first commit

2026-09-03 23:24:48 +02:00 · 2026-07-08 11:05:21 +02:00 · 2026-07-08 11:05:21 +02:00 · 244cdbedd7
commit 244cdbedd7
44 changed files with 3386 additions and 0 deletions
--- a/.env.example
+++ b/.env.example
@ -0,0 +1,20 @@
+NODE_ENV=production
+PORT=3000
+
+# Postgres
+DATABASE_URL=postgres://octane:changeme@postgres:5432/octane
+POSTGRES_PASSWORD=changeme
+
+# Sessions
+SESSION_SECRET=change-me-to-a-long-random-string
+
+# Authentik OIDC
+AUTHENTIK_ISSUER_URL=https://auth.example.com/application/o/octane-website/
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URI=https://octane.example.com/auth/callback
+ADMIN_GROUP_NAME=octane-admins
+
+# Docker networking (must match the network created by your existing Authentik compose stack)
+AUTHENTIK_NETWORK_NAME=authentik_default
+APP_PORT=3000
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,3 @@
+node_modules/
+.env
+npm-debug.log*
--- a/8
+++ b/8
@ -0,0 +1,8 @@
+FROM node:20-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm install --omit=dev
+COPY . .
+ENV NODE_ENV=production
+EXPOSE 3000
+CMD ["node", "src/server.js"]
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -0,0 +1,33 @@
+services:
+  app:
+    build: .
+    restart: unless-stopped
+    env_file: .env
+    ports:
+      - "${APP_PORT:-3000}:3000"
+    depends_on:
+      - postgres
+    networks:
+      - default
+      - authentik
+
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: octane
+      POSTGRES_USER: octane
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    networks:
+      - default
+
+networks:
+  default:
+  authentik:
+    external: true
+    name: ${AUTHENTIK_NETWORK_NAME:-authentik_default}
+
+volumes:
+  pgdata:
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@ -0,0 +1,19 @@
+{
+  "name": "octane-website",
+  "version": "1.0.0",
+  "description": "Outil interne de gestion du repertoire, suggestions et setlists du groupe",
+  "private": true,
+  "main": "src/server.js",
+  "scripts": {
+    "start": "node src/server.js",
+    "migrate": "node src/db/migrate.js"
+  },
+  "dependencies": {
+    "connect-pg-simple": "^10.0.0",
+    "dotenv": "^16.4.5",
+    "express": "^4.21.1",
+    "express-session": "^1.18.1",
+    "openid-client": "^6.1.7",
+    "pg": "^8.13.1"
+  }
+}
--- a/public/css/style.css
+++ b/public/css/style.css
@ -0,0 +1,254 @@
+:root {
+  --bg: #f7f7f9;
+  --surface: #ffffff;
+  --text: #1c1c1e;
+  --muted: #6b6b70;
+  --border: #e2e2e6;
+  --accent: #3457d5;
+  --accent-contrast: #ffffff;
+  --danger: #c0392b;
+  --success: #1e8e3e;
+  font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #121214;
+    --surface: #1c1c1f;
+    --text: #ececef;
+    --muted: #9a9aa2;
+    --border: #2e2e33;
+    --accent: #7189e8;
+    --accent-contrast: #0d0d0f;
+  }
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+}
+
+header.app-header {
+  background: var(--surface);
+  border-bottom: 1px solid var(--border);
+  padding: 0.75rem 1.5rem;
+}
+
+nav#main-nav {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+}
+
+.nav-links a {
+  margin-right: 1rem;
+  color: var(--muted);
+  text-decoration: none;
+  font-weight: 500;
+}
+
+.nav-links a.active, .nav-links a:hover {
+  color: var(--accent);
+}
+
+.nav-user {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+  color: var(--muted);
+  font-size: 0.9rem;
+}
+
+.nav-user a {
+  color: var(--accent);
+  text-decoration: none;
+}
+
+.badge {
+  background: var(--accent);
+  color: var(--accent-contrast);
+  border-radius: 999px;
+  padding: 0.1rem 0.5rem;
+  font-size: 0.75rem;
+}
+
+main {
+  max-width: 900px;
+  margin: 0 auto;
+  padding: 1.5rem;
+}
+
+h1 { font-size: 1.5rem; }
+h2 { font-size: 1.15rem; margin-top: 2rem; }
+
+.card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: 10px;
+  padding: 1rem 1.25rem;
+  margin-bottom: 0.75rem;
+}
+
+.card-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  gap: 1rem;
+}
+
+.card-title { font-weight: 600; }
+.card-subtitle { color: var(--muted); font-size: 0.9rem; }
+
+.tag-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  margin-top: 0.5rem;
+}
+
+.tag {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 0.15rem 0.5rem;
+  font-size: 0.8rem;
+}
+
+.tag a { color: var(--accent); text-decoration: none; }
+
+.empty {
+  color: var(--muted);
+  font-style: italic;
+}
+
+form.inline-form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+  margin-top: 0.75rem;
+  align-items: flex-end;
+}
+
+form.inline-form label {
+  display: flex;
+  flex-direction: column;
+  font-size: 0.8rem;
+  color: var(--muted);
+  gap: 0.25rem;
+}
+
+input, select, textarea {
+  font: inherit;
+  padding: 0.4rem 0.5rem;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  background: var(--surface);
+  color: var(--text);
+}
+
+button {
+  font: inherit;
+  padding: 0.45rem 0.9rem;
+  border: none;
+  border-radius: 6px;
+  background: var(--accent);
+  color: var(--accent-contrast);
+  cursor: pointer;
+}
+
+button.secondary {
+  background: transparent;
+  border: 1px solid var(--border);
+  color: var(--text);
+}
+
+button.danger {
+  background: var(--danger);
+  color: #fff;
+}
+
+button:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.vote-tally {
+  display: flex;
+  gap: 1rem;
+  font-size: 0.9rem;
+  margin-top: 0.5rem;
+}
+
+.vote-tally .approve { color: var(--success); }
+.vote-tally .reject { color: var(--danger); }
+
+.vote-list {
+  margin-top: 0.5rem;
+  border-top: 1px solid var(--border);
+  padding-top: 0.5rem;
+}
+
+.vote-item {
+  font-size: 0.85rem;
+  margin-bottom: 0.35rem;
+}
+
+.vote-item .voter { font-weight: 600; }
+
+.youtube-embed {
+  margin-top: 0.75rem;
+  aspect-ratio: 16 / 9;
+  width: 100%;
+  max-width: 480px;
+}
+
+.youtube-embed iframe {
+  width: 100%;
+  height: 100%;
+  border: 0;
+  border-radius: 8px;
+}
+
+.setlist-section h3 {
+  margin-bottom: 0.4rem;
+}
+
+ol.setlist {
+  padding-left: 1.25rem;
+}
+
+ol.setlist li {
+  margin-bottom: 0.5rem;
+}
+
+.note {
+  color: var(--muted);
+  font-size: 0.85rem;
+  display: block;
+}
+
+.error-banner {
+  background: #fdecea;
+  color: var(--danger);
+  border: 1px solid var(--danger);
+  border-radius: 8px;
+  padding: 0.6rem 0.9rem;
+  margin-bottom: 1rem;
+}
+
+@media (prefers-color-scheme: dark) {
+  .error-banner {
+    background: #3a1f1c;
+  }
+}
+
+a.back-link {
+  color: var(--muted);
+  text-decoration: none;
+  font-size: 0.9rem;
+}
--- a/public/history-detail.html
+++ b/public/history-detail.html
@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="fr">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Détail du concert — Octane</title>
+<link rel="stylesheet" href="/css/style.css">
+</head>
+<body>
+<header class="app-header">
+  <nav id="main-nav"></nav>
+</header>
+<main>
+  <a href="/history.html" class="back-link">&larr; Retour à l'historique</a>
+  <div id="error"></div>
+  <div id="content">Chargement…</div>
+</main>
+
+<script src="/js/api.js"></script>
+<script src="/js/render.js"></script>
+<script src="/js/nav.js"></script>
+<script src="/js/history-detail.js"></script>
+</body>
+</html>
--- a/public/history.html
+++ b/public/history.html
@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="fr">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Historique des concerts — Octane</title>
+<link rel="stylesheet" href="/css/style.css">
+</head>
+<body>
+<header class="app-header">
+  <nav id="main-nav"></nav>
+</header>
+<main>
+  <h1>Historique des concerts</h1>
+  <div id="error"></div>
+  <div id="history-list"></div>
+</main>
+
+<script src="/js/api.js"></script>
+<script src="/js/render.js"></script>
+<script src="/js/nav.js"></script>
+<script src="/js/history.js"></script>
+</body>
+</html>
--- a/public/index.html
+++ b/public/index.html
@ -0,0 +1,36 @@
+<!doctype html>
+<html lang="fr">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Répertoire — Octane</title>
+<link rel="stylesheet" href="/css/style.css">
+</head>
+<body>
+<header class="app-header">
+  <nav id="main-nav"></nav>
+</header>
+<main>
+  <h1>Répertoire</h1>
+  <div id="error"></div>
+
+  <div id="admin-add-song" style="display:none">
+    <h2>Ajouter un morceau</h2>
+    <form id="add-song-form" class="inline-form">
+      <label>Titre <input name="title" required></label>
+      <label>Artiste <input name="artist" required></label>
+      <label>Notes <input name="notes"></label>
+      <button type="submit">Ajouter</button>
+    </form>
+  </div>
+
+  <h2>Morceaux travaillés</h2>
+  <div id="songs-list"></div>
+</main>
+
+<script src="/js/api.js"></script>
+<script src="/js/render.js"></script>
+<script src="/js/nav.js"></script>
+<script src="/js/repertoire.js"></script>
+</body>
+</html>
--- a/public/js/api.js
+++ b/public/js/api.js
@ -0,0 +1,24 @@
+async function apiFetch(path, options = {}) {
+  const res = await fetch(path, {
+    headers: { 'Content-Type': 'application/json' },
+    ...options,
+  });
+  if (res.status === 401) {
+    window.location.href = '/auth/login?returnTo=' + encodeURIComponent(window.location.pathname);
+    return new Promise(() => {});
+  }
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new Error(body.message || body.error || `Request failed: ${res.status}`);
+  }
+  if (res.status === 204) return null;
+  return res.json();
+}
+
+const api = {
+  get: (path) => apiFetch(path),
+  post: (path, data) => apiFetch(path, { method: 'POST', body: JSON.stringify(data) }),
+  patch: (path, data) => apiFetch(path, { method: 'PATCH', body: JSON.stringify(data) }),
+  put: (path, data) => apiFetch(path, { method: 'PUT', body: JSON.stringify(data) }),
+  del: (path) => apiFetch(path, { method: 'DELETE' }),
+};
--- a/public/js/history-detail.js
+++ b/public/js/history-detail.js
@ -0,0 +1,42 @@
+function formatDate(dateStr) {
+  const d = new Date(dateStr);
+  return d.toLocaleDateString('fr-FR', { weekday: 'long', year: 'numeric', month: 'long', day: 'numeric' });
+}
+
+function showError(message) {
+  document.getElementById('error').innerHTML = `<div class="error-banner">${escapeHtml(message)}</div>`;
+}
+
+(async function init() {
+  await initNav('history');
+  const params = new URLSearchParams(window.location.search);
+  const id = params.get('id');
+  const container = document.getElementById('content');
+  if (!id) {
+    container.innerHTML = '<p class="empty">Concert introuvable.</p>';
+    return;
+  }
+  try {
+    const setlist = await api.get(`/api/setlists/${id}`);
+    const main = setlist.songs.filter((s) => !s.is_encore);
+    const encore = setlist.songs.filter((s) => s.is_encore);
+    container.innerHTML = `
+      <h1>${escapeHtml(setlist.name || 'Concert')}</h1>
+      <p class="card-subtitle">${escapeHtml(setlist.venue || '')} · ${formatDate(setlist.concert_date)}</p>
+      <div class="setlist-section">
+        <h3>Setlist</h3>
+        ${main.length
+          ? `<ol class="setlist">${main.map((s) => `<li>${escapeHtml(s.title)} — ${escapeHtml(s.artist)}${s.note ? `<span class="note">${escapeHtml(s.note)}</span>` : ''}</li>`).join('')}</ol>`
+          : '<p class="empty">Aucun morceau enregistré.</p>'}
+      </div>
+      <div class="setlist-section">
+        <h3>Rappel</h3>
+        ${encore.length
+          ? `<ol class="setlist">${encore.map((s) => `<li>${escapeHtml(s.title)} — ${escapeHtml(s.artist)}${s.note ? `<span class="note">${escapeHtml(s.note)}</span>` : ''}</li>`).join('')}</ol>`
+          : '<p class="empty">Aucun rappel enregistré.</p>'}
+      </div>
+    `;
+  } catch (err) {
+    showError(err.message);
+  }
+})();
--- a/public/js/history.js
+++ b/public/js/history.js
@ -0,0 +1,29 @@
+function formatDate(dateStr) {
+  const d = new Date(dateStr);
+  return d.toLocaleDateString('fr-FR', { year: 'numeric', month: 'long', day: 'numeric' });
+}
+
+function concertTemplate(c) {
+  return `
+    <div class="card">
+      <a href="/history-detail.html?id=${c.id}" style="text-decoration:none;color:inherit">
+        <div class="card-title">${escapeHtml(c.name || 'Concert')}</div>
+        <div class="card-subtitle">${escapeHtml(c.venue || '')} · ${formatDate(c.concert_date)}</div>
+      </a>
+    </div>
+  `;
+}
+
+function showError(message) {
+  document.getElementById('error').innerHTML = `<div class="error-banner">${escapeHtml(message)}</div>`;
+}
+
+(async function init() {
+  await initNav('history');
+  try {
+    const history = await api.get('/api/setlists/history');
+    renderList(document.getElementById('history-list'), history, concertTemplate, 'Aucun concert passé enregistré.');
+  } catch (err) {
+    showError(err.message);
+  }
+})();
--- a/public/js/nav.js
+++ b/public/js/nav.js
@ -0,0 +1,17 @@
+async function initNav(activePage) {
+  const me = await api.get('/api/users/me');
+  const nav = document.getElementById('main-nav');
+  nav.innerHTML = `
+    <div class="nav-links">
+      <a href="/index.html" class="${activePage === 'repertoire' ? 'active' : ''}">Répertoire</a>
+      <a href="/suggestions.html" class="${activePage === 'suggestions' ? 'active' : ''}">Suggestions</a>
+      <a href="/setlist.html" class="${activePage === 'setlist' ? 'active' : ''}">Prochain concert</a>
+      <a href="/history.html" class="${activePage === 'history' ? 'active' : ''}">Historique</a>
+    </div>
+    <div class="nav-user">
+      <span>${escapeHtml(me.name)}${me.isAdmin ? ' <span class="badge">admin</span>' : ''}</span>
+      <a href="/auth/logout">Se déconnecter</a>
+    </div>
+  `;
+  return me;
+}
--- a/public/js/render.js
+++ b/public/js/render.js
@ -0,0 +1,30 @@
+function renderList(container, items, templateFn, emptyMessage) {
+  if (!items.length) {
+    container.innerHTML = `<p class="empty">${escapeHtml(emptyMessage || 'Rien à afficher pour le moment.')}</p>`;
+    return;
+  }
+  container.innerHTML = items.map(templateFn).join('');
+}
+
+function escapeHtml(str) {
+  return String(str ?? '').replace(/[&<>"']/g, (c) => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+  }[c]));
+}
+
+function youtubeEmbedUrl(url) {
+  try {
+    const parsed = new URL(url);
+    let videoId = null;
+    if (parsed.hostname === 'youtu.be') {
+      videoId = parsed.pathname.slice(1);
+    } else if (parsed.pathname === '/watch') {
+      videoId = parsed.searchParams.get('v');
+    } else if (parsed.pathname.startsWith('/embed/')) {
+      videoId = parsed.pathname.split('/embed/')[1];
+    }
+    return videoId ? `https://www.youtube.com/embed/${videoId}` : null;
+  } catch {
+    return null;
+  }
+}
--- a/public/js/repertoire.js
+++ b/public/js/repertoire.js
@ -0,0 +1,137 @@
+let me = null;
+let instruments = [];
+let songs = [];
+const expanded = new Set();
+
+async function loadInstruments() {
+  instruments = await api.get('/api/instruments');
+}
+
+async function loadSongs() {
+  songs = await api.get('/api/songs');
+  renderSongs();
+}
+
+function instrumentOptions() {
+  return instruments.map((i) => `<option value="${i.id}">${escapeHtml(i.name)}</option>`).join('');
+}
+
+function songCardTemplate(song) {
+  const isOpen = expanded.has(song.id);
+  return `
+    <div class="card" data-song-id="${song.id}">
+      <div class="card-header">
+        <div>
+          <div class="card-title">${escapeHtml(song.title)}</div>
+          <div class="card-subtitle">${escapeHtml(song.artist)}</div>
+        </div>
+        <button class="secondary toggle-tutorials" data-id="${song.id}">
+          ${isOpen ? 'Masquer les tutos' : `Tutos (${song.tutorial_count})`}
+        </button>
+      </div>
+      ${song.notes ? `<p class="note">${escapeHtml(song.notes)}</p>` : ''}
+      <div class="tutorials-panel" style="${isOpen ? '' : 'display:none'}">
+        <div class="tag-list" data-tutorials-for="${song.id}"><p class="empty">Chargement…</p></div>
+        ${me && me.isAdmin ? `
+        <form class="inline-form add-tutorial-form" data-song-id="${song.id}">
+          <label>Instrument
+            <select name="instrumentId" required>${instrumentOptions()}</select>
+          </label>
+          <label>Lien <input name="url" type="url" required placeholder="https://..."></label>
+          <label>Libellé <input name="label" placeholder="ex: tuto solo"></label>
+          <button type="submit">Ajouter le tuto</button>
+        </form>` : ''}
+      </div>
+    </div>
+  `;
+}
+
+function renderSongs() {
+  const container = document.getElementById('songs-list');
+  renderList(container, songs, songCardTemplate, 'Aucun morceau au répertoire pour le moment.');
+  document.querySelectorAll('.toggle-tutorials').forEach((btn) => {
+    btn.addEventListener('click', () => onToggleTutorials(parseInt(btn.dataset.id, 10)));
+  });
+  document.querySelectorAll('.add-tutorial-form').forEach((form) => {
+    form.addEventListener('submit', onAddTutorial);
+  });
+}
+
+async function onToggleTutorials(songId) {
+  if (expanded.has(songId)) {
+    expanded.delete(songId);
+  } else {
+    expanded.add(songId);
+  }
+  renderSongs();
+  if (expanded.has(songId)) {
+    await loadTutorials(songId);
+  }
+}
+
+async function loadTutorials(songId) {
+  try {
+    const detail = await api.get(`/api/songs/${songId}`);
+    const container = document.querySelector(`[data-tutorials-for="${songId}"]`);
+    if (!container) return;
+    if (!detail.tutorials.length) {
+      container.innerHTML = '<p class="empty">Aucun lien pour le moment.</p>';
+      return;
+    }
+    container.innerHTML = detail.tutorials
+      .map(
+        (t) => `<span class="tag">${escapeHtml(t.instrument_name)}: <a href="${escapeHtml(t.url)}" target="_blank" rel="noopener">${escapeHtml(t.label || t.url)}</a></span>`
+      )
+      .join('');
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+async function onAddTutorial(e) {
+  e.preventDefault();
+  const form = e.target;
+  const songId = parseInt(form.dataset.songId, 10);
+  const instrumentId = parseInt(form.instrumentId.value, 10);
+  const url = form.url.value.trim();
+  const label = form.label.value.trim();
+  try {
+    await api.post(`/api/songs/${songId}/tutorials`, { instrumentId, url, label });
+    form.reset();
+    const song = songs.find((s) => s.id === songId);
+    if (song) song.tutorial_count += 1;
+    await loadTutorials(songId);
+    renderSongs();
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+async function onAddSong(e) {
+  e.preventDefault();
+  const form = e.target;
+  const title = form.title.value.trim();
+  const artist = form.artist.value.trim();
+  const notes = form.notes.value.trim();
+  try {
+    await api.post('/api/songs', { title, artist, notes });
+    form.reset();
+    await loadSongs();
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+function showError(message) {
+  document.getElementById('error').innerHTML = `<div class="error-banner">${escapeHtml(message)}</div>`;
+}
+
+(async function init() {
+  me = await initNav('repertoire');
+  await loadInstruments();
+  if (me.isAdmin) {
+    document.getElementById('admin-add-song').style.display = 'block';
+    document.getElementById('add-song-form').addEventListener('submit', onAddSong);
+  }
+  await loadSongs();
+})();
--- a/public/js/setlist.js
+++ b/public/js/setlist.js
@ -0,0 +1,194 @@
+let me = null;
+let allSongs = [];
+let setlist = null;
+let editRows = [];
+
+function formatDate(dateStr) {
+  const d = new Date(dateStr);
+  return d.toLocaleDateString('fr-FR', { weekday: 'long', year: 'numeric', month: 'long', day: 'numeric' });
+}
+
+function songOptions(selectedId) {
+  return allSongs
+    .map((s) => `<option value="${s.id}" ${s.id === selectedId ? 'selected' : ''}>${escapeHtml(s.title)} — ${escapeHtml(s.artist)}</option>`)
+    .join('');
+}
+
+function readOnlyView() {
+  const main = setlist.songs.filter((s) => !s.is_encore);
+  const encore = setlist.songs.filter((s) => s.is_encore);
+  return `
+    <div class="card">
+      <div class="card-title">${escapeHtml(setlist.name || 'Concert')}</div>
+      <div class="card-subtitle">${escapeHtml(setlist.venue || '')} · ${formatDate(setlist.concert_date)}</div>
+    </div>
+    <div class="setlist-section">
+      <h3>Setlist</h3>
+      ${main.length
+        ? `<ol class="setlist">${main.map((s) => `<li>${escapeHtml(s.title)} — ${escapeHtml(s.artist)}${s.note ? `<span class="note">${escapeHtml(s.note)}</span>` : ''}</li>`).join('')}</ol>`
+        : '<p class="empty">Aucun morceau pour le moment.</p>'}
+    </div>
+    <div class="setlist-section">
+      <h3>Rappel</h3>
+      ${encore.length
+        ? `<ol class="setlist">${encore.map((s) => `<li>${escapeHtml(s.title)} — ${escapeHtml(s.artist)}${s.note ? `<span class="note">${escapeHtml(s.note)}</span>` : ''}</li>`).join('')}</ol>`
+        : '<p class="empty">Aucun morceau de rappel prévu.</p>'}
+    </div>
+    ${me.isAdmin ? '<button id="edit-btn" class="secondary">Modifier la setlist</button>' : ''}
+  `;
+}
+
+function editRowTemplate(row, index) {
+  return `
+    <div class="card" data-row-index="${index}">
+      <div class="inline-form">
+        <label>Morceau
+          <select data-field="songId">${songOptions(row.songId)}</select>
+        </label>
+        <label>Position <input type="number" min="1" value="${row.position}" data-field="position" style="width:4rem"></label>
+        <label>Note <input value="${escapeHtml(row.note || '')}" data-field="note"></label>
+        <label><input type="checkbox" ${row.isEncore ? 'checked' : ''} data-field="isEncore"> Rappel</label>
+        <button type="button" class="danger remove-row" data-index="${index}">Retirer</button>
+      </div>
+    </div>
+  `;
+}
+
+function editView() {
+  return `
+    <div class="card">
+      <h3>Détails du concert</h3>
+      <form id="meta-form" class="inline-form">
+        <label>Nom <input name="name" value="${escapeHtml(setlist?.name || '')}"></label>
+        <label>Lieu <input name="venue" value="${escapeHtml(setlist?.venue || '')}"></label>
+        <label>Date <input type="date" name="concertDate" value="${setlist ? setlist.concert_date.slice(0, 10) : ''}" required></label>
+        <button type="submit">${setlist ? 'Enregistrer' : 'Créer le concert'}</button>
+      </form>
+    </div>
+    ${setlist ? `
+    <div id="rows-container">
+      ${editRows.map(editRowTemplate).join('')}
+    </div>
+    <div class="inline-form">
+      <button type="button" id="add-row-btn" class="secondary">Ajouter un morceau</button>
+      <button type="button" id="save-songs-btn">Enregistrer la setlist</button>
+      <button type="button" id="cancel-edit-btn" class="secondary">Annuler</button>
+    </div>` : ''}
+  `;
+}
+
+function renderReadOnly() {
+  const container = document.getElementById('content');
+  if (!setlist) {
+    container.innerHTML = me.isAdmin
+      ? `<p class="empty">Aucun concert à venir.</p>${editView()}`
+      : '<p class="empty">Aucun concert à venir pour le moment.</p>';
+    if (me.isAdmin) attachMetaFormHandler();
+    return;
+  }
+  container.innerHTML = readOnlyView();
+  const editBtn = document.getElementById('edit-btn');
+  if (editBtn) editBtn.addEventListener('click', enterEditMode);
+}
+
+function enterEditMode() {
+  editRows = setlist.songs.map((s) => ({
+    setlistSongId: s.id,
+    songId: s.song_id,
+    position: s.position,
+    note: s.note,
+    isEncore: s.is_encore,
+  }));
+  renderEdit();
+}
+
+function renderEdit() {
+  const container = document.getElementById('content');
+  container.innerHTML = editView();
+  attachMetaFormHandler();
+  attachEditHandlers();
+}
+
+function attachMetaFormHandler() {
+  const form = document.getElementById('meta-form');
+  if (!form) return;
+  form.addEventListener('submit', async (e) => {
+    e.preventDefault();
+    const name = form.name.value.trim();
+    const venue = form.venue.value.trim();
+    const concertDate = form.concertDate.value;
+    try {
+      if (setlist) {
+        setlist = await api.patch(`/api/setlists/${setlist.id}`, { name, venue, concertDate });
+        setlist.songs = (await api.get(`/api/setlists/${setlist.id}`)).songs;
+      } else {
+        setlist = await api.post('/api/setlists', { name, venue, concertDate });
+        setlist.songs = [];
+      }
+      enterEditMode();
+    } catch (err) {
+      showError(err.message);
+    }
+  });
+}
+
+function attachEditHandlers() {
+  document.querySelectorAll('.remove-row').forEach((btn) => {
+    btn.addEventListener('click', () => {
+      editRows.splice(parseInt(btn.dataset.index, 10), 1);
+      renderEdit();
+    });
+  });
+  document.querySelectorAll('[data-row-index]').forEach((rowEl) => {
+    const index = parseInt(rowEl.dataset.rowIndex, 10);
+    rowEl.querySelectorAll('[data-field]').forEach((input) => {
+      input.addEventListener('change', () => {
+        const field = input.dataset.field;
+        if (field === 'isEncore') editRows[index][field] = input.checked;
+        else if (field === 'position') editRows[index][field] = parseInt(input.value, 10);
+        else if (field === 'songId') editRows[index][field] = parseInt(input.value, 10);
+        else editRows[index][field] = input.value;
+      });
+    });
+  });
+  const addBtn = document.getElementById('add-row-btn');
+  if (addBtn) {
+    addBtn.addEventListener('click', () => {
+      const nextPos = editRows.filter((r) => !r.isEncore).length + 1;
+      editRows.push({ songId: allSongs[0]?.id, position: nextPos, note: '', isEncore: false });
+      renderEdit();
+    });
+  }
+  const saveBtn = document.getElementById('save-songs-btn');
+  if (saveBtn) {
+    saveBtn.addEventListener('click', async () => {
+      try {
+        const payload = editRows.map((r) => ({
+          songId: r.songId,
+          position: r.position,
+          note: r.note,
+          isEncore: !!r.isEncore,
+        }));
+        setlist = await api.put(`/api/setlists/${setlist.id}/songs`, { songs: payload });
+        renderReadOnly();
+      } catch (err) {
+        showError(err.message);
+      }
+    });
+  }
+  const cancelBtn = document.getElementById('cancel-edit-btn');
+  if (cancelBtn) cancelBtn.addEventListener('click', renderReadOnly);
+}
+
+function showError(message) {
+  document.getElementById('error').innerHTML = `<div class="error-banner">${escapeHtml(message)}</div>`;
+}
+
+(async function init() {
+  me = await initNav('setlist');
+  if (me.isAdmin) {
+    allSongs = await api.get('/api/songs');
+  }
+  setlist = await api.get('/api/setlists/next');
+  renderReadOnly();
+})();
--- a/public/js/suggestions.js
+++ b/public/js/suggestions.js
@ -0,0 +1,190 @@
+let me = null;
+let suggestions = [];
+const expanded = new Set();
+
+async function loadSuggestions() {
+  suggestions = await api.get('/api/suggestions');
+  renderSuggestions();
+}
+
+function statusLabel(status) {
+  return { pending: 'En attente', approved: 'Approuvé', rejected: 'Rejeté' }[status] || status;
+}
+
+function suggestionTemplate(s) {
+  const isOpen = expanded.has(s.id);
+  const embed = youtubeEmbedUrl(s.youtube_url);
+  return `
+    <div class="card" data-suggestion-id="${s.id}">
+      <div class="card-header">
+        <div>
+          <div class="card-title">${escapeHtml(s.title)}${s.artist ? ` — ${escapeHtml(s.artist)}` : ''}</div>
+          <div class="card-subtitle">Proposé par ${escapeHtml(s.suggested_by_name)} · ${statusLabel(s.status)}</div>
+        </div>
+        <button class="secondary toggle-detail" data-id="${s.id}">${isOpen ? 'Masquer' : 'Voir / voter'}</button>
+      </div>
+      <div class="vote-tally">
+        <span class="approve">✔ ${s.approve_count}</span>
+        <span class="reject">✘ ${s.reject_count}</span>
+      </div>
+      <div class="detail-panel" style="${isOpen ? '' : 'display:none'}" data-detail-for="${s.id}">
+        <p class="empty">Chargement…</p>
+      </div>
+    </div>
+  `;
+}
+
+function detailTemplate(s) {
+  const embed = youtubeEmbedUrl(s.youtube_url);
+  const myVote = s.votes.find((v) => v.user_id === me.id);
+  return `
+    ${embed ? `<div class="youtube-embed"><iframe src="${embed}" allowfullscreen></iframe></div>` : `<p><a href="${escapeHtml(s.youtube_url)}" target="_blank" rel="noopener">${escapeHtml(s.youtube_url)}</a></p>`}
+
+    <form class="inline-form vote-form" data-id="${s.id}">
+      <label>Mon vote
+        <select name="vote">
+          <option value="approve" ${myVote?.vote === 'approve' ? 'selected' : ''}>J'approuve</option>
+          <option value="reject" ${myVote?.vote === 'reject' ? 'selected' : ''}>Je rejette</option>
+        </select>
+      </label>
+      <label>Commentaire <input name="comment" value="${escapeHtml(myVote?.comment || '')}" placeholder="pourquoi ?"></label>
+      <button type="submit">${myVote ? 'Mettre à jour mon vote' : 'Voter'}</button>
+    </form>
+
+    <div class="vote-list">
+      ${s.votes.length ? s.votes.map(voteItemTemplate).join('') : '<p class="empty">Aucun vote pour le moment.</p>'}
+    </div>
+
+    ${me.isAdmin ? `
+    <form class="inline-form admin-actions" data-id="${s.id}">
+      <button type="button" class="promote-btn" data-id="${s.id}" ${s.promoted_song_id ? 'disabled' : ''}>
+        ${s.promoted_song_id ? 'Déjà au répertoire' : 'Promouvoir au répertoire'}
+      </button>
+      <button type="button" class="secondary reject-btn" data-id="${s.id}">Marquer rejeté</button>
+      <button type="button" class="danger delete-btn" data-id="${s.id}">Supprimer</button>
+    </form>` : ''}
+  `;
+}
+
+function voteItemTemplate(v) {
+  const icon = v.vote === 'approve' ? '✔' : '✘';
+  return `
+    <div class="vote-item">
+      <span class="voter">${escapeHtml(v.voter_name)}</span> ${icon}
+      ${v.comment ? `— ${escapeHtml(v.comment)}` : ''}
+    </div>
+  `;
+}
+
+function renderSuggestions() {
+  const container = document.getElementById('suggestions-list');
+  renderList(container, suggestions, suggestionTemplate, 'Aucune suggestion pour le moment.');
+  document.querySelectorAll('.toggle-detail').forEach((btn) => {
+    btn.addEventListener('click', () => onToggleDetail(parseInt(btn.dataset.id, 10)));
+  });
+}
+
+async function onToggleDetail(id) {
+  if (expanded.has(id)) {
+    expanded.delete(id);
+  } else {
+    expanded.add(id);
+  }
+  renderSuggestions();
+  if (expanded.has(id)) {
+    await loadDetail(id);
+  }
+}
+
+async function loadDetail(id) {
+  try {
+    const detail = await api.get(`/api/suggestions/${id}`);
+    const container = document.querySelector(`[data-detail-for="${id}"]`);
+    if (!container) return;
+    container.innerHTML = detailTemplate(detail);
+    container.querySelector('.vote-form').addEventListener('submit', (e) => onVote(e, id));
+    const promoteBtn = container.querySelector('.promote-btn');
+    if (promoteBtn) promoteBtn.addEventListener('click', () => onPromote(id));
+    const rejectBtn = container.querySelector('.reject-btn');
+    if (rejectBtn) rejectBtn.addEventListener('click', () => onReject(id));
+    const deleteBtn = container.querySelector('.delete-btn');
+    if (deleteBtn) deleteBtn.addEventListener('click', () => onDelete(id));
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+async function onVote(e, id) {
+  e.preventDefault();
+  const form = e.target;
+  const vote = form.vote.value;
+  const comment = form.comment.value.trim();
+  try {
+    await api.post(`/api/suggestions/${id}/vote`, { vote, comment });
+    await loadSuggestions();
+    expanded.add(id);
+    renderSuggestions();
+    await loadDetail(id);
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+async function onPromote(id) {
+  try {
+    await api.post(`/api/suggestions/${id}/promote`, {});
+    await loadSuggestions();
+    expanded.add(id);
+    renderSuggestions();
+    await loadDetail(id);
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+async function onReject(id) {
+  try {
+    await api.patch(`/api/suggestions/${id}`, { status: 'rejected' });
+    await loadSuggestions();
+    expanded.add(id);
+    renderSuggestions();
+    await loadDetail(id);
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+async function onDelete(id) {
+  try {
+    await api.del(`/api/suggestions/${id}`);
+    expanded.delete(id);
+    await loadSuggestions();
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+async function onAddSuggestion(e) {
+  e.preventDefault();
+  const form = e.target;
+  const title = form.title.value.trim();
+  const artist = form.artist.value.trim();
+  const youtubeUrl = form.youtubeUrl.value.trim();
+  try {
+    await api.post('/api/suggestions', { title, artist, youtubeUrl });
+    form.reset();
+    await loadSuggestions();
+  } catch (err) {
+    showError(err.message);
+  }
+}
+
+function showError(message) {
+  document.getElementById('error').innerHTML = `<div class="error-banner">${escapeHtml(message)}</div>`;
+}
+
+(async function init() {
+  me = await initNav('suggestions');
+  document.getElementById('add-suggestion-form').addEventListener('submit', onAddSuggestion);
+  await loadSuggestions();
+})();
--- a/public/setlist.html
+++ b/public/setlist.html
@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="fr">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Prochain concert — Octane</title>
+<link rel="stylesheet" href="/css/style.css">
+</head>
+<body>
+<header class="app-header">
+  <nav id="main-nav"></nav>
+</header>
+<main>
+  <h1>Prochain concert</h1>
+  <div id="error"></div>
+  <div id="content">Chargement…</div>
+</main>
+
+<script src="/js/api.js"></script>
+<script src="/js/render.js"></script>
+<script src="/js/nav.js"></script>
+<script src="/js/setlist.js"></script>
+</body>
+</html>
--- a/public/suggestions.html
+++ b/public/suggestions.html
@ -0,0 +1,34 @@
+<!doctype html>
+<html lang="fr">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Suggestions — Octane</title>
+<link rel="stylesheet" href="/css/style.css">
+</head>
+<body>
+<header class="app-header">
+  <nav id="main-nav"></nav>
+</header>
+<main>
+  <h1>Suggestions de morceaux</h1>
+  <div id="error"></div>
+
+  <h2>Proposer un morceau</h2>
+  <form id="add-suggestion-form" class="inline-form">
+    <label>Titre <input name="title" required></label>
+    <label>Artiste <input name="artist"></label>
+    <label>Lien YouTube <input name="youtubeUrl" type="url" required placeholder="https://youtube.com/watch?v=..."></label>
+    <button type="submit">Proposer</button>
+  </form>
+
+  <h2>Toutes les suggestions</h2>
+  <div id="suggestions-list"></div>
+</main>
+
+<script src="/js/api.js"></script>
+<script src="/js/render.js"></script>
+<script src="/js/nav.js"></script>
+<script src="/js/suggestions.js"></script>
+</body>
+</html>
--- a/src/app.js
+++ b/src/app.js
@ -0,0 +1,37 @@
+const path = require('path');
+const express = require('express');
+const sessionMiddleware = require('./auth/session');
+const authRoutes = require('./auth/routes');
+const { attachUser, requireAuth } = require('./auth/middleware');
+const apiRouter = require('./routes');
+
+function createApp() {
+  const app = express();
+
+  app.get('/health', (req, res) => res.status(200).json({ status: 'ok' }));
+
+  app.use(express.json());
+  app.use(sessionMiddleware);
+  app.use('/auth', authRoutes);
+  app.use(attachUser);
+
+  app.use('/api', requireAuth, apiRouter);
+  app.use(requireAuth, express.static(path.join(__dirname, '../public')));
+
+  app.use((req, res) => {
+    res.status(404).json({ error: 'not_found' });
+  });
+
+  // eslint-disable-next-line no-unused-vars
+  app.use((err, req, res, next) => {
+    console.error(err);
+    if (req.path.startsWith('/api/')) {
+      return res.status(500).json({ error: 'internal_error' });
+    }
+    res.status(500).send('Une erreur est survenue.');
+  });
+
+  return app;
+}
+
+module.exports = createApp;
--- a/src/auth/middleware.js
+++ b/src/auth/middleware.js
@ -0,0 +1,31 @@
+const usersRepo = require('../repositories/usersRepo');
+
+async function attachUser(req, res, next) {
+  try {
+    if (req.session.userId) {
+      req.user = await usersRepo.findById(req.session.userId);
+    }
+    next();
+  } catch (err) {
+    next(err);
+  }
+}
+
+function requireAuth(req, res, next) {
+  if (!req.user) {
+    if (req.path.startsWith('/api/')) {
+      return res.status(401).json({ error: 'unauthenticated' });
+    }
+    return res.redirect(`/auth/login?returnTo=${encodeURIComponent(req.originalUrl)}`);
+  }
+  next();
+}
+
+function requireAdmin(req, res, next) {
+  if (!req.user || !req.user.is_admin) {
+    return res.status(403).json({ error: 'forbidden' });
+  }
+  next();
+}
+
+module.exports = { attachUser, requireAuth, requireAdmin };
--- a/src/auth/oidc.js
+++ b/src/auth/oidc.js
@ -0,0 +1,20 @@
+const client = require('openid-client');
+const config = require('../config');
+
+let oidcConfig = null;
+
+async function initOidc() {
+  oidcConfig = await client.discovery(
+    new URL(config.authentikIssuerUrl),
+    config.oidcClientId,
+    config.oidcClientSecret
+  );
+  return oidcConfig;
+}
+
+function getOidcConfig() {
+  if (!oidcConfig) throw new Error('OIDC not initialized yet');
+  return oidcConfig;
+}
+
+module.exports = { initOidc, getOidcConfig, client };
--- a/src/auth/routes.js
+++ b/src/auth/routes.js
@ -0,0 +1,88 @@
+const express = require('express');
+const { client, getOidcConfig } = require('./oidc');
+const usersRepo = require('../repositories/usersRepo');
+const config = require('../config');
+const asyncHandler = require('../lib/asyncHandler');
+
+const router = express.Router();
+
+router.get(
+  '/login',
+  asyncHandler(async (req, res) => {
+    const oidcConfig = getOidcConfig();
+    const codeVerifier = client.randomPKCECodeVerifier();
+    const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+    const state = client.randomState();
+    const nonce = client.randomNonce();
+
+    req.session.oidc = { codeVerifier, state, nonce };
+    if (req.query.returnTo) {
+      req.session.returnTo = req.query.returnTo;
+    }
+
+    const authUrl = client.buildAuthorizationUrl(oidcConfig, {
+      scope: 'openid profile email groups',
+      redirect_uri: config.oidcRedirectUri,
+      state,
+      nonce,
+      code_challenge: codeChallenge,
+      code_challenge_method: 'S256',
+    });
+
+    res.redirect(authUrl.href);
+  })
+);
+
+router.get(
+  '/callback',
+  asyncHandler(async (req, res) => {
+    const oidcConfig = getOidcConfig();
+    const pending = req.session.oidc;
+    if (!pending) {
+      return res.status(400).send('Session de connexion expirée, réessayez.');
+    }
+
+    const currentUrl = new URL(
+      req.originalUrl,
+      `${req.protocol}://${req.get('host')}`
+    );
+
+    const tokens = await client.authorizationCodeGrant(oidcConfig, currentUrl, {
+      pkceCodeVerifier: pending.codeVerifier,
+      expectedState: pending.state,
+      expectedNonce: pending.nonce,
+    });
+
+    const claims = tokens.claims();
+    const groups = Array.isArray(claims.groups) ? claims.groups : [];
+    const isAdmin = groups.includes(config.adminGroupName);
+
+    const user = await usersRepo.upsertFromClaims({
+      sub: claims.sub,
+      name: claims.name || claims.preferred_username || claims.email || claims.sub,
+      email: claims.email || null,
+      isAdmin,
+    });
+
+    const returnTo = req.session.returnTo || '/';
+    delete req.session.oidc;
+    delete req.session.returnTo;
+
+    req.session.regenerate((err) => {
+      if (err) throw err;
+      req.session.userId = user.id;
+      req.session.save((saveErr) => {
+        if (saveErr) throw saveErr;
+        res.redirect(returnTo);
+      });
+    });
+  })
+);
+
+router.get('/logout', (req, res) => {
+  req.session.destroy(() => {
+    res.redirect('/');
+  });
+});
+
+module.exports = router;
--- a/src/auth/session.js
+++ b/src/auth/session.js
@ -0,0 +1,22 @@
+const session = require('express-session');
+const pgSessionFactory = require('connect-pg-simple');
+const pool = require('../db/pool');
+const config = require('../config');
+
+const PgSession = pgSessionFactory(session);
+
+module.exports = session({
+  store: new PgSession({
+    pool,
+    createTableIfMissing: true,
+  }),
+  secret: config.sessionSecret,
+  resave: false,
+  saveUninitialized: false,
+  cookie: {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: config.nodeEnv === 'production',
+    maxAge: 1000 * 60 * 60 * 24 * 30,
+  },
+});
--- a/src/config.js
+++ b/src/config.js
@ -0,0 +1,21 @@
+require('dotenv').config();
+
+function required(name) {
+  const value = process.env[name];
+  if (!value && process.env.NODE_ENV !== 'test') {
+    throw new Error(`Missing required env var: ${name}`);
+  }
+  return value;
+}
+
+module.exports = {
+  nodeEnv: process.env.NODE_ENV || 'development',
+  port: parseInt(process.env.PORT, 10) || 3000,
+  databaseUrl: required('DATABASE_URL'),
+  sessionSecret: required('SESSION_SECRET'),
+  authentikIssuerUrl: required('AUTHENTIK_ISSUER_URL'),
+  oidcClientId: required('OIDC_CLIENT_ID'),
+  oidcClientSecret: required('OIDC_CLIENT_SECRET'),
+  oidcRedirectUri: required('OIDC_REDIRECT_URI'),
+  adminGroupName: process.env.ADMIN_GROUP_NAME || 'octane-admins',
+};
--- a/src/db/migrate.js
+++ b/src/db/migrate.js
@ -0,0 +1,56 @@
+const fs = require('fs');
+const path = require('path');
+const pool = require('./pool');
+
+const MIGRATIONS_DIR = path.join(__dirname, 'migrations');
+
+async function runMigrations() {
+  const client = await pool.connect();
+  try {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS schema_migrations (
+        filename   TEXT PRIMARY KEY,
+        applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      );
+    `);
+
+    const { rows } = await client.query('SELECT filename FROM schema_migrations');
+    const applied = new Set(rows.map((r) => r.filename));
+
+    const files = fs
+      .readdirSync(MIGRATIONS_DIR)
+      .filter((f) => f.endsWith('.sql'))
+      .sort();
+
+    for (const file of files) {
+      if (applied.has(file)) continue;
+      const sql = fs.readFileSync(path.join(MIGRATIONS_DIR, file), 'utf8');
+      console.log(`Applying migration: ${file}`);
+      await client.query('BEGIN');
+      try {
+        await client.query(sql);
+        await client.query('INSERT INTO schema_migrations (filename) VALUES ($1)', [file]);
+        await client.query('COMMIT');
+      } catch (err) {
+        await client.query('ROLLBACK');
+        throw err;
+      }
+    }
+  } finally {
+    client.release();
+  }
+}
+
+if (require.main === module) {
+  runMigrations()
+    .then(() => {
+      console.log('Migrations complete.');
+      return pool.end();
+    })
+    .catch((err) => {
+      console.error('Migration failed:', err);
+      process.exit(1);
+    });
+}
+
+module.exports = { runMigrations };
--- a/src/db/migrations/001_init.sql
+++ b/src/db/migrations/001_init.sql
@ -0,0 +1,92 @@
+-- Users, keyed by Authentik OIDC "sub" claim
+CREATE TABLE users (
+    id            SERIAL PRIMARY KEY,
+    authentik_sub TEXT NOT NULL UNIQUE,
+    name          TEXT NOT NULL,
+    email         TEXT,
+    is_admin      BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Instruments (fixed-ish list)
+CREATE TABLE instruments (
+    id   SERIAL PRIMARY KEY,
+    name TEXT NOT NULL UNIQUE
+);
+
+-- Repertoire
+CREATE TABLE songs (
+    id         SERIAL PRIMARY KEY,
+    title      TEXT NOT NULL,
+    artist     TEXT NOT NULL,
+    notes      TEXT,
+    added_by   INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Per-song, per-instrument tutorial/resource links
+CREATE TABLE song_tutorials (
+    id            SERIAL PRIMARY KEY,
+    song_id       INTEGER NOT NULL REFERENCES songs(id) ON DELETE CASCADE,
+    instrument_id INTEGER NOT NULL REFERENCES instruments(id) ON DELETE RESTRICT,
+    url           TEXT NOT NULL,
+    label         TEXT,
+    added_by      INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX idx_song_tutorials_song_id ON song_tutorials(song_id);
+
+-- Song suggestions
+CREATE TABLE suggestions (
+    id               SERIAL PRIMARY KEY,
+    title            TEXT NOT NULL,
+    artist           TEXT,
+    youtube_url      TEXT NOT NULL,
+    suggested_by     INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    status           TEXT NOT NULL DEFAULT 'pending'
+                     CHECK (status IN ('pending', 'approved', 'rejected')),
+    promoted_song_id INTEGER REFERENCES songs(id) ON DELETE SET NULL,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Votes/comments on suggestions, one per user per suggestion
+CREATE TABLE suggestion_votes (
+    id            SERIAL PRIMARY KEY,
+    suggestion_id INTEGER NOT NULL REFERENCES suggestions(id) ON DELETE CASCADE,
+    user_id       INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    vote          TEXT NOT NULL CHECK (vote IN ('approve', 'reject')),
+    comment       TEXT,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (suggestion_id, user_id)
+);
+
+-- Concerts / setlists
+CREATE TABLE setlists (
+    id           SERIAL PRIMARY KEY,
+    name         TEXT,
+    venue        TEXT,
+    concert_date DATE NOT NULL,
+    created_by   INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Songs within a setlist, ordered, with per-song note and encore flag
+CREATE TABLE setlist_songs (
+    id         SERIAL PRIMARY KEY,
+    setlist_id INTEGER NOT NULL REFERENCES setlists(id) ON DELETE CASCADE,
+    song_id    INTEGER NOT NULL REFERENCES songs(id) ON DELETE RESTRICT,
+    position   INTEGER NOT NULL,
+    note       TEXT,
+    is_encore  BOOLEAN NOT NULL DEFAULT FALSE,
+    UNIQUE (setlist_id, song_id)
+);
+CREATE INDEX idx_setlist_songs_setlist_id ON setlist_songs(setlist_id);
+CREATE UNIQUE INDEX uq_setlist_position_main
+    ON setlist_songs(setlist_id, position) WHERE NOT is_encore;
+CREATE UNIQUE INDEX uq_setlist_position_encore
+    ON setlist_songs(setlist_id, position) WHERE is_encore;
--- a/src/db/migrations/002_seed_instruments.sql
+++ b/src/db/migrations/002_seed_instruments.sql
@ -0,0 +1,4 @@
+INSERT INTO instruments (name) VALUES
+    ('chant'), ('guitare'), ('basse'), ('batterie'), ('clavier'),
+    ('percussions'), ('cuivres'), ('autre')
+ON CONFLICT (name) DO NOTHING;
--- a/src/db/pool.js
+++ b/src/db/pool.js
@ -0,0 +1,6 @@
+const { Pool } = require('pg');
+const config = require('../config');
+
+const pool = new Pool({ connectionString: config.databaseUrl });
+
+module.exports = pool;
--- a/src/lib/asyncHandler.js
+++ b/src/lib/asyncHandler.js
@ -0,0 +1,3 @@
+module.exports = function asyncHandler(fn) {
+  return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
+};
--- a/src/lib/youtube.js
+++ b/src/lib/youtube.js
@ -0,0 +1,28 @@
+const YOUTUBE_HOSTS = new Set(['youtube.com', 'www.youtube.com', 'youtu.be', 'm.youtube.com']);
+
+function extractVideoId(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (!YOUTUBE_HOSTS.has(parsed.hostname)) return null;
+
+  if (parsed.hostname === 'youtu.be') {
+    return parsed.pathname.slice(1) || null;
+  }
+  if (parsed.pathname === '/watch') {
+    return parsed.searchParams.get('v');
+  }
+  if (parsed.pathname.startsWith('/embed/')) {
+    return parsed.pathname.split('/embed/')[1] || null;
+  }
+  return null;
+}
+
+function isValidYoutubeUrl(url) {
+  return extractVideoId(url) !== null;
+}
+
+module.exports = { extractVideoId, isValidYoutubeUrl };
--- a/src/repositories/instrumentsRepo.js
+++ b/src/repositories/instrumentsRepo.js
@ -0,0 +1,8 @@
+const pool = require('../db/pool');
+
+async function findAll() {
+  const { rows } = await pool.query('SELECT id, name FROM instruments ORDER BY name');
+  return rows;
+}
+
+module.exports = { findAll };
--- a/src/repositories/setlistsRepo.js
+++ b/src/repositories/setlistsRepo.js
@ -0,0 +1,118 @@
+const pool = require('../db/pool');
+
+async function findNext() {
+  const { rows } = await pool.query(
+    `SELECT id, name, venue, concert_date, created_by, created_at, updated_at
+     FROM setlists
+     WHERE concert_date >= CURRENT_DATE
+     ORDER BY concert_date ASC
+     LIMIT 1`
+  );
+  return rows[0] || null;
+}
+
+async function findHistory() {
+  const { rows } = await pool.query(
+    `SELECT id, name, venue, concert_date, created_by, created_at, updated_at
+     FROM setlists
+     WHERE concert_date < CURRENT_DATE
+     ORDER BY concert_date DESC`
+  );
+  return rows;
+}
+
+async function findById(id) {
+  const { rows } = await pool.query(
+    `SELECT id, name, venue, concert_date, created_by, created_at, updated_at
+     FROM setlists WHERE id = $1`,
+    [id]
+  );
+  return rows[0] || null;
+}
+
+async function findSongs(setlistId) {
+  const { rows } = await pool.query(
+    `SELECT ss.id, ss.setlist_id, ss.song_id, s.title, s.artist, ss.position, ss.note, ss.is_encore
+     FROM setlist_songs ss
+     JOIN songs s ON s.id = ss.song_id
+     WHERE ss.setlist_id = $1
+     ORDER BY ss.is_encore, ss.position`,
+    [setlistId]
+  );
+  return rows;
+}
+
+async function create({ name, venue, concertDate, createdBy }) {
+  const { rows } = await pool.query(
+    `INSERT INTO setlists (name, venue, concert_date, created_by)
+     VALUES ($1, $2, $3, $4)
+     RETURNING id, name, venue, concert_date, created_by, created_at, updated_at`,
+    [name || null, venue || null, concertDate, createdBy]
+  );
+  return rows[0];
+}
+
+async function update(id, { name, venue, concertDate }) {
+  const { rows } = await pool.query(
+    `UPDATE setlists SET name = $2, venue = $3, concert_date = $4, updated_at = now()
+     WHERE id = $1
+     RETURNING id, name, venue, concert_date, created_by, created_at, updated_at`,
+    [id, name || null, venue || null, concertDate]
+  );
+  return rows[0] || null;
+}
+
+async function remove(id) {
+  await pool.query('DELETE FROM setlists WHERE id = $1', [id]);
+}
+
+async function replaceSongs(setlistId, songEntries) {
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    await client.query('DELETE FROM setlist_songs WHERE setlist_id = $1', [setlistId]);
+    for (const entry of songEntries) {
+      await client.query(
+        `INSERT INTO setlist_songs (setlist_id, song_id, position, note, is_encore)
+         VALUES ($1, $2, $3, $4, $5)`,
+        [setlistId, entry.songId, entry.position, entry.note || null, !!entry.isEncore]
+      );
+    }
+    await client.query('COMMIT');
+  } catch (err) {
+    await client.query('ROLLBACK');
+    throw err;
+  } finally {
+    client.release();
+  }
+}
+
+async function addSong(setlistId, { songId, position, note, isEncore }) {
+  const { rows } = await pool.query(
+    `INSERT INTO setlist_songs (setlist_id, song_id, position, note, is_encore)
+     VALUES ($1, $2, $3, $4, $5)
+     RETURNING id, setlist_id, song_id, position, note, is_encore`,
+    [setlistId, songId, position, note || null, !!isEncore]
+  );
+  return rows[0];
+}
+
+async function removeSong(setlistId, setlistSongId) {
+  await pool.query('DELETE FROM setlist_songs WHERE id = $1 AND setlist_id = $2', [
+    setlistSongId,
+    setlistId,
+  ]);
+}
+
+module.exports = {
+  findNext,
+  findHistory,
+  findById,
+  findSongs,
+  create,
+  update,
+  remove,
+  replaceSongs,
+  addSong,
+  removeSong,
+};
--- a/src/repositories/songsRepo.js
+++ b/src/repositories/songsRepo.js
@ -0,0 +1,86 @@
+const pool = require('../db/pool');
+
+async function findAll() {
+  const { rows } = await pool.query(`
+    SELECT s.id, s.title, s.artist, s.notes, s.created_at,
+           COUNT(st.id)::int AS tutorial_count
+    FROM songs s
+    LEFT JOIN song_tutorials st ON st.song_id = s.id
+    GROUP BY s.id
+    ORDER BY s.title
+  `);
+  return rows;
+}
+
+async function findById(id) {
+  const { rows } = await pool.query(
+    'SELECT id, title, artist, notes, added_by, created_at, updated_at FROM songs WHERE id = $1',
+    [id]
+  );
+  return rows[0] || null;
+}
+
+async function create({ title, artist, notes, addedBy }) {
+  const { rows } = await pool.query(
+    `INSERT INTO songs (title, artist, notes, added_by)
+     VALUES ($1, $2, $3, $4)
+     RETURNING id, title, artist, notes, added_by, created_at, updated_at`,
+    [title, artist, notes || null, addedBy]
+  );
+  return rows[0];
+}
+
+async function update(id, { title, artist, notes }) {
+  const { rows } = await pool.query(
+    `UPDATE songs SET title = $2, artist = $3, notes = $4, updated_at = now()
+     WHERE id = $1
+     RETURNING id, title, artist, notes, added_by, created_at, updated_at`,
+    [id, title, artist, notes || null]
+  );
+  return rows[0] || null;
+}
+
+async function remove(id) {
+  await pool.query('DELETE FROM songs WHERE id = $1', [id]);
+}
+
+async function findTutorials(songId) {
+  const { rows } = await pool.query(
+    `SELECT st.id, st.song_id, st.instrument_id, i.name AS instrument_name,
+            st.url, st.label, st.added_by, st.created_at
+     FROM song_tutorials st
+     JOIN instruments i ON i.id = st.instrument_id
+     WHERE st.song_id = $1
+     ORDER BY i.name`,
+    [songId]
+  );
+  return rows;
+}
+
+async function addTutorial(songId, { instrumentId, url, label, addedBy }) {
+  const { rows } = await pool.query(
+    `INSERT INTO song_tutorials (song_id, instrument_id, url, label, added_by)
+     VALUES ($1, $2, $3, $4, $5)
+     RETURNING id, song_id, instrument_id, url, label, added_by, created_at`,
+    [songId, instrumentId, url, label || null, addedBy]
+  );
+  return rows[0];
+}
+
+async function removeTutorial(songId, tutorialId) {
+  await pool.query('DELETE FROM song_tutorials WHERE id = $1 AND song_id = $2', [
+    tutorialId,
+    songId,
+  ]);
+}
+
+module.exports = {
+  findAll,
+  findById,
+  create,
+  update,
+  remove,
+  findTutorials,
+  addTutorial,
+  removeTutorial,
+};
--- a/src/repositories/suggestionsRepo.js
+++ b/src/repositories/suggestionsRepo.js
@ -0,0 +1,127 @@
+const pool = require('../db/pool');
+
+async function findAll() {
+  const { rows } = await pool.query(`
+    SELECT sg.id, sg.title, sg.artist, sg.youtube_url, sg.status, sg.promoted_song_id,
+           sg.created_at, sg.suggested_by, u.name AS suggested_by_name,
+           COUNT(*) FILTER (WHERE v.vote = 'approve')::int AS approve_count,
+           COUNT(*) FILTER (WHERE v.vote = 'reject')::int AS reject_count
+    FROM suggestions sg
+    JOIN users u ON u.id = sg.suggested_by
+    LEFT JOIN suggestion_votes v ON v.suggestion_id = sg.id
+    GROUP BY sg.id, u.name
+    ORDER BY sg.created_at DESC
+  `);
+  return rows;
+}
+
+async function findById(id) {
+  const { rows } = await pool.query(
+    `SELECT sg.id, sg.title, sg.artist, sg.youtube_url, sg.status, sg.promoted_song_id,
+            sg.created_at, sg.suggested_by, u.name AS suggested_by_name
+     FROM suggestions sg
+     JOIN users u ON u.id = sg.suggested_by
+     WHERE sg.id = $1`,
+    [id]
+  );
+  return rows[0] || null;
+}
+
+async function findVotes(suggestionId) {
+  const { rows } = await pool.query(
+    `SELECT v.id, v.user_id, u.name AS voter_name, v.vote, v.comment, v.created_at, v.updated_at
+     FROM suggestion_votes v
+     JOIN users u ON u.id = v.user_id
+     WHERE v.suggestion_id = $1
+     ORDER BY v.created_at`,
+    [suggestionId]
+  );
+  return rows;
+}
+
+async function create({ title, artist, youtubeUrl, suggestedBy }) {
+  const { rows } = await pool.query(
+    `INSERT INTO suggestions (title, artist, youtube_url, suggested_by)
+     VALUES ($1, $2, $3, $4)
+     RETURNING id, title, artist, youtube_url, status, promoted_song_id, created_at, suggested_by`,
+    [title, artist || null, youtubeUrl, suggestedBy]
+  );
+  return rows[0];
+}
+
+async function updateStatus(id, status) {
+  const { rows } = await pool.query(
+    `UPDATE suggestions SET status = $2, updated_at = now() WHERE id = $1
+     RETURNING id, title, artist, youtube_url, status, promoted_song_id, created_at, suggested_by`,
+    [id, status]
+  );
+  return rows[0] || null;
+}
+
+async function remove(id) {
+  await pool.query('DELETE FROM suggestions WHERE id = $1', [id]);
+}
+
+async function upsertVote(suggestionId, userId, { vote, comment }) {
+  const { rows } = await pool.query(
+    `INSERT INTO suggestion_votes (suggestion_id, user_id, vote, comment)
+     VALUES ($1, $2, $3, $4)
+     ON CONFLICT (suggestion_id, user_id)
+     DO UPDATE SET vote = $3, comment = $4, updated_at = now()
+     RETURNING id, suggestion_id, user_id, vote, comment, created_at, updated_at`,
+    [suggestionId, userId, vote, comment || null]
+  );
+  return rows[0];
+}
+
+async function removeVote(suggestionId, userId) {
+  await pool.query('DELETE FROM suggestion_votes WHERE suggestion_id = $1 AND user_id = $2', [
+    suggestionId,
+    userId,
+  ]);
+}
+
+async function promoteToSong(suggestionId, addedBy) {
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const { rows: sugRows } = await client.query('SELECT * FROM suggestions WHERE id = $1 FOR UPDATE', [
+      suggestionId,
+    ]);
+    const suggestion = sugRows[0];
+    if (!suggestion) {
+      await client.query('ROLLBACK');
+      return null;
+    }
+    const { rows: songRows } = await client.query(
+      `INSERT INTO songs (title, artist, added_by)
+       VALUES ($1, $2, $3)
+       RETURNING id, title, artist, notes, added_by, created_at, updated_at`,
+      [suggestion.title, suggestion.artist || suggestion.title, addedBy]
+    );
+    const song = songRows[0];
+    await client.query(
+      `UPDATE suggestions SET status = 'approved', promoted_song_id = $2, updated_at = now() WHERE id = $1`,
+      [suggestionId, song.id]
+    );
+    await client.query('COMMIT');
+    return song;
+  } catch (err) {
+    await client.query('ROLLBACK');
+    throw err;
+  } finally {
+    client.release();
+  }
+}
+
+module.exports = {
+  findAll,
+  findById,
+  findVotes,
+  create,
+  updateStatus,
+  remove,
+  upsertVote,
+  removeVote,
+  promoteToSong,
+};
--- a/src/repositories/usersRepo.js
+++ b/src/repositories/usersRepo.js
@ -0,0 +1,23 @@
+const pool = require('../db/pool');
+
+async function findById(id) {
+  const { rows } = await pool.query(
+    'SELECT id, authentik_sub, name, email, is_admin, created_at FROM users WHERE id = $1',
+    [id]
+  );
+  return rows[0] || null;
+}
+
+async function upsertFromClaims({ sub, name, email, isAdmin }) {
+  const { rows } = await pool.query(
+    `INSERT INTO users (authentik_sub, name, email, is_admin)
+     VALUES ($1, $2, $3, $4)
+     ON CONFLICT (authentik_sub)
+     DO UPDATE SET name = $2, email = $3, is_admin = $4, updated_at = now()
+     RETURNING id, authentik_sub, name, email, is_admin, created_at`,
+    [sub, name, email, isAdmin]
+  );
+  return rows[0];
+}
+
+module.exports = { findById, upsertFromClaims };
--- a/src/routes/index.js
+++ b/src/routes/index.js
@ -0,0 +1,16 @@
+const express = require('express');
+const usersRoutes = require('./users');
+const instrumentsRoutes = require('./instruments');
+const songsRoutes = require('./songs');
+const suggestionsRoutes = require('./suggestions');
+const setlistsRoutes = require('./setlists');
+
+const router = express.Router();
+
+router.use('/users', usersRoutes);
+router.use('/instruments', instrumentsRoutes);
+router.use('/songs', songsRoutes);
+router.use('/suggestions', suggestionsRoutes);
+router.use('/setlists', setlistsRoutes);
+
+module.exports = router;
--- a/src/routes/instruments.js
+++ b/src/routes/instruments.js
@ -0,0 +1,15 @@
+const express = require('express');
+const instrumentsRepo = require('../repositories/instrumentsRepo');
+const asyncHandler = require('../lib/asyncHandler');
+
+const router = express.Router();
+
+router.get(
+  '/',
+  asyncHandler(async (req, res) => {
+    const instruments = await instrumentsRepo.findAll();
+    res.json(instruments);
+  })
+);
+
+module.exports = router;
--- a/src/routes/setlists.js
+++ b/src/routes/setlists.js
@ -0,0 +1,123 @@
+const express = require('express');
+const setlistsRepo = require('../repositories/setlistsRepo');
+const { requireAdmin } = require('../auth/middleware');
+const asyncHandler = require('../lib/asyncHandler');
+
+const router = express.Router();
+
+async function withSongs(setlist) {
+  if (!setlist) return null;
+  const songs = await setlistsRepo.findSongs(setlist.id);
+  return { ...setlist, songs };
+}
+
+router.get(
+  '/next',
+  asyncHandler(async (req, res) => {
+    const setlist = await setlistsRepo.findNext();
+    res.json(await withSongs(setlist));
+  })
+);
+
+router.get(
+  '/history',
+  asyncHandler(async (req, res) => {
+    res.json(await setlistsRepo.findHistory());
+  })
+);
+
+router.get(
+  '/:id',
+  asyncHandler(async (req, res) => {
+    const setlist = await setlistsRepo.findById(req.params.id);
+    if (!setlist) return res.status(404).json({ error: 'not_found' });
+    res.json(await withSongs(setlist));
+  })
+);
+
+router.post(
+  '/',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { name, venue, concertDate } = req.body || {};
+    if (!concertDate) return res.status(400).json({ error: 'concert_date_required' });
+    const setlist = await setlistsRepo.create({ name, venue, concertDate, createdBy: req.user.id });
+    res.status(201).json(setlist);
+  })
+);
+
+router.patch(
+  '/:id',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { name, venue, concertDate } = req.body || {};
+    if (!concertDate) return res.status(400).json({ error: 'concert_date_required' });
+    const setlist = await setlistsRepo.update(req.params.id, { name, venue, concertDate });
+    if (!setlist) return res.status(404).json({ error: 'not_found' });
+    res.json(setlist);
+  })
+);
+
+router.delete(
+  '/:id',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    await setlistsRepo.remove(req.params.id);
+    res.status(204).end();
+  })
+);
+
+router.put(
+  '/:id/songs',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { songs } = req.body || {};
+    if (!Array.isArray(songs)) return res.status(400).json({ error: 'songs_array_required' });
+    for (const s of songs) {
+      if (!s.songId || typeof s.position !== 'number') {
+        return res.status(400).json({ error: 'invalid_song_entry' });
+      }
+    }
+    try {
+      await setlistsRepo.replaceSongs(req.params.id, songs);
+    } catch (err) {
+      if (err.code === '23505') {
+        return res.status(409).json({ error: 'duplicate_position', message: 'Deux morceaux ont la même position.' });
+      }
+      throw err;
+    }
+    const setlist = await setlistsRepo.findById(req.params.id);
+    res.json(await withSongs(setlist));
+  })
+);
+
+router.post(
+  '/:id/songs',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { songId, position, note, isEncore } = req.body || {};
+    if (!songId || typeof position !== 'number') {
+      return res.status(400).json({ error: 'invalid_song_entry' });
+    }
+    try {
+      const entry = await setlistsRepo.addSong(req.params.id, { songId, position, note, isEncore });
+      res.status(201).json(entry);
+    } catch (err) {
+      if (err.code === '23505') {
+        return res.status(409).json({ error: 'duplicate_position', message: 'Ce morceau ou cette position est déjà utilisé.' });
+      }
+      throw err;
+    }
+  })
+);
+
+router.delete(
+  '/:id/songs/:setlistSongId',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    await setlistsRepo.removeSong(req.params.id, req.params.setlistSongId);
+    res.status(204).end();
+  })
+);
+
+module.exports = router;
--- a/src/routes/songs.js
+++ b/src/routes/songs.js
@ -0,0 +1,99 @@
+const express = require('express');
+const songsRepo = require('../repositories/songsRepo');
+const { requireAdmin } = require('../auth/middleware');
+const asyncHandler = require('../lib/asyncHandler');
+
+const router = express.Router();
+
+router.get(
+  '/',
+  asyncHandler(async (req, res) => {
+    res.json(await songsRepo.findAll());
+  })
+);
+
+router.get(
+  '/:id',
+  asyncHandler(async (req, res) => {
+    const song = await songsRepo.findById(req.params.id);
+    if (!song) return res.status(404).json({ error: 'not_found' });
+    const tutorials = await songsRepo.findTutorials(req.params.id);
+    res.json({ ...song, tutorials });
+  })
+);
+
+router.post(
+  '/',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { title, artist, notes } = req.body || {};
+    if (!title || !title.trim() || !artist || !artist.trim()) {
+      return res.status(400).json({ error: 'title_and_artist_required' });
+    }
+    const song = await songsRepo.create({ title: title.trim(), artist: artist.trim(), notes, addedBy: req.user.id });
+    res.status(201).json(song);
+  })
+);
+
+router.patch(
+  '/:id',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { title, artist, notes } = req.body || {};
+    if (!title || !title.trim() || !artist || !artist.trim()) {
+      return res.status(400).json({ error: 'title_and_artist_required' });
+    }
+    const song = await songsRepo.update(req.params.id, { title: title.trim(), artist: artist.trim(), notes });
+    if (!song) return res.status(404).json({ error: 'not_found' });
+    res.json(song);
+  })
+);
+
+router.delete(
+  '/:id',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    try {
+      await songsRepo.remove(req.params.id);
+      res.status(204).end();
+    } catch (err) {
+      if (err.code === '23503') {
+        return res
+          .status(409)
+          .json({ error: 'song_in_use', message: 'Ce morceau est utilisé dans une setlist et ne peut pas être supprimé.' });
+      }
+      throw err;
+    }
+  })
+);
+
+router.post(
+  '/:id/tutorials',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { instrumentId, url, label } = req.body || {};
+    if (!instrumentId || !url || !url.trim()) {
+      return res.status(400).json({ error: 'instrument_and_url_required' });
+    }
+    const song = await songsRepo.findById(req.params.id);
+    if (!song) return res.status(404).json({ error: 'not_found' });
+    const tutorial = await songsRepo.addTutorial(req.params.id, {
+      instrumentId,
+      url: url.trim(),
+      label,
+      addedBy: req.user.id,
+    });
+    res.status(201).json(tutorial);
+  })
+);
+
+router.delete(
+  '/:songId/tutorials/:id',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    await songsRepo.removeTutorial(req.params.songId, req.params.id);
+    res.status(204).end();
+  })
+);
+
+module.exports = router;
--- a/src/routes/suggestions.js
+++ b/src/routes/suggestions.js
@ -0,0 +1,101 @@
+const express = require('express');
+const suggestionsRepo = require('../repositories/suggestionsRepo');
+const { requireAdmin } = require('../auth/middleware');
+const { isValidYoutubeUrl } = require('../lib/youtube');
+const asyncHandler = require('../lib/asyncHandler');
+
+const router = express.Router();
+
+router.get(
+  '/',
+  asyncHandler(async (req, res) => {
+    res.json(await suggestionsRepo.findAll());
+  })
+);
+
+router.get(
+  '/:id',
+  asyncHandler(async (req, res) => {
+    const suggestion = await suggestionsRepo.findById(req.params.id);
+    if (!suggestion) return res.status(404).json({ error: 'not_found' });
+    const votes = await suggestionsRepo.findVotes(req.params.id);
+    res.json({ ...suggestion, votes });
+  })
+);
+
+router.post(
+  '/',
+  asyncHandler(async (req, res) => {
+    const { title, artist, youtubeUrl } = req.body || {};
+    if (!title || !title.trim() || !youtubeUrl || !youtubeUrl.trim()) {
+      return res.status(400).json({ error: 'title_and_youtube_url_required' });
+    }
+    if (!isValidYoutubeUrl(youtubeUrl.trim())) {
+      return res.status(400).json({ error: 'invalid_youtube_url' });
+    }
+    const suggestion = await suggestionsRepo.create({
+      title: title.trim(),
+      artist: artist ? artist.trim() : null,
+      youtubeUrl: youtubeUrl.trim(),
+      suggestedBy: req.user.id,
+    });
+    res.status(201).json(suggestion);
+  })
+);
+
+router.patch(
+  '/:id',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const { status } = req.body || {};
+    if (!['pending', 'approved', 'rejected'].includes(status)) {
+      return res.status(400).json({ error: 'invalid_status' });
+    }
+    const suggestion = await suggestionsRepo.updateStatus(req.params.id, status);
+    if (!suggestion) return res.status(404).json({ error: 'not_found' });
+    res.json(suggestion);
+  })
+);
+
+router.delete(
+  '/:id',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    await suggestionsRepo.remove(req.params.id);
+    res.status(204).end();
+  })
+);
+
+router.post(
+  '/:id/vote',
+  asyncHandler(async (req, res) => {
+    const { vote, comment } = req.body || {};
+    if (!['approve', 'reject'].includes(vote)) {
+      return res.status(400).json({ error: 'invalid_vote' });
+    }
+    const suggestion = await suggestionsRepo.findById(req.params.id);
+    if (!suggestion) return res.status(404).json({ error: 'not_found' });
+    const result = await suggestionsRepo.upsertVote(req.params.id, req.user.id, { vote, comment });
+    res.status(200).json(result);
+  })
+);
+
+router.delete(
+  '/:id/vote',
+  asyncHandler(async (req, res) => {
+    await suggestionsRepo.removeVote(req.params.id, req.user.id);
+    res.status(204).end();
+  })
+);
+
+router.post(
+  '/:id/promote',
+  requireAdmin,
+  asyncHandler(async (req, res) => {
+    const song = await suggestionsRepo.promoteToSong(req.params.id, req.user.id);
+    if (!song) return res.status(404).json({ error: 'not_found' });
+    res.status(201).json(song);
+  })
+);
+
+module.exports = router;
--- a/src/routes/users.js
+++ b/src/routes/users.js
@ -0,0 +1,14 @@
+const express = require('express');
+const asyncHandler = require('../lib/asyncHandler');
+
+const router = express.Router();
+
+router.get(
+  '/me',
+  asyncHandler(async (req, res) => {
+    const { id, name, email, is_admin } = req.user;
+    res.json({ id, name, email, isAdmin: is_admin });
+  })
+);
+
+module.exports = router;
--- a/src/server.js
+++ b/src/server.js
@ -0,0 +1,19 @@
+const config = require('./config');
+const createApp = require('./app');
+const { initOidc } = require('./auth/oidc');
+const { runMigrations } = require('./db/migrate');
+
+async function main() {
+  await runMigrations();
+  await initOidc();
+
+  const app = createApp();
+  app.listen(config.port, () => {
+    console.log(`Octane website listening on port ${config.port}`);
+  });
+}
+
+main().catch((err) => {
+  console.error('Failed to start server:', err);
+  process.exit(1);
+});