feed of the 30 most recently updated plugins.
+
+**No auth required.** Returns RSS XML.
+
+---
+
+### `POST /plugin/star`
+
+Rate a plugin.
+
+**Scopes required:** `plugin:star`
+
+**Request body:**
+```json
+{
+  "plugin_id": 42,
+  "note": 4
+}
+```
+
+**Response `200`:**
+```json
+{ "new_average": 4.2 }
+```
+
+**Errors:**
+- `400` — missing or non-numeric `plugin_id` or `note`
+- `400` — plugin does not exist
+
+---
+
+### `GET /plugin/:key`
+
+Get full details for a single active plugin.
+
+**Scopes required:** `plugin:card`
+
+**Path parameter:** `key` — unique plugin key (e.g. `fields`)
+
+**Response `200`:**
+```json
+{
+  "id": 1,
+  "key": "fields",
+  "name": "Additional Fields",
+  "logo_url": "...",
+  "xml_url": "...",
+  "download_count": 15000,
+  "note": 4.5,
+  "nb_votes": 120,
+  "watched": false,
+  "descriptions": [...],
+  "authors": [...],
+  "versions": [...],
+  "screenshots": [...],
+  "tags": [...],
+  "langs": [...]
+}
+```
+
+**Errors:**
+- `404 ResourceNotFound` — plugin not found or inactive
+
+---
+
+### `GET /plugin/:key/download`
+
+Track a download and redirect to the plugin's download URL (HTTP 301).
+
+**No auth required.**
+
+When `Accept: application/json` header is set, tracking happens but no redirect is issued.
+
+---
+
+### `GET /plugin/:key/permissions`
+
+List users who have permissions on the plugin.
+
+**Scopes required:** `user`, `plugin:card`
+
+**Auth requirement:** caller must have `admin` flag on the plugin.
+
+**Response `200`:** array of user/permission objects
+
+---
+
+### `POST /plugin/:key/permissions`
+
+Grant a user access to the plugin.
+
+**Scopes required:** `user`, `plugin:card`
+
+**Auth requirement:** caller must have `admin` flag on the plugin.
+
+**Request body:**
+```json
+{ "username": "jane" }
+```
+
+**Errors:**
+- `400 InvalidField` — missing username
+- `404 ResourceNotFound` — user not found
+- `400 RightAlreadyExist` — user already has a permission entry
+
+---
+
+### `DELETE /plugin/:key/permissions/:username`
+
+Remove a user's permission on the plugin.
+
+**Scopes required:** `user`, `plugin:card`
+
+**Auth requirement:** caller must be `admin`, unless removing their own (non-admin) permission.
+
+**Errors:**
+- `400 RightDoesntExist` — user has no permission on this plugin
+- `401 CannotDeleteAdmin` — cannot remove an admin's permission
+
+---
+
+### `PATCH /plugin/:key/permissions/:username`
+
+Modify a specific permission flag for a user on a plugin.
+
+**Scopes required:** `user`, `plugin:card`
+
+**Auth requirement:** caller must have `admin` flag on the plugin.
+
+**Request body:**
+```json
+{
+  "right": "allowed_refresh_xml",
+  "set": true
+}
+```
+
+| `right` values |
+|----------------|
+| `allowed_refresh_xml` |
+| `allowed_change_xml_url` |
+| `allowed_notifications` |
+
+**Errors:**
+- `400 InvalidField` — invalid `right` or `set` value
+
+---
+
+### `POST /plugin/:key/refresh_xml`
+
+Re-fetch and update the plugin data from its XML URL.
+
+**Scopes required:** `user`, `plugin:card`
+
+**Auth requirement:** caller must have `admin` or `allowed_refresh_xml` flag.
+
+**Response `200`:**
+```json
+{
+  "errors": [],
+  "xml_state": { ... }
+}
+```
+
+**Errors in response body (not HTTP errors):**
+- XML URL unreachable
+- XML parse error
+- XML field validation errors (collected in array)
+
+---
+
+## Panel (Author Mode)
+
+### `GET /panel/plugin/:key`
+
+Author dashboard view of a plugin. Includes tags and stub statistics.
+
+**Scopes required:** `plugin:card`, `user`
+
+**Auth requirement:** caller must have `admin`, `allowed_refresh_xml`, or `allowed_change_xml_url` flag.
+
+**Response `200`:**
+```json
+{
+  "card": { ...plugin object... },
+  "tags": [...],
+  "statistics": {
+    "current_monthly_downloads": 500,
+    "current_weekly_downloads": 250
+  }
+}
+```
+
+---
+
+### `POST /panel/plugin/:key`
+
+Update the plugin's XML URL.
+
+**Scopes required:** `user`, `plugin:card`
+
+**Auth requirement:** caller must have `admin` or `allowed_change_xml_url` flag.
+
+**Request body:**
+```json
+{ "xml_url": "https://example.com/new-plugin.xml" }
+```
+
+The new URL is validated:
+1. Must be a valid URL
+2. Must be fetchable over HTTP
+3. XML must be valid and parseable
+4. Plugin `key` in XML must match the existing key
+5. All existing authors must still be present in the new XML
+
+**Response `200`:** empty body
+
+---
+
+## Authors
+
+### `GET /author`
+
+List all authors who have contributed to at least one plugin, paginated.
+
+**Scopes required:** `authors`
+
+---
+
+### `GET /author/top`
+
+List top authors (all, including non-contributors), paginated.
+
+**Scopes required:** `authors`
+
+---
+
+### `GET /author/:id`
+
+Get details for a specific author. Includes gravatar hash if linked to a user account.
+
+**Scopes required:** `author`
+
+**Path parameter:** `id` — author ID (integer)
+
+**Response `200`:**
+```json
+{
+  "id": 1,
+  "name": "John Doe",
+  "plugin_count": 5,
+  "username": "john",
+  "gravatar": "<md5>"
+}
+```
+
+---
+
+### `GET /author/:id/plugin`
+
+List plugins by a specific author, paginated.
+
+**Scopes required:** `author`, `plugins`
+
+---
+
+### `POST /claimauthorship`
+
+Send a request to admins to claim authorship of a plugin author record.
+
+**Scopes required:** `user`
+
+**Request body:**
+```json
+{
+  "author": "John Doe",
+  "recaptcha_response": "<token>"
+}
+```
+
+**Response `200`:** empty body (email sent to admins)
+
+**Errors:**
+- `400 InvalidRecaptcha` — reCAPTCHA failed
+- `400 InvalidField` — missing/invalid author name
+- `404 ResourceNotFound` — author name not found
+
+---
+
+## Tags
+
+### `GET /tags`
+
+List all tags ordered by usage count, paginated. Automatically falls back to `en` if no tags in requested language.
+
+**Scopes required:** `tags`
+
+**Response `206/200`:** paginated array of tag objects
+
+---
+
+### `GET /tags/top`
+
+Same as `GET /tags`. Returns top tags by plugin count.
+
+**Scopes required:** `tags`
+
+---
+
+### `GET /tags/:id`
+
+Get a single tag by key.
+
+**Scopes required:** `tag`
+
+**Path parameter:** `id` — tag key (string, e.g. `inventory`)
+
+**Response `200`:**
+```json
+{ "id": 1, "key": "inventory", "tag": "Inventory", "plugin_count": 12 }
+```
+
+**Errors:**
+- `404 ResourceNotFound` — tag key not found
+
+---
+
+### `GET /tags/:id/plugin`
+
+List active plugins associated with a tag, paginated.
+
+**Scopes required:** `tag`, `plugins`
+
+---
+
+## Search
+
+### `POST /search`
+
+Full-text search across plugin names, keys, and descriptions.
+
+**Scopes required:** `plugins:search`
+
+**Request body:**
+```json
+{ "query_string": "inventory" }
+```
+
+Minimum length: **2 characters**.
+
+Results are ordered by `download_count DESC`, `note DESC`, `name ASC`.
+
+**Response `206/200`:** paginated array of plugin objects
+
+**Errors:**
+- `400` — query_string missing or too short
+
+---
+
+## Versions
+
+### `GET /version/:version/plugin`
+
+List plugins compatible with a given GLPI version, paginated.
+
+**Scopes required:** `version`, `plugins`
+
+**Path parameter:** `version` — GLPI version string (e.g. `9.5`, `10.0`)
+
+**Response `206/200`:** paginated array of plugin objects
+
+---
+
+## Messages
+
+### `POST /message`
+
+Send a contact message to the site administrators. Saved to DB and emailed.
+
+**Scopes required:** `message`
+
+**Request body:**
+```json
+{
+  "recaptcha_response": "<token>",
+  "contact": {
+    "firstname": "John",
+    "lastname": "Doe",
+    "email": "john@example.com",
+    "subject": "Question about a plugin",
+    "message": "Hello, I have a question..."
+  }
+}
+```
+
+| Field | Max length |
+|-------|-----------|
+| `firstname` | 45 chars |
+| `lastname` | 45 chars |
+| `subject` | 280 chars |
+| `message` | 16000 chars |
+
+**Response `200`:**
+```json
+{ "success": true }
+```
+
+**Errors:**
+- `400 InvalidRecaptcha` — reCAPTCHA failed
+- `400 MissingField` — required contact field missing
+- `400 InvalidField` — field validation failed
+
+---
+
+## Error Response Format
+
+All errors return JSON with an HTTP status ≥ 400:
+
+```json
+{
+  "error": "RESOURCE_NOT_FOUND(type=Plugin, key=myplugin)"
+}
+```
+
+All errors use a single `error` field containing the string representation of the exception. Extra context (resource type, field name, etc.) is encoded inline in that string.
+
+Common HTTP status codes used:
+- `400 Bad Request` — invalid input
+- `401 Unauthorized` — missing or invalid token, or insufficient scopes/permissions
+- `404 Not Found` — resource does not exist
+- `500 Internal Server Error` — unexpected server error
diff --git a/specs/testing/e2e.md b/specs/testing/e2e.md
new file mode 100644
index 00000000..d210b4e4
--- /dev/null
+++ b/specs/testing/e2e.md
@@ -0,0 +1,152 @@
+# End-to-End Test Specifications
+
+E2E tests exercise the **full stack** through a real browser. They are the slowest
+layer but give the highest confidence before a release.
+
+## Stack
+
+| Tool | Purpose |
+|------|---------|
+| [Playwright](https://playwright.dev/) | Browser automation |
+| Docker Compose | Full stack (API + DB + frontend) |
+
+**Suggested location:** `frontend/e2e/`
+
+---
+
+## Environment Setup
+
+```yaml
+# docker-compose.e2e.yml
+services:
+  mysql:
+    image: mysql:8.0
+    environment:
+      MYSQL_ROOT_PASSWORD: root
+      MYSQL_DATABASE: glpi_plugins_e2e
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  api:
+    # Reuses the same Apache/PHP 7.4 image as the functional test stack
+    build:
+      context: .
+      dockerfile: .docker/test/api/Dockerfile
+    volumes:
+      - ./api:/var/www/api
+    environment:
+      APP_CONFIG_FILE: /var/www/api/config.e2e.php
+      TEST_DB_HOST: mysql
+      TEST_DB_NAME: glpi_plugins_e2e
+      TEST_DB_USER: root
+      TEST_DB_PASS: root
+    depends_on:
+      mysql:
+        condition: service_healthy
+
+  frontend:
+    # Builds the AngularJS SPA (grunt build) and serves dist/ statically
+    build:
+      context: .
+      dockerfile: .docker/e2e/frontend/Dockerfile
+    ports:
+      - "4200:80"
+    depends_on:
+      - api
+```
+
+`config.e2e.php` mirrors `config.php` but points to the `glpi_plugins_e2e` database.
+
+Run: `docker compose -f docker-compose.e2e.yml up -d`
+
+---
+
+## Frontend E2E Test Suites (Playwright)
+
+### Selector strategy
+
+Target **content and semantics**, not UI framework internals.
+The frontend is currently AngularJS 1 but will be replaced; CSS classes,
+`ng-*` attributes, and component structure will change. Tests must not.
+
+Preferred selectors, in order:
+
+1. **Visible text / labels** — `getByText('Sign in')`, `getByLabel('Password')`
+2. **ARIA roles** — `getByRole('button', { name: 'Watch' })`, `getByRole('navigation')`
+3. **Semantic HTML** — `<h1>`, `<nav>`, `<main>`, `<table>`
+4. **`data-testid` attributes** — add sparingly, only when 1–3 are insufficient
+
+Avoid: CSS class selectors (`.plugin-card`, `.ng-binding`), XPath, positional
+selectors (`:nth-child`), and any framework-specific attributes.
+
+> **Minimal markup changes:** if a selector needs an anchor point, prefer adding
+> an ARIA `role` or `aria-label` to an existing element over introducing new DOM
+> nodes or `data-testid` attributes. This improves accessibility and keeps the
+> diff small.
+
+---
+
+### Suite F1 — Homepage
+
+- Page loads; a list of plugins is visible (each item shows a name and download count)
+- Navigating to the next page shows a different set of plugins
+- The page title / heading identifies the site
+
+### Suite F2 — Plugin Detail Page
+
+- Navigate to `/plugin/fields`
+- Plugin name, description, at least one version, and author name are present in the page
+- Star rating control is present and interactive when logged in
+- Watch control toggles its label/state when clicked (logged-in user)
+
+### Suite F3 — Search
+
+- Typing a query and submitting shows a list of results containing the query term
+- Each result shows a plugin name and a link to the detail page
+- Submitting a query shorter than the minimum length shows an error message
+
+### Suite F4 — Authentication
+
+- **Sign up:** fill the registration form, submit, a confirmation message appears
+- **Sign in:** valid credentials → user name appears in the page, panel is accessible
+- **Sign in:** wrong password → an error message appears, user is not redirected
+- **Sign out:** user name disappears, protected pages redirect to login
+- **GitHub OAuth:** the "Login with GitHub" control is present and starts the OAuth flow
+
+### Suite F5 — User Panel
+
+- Authenticated user can reach `/panel` and sees their plugin list
+- API keys section lists existing keys and allows creating and deleting a key
+
+### Suite F6 — Plugin Author Panel
+
+- Author reaches `/panel/plugin/:key` and sees the plugin name
+- Triggering an XML refresh shows a success or error message
+- Updating the XML URL persists the new value (visible after reload)
+- Permission list shows current members; adding and removing a user updates the list
+
+---
+
+## Running the Tests
+
+```bash
+docker compose -f docker-compose.e2e.yml up -d
+cd frontend
+npx playwright test
+```
+
+---
+
+## CI Integration
+
+```yaml
+e2e:
+  runs-on: ubuntu-latest
+  steps:
+    - uses: actions/checkout@v4
+    - run: docker compose -f docker-compose.e2e.yml up -d
+    - run: cd frontend && npx playwright test
+```
diff --git a/specs/testing/functional.md b/specs/testing/functional.md
new file mode 100644
index 00000000..356938d3
--- /dev/null
+++ b/specs/testing/functional.md
@@ -0,0 +1,381 @@
+# Functional Test Specifications
+
+Functional tests exercise the full HTTP stack against a **real test database**.
+Requests are sent over HTTP to a real server process — no framework-specific test
+client is used — so the suite is portable across Slim, Symfony, or any other PHP
+framework.
+
+## Stack
+
+| Tool | Purpose |
+|------|---------|
+| [PHPUnit](https://phpunit.de/) ≥ 10 | Test runner |
+| [Guzzle](https://docs.guzzlephp.org/) (`guzzlehttp/guzzle`) | HTTP client — framework-agnostic |
+| PHP built-in server (`php -S`) | Real HTTP server, started as a subprocess |
+| MySQL (dedicated test DB) | Test database; SQLite where feasible |
+| Database migrations/seeds | Repeatable test fixtures |
+
+**Location:** `api/tests/Functional/`
+
+### Why PHP built-in server + Guzzle
+
+Using a real HTTP server means tests are completely decoupled from the framework
+layer. The test code only knows about HTTP — methods, headers, status codes, and
+JSON bodies. This makes the suite reusable if the backend framework changes.
+
+A `symfony/process`-managed `php -S` subprocess is started once per suite in
+`setUpBeforeClass` and stopped in `tearDownAfterClass`. Each test creates a
+`GuzzleHttp\Client` pointed at that server.
+
+```
+phpunit
+  └── FunctionalTestCase (setUpBeforeClass)
+        ├── start: php -S localhost:PORT -t api/public api/public/index.php
+        ├── wait for port to be ready
+        └── tearDownAfterClass: terminate process
+```
+
+### Test database strategy
+
+- Use a dedicated MySQL test database (separate from dev/prod).
+- Run migrations once before the suite (`setUpBeforeClass`).
+- Seed fixtures before each test class; wrap each test in a transaction and roll
+  back in `tearDown` to keep tests isolated.
+
+---
+
+## 2. Authentication (`POST /oauth/authorize`)
+
+### 2.1 Password grant — success
+- Authenticating with valid `username` + `password` returns `200` with `access_token`, `refresh_token`, `expires_in`
+- Token is stored in the `access_tokens` table
+
+### 2.2 Password grant — failures
+- Wrong password returns `401`
+- Unknown username returns `401`
+- Inactive account returns `401`
+
+### 2.3 Refresh token grant
+- A valid `refresh_token` issues a new `access_token` and new `refresh_token`
+- An expired or unknown `refresh_token` returns `401`
+
+### 2.4 Client credentials grant
+- Valid `client_id` + `client_secret` returns an access token
+- Unknown `client_id` returns `401`
+
+---
+
+## 3. User Registration & Validation (`POST /user`, `GET /user/validatemail/:token`)
+
+### 3.1 Registration success
+- Creates user with `active = false`
+- Creates a `ValidationToken` record
+- Returns `200`
+
+### 3.2 Registration validation
+- Missing `username` → `400 InvalidField`
+- `username` shorter than 4 chars → `400 InvalidField`
+- `username` with special characters → `400 InvalidField`
+- Duplicate `username` → `400 UnavailableName`
+- Invalid `email` format → `400 InvalidField`
+- Duplicate `email` → `400 UnavailableName`
+- Weak `password` → `400 InvalidField`
+
+### 3.3 Email validation
+- Valid token activates user (`active = true`), deletes token, returns access token
+- Invalid/unknown token → `400 InvalidValidationToken`
+
+---
+
+## 4. User Profile (`GET /user`, `PUT /user`, `POST /user/delete`)
+
+### 4.1 View profile
+- Returns current user's fields including computed `gravatar`
+- Missing token → `401`
+
+### 4.2 Edit profile
+- `realname`, `website` are updated and persisted
+- `password` is hashed before saving
+- Changing `email` with an address not in external accounts is silently ignored
+- Changing `email` to one verified via GitHub updates it and activates the account
+
+### 4.3 Delete account
+- Correct password deletes user, sessions, and access tokens
+- Wrong password → `401 InvalidCredentials`
+- Short/invalid password format → `400 InvalidField`
+
+---
+
+## 5. Password Reset (`POST /user/sendpasswordresetlink`, `PUT /user/password`)
+
+### 5.1 Send reset link
+- Known email creates a `ResetPasswordToken` and returns `200`
+- Unknown email → `404 AccountNotFound`
+- Missing email field → `400 InvalidField`
+
+### 5.2 Reset password
+- Valid token + new password updates password hash, deletes all reset tokens
+- Invalid token → `400 WrongPasswordResetToken`
+- Missing password → `400 InvalidField`
+
+---
+
+## 6. Plugin Listing
+
+### 6.1 `GET /plugin`
+- Returns only `active = 1` plugins
+- Response is paginated according to `x-range` header
+- `accept-range` and `content-range` headers are set correctly
+- Without auth token → `401`
+
+### 6.2 `GET /plugin/popular`, `/plugin/new`, `/plugin/trending`, `/plugin/updated`
+- Return only active plugins
+- Results are ordered correctly (popular: `download_count DESC`, new: `date_added DESC`)
+
+### 6.3 `GET /plugin/:key`
+- Returns all relations (descriptions, authors, versions, screenshots, tags)
+- Includes `watched: true` for a user who is watching the plugin
+- Inactive plugin → `404 ResourceNotFound`
+- Unknown key → `404 ResourceNotFound`
+
+### 6.4 `GET /plugin/rss_new`, `/plugin/rss_updated`
+- Returns valid RSS XML without authentication
+- Contains at most 30 entries
+
+---
+
+## 7. Plugin Submission (`POST /plugin`)
+
+### 7.1 Validation
+- Missing `plugin_url` → `400 InvalidField`
+- Duplicate `xml_url` → `400 UnavailableName`
+- XML not fetchable → `400 InvalidXML`
+- Duplicate plugin `key` in XML → `400 UnavailableName`
+
+### 7.2 Success
+- Creates plugin with `active = false`
+- Creates a permission entry with `admin = true` for the submitting user
+- Returns `{ "success": true }`
+
+---
+
+## 8. Plugin Rating (`POST /plugin/star`)
+
+- Creates a `PluginStar` record
+- Returns updated `new_average`
+- Non-numeric `plugin_id` or `note` → `400`
+- Non-existent plugin → `400`
+- Missing required scope → `401`
+
+---
+
+## 9. Plugin Download (`GET /plugin/:key/download`)
+
+- Increments `download_count` by 1
+- Creates a `PluginDownload` record
+- Redirects to `download_url` with HTTP `301` (when `Accept` is not `application/json`)
+- Returns `200` without redirect when `Accept: application/json`
+
+---
+
+## 10. Plugin Permissions
+
+### 10.1 View permissions (`GET /plugin/:key/permissions`)
+- Non-admin user → `401 LackPermission`
+- Admin user → `200` with array of permission objects
+
+### 10.2 Add permission (`POST /plugin/:key/permissions`)
+- Adds permission for a valid username
+- Non-existent username → `404 ResourceNotFound`
+- Already has permission → `400 RightAlreadyExist`
+- Non-admin caller → `401 LackPermission`
+
+### 10.3 Delete permission (`DELETE /plugin/:key/permissions/:username`)
+- Non-admin user can remove their own non-admin permission
+- Admin cannot delete another admin's permission → `401 CannotDeleteAdmin`
+- Non-admin cannot delete another user's permission → `401 LackPermission`
+- Non-existent permission → `400 RightDoesntExist`
+
+### 10.4 Modify permission (`PATCH /plugin/:key/permissions/:username`)
+- Sets `allowed_refresh_xml`, `allowed_change_xml_url`, `allowed_notifications`
+- Invalid `right` value → `400 InvalidField`
+- Missing `set` field → `400 InvalidField`
+- Non-admin caller → `401 LackPermission`
+
+---
+
+## 11. Author Panel (`GET /panel/plugin/:key`, `POST /panel/plugin/:key`)
+
+### 11.1 View
+- User with `admin` flag → `200` with card, tags, statistics
+- User with no permission → `401 LackPermission`
+
+### 11.2 Update XML URL
+- Valid URL with matching key and authors updates `xml_url`
+- URL not fetchable → `400 InvalidXML`
+- Key mismatch in new XML → `400 DifferentPluginSignature`
+- Author removed in new XML → `400 DifferentPluginSignature`
+- Non-URL string → `400 InvalidField`
+
+---
+
+## 12. Authors
+
+### 12.1 `GET /author` / `GET /author/top`
+- Returns paginated list
+- `GET /author` returns only authors with `plugin_count > 0`
+
+### 12.2 `GET /author/:id`
+- Returns `username` and `gravatar` when author is linked to a user account
+- Unknown ID → `404 ResourceNotFound`
+
+### 12.3 `GET /author/:id/plugin`
+- Returns only the author's active plugins
+
+### 12.4 `POST /claimauthorship`
+- Known author name → `200` (email sent to admins)
+- Unknown author name → `404 ResourceNotFound`
+- Invalid reCAPTCHA → `400 InvalidRecaptcha`
+
+---
+
+## 13. Tags
+
+### 13.1 `GET /tags` / `GET /tags/top`
+- Returns tags ordered by `plugin_count DESC`
+- Falls back to `en` when no tags exist for requested language
+
+### 13.2 `GET /tags/:id`
+- Known tag key → `200` with tag data
+- Unknown key → `404 ResourceNotFound`
+
+### 13.3 `GET /tags/:id/plugin`
+- Returns plugins that have the specified tag
+
+---
+
+## 14. Search (`POST /search`)
+
+- Returns plugins matching `name`, `key`, `short_description`, or `long_description`
+- Query shorter than 2 chars → `400`
+- Missing `query_string` → `400`
+- Results ordered by `download_count DESC`, `note DESC`, `name ASC`
+
+---
+
+## 15. Version Filter (`GET /version/:version/plugin`)
+
+- Returns plugins compatible with the given GLPI version
+- Returns empty list (not error) when no plugins match
+
+---
+
+## 16. User Watches
+
+### 16.1 `POST /user/watchs`
+- Creates a `PluginWatch` record
+- Unknown `plugin_key` → `404 ResourceNotFound`
+- Already watched → `400 AlreadyWatched`
+
+### 16.2 `DELETE /user/watchs/:key`
+- Removes the watch record
+- Not watching → `404`
+
+### 16.3 `GET /user/watchs`
+- Returns an array of plugin keys
+
+---
+
+## 17. User Search (`POST /user/search`)
+
+- Matches on `username`, `realname` (partial), or `email` (exact)
+- Missing `search` field → `400 InvalidField`
+- Results include only `username` and `realname`
+
+---
+
+## 18. External Accounts
+
+### 18.1 `GET /user/external_accounts`
+- Returns list of linked external accounts for current user
+
+### 18.2 `DELETE /user/external_accounts/:id`
+- Removes the link
+- Last external account with no password set → `401 NoCredentialsLeft`
+
+---
+
+## 19. User Apps
+
+### 19.1 `POST /user/apps`
+- Creates app with random `client_id` and `secret`
+- Duplicate name (same user) → `400 UnavailableName`
+- Invalid name → `400 InvalidField`
+
+### 19.2 `GET /user/apps`, `GET /user/apps/:id`
+- Returns only apps belonging to the current user
+- Unknown app ID → `404 ResourceNotFound`
+
+### 19.3 `PUT /user/apps/:id`
+- Updates modifiable fields; auto-generated fields unchanged
+
+### 19.4 `DELETE /user/apps/:id`
+- Removes the app record
+
+---
+
+## 20. Contact Messages (`POST /message`)
+
+- Creates a `Message` record in the database
+- Missing required contact field → `400 MissingField`
+- Invalid email format → `400 InvalidField`
+- Failed reCAPTCHA → `400 InvalidRecaptcha`
+
+---
+
+## Running the Tests
+
+```bash
+cd api
+cp config.example.php config.test.php  # set test DB credentials
+APP_ENV=test vendor/bin/phpunit --configuration phpunit.xml --testsuite Functional
+```
+
+### Base test case skeleton
+
+```php
+abstract class FunctionalTestCase extends \PHPUnit\Framework\TestCase
+{
+    private static \Symfony\Component\Process\Process $server;
+    protected static GuzzleHttp\Client $http;
+
+    public static function setUpBeforeClass(): void
+    {
+        // Start PHP built-in server
+        self::$server = new \Symfony\Component\Process\Process(
+            ['php', '-S', 'localhost:8099', 'public/index.php'],
+            __DIR__ . '/../../'
+        );
+        self::$server->start();
+        // Wait until the port accepts connections
+        usleep(200_000);
+
+        self::$http = new \GuzzleHttp\Client([
+            'base_uri'        => 'http://localhost:8099',
+            'http_errors'     => false,   // don't throw on 4xx/5xx
+            'allow_redirects' => false,
+        ]);
+    }
+
+    public static function tearDownAfterClass(): void
+    {
+        self::$server->stop();
+    }
+}
+```
+
+> `http_errors: false` is important — it lets tests assert on 4xx/5xx responses
+> instead of catching Guzzle exceptions.
+
+> `allow_redirects: false` is important for endpoints that return HTTP `301`
+> (e.g. plugin download) so the redirect itself can be asserted.
diff --git a/specs/testing/review-88.md b/specs/testing/review-88.md
new file mode 100644
index 00000000..1bf34d27
--- /dev/null
+++ b/specs/testing/review-88.md
@@ -0,0 +1,144 @@
+# Review Response — PR #88 (E2E Test Suite)
+
+This document records the decisions taken in response to the review of PR #88.
+Each numbered point matches the reviewer's numbering.
+
+---
+
+## Critical Issues
+
+### 1. Raw CSS selectors in spec files — **FIXED**
+
+All raw CSS selectors have been replaced.
+
+**`auth.spec.js` — submit button (lines 33, 45, 61)**
+
+The reviewer suggested `getByRole('button', { name: /sign.?in/i })`, but the header
+user-menu also renders a "Sign in" button, causing a selector conflict.
+Fix: add `data-testid="signin-submit-button"` to the `<md-button type="submit">` in
+`signin.html` and target it via `[data-testid="signin-submit-button"]`. This is
+consistent with how the other inputs in the signin form already use `data-testid`.
+
+**`auth.spec.js` — toast selector (lines 49–50)**
+
+`md-toast, .md-toast-content` is AngularJS Material-specific.
+Fix: `page.getByText(/wrong credentials/i)` — checks the actual translated message
+text, consistent with how the other toast assertions in the file work
+(`'You are now successfully logged in'`, `'You are now disconnected'`).
+Angular Material 1's `$mdToast` does not render with `role="alert"`, so
+`getByRole('alert')` does not match.
+
+**`plugin.spec.js` — plugin detail selectors (lines 12, 16, 20, 24)**
+
+Added `data-testid` attributes to `plugin.html`:
+- `data-testid="plugin-name"` on `<h2>{{plugin.name}}</h2>`
+- `data-testid="plugin-authors"` on `<h4 class="inline-authors">`
+- `data-testid="version-badge"` on the `<span class="pill bg_lightblue">` items
+- `data-testid="plugin-description"` on the `<div class="markdown">` container
+
+**`panel.spec.js` — panel selectors (lines 19, 40, 64)**
+
+Added `data-testid` attributes to `panel.html` and `pluginpanel.html`:
+- `data-testid="panel-plugin-name"` on `<h4 class="plugin-name">` in `panel.html`
+- `data-testid="plugin-panel-header-name"` on `<h2 class="plugin-name">` in `pluginpanel.html`
+- `data-testid="xml-errors"` on `<md-content class="xml-errors">` in `pluginpanel.html`
+
+---
+
+### 2. Root DB credentials in `docker-compose.e2e.yml` — **FIXED**
+
+Added a dedicated MySQL user `e2euser`/`e2epass` with `GRANT ALL ON glpi_plugins_e2e.*`.
+The `api` service now uses `TEST_DB_USER: e2euser` / `TEST_DB_PASS: e2epass`.
+
+---
+
+### 3. CI wait loop exits 0 on frontend failure — **FIXED**
+
+Added `|| exit 1` after the loop in `.github/workflows/tests_e2e.yml` so the job
+fails immediately if the frontend never becomes reachable.
+
+---
+
+## Moderate Issues
+
+### 4. `utf8` / `utf8_general_ci` in `api/config.e2e.php` — **FIXED**
+
+Changed to `utf8mb4` / `utf8mb4_unicode_ci` to match production and avoid data
+truncation on 4-byte Unicode characters.
+
+---
+
+### 5. `frontend` has no health-check on `api` — **FIXED**
+
+Added a healthcheck to the `api` service in `docker-compose.e2e.yml` and updated
+`frontend`'s `depends_on` to `condition: service_healthy`.
+
+---
+
+### 6. XML URL test mutates shared DB state — **FIXED**
+
+The `'XML URL field is editable and persists on save'` test in `panel.spec.js` now
+stores the original XML URL before the test and restores it in an `afterAll` hook,
+preventing state leakage to subsequent tests.
+
+---
+
+### 7. `api` Docker hostname assumed reachable — **DOCUMENTED**
+
+The `updatedXmlUrl` pointing to `http://api/...` relies on the PHP container being
+able to reach itself via the `api` Docker service hostname. This is guaranteed by
+Docker Compose's internal DNS when all services are on the same network. A comment
+has been added to `panel.spec.js` to make this assumption explicit.
+
+---
+
+### 8. Sign-up toast may be dismissed before assertion — **FIXED**
+
+The sign-up test in `auth.spec.js` previously called `waitForURL('/#/')` before
+checking for the toast. The assertion order has been swapped: the toast is checked
+first (immediately after clicking submit), then the URL redirect is verified.
+
+---
+
+## Minor Issues
+
+### 9. Duplicate `data-testid="featured-plugin-item"` — **FIXED**
+
+Each featured section already uses a distinct `ng-repeat` variable, so the fix is
+straightforward. Replaced the shared testid with section-specific values in
+`featured.html`:
+
+- Trending → `data-testid="trending-plugin-item"`
+- New      → `data-testid="new-plugin-item"`
+- Popular  → `data-testid="popular-plugin-item"`
+- Updated  → `data-testid="updated-plugin-item"`
+
+`homepage.spec.js` updated accordingly: the "each section has at least one item"
+test now verifies each list individually, and the "click navigates" test anchors
+on `[data-testid="trending-plugin-item"]`.
+
+---
+
+### 10. `--ignore-platform-reqs` in CI workflow — **FIXED**
+
+Removed from the `composer install` step. The CI environment uses PHP 7.4, which
+matches the project's requirements; the flag was suppressing useful validation.
+
+---
+
+### 11. `networkidle` may be unreliable for polling apps — **ARGUED / KEPT**
+
+The AngularJS app uses `$http` (request/response), not persistent polling,
+WebSockets, or Server-Sent Events. All in-flight requests complete in finite time,
+so `networkidle` (500 ms of quiet) is reliable in practice. Switching to
+`waitForResponse` / `waitForFunction` on a specific API call would add coupling
+between the helper and individual page logic. `networkidle` is kept.
+
+---
+
+### 12. Node.js 10 EOL and missing lockfile in Dockerfile — **ACKNOWLEDGED / OUT OF SCOPE**
+
+Node 10 is intentional: the legacy frontend build chain (Grunt + Bower + Ruby
+Compass) requires it. Upgrading Node is a separate modernisation step. The lockfile
+concern (non-deterministic `npm install`) is valid and will be addressed when the
+Node version is bumped, as part of the same effort.